[breaking-change] Undocumented breaking changes detected (2026-04-16)

Recent commits introduced a breaking change that appears undocumented.

## Breaking Changes

### 1. `eset_protect.event.occured` was renamed to `eset_protect.event.occurred` without migration guidance
**Commit(s):** [`0cfc9eb235`](https://github.com/elastic/integrations/commit/0cfc9eb235)
**PR:** [#18248](https://github.com/elastic/integrations/pull/18248)
**What broke:** Existing downstream queries/alerts/transforms that reference `eset_protect.event.occured` no longer match the field after upgrade.
**Evidence:**
- Field schema rename in `packages/eset_protect/data_stream/event/fields/fields.yml` (`name: occured` → `name: occurred`, hunk `@@ -99,7 +99,7 @@`).
- Pipeline target rename in `packages/eset_protect/data_stream/event/elasticsearch/ingest_pipeline/default.yml` (`target_field: eset_protect.event.occured` → `target_field: eset_protect.event.occurred`, around hunk `@@ -199,28 +199,35 @@`).
- Documentation now shows only `eset_protect.event.occurred` in `packages/eset_protect/docs/README.md` (table entry around the exported fields section).
**Why undocumented:**
- `packages/eset_protect/changelog.yml` version `2.2.0` only documents “Parse mail addresses in event.object_uri” as an enhancement and does not mention the field rename or migration.
- PR #18248 title/body/comments do not provide migration steps for the renamed field.

## Suggested Actions
- [ ] Document this field rename explicitly as a breaking change in package release notes/changelog
- [ ] Add migration guidance for users to update saved objects and rules from `eset_protect.event.occured` to `eset_protect.event.occurred`

> [!NOTE]
>
> 🔒 Integrity filter blocked 5 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#18411](https://github.com/elastic/integrations/pull/18411) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#17670](https://github.com/elastic/integrations/pull/17670) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18248](https://github.com/elastic/integrations/pull/18248) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18390](https://github.com/elastic/integrations/pull/18390) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#18420](https://github.com/elastic/integrations/pull/18420) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Breaking Change Detector](https://github.com/elastic/integrations/actions/runs/24513254925)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 23, 2026, 1:52 PM UTC