[Azure] Application Gateway WAF: add event.reason

[jH-]

Proposed commit message

Update the Azure Application Gateway pipeline to parse and include values from
`json.properties.details.data` into the ECS `event.reason` field.

This field provides action context by logging the specific data found in 
requests that matched a rule.

It excludes the field if `json.properties.details.message` contains values indicating 
missing headers or content were the reason to avoid unnecessary duplicate data.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have added an entry to my package's changelog.yml file.

How to test this PR locally

elastic-package stack up -v -d

# check that the updated integration version is included (https://localhost:8080/search?package=azure)

elastic-package test pipeline

elastic-package stack down

[cla-checker-service]

💚 CLA has been signed

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

/test

[elasticmachine]

🚀 Benchmarks report

Package azure 👍(2) 💚(0) 💔(9)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
springcloudlogs	4098.36	3115.26	-983.1 (-23.99%)	💔
application_gateway	2967.36	1733.1	-1234.26 (-41.59%)	💔
auditlogs	1945.53	1526.72	-418.81 (-21.53%)	💔
eventhub	333333.33	250000	-83333.33 (-25%)	💔
firewall_logs	1420.45	1113.59	-306.86 (-21.6%)	💔
graphactivitylogs	1834.86	1451.38	-383.48 (-20.9%)	💔
identity_protection	4608.29	2724.8	-1883.49 (-40.87%)	💔
platformlogs	4950.5	2849	-2101.5 (-42.45%)	💔
provisioning	2898.55	2288.33	-610.22 (-21.05%)	💔

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
38.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[jH-]

@jH- , can you please sign the Contributor Agreement?

NOTE that this PR contains commits from two different email addresses so you may be need amend those commits to use the same email that you use to sign the CLA.

Signed.

[kcreddy]

/test

[kcreddy]

@jH- could you please fix the merge conflicts?

[kcreddy]

/test

[andrewkroh]

There are a bunch of changes outside of the packages/azure directory that need to undone. I think they were the result of merge issue.

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[jH-]

deleted

Merge issues were corrected. Changeset looks fine now.

[andrewkroh]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d5c9a82

History

• 💔 Build #14965 failed a2b7ebb
• 💔 Build #14893 failed af7f7f8
• 💚 Build #13283 succeeded 2037f9a

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
83.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package azure - 1.17.0 containing this change is available at https://epr.elastic.co/search?package=azure