Make cyberark_epm.raw_event.evidences a flattened field

[chrisberkhout]

Proposed commit message

Map `cyberark_epm.raw_event.evidences` as flattened

The documentation[1] is not specific about the structure of the objects.
A pipeline test has had a value added based on real-world data.

[1]: https://docs.cyberark.com/epm/latest/en/content/webservices/getdetailedrawevents.htm

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 9b3c8f3

Failed CI Steps

• Check integrations cyberark_epm

History

cc @chrisberkhout

[github-actions]

Buildkite failure is caused by an out-of-date generated README after changing evidences field type.

Build: https://buildkite.com/elastic/integrations/builds/39723

What failed: Check integrations cyberark_epm (.buildkite/scripts/test_one_package.sh cyberark_epm origin/main 9b3c8f34e8541e8b53816082690fdbfac05d0994)

Error:
Error: checking package failed: checking readme files are up-to-date failed: files do not match

Log excerpt

README.md is outdated. Rebuild the package with 'elastic-package build'
--- want
+++ got
@@ -232,3 +232,3 @@
 | cyberark_epm.raw_event.display_name | The file display name. | keyword |
-| cyberark_epm.raw_event.evidences | The evidence related to a Threat Protection event. | keyword |
+| cyberark_epm.raw_event.evidences | The evidence related to a Threat Protection event. | flattened |
Error: checking package failed: checking readme files are up-to-date failed: files do not match

Root cause:
packages/cyberark_epm/data_stream/raw_event/fields/fields.yml was changed so evidences is flattened (PR diff around line 66), but generated docs were not updated. packages/cyberark_epm/docs/README.md still has cyberark_epm.raw_event.evidences as keyword (line 233), so the CI README consistency check fails.

Recommended fix:
Regenerate and commit package docs after the field mapping change:

cd packages/cyberark_epm
elastic-package build

Then commit the resulting change(s), especially packages/cyberark_epm/docs/README.md, and re-run CI.

Verification:
I verified the failing Buildkite job log and matched it to the PR diff:

• Buildkite job 019cf748-a42f-4764-9561-78c9c9dbd3e6 reports README mismatch for raw_event.evidences.
• PR diff changes fields.yml type (keyword -> flattened) but does not include packages/cyberark_epm/docs/README.md update.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

Good after docs are regenerated.

[efd6]

Needs an elastic-package build.