Describe the enhancement:
Fortinet ingest pipeline should set event.kind: alert if fortinet.firewall.attack field is set.

Describe a specific use case for the enhancement or feature:
Filebeat Paloalt module has its ingest pipeline to set event.kind: alert if ctx?.panw?.panos?.type == "THREAT". So analysts can see such events at SIEM Overview 'External alert trend' graph. But Fortinet module doesn't have such logic and its kind is always event.kind: event. Fortinet module should implement the similar logic.