auditbeat/module/file_integrity: add file parsing processor

CHANGELOG.next.asciidoc

@@ -128,6 +128,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 
 *Auditbeat*
 
+- Add file parser processor to file_integrity module. {pull}28802[28802]
 - Improve documentation for symlink handling behaviour in file integrity module. {pull}33430[33430]
 - Ensure file integrity module watch paths are absolute. {pull}33430[33430]
 

auditbeat/auditbeat.reference.yml

@@ -116,6 +116,60 @@ auditbeat.modules:
   # Set to true to publish fields with null values in events.
   #keep_null: false
 
+  # Parse detailed information for the listed fields. Field paths in the list below
+  # that are a prefix of other field paths imply the longer field path. A set of
+  # fields may be specified using an RE2 regular expression quoted in //. For example
+  # /^file\.pe\./ will match all file.pe.* fields. Note that the expression is not
+  # implicitly anchored, so the empty expression will match all fields.
+  # file_parsers:
+  # - file.elf.sections
+  # - file.elf.sections.name
+  # - file.elf.sections.physical_size
+  # - file.elf.sections.virtual_size
+  # - file.elf.sections.entropy
+  # - file.elf.sections.var_entropy
+  # - file.elf.import_hash
+  # - file.elf.imports
+  # - file.elf.imports_names_entropy
+  # - file.elf.imports_names_var_entropy
+  # - file.elf.go_import_hash
+  # - file.elf.go_imports
+  # - file.elf.go_imports_names_entropy
+  # - file.elf.go_imports_names_var_entropy
+  # - file.elf.go_stripped
+  # - file.macho.sections
+  # - file.macho.sections.name
+  # - file.macho.sections.physical_size
+  # - file.macho.sections.virtual_size
+  # - file.macho.sections.entropy
+  # - file.macho.sections.var_entropy
+  # - file.macho.import_hash
+  # - file.macho.symhash
+  # - file.macho.imports
+  # - file.macho.imports_names_entropy
+  # - file.macho.imports_names_var_entropy
+  # - file.macho.go_import_hash
+  # - file.macho.go_imports
+  # - file.macho.go_imports_names_entropy
+  # - file.macho.go_imports_names_var_entropy
+  # - file.macho.go_stripped
+  # - file.pe.sections
+  # - file.pe.sections.name
+  # - file.pe.sections.physical_size
+  # - file.pe.sections.virtual_size
+  # - file.pe.sections.entropy
+  # - file.pe.sections.var_entropy
+  # - file.pe.import_hash
+  # - file.pe.imphash
+  # - file.pe.imports
+  # - file.pe.imports_names_entropy
+  # - file.pe.imports_names_var_entropy
+  # - file.pe.go_import_hash
+  # - file.pe.go_imports
+  # - file.pe.go_imports_names_entropy
+  # - file.pe.go_imports_names_var_entropy
+  # - file.pe.go_stripped
+
 
 
 # ================================== General ===================================