feat(osquery_manager): add config-driven osquery schema generator under _dev/scripts

[marc-gr]

Proposed commit message

Enhancement: migrate osquery_manager schema generation to a standalone, config-driven tool under _dev/scripts

This PR consolidates osquery schema generation into a single standalone tool at packages/osquery_manager/_dev/scripts/osquery-gen.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

1. From integrations repo:

   cd packages/osquery_manager/_dev/scripts/osquery-gen

2. Create local config:

   cp config.example.yml config.yml
   # edit explicit versions as needed

3. Run generation (default includes package check):

   go run . -config ./config.yml

4. For iterative dev runs (skip package check):

   go run . -config ./config.yml -skip-package-check

5. Verify outputs:
   • packages/osquery_manager/data_stream/result/fields/osquery.yml
   • packages/osquery_manager/data_stream/result/fields/ecs.yml
   • packages/osquery_manager/schemas/osquery.json
   • packages/osquery_manager/schemas/ecs.json
6. Run package validation explicitly (if skipped during dev):

   elastic-package -C packages/osquery_manager check

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[marc-gr]

/ai

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 21ae6b0

Failed CI Steps

• Check integrations osquery_manager

History

• 💔 Build #39531 failed fc7511a