Issue:
network.interface.name and rsa.* fields are listed under the microsoft.defender_atp section on the Microsoft fields doc, but they are supposed to be independent because they originate in different fields.yml.

• https://github.com/elastic/beats/blob/v8.11.1/x-pack/filebeat/module/microsoft/defender_atp/_meta/fields.yml
• https://github.com/elastic/beats/blob/v8.11.1/x-pack/filebeat/module/microsoft/dhcp/_meta/fields.yml

• Version: since 7.9 (https://www.elastic.co/guide/en/beats/filebeat/7.9/exported-fields-microsoft.html)
• Operating System: n/a
• Discuss Forum URL: n/a
• Steps to Reproduce:

1. Open the Microsoft fields doc.
2. Scroll down to the network.interface.name.
3. No separation exists between microsoft.defender_atp.* and network.interface.name.