Cisco Umbrella Integration

{
    "@timestamp": "2024-03-14T18:59:23.000Z",
    "agent": {
        "ephemeral_id": "4b522414-3f7d-4cec-a7f7-7df2a87de0c9",
        "id": "d2a14a09-96fc-4f81-94ef-b0cd75ad71e7",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "aws": {
        "s3": {
            "bucket": {
                "arn": "arn:aws:s3:::elastic-package-cisco-umbrella-bucket-37380",
                "name": "elastic-package-cisco-umbrella-bucket-37380"
            },
            "object": {
                "key": "auditlogs.log"
            }
        }
    },
    "cisco": {
        "umbrella": {
            "audit": {
                "after": [
                    "includeAuditLog: 1"
                ],
                "after_values": {
                    "includeAuditLog": "1"
                },
                "type": "logexportconfigurations"
            }
        }
    },
    "cloud": {
        "provider": "",
        "region": "us-east-1"
    },
    "data_stream": {
        "dataset": "cisco_umbrella.log",
        "namespace": "27145",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "d2a14a09-96fc-4f81-94ef-b0cd75ad71e7",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "update",
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "dataset": "cisco_umbrella.log",
        "id": "1757843536",
        "ingested": "2024-06-12T03:03:50Z",
        "kind": "event",
        "original": "\"1757843536\",\"2024-03-14 18:59:23\",\"admin@example.com\",\"Administrator\",\"logexportconfigurations\",\"update\",\"81.2.69.144\",\"\",\"includeAuditLog: 1\n\"",
        "type": [
            "change"
        ]
    },
    "input": {
        "type": "aws-s3"
    },
    "log": {
        "file": {
            "path": "https://elastic-package-cisco-umbrella-bucket-37380.s3.us-east-1.amazonaws.com/auditlogs.log"
        },
        "offset": 529
    },
    "observer": {
        "product": "Umbrella",
        "vendor": "Cisco"
    },
    "related": {
        "ip": [
            "81.2.69.144"
        ],
        "user": [
            "Administrator"
        ]
    },
    "source": {
        "address": "81.2.69.144",
        "geo": {
            "city_name": "London",
            "continent_name": "Europe",
            "country_iso_code": "GB",
            "country_name": "United Kingdom",
            "location": {
                "lat": 51.5142,
                "lon": -0.0931
            },
            "region_iso_code": "GB-ENG",
            "region_name": "England"
        },
        "ip": "81.2.69.144"
    },
    "tags": [
        "preserve_original_event",
        "cisco-umbrella",
        "forwarded"
    ],
    "user": {
        "email": "admin@example.com",
        "id": "admin@example.com",
        "name": "Administrator"
    }
}