Oren.margalit/loi 571 cisco duo preserve source ocsf (DataDog#21194)

* preserve source for 2 fields

* change test file

* update test file

Author: orenma-dd

cisco_duo/assets/logs/cisco-duo.yaml

@@ -320,7 +320,7 @@ pipeline:
           sourceType: attribute
           target: ocsf.metadata.event_code
           targetType: attribute
-          preserveSource: false
+          preserveSource: true
           overrideOnConflict: false
         - type: attribute-remapper
           name: Map `isotimestamp`, `ts` to `ocsf.time`
@@ -704,7 +704,7 @@ pipeline:
           sourceType: attribute
           target: ocsf.actor.app_uid
           targetType: attribute
-          preserveSource: false
+          preserveSource: true
           overrideOnConflict: false
         - type: attribute-remapper
           name: Map `access_device.ip.address`, `access_device.ip` to `ocsf.src_endpoint.ip`
@@ -797,7 +797,7 @@ pipeline:
           sourceType: attribute
           target: ocsf.user.email_addr
           targetType: attribute
-          preserveSource: false
+          preserveSource: true
           overrideOnConflict: false
         - type: attribute-remapper
           name: Map `target.type` to `ocsf.user.type`
@@ -939,7 +939,7 @@ pipeline:
           sourceType: attribute
           target: ocsf.actor.user.email_addr
           targetType: attribute
-          preserveSource: false
+          preserveSource: true
           overrideOnConflict: false
         - type: attribute-remapper
           name: Map `actor.type` to `ocsf.actor.user.type`
@@ -1210,7 +1210,7 @@ pipeline:
           sourceType: attribute
           target: ocsf.user.email_addr
           targetType: attribute
-          preserveSource: false
+          preserveSource: true
           overrideOnConflict: false
     - type: pipeline
       name: OCSF sub pipeline for auth factor device enrichment