Properly populate file.* fields for network share events

[brian-mckinney]

Proposed commit message

Network share events were not correctly populating the file.* fields according to the ECS Schema.

These fields have a ShareLocalPath and a RelativeTargetName, we were simply using those fields for file.directory and file.name respectively. RelativeTargetName however is all parts of the path after the share name, including the filename. For example:

  "ShareLocalPath": "C:\\Shares\\Documents",
  "RelativeTargetName": "\\reports\\Q1\\summary.docx",

ECS Schema says file.name should be the name of the file including extension. This PR applies logic to the two fields to construct the full path and use that to populate the fields accordingly

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Fixes: https://github.com/elastic/sdh-beats/issues/7064

[macroscopeapp]

🟡 Medium pipeline/test-security-5145.json-expected.json:28

The file.target_path value on line 28 contains inconsistent backslash escaping. The JSON \\\reports decodes to 3 actual backslashes while \\Q1 and \\summary.docx decode to 2 backslashes, creating a malformed UNC path that doesn't match expected Windows path formats. This typo will cause pipeline test failures when the actual implementation produces consistently escaped output.

Suggested change

	"target_path": "\\\\\\\\*\\\\Documents\\\\\\reports\\\\Q1\\\\summary.docx"
	"target_path": "\\\\*\\Documents\\reports\\Q1\\summary.docx"

🤖 Copy this AI Prompt to have your agent fix this:

In file packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-5145.json-expected.json around line 28:

The `file.target_path` value on line 28 contains inconsistent backslash escaping. The JSON `\\\reports` decodes to 3 actual backslashes while `\\Q1` and `\\summary.docx` decode to 2 backslashes, creating a malformed UNC path that doesn't match expected Windows path formats. This typo will cause pipeline test failures when the actual implementation produces consistently escaped output.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: e6b84b9

Failed CI Steps

• Check integrations windows

History

cc @brian-mckinney

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)