crowdstrike: add event categorization fields to process data in alerts

[navnit-elastic]

Proposed commit message

crowdstrike: add event categorization fields to process data in alerts

Set event.category to "process" and event.type to "start" when
certain process fields are present in the alerts dataset.
Previously, alerts were being sent without setting
the event.category and event.type fields.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Pipeline Tests:

--- Test results for package: crowdstrike - START ---
╭─────────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE     │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├─────────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ crowdstrike │ alert       │ pipeline  │ (ingest pipeline warnings test-alert.log) │ PASS   │ 358.102002ms │
│ crowdstrike │ alert       │ pipeline  │ test-alert.log                            │ PASS   │  543.17555ms │
╰─────────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: crowdstrike - END   ---
Done

Related issues

• Relates [CrowdStrike]: Possible issues with Crowdstrike process data #15466

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package crowdstrike 👍(5) 💚(3) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
falcon	4405.29	3654.97	-750.32 (-17.03%)	💔
host	4566.21	3558.72	-1007.49 (-22.06%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 5a8d990

History

• 💚 Build #32552 succeeded 0e7477a
• 💔 Build #32551 failed 079dc07

cc @navnit-elastic

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[tomsonpl]

Thank you, this looks great!