[Crowdstrike] Parse prevented and worker_node_name field for alert data streams

[moxarth-rathod]

Proposed commit message

crowdstrike: request for parsing additional fields

This PR parses `prevented` and `worker_node_name` fields for alert data streams.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/crowdstrike directory.
• Run the following command to run tests.

elastic-package test

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[ShourieG]

@moxarth-rathod, just one query, how were the logs generated ?

[moxarth-rathod]

@moxarth-rathod, just one query, how were the logs generated ?

@ShourieG since the original event wasn’t provided, I've created a log based on the issue description.

[efd6]

since the original event wasn’t provided, I've created a log based on the issue description.

Can we get by with deriving this from the last event that already exists in the test sample? It is much shorter and would still exercise the change here.

[ShourieG]

since the original event wasn’t provided, I've created a log based on the issue description.

Can we get by with deriving this from the last event that already exists in the test sample? It is much shorter and would still exercise the change here.

Agree with Dan here, if its possible to retrofit the new attributes in the existing smaller log then it would be good in reducing the overall footprint of the change.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3a5be2e

History

• 💚 Build #26516 succeeded 36f045c
• 💚 Build #26485 succeeded 7bb8b39

cc @moxarth-rathod

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package crowdstrike - 1.73.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/1.73.0/