Moving logstash dockerfile and associated files to its own folder

[f-galland]

Description

This PR moves the integrations' logstash dependencies to its own folder for ease of maintenance.

Issues Resolved

Resolves #299

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Failing checks are inspected and point to the corresponding known issue(s) (See: Troubleshooting Failing Builds)
• Commits are signed per the DCO using --signoff
• Commit changes are listed out in CHANGELOG.md file (See: Changelog)
• Public documentation issue/PR created

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[f-galland]

Alerts are now being pushed to the S3 in json.gz format:

The lambda function reads the files and generates the appropriate OCSF and parquet files:

[f-galland]

The parquet file is properly populated:

$ parquet-tools show --format github --head 5 ext_wazuh_region\=us-east-1_accountId\=111111111111_eventDay\=20240711_986b64bbdbc54d73a38a42c7fc0957b9.parquet
|   activity_id | category_name   |   category_uid | class_name       |   class_uid |   count | message                                         | metadata                                                                                                                                                | raw_data                                                              | resources                           |   risk_score |   severity_id |   status_id |       time |   type_uid | unmapped                                                                                               | analytic                                                                                          | attacks                                                                                                     | finding                                                                                                                        |   state_id |
|---------------|-----------------|----------------|------------------|-------------|---------|-------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|-------------------------------------|--------------|---------------|-------------|------------|------------|--------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|------------|
|             1 | Findings        |              2 | Security Finding |        2001 |       6 | Host-based anomaly detection event (rootcheck). | {'log_name': 'Security events', 'log_provider': 'Wazuh', 'product': {'lang': 'en', 'name': 'Wazuh', 'vendor_name': 'Wazuh, Inc,.'}, 'version': '1.1.0'} | Rootkit 'Slapper' detected by the presence of file '/tmp/.bugtraq.c'. | [{'name': 'RHEL7', 'uid': '001'}]   |            7 |             2 |          99 | 1720697518 |     200101 | {'data_sources': array(['rootcheck', 'wazuh-manager'], dtype=object), 'nist': array([], dtype=object)} | {'category': 'wazuh, rootcheck', 'name': 'rootcheck', 'type': 'Rule', 'type_id': 1, 'uid': '510'} | [{'tactic': {'name': 'N/A', 'uid': 'N/A'}, 'technique': {'name': 'N/A', 'uid': 'N/A'}, 'version': 'v13.1'}] | {'title': 'Host-based anomaly detection event (rootcheck).', 'types': array(['log'], dtype=object), 'uid': '1580123327.49031'} |          1 |
|             1 | Findings        |              2 | Security Finding |        2001 |      11 | Audit: Command: /usr/sbin/id                    | {'log_name': 'Security events', 'log_provider': 'Wazuh', 'product': {'lang': 'en', 'name': 'Wazuh', 'vendor_name': 'Wazuh, Inc,.'}, 'version': '1.1.0'} |                                                                       | [{'name': 'Amazon', 'uid': '002'}]  |            3 |             1 |          99 | 1720697423 |     200101 | {'data_sources': array(['', 'wazuh-manager'], dtype=object), 'nist': array([], dtype=object)}          | {'category': 'audit, audit_command', 'name': 'N/A', 'type': 'Rule', 'type_id': 1, 'uid': '80784'} | [{'tactic': {'name': 'N/A', 'uid': 'N/A'}, 'technique': {'name': 'N/A', 'uid': 'N/A'}, 'version': 'v13.1'}] | {'title': 'Audit: Command: /usr/sbin/id', 'types': array(['N/A'], dtype=object), 'uid': '1580123327.49031'}                    |          1 |
|             1 | Findings        |              2 | Security Finding |        2001 |      16 | Audit: Command: /usr/sbin/consoletype           | {'log_name': 'Security events', 'log_provider': 'Wazuh', 'product': {'lang': 'en', 'name': 'Wazuh', 'vendor_name': 'Wazuh, Inc,.'}, 'version': '1.1.0'} |                                                                       | [{'name': 'Debian', 'uid': '007'}]  |            3 |             1 |          99 | 1720697695 |     200101 | {'data_sources': array(['', 'wazuh-manager'], dtype=object), 'nist': array([], dtype=object)}          | {'category': 'audit, audit_command', 'name': 'N/A', 'type': 'Rule', 'type_id': 1, 'uid': '80784'} | [{'tactic': {'name': 'N/A', 'uid': 'N/A'}, 'technique': {'name': 'N/A', 'uid': 'N/A'}, 'version': 'v13.1'}] | {'title': 'Audit: Command: /usr/sbin/consoletype', 'types': array(['N/A'], dtype=object), 'uid': '1580123327.49031'}           |          1 |
|             1 | Findings        |              2 | Security Finding |        2001 |      13 | Audit: Command: /usr/sbin/hostname              | {'log_name': 'Security events', 'log_provider': 'Wazuh', 'product': {'lang': 'en', 'name': 'Wazuh', 'vendor_name': 'Wazuh, Inc,.'}, 'version': '1.1.0'} |                                                                       | [{'name': 'Windows', 'uid': '006'}] |            3 |             1 |          99 | 1720697604 |     200101 | {'data_sources': array(['', 'wazuh-manager'], dtype=object), 'nist': array([], dtype=object)}          | {'category': 'audit, audit_command', 'name': 'N/A', 'type': 'Rule', 'type_id': 1, 'uid': '80784'} | [{'tactic': {'name': 'N/A', 'uid': 'N/A'}, 'technique': {'name': 'N/A', 'uid': 'N/A'}, 'version': 'v13.1'}] | {'title': 'Audit: Command: /usr/sbin/hostname', 'types': array(['N/A'], dtype=object), 'uid': '1580123327.49031'}              |          1 |
|             1 | Findings        |              2 | Security Finding |        2001 |      17 | Audit: Command: /usr/sbin/sh                    | {'log_name': 'Security events', 'log_provider': 'Wazuh', 'product': {'lang': 'en', 'name': 'Wazuh', 'vendor_name': 'Wazuh, Inc,.'}, 'version': '1.1.0'} |                                                                       | [{'name': 'Ubuntu', 'uid': '004'}]  |            3 |             1 |          99 | 1720697690 |     200101 | {'data_sources': array(['', 'wazuh-manager'], dtype=object), 'nist': array([], dtype=object)}          | {'category': 'audit, audit_command', 'name': 'N/A', 'type': 'Rule', 'type_id': 1, 'uid': '80790'} | [{'tactic': {'name': 'N/A', 'uid': 'N/A'}, 'technique': {'name': 'N/A', 'uid': 'N/A'}, 'version': 'v13.1'}] | {'title': 'Audit: Command: /usr/sbin/sh', 'types': array(['N/A'], dtype=object), 'uid': '1580123327.49031'}                    |          1 |

[AlexRuiz7]

• Indexer to OpenSearch - ✔️
• Indexer to Elastic - ✔️
• Indexer to Splunk - ✔️
• Indexer to Amazon Security Lake - ✔️