Linux Audit Logs: Map event_id to ocsf.metadata.uid

[nbeckstead-ddog]

What does this PR do?

Maps the auditd event_id field to ocsf.metadata.correlation_uid across all OCSF sub-pipelines in the Linux Audit Logs integration.

Motivation

Detection rules correlate related audit records (e.g. SYSCALL + PATH events) using @event_id. metadata.correlation_uid is the OCSF-standard field for this purpose — its description is "The unique identifier used to correlate events," which matches exactly how auditd uses event_id to group related record types within a single audit event.

[github-actions]

⚠️ Recommendation: Add qa/skip-qa label

This PR does not modify any files shipped with the agent.

To help streamline the release process, please consider adding the qa/skip-qa label if these changes do not require QA testing.

[gfoss]

LGTM

[cepolation-datadog]

The event_id isn't a correlation uid. A correlation_uid is something that ties together several events, like in a session. This should map to ocsf.metadata.event_code https://schema.ocsf.io/1.5.0/objects/metadata

[nbeckstead-ddog]

The event_id isn't a correlation uid. A correlation_uid is something that ties together several events, like in a session. This should map to ocsf.metadata.event_code https://schema.ocsf.io/1.5.0/objects/metadata

I don't think event_code is right since the ID is a random number, not an ID for a specific event type. Updated to use uid

[cepolation-datadog]

LGTM