Add event.kind: alert to Parsed Data for Mimecast Integration

Description

Currently, the Mimecast integration does not include event.kind: alert in the parsed data mapped to ECS. As a result, alerts are not visible in Kibana since event.kind: alert is a required field for External Alerts. While event.module is correctly mapped, event.kind: alert is missing.

At the moment, the only values assigned to event.kind are:

• event
• enrichment
• pipeline_error

Impact

• Alerts are not visible in Kibana under External Alerts.
• Users cannot effectively use Kibana’s detection and alerting workflows for Mimecast-generated alerts.
• Breaks consistency with ECS mapping for third-party alerts.

Proposed Solution

• Ensure event.kind: alert is correctly assigned to relevant Mimecast alert events.
• Validate that all alert events from Mimecast include both event.kind and event.module.
• Update documentation if necessary to reflect this requirement.

Acceptance Criteria

• event.kind: alert is correctly mapped for all relevant Mimecast alerts.
• Alerts are visible in Kibana under External Alerts.
• Integration tests verify the presence of event.kind: alert.