proofpoint_tap: clarify use of {source,destination}.ip

Author: efd6

packages/proofpoint_tap/_dev/build/docs/README.md

@@ -23,6 +23,8 @@ For the more information on generating TAP credentials please follow the steps m
 
 This is the `clicks_blocked` dataset.
 
+NOTE: For the `clicks_blocked` dataset, `source.ip` corresponds to the Proofpoint `senderIP` — the IP of the email sender — and `destination.ip` corresponds to `clickIP` — the IP of the click destination.
+
 {{event "clicks_blocked"}}
 
 {{fields "clicks_blocked"}}
@@ -31,6 +33,8 @@ This is the `clicks_blocked` dataset.
 
 This is the `clicks_permitted` dataset.
 
+NOTE: For the `clicks_permitted` dataset, `source.ip` corresponds to the Proofpoint `senderIP` — the IP of the email sender — and `destination.ip` corresponds to `clickIP` — the IP of the click destination.
+
 {{event "clicks_permitted"}}
 
 {{fields "clicks_permitted"}}

packages/proofpoint_tap/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.0"
+ changes:
+ - description: Clarify us of `{source,destination}.ip` in click datasets.
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/3979
 - version: "1.0.0"
  changes:
  - description: Make GA

packages/proofpoint_tap/docs/README.md

@@ -23,6 +23,8 @@ For the more information on generating TAP credentials please follow the steps m
 
 This is the `clicks_blocked` dataset.
 
+NOTE: For the `clicks_blocked` dataset, `source.ip` corresponds to the Proofpoint `senderIP` — the IP of the email sender — and `destination.ip` corresponds to `clickIP` — the IP of the click destination.
+
 An example event for `clicks_blocked` looks as following:
 
 ```json
@@ -249,6 +251,8 @@ An example event for `clicks_blocked` looks as following:
 
 This is the `clicks_permitted` dataset.
 
+NOTE: For the `clicks_permitted` dataset, `source.ip` corresponds to the Proofpoint `senderIP` — the IP of the email sender — and `destination.ip` corresponds to `clickIP` — the IP of the click destination.
+
 An example event for `clicks_permitted` looks as following:
 
 ```json

packages/proofpoint_tap/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: proofpoint_tap
 title: Proofpoint TAP
-version: "1.0.0"
+version: "1.1.0"
 license: basic
 description: Collect logs from Proofpoint TAP with Elastic Agent.
 type: integration