[trellix_epo_on_prem] Improve ECS event categorization across threat_event, product_event, dlp_incident and syslog event data streams

[muskan-agarwal26]

Refines ECS categorization and severity mapping across four data streams, based on Trellix ePO event-code semantics validated against production event samples.

threat_event

• Added event-code driven mappings for validated codes, setting event.kind, event.action, event.category, event.type and event.outcome per code instead of static values.
• Derived event.outcome dynamically from ThreatActionTaken and ThreatHandled so blocked, would-block (audit mode) and failed actions are distinguished.
• Mapped ThreatSeverity to ECS event.severity and removed the duplicate vendor field.
• Split TargetPath by destination type: registry hives (HK*) now map to registry.path, filesystem paths to file.directory.

product_event

• Added mappings for validated TVDEventID codes, setting event.action, event.kind and event.outcome, and appending ECS-valid event.category and event.type values.
• Differentiated install vs. uninstall deployment events that share a single event code.

dlp_incident

• Mapped incident Severity to ECS event.severity and removed the duplicate vendor field.

event (syslog)

• Removed the blanket categorization that applied an identical event.category and event.type to every event regardless of content.
• Added event-code driven categorization for validated codes; unmapped events now carry only event.kind rather than asserting an incorrect category.
• Added event.outcome derived from ThreatHandled, event.severity from ThreatSeverity, and the same TargetPath registry/filesystem split.
• Normalized event.action to lowercase hyphenated form.

Pipeline tests, sample events, dashboards and documentation were updated accordingly.

Part of #20363.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)