crowdstrike using invalid field values according to ECS

`[0] parsing field value failed: field "event.type"'s value "session" is not one of the allowed values (access, admin, allowed, change, connection, creation, deletion, denied, end, error, group, indicator, info, installation, protocol, start, user)`                              
"session" => "access"?

Part of #3016