Use array-map-processor to map DNS answers to ocsf.answers

[jbfeldman-dd]

What does this PR do?

Converts the DNS Activity [4003] OCSF sub-pipelines to populate ocsf.answers using an array-map-processor, for log sources whose raw DNS answers are in array format:

• bluecat_integrity: maps responseData.answers (array of objects: recordType, rData, class, ttl) into ocsf.answers, and adds the required ocsf.answers self-map in the schema-processor. Previously ocsf.answers was not populated.
• zeek: replaces the string-builder + grok + array-processor append workaround (which only captured the first answer) with an array-map-processor over the answers array of IP strings, so all answers are mapped.

Motivation

The DNS OCSF class exposes answers as an array. Using array-map-processor maps the raw answers array element-by-element into a proper array of OCSF dns_answer objects, which is more correct than the prior single-object/first-answer workarounds.

Note: the OCSF validator CLI does not yet execute array-map-processor (it logs a no-op), so the regenerated test outputs do not include ocsf.answers. The mapping is exercised by the real backend; the test outputs here match exactly what the validator CLI produces.

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run