Update Data Source Objects Fields and Example Logs - #4342

Summary

Many data source objects in security_content/data_sources/ were created some time ago and had not been updated. This work reviewed and refreshed the fields and example_log entries using released TA configurations and replayed detection test data.

For each eligible data source, I did the following:

• Identified its supported TA and pinned the source review to a released tag and commit.
• Found active detections that use the data source and replayed their local attack data into my Splunk’s test index.
• Queried events over all time, scoped to the replay host, sourcetype, and separator/value.
• Updated fields from the extracted fields present in the scoped events, added _time, and alphabetized the list.
• Reviewed the matching TA props and extraction rules to confirm which fields apply to the source and event.
• Added an example_log from a matching Splunk event, using YAML literal block format for readability.

This resulted in updating 188 data source objects with matching event evidence.

I did not touch all the DS due to time. I will revisit this in the future, where the plan is to build an automated pipeline that does for us.

See TR-4688