symantec_endpoint using invalid field values according to ECS

[jsoriano]

[0] parsing field value failed: field "event.type"'s value "process" is not one of the allowed values (access, admin, allowed, change, connection, creation, deletion, denied, end, error, group, indicator, info, installation, protocol, start, user)

"process" => use "event.category: process" instead?

Part of #3016

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jsoriano]

Reopening as the issue seems to be still present https://beats-ci.elastic.co/blue/organizations/jenkins/Ingest-manager%2Fintegrations/detail/PR-3017/3/tests