[SIEM][Detection Engine] Adds signal to ECS event.kind and fixes status in signals

[FrankHassanabad]

Summary

• Adds signal to the ECS event.kind when it copies over a signal
• Creates a original_event if needed within signal so additional look ups don't have to happen
• Fixes a bug with signal.status where it was not plumbed correctly
• Adds extra unit tests around the filter
• Adds missing unit tests around utils I didn't add before
• Fixes a typing issue with output of a signal

Example signal output:

Original event turns into this:

  "event" : {
    "dataset" : "socket",
    "kind" : "signal",
    "action" : "existing_socket",
    "id" : "ffec6797-b92f-4436-bb40-69bac2c21874",
    "module" : "system"
  },

Signal amplification turns into this where it contains original_event looks like this:

  "signal" : {
    "parent" : {
      "id" : "xNRlqW4BHe9nqdOi2358",
      "type" : "event",
      "index" : "auditbeat",
      "depth" : 1
    },
    "original_time" : "2019-11-26T20:27:11.169Z",
    "status" : "open",
    "rule" : {
      "id" : "643fbd2f-a3c9-449e-ba95-e3d89000a72a",
      "rule_id" : "rule-1",
      "false_positives" : [ ],
      "max_signals" : 100,
      "risk_score" : 1,
      "description" : "Detecting root and admin users",
      "from" : "now-6m",
      "immutable" : false,
      "interval" : "5m",
      "language" : "kuery",
      "name" : "Detect Root/Admin Users",
      "query" : "user.name: root or user.name: admin",
      "references" : [
        "http://www.example.com",
        "https://ww.example.com"
      ],
      "severity" : "high",
      "tags" : [ ],
      "type" : "query",
      "to" : "now",
      "enabled" : true,
      "created_by" : "elastic_some_user",
      "updated_by" : "elastic_some_user"
    },
    "original_event" : {
      "dataset" : "socket",
      "kind" : "state",
      "action" : "existing_socket",
      "id" : "ffec6797-b92f-4436-bb40-69bac2c21874",
      "module" : "system"
    }
  }

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

- [ ] This was checked for cross-browser compatibility, including a check against IE11

- [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

- [ ] Documentation was added for features that require explanation or tutorials

• Unit or functional tests were updated or added to match the most common scenarios

- [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

- [ ] This was checked for breaking API changes and was labeled appropriately

• This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 8752924

[dhurley14]

Checked out and ran locally. Thanks for the updates to the types and the tests. LGTM!