Add SpoofSentry integration

[netallion]

What does this PR do?

Adds a new community integration for SpoofSentry by DomainSeal — a DMARC monitoring, domain spoofing detection, and automated takedown platform.

SpoofSentry sends domain security events to Elastic via an HTTP endpoint input.

Includes

• Integration manifest (http_endpoint input, Fleet-compatible)
• Data stream (events) with ECS-compliant ingest pipeline
• Field definitions (custom fields + ECS references + base fields)
• Kibana dashboard (event counts, severity timeseries, domain breakdown, threat toplist)
• Documentation (setup guide, ECS field mapping, log reference)
• Changelog

Ingest Pipeline

The pipeline (data_stream/events/elasticsearch/ingest_pipeline/default.yml) processes incoming events:

• Sets ECS base fields (event.kind: alert, event.dataset: spoofsentry.alert)
• Remaps eventType → event.action, domain → host.domain, tenantId → labels.tenant_id
• Maps severity strings (info/low/medium/high/critical) to ECS numeric severity (1-10)
• Categorizes events into event.category and event.type based on event action

Event Types

• DMARC authentication failures
• Spoofing campaign detections
• Lookalike domain threats
• DNS enforcement changes (SPF, DKIM, DMARC policy)
• Takedown orchestration lifecycle

Author

• Company: DomainSeal
• Product: SpoofSentry
• Support: hello@spoofsentry.com

[cla-checker-service]

❌ Author of the following commits did not sign a Contributor Agreement:
60d8c6c

Please, read and sign the above mentioned agreement if you want to contribute to this project

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.