[Enhancement] Set event.kind to alert for AWS GuardDuty findings

[bryans3c]

Proposed commit message

​ Set `event.kind` to `alert` for the AWS GuardDuty findings. ​

Summary

This sets event.kind to alert in AWS GuardDuty events, so that the default external alert promotion detection rule in elastic/detection-rules matches GuardDuty findings and surfaces them on the Alerts page. Currently the pipeline sets event.kind: event, which causes the promotion rule to silently skip GuardDuty data despite the integration being installed.

Same pattern as #16401 (Wiz Defend) and #5744 (M365D incidents).

Why this is safe

The aws.guardduty data stream is finding-only by API contract:

• The data stream manifest configures two inputs (httpjson and aws-s3), both titled "Collect Amazon GuardDuty Findings from AWS."
• httpjson polls AWS's GuardDuty Findings API (ListFindings/GetFindings), which returns findings only.
• aws-s3 ingests GuardDuty findings exports, which contain findings only.
• Neither input can deliver any other event type into this stream.

This is the key difference from #10528 (F5 BIG-IP ASM), where a single dataset legitimately mixed informational and alert events and unconditional event.kind: alert mislabeled the informational ones. There is no equivalent informational subset in aws.guardduty to mislabel.

The two existing GuardDuty-related detection rules in elastic/detection-rules (defense_evasion_guardduty_detector_deletion and defense_evasion_guardduty_member_manipulation) detect tampering with the GuardDuty service itself via CloudTrail (DeleteDetector, DisassociateMembers, etc.) and query logs-aws.cloudtrail-*, not logs-aws.guardduty-*. They are unaffected by this change.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

Check integrations aws failed in Buildkite #42560, but the available log artifact only includes teardown output and a generic exit status 1, so the actual failing check is not visible. The immediate next step is to retrieve the full failed step output (or the failing test/check artifact) and rerun triage on that data.

Remediation

• Re-run Check integrations aws with full step output retained (especially the section before --- [aws] failed) and share that log.
• If available, inspect/upload the failing artifact from that run (for example the failing build/test-results/*.xml entry) and include the exact failing test/check name and message.

Investigation details

Root Cause

Inconclusive with current data. The pre-fetched log at /tmp/gh-aw/buildkite-logs/integrations-check-integrations-aws.txt does not include the failing command/test output, only cleanup and a generic failure marker.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/42560
• Job/step: Check integrations aws
• Key log excerpt:

  --- [aws] failed
  🚨 Error: The command exited with status 1
  user command error: exit status 1
  

• The same file then immediately shows artifact upload + stack teardown logs, with no preceding assertion/lint/test failure text.

Verification

• Not run end-to-end locally in this workflow because CI bootstrap variables/tools required by .buildkite/scripts/test_one_package.sh are not available in this environment.

Follow-up

Once the full failed step output is available, I can map it directly to the owning file/line and provide a precise fix recommendation.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a5d37e4

History

• 💚 Build #43129 succeeded fbf38ae
• 💔 Build #42621 failed 87f6c28
• 💔 Build #42601 failed 08e6534
• 💔 Build #42576 failed a02389f
• 💔 Build #42560 failed 7bd0bb3
• 💔 Build #42558 failed 131fc1b

cc @bryans3c

[elastic-vault-github-plugin-prod]

Package aws - 6.18.0 containing this change is available at https://epr.elastic.co/package/aws/6.18.0/