[Asset Discovery] Add `event.category` and `event.kind` to published events

[JordanSh]

Summary

The event.category field is missing from Asset Discovery logs, which is essential for better event classification. SIEM Readiness uses this field to categorize logs.

Required changes

1. Add event.category

Use the ECS allowed values for event.category when publishing Asset Discovery events. Supported values include:

• api
• authentication
• configuration
• database
• driver
• email
• file
• host
• iam
• intrusion_detection
• library
• malware
• network
• package
• process
• registry
• session
• threat
• vulnerability
• web

Choose the value(s) that best match each Asset Discovery event type.

2. Add event.kind

Set event.kind to asset on published events so Entity Store can correctly treat them as asset events when extracting users in the entity store (see ECS event.kind — asset).

3. Add event.module

Optional

Consider adding event.type and other ECS fields that would improve classification and downstream use (e.g. SIEM Readiness, Entity Store).

---

References

• GitHub: [Entity Store] Adapt user extraction to create IDP entities only kibana#256297
• ECS allowed values — event.category: https://www.elastic.co/docs/reference/ecs/ecs-allowed-values-event-category
• ECS allowed values — event.kind (asset): https://www.elastic.co/docs/reference/ecs/ecs-allowed-values-event-kind#ecs-event-kind-asset