[proofpoint_tap] Set timestamp to max of {click,message}Time and threatTime

[andrewkroh]

Proposed commit message

Prevent new events from appearing in the past by using the time the event was triggered as the @timestamp. An event can be triggered when a click occurs, a message is delivered/blocked, or new threat is discovered. When a new threat is discovered the previous behavior made the event appear to have happened in the past because we used the clickTime or messageTime as the timestamp which might have occurred weeks ago.

The API docs state, "the time an event is created is always after either of these two times:

• the time that the message was sent or the time click occurred (messageTime or clickTime)
• the time that the threat referenced by the message or click was recognized and condemned by Proofpoint (threatsInfoMap/threatTime)"

I suspect this does not occur for clicks_blocked because click was already condemned, but in case they send an update if a new threat matches the previous click I'll include the same change there.

Fixes #9967

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Closes [Proofpoint TAP] Document surprising timestamp behavior #9967

[elasticmachine]

🚀 Benchmarks report

Package proofpoint_tap 👍(3) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
message_blocked	3521.13	2638.52	-882.61 (-25.07%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3d7927c

History

• 💚 Build #11899 succeeded d5885f8

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Package proofpoint_tap - 1.19.0 containing this change is available at https://epr.elastic.co/search?package=proofpoint_tap