[github] audit: prefer @timestamp over created_at in agent cursor logic

[chrisberkhout]

Proposed commit message

[github] audit: prefer @timestamp over created_at in agent cursor logic

Although the query parameter is `created`, listings are ordered by
`@timestamp`. The `created_at` field often has older times, and it's
absent from some even types, such as git events[1].

We keep `created_at` as a fallback, because some events don't have
`@timestamp` according to the documentation[2] (although that hasn't
been verified in the live API).

[1]: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#git
[2]: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#code_scanning

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Suggest title change to [github] audit: prefer @timestamp over created_at in agent cursor logic.

[efd6]

Should this be "cursor logic"?

[chrisberkhout]

You use a cursor to request a page, so I think either is okay but I updated to

Fix HTTPJSON cursor logic for audit data stream.

Took the suggested PR/commit description.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 915255b

History

• 💚 Build #34559 succeeded 842c93c

cc @chrisberkhout

[elastic-vault-github-plugin-prod]

Package github - 2.17.3 containing this change is available at https://epr.elastic.co/package/github/2.17.3/