[Okta] Add event categories and types

[moxarth-rathod]

Proposed commit message

okta: add missing event categories

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/okta directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [Okta] Add Missing Event Categories #15235

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[ShourieG]

@moxarth-rathod, looks good, majority of the pipeline was autogenerated so looks fine, please fix the PR no. and i'll approve.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c95a593

History

• 💔 Build #33803 failed 0e6bbac
• 💚 Build #33649 succeeded 799e6ea

cc @moxarth-rathod

[moxarth-rathod]

@terrancedejesus @ShourieG @efd6 fyi, I had to adjust some of the suggested mappings because certain event categories contained invalid event types. For example, the access.request.cancel event category was set to iam with event types access and deletion, but iam only allows the following event types: admin, change, creation, deletion, group, info, and user. Therefore, I removed access to align with the allowed values.

[efd6]

Can you confirm that you have used the generator shown in #15235 (comment) with the definitions in #15235 (comment)?

[moxarth-rathod]

Can you confirm that you have used the generator shown in #15235 (comment) with the definitions in #15235 (comment)?

Yes, but I made a few changes during testing, including adding null handling. Also, some event types were invalid for their respective categories, so I've updated those definitions accordingly.

[andrewkroh]

Can you please share the exact code used to produce this in a gist for me to replicate and validate .