crowdstrike: add ECS categorization and fields for new FDR event types

[navnit-elastic]

Proposed commit message

crowdstrike: add ECS categorization and fields for new FDR event types

Expand FDR ingest categorization for additional event types, including
IDP telemetry, Active Directory account changes, DBus/systemd activity,
network containment, host firewall matches, sensor diagnostics, and container
events. Add field mappings for newly supported events.

Map Active Directory account-management events to ECS user fields from
SamAccountName, AccountObjectSid, and AccountDomain when SourceAccount*
fields are absent. Add DNS enrichment for DNSRequestDetectInfo by matching
DNS request actions case-insensitively so dns.question and network.protocol
are populated.

The anonymized samples are derived from live CrowdStrike instance.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Relates [CrowdStrike]: Expand event categorization for FDR event types #15341

Screenshots

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[navnit-elastic]

It seems like Git did not show the diff properly.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package crowdstrike 👍(10) 💚(2) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
falcon	5000	3022.06	-1977.94 (-39.56%)	💔
identity_protection_assessment	29239.77	14556.04	-14683.73 (-50.22%)	💔

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

We could factor this out to a temporary boolean so that we don't need to do the repeated string allocation and sub-string search.

  - set:
      tag: set_temp_is_dns_request
      if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest')
      field: _temp.is_dns_request
      value: true
  - set:
      tag: set_dns_type_2198a4ce
      if: ctx._temp?.is_dns_request == true
      field: dns.type
      value: query

and so on below.

The value will be cleaned up in remove_d684cf91.

[navnit-elastic]

Code refactor applied in a2c5504.

[navnit-elastic]

Same pattern applied to "ActiveDirectory" events in 3de7d93.

[efd6]

Suggested change

	- registry
	- registry
	- configuration

This allows you to have "info" in event.type while keeping the "registry" event.category.

Alternatively make it consistent with RemediationMonitorScheduledTaskRemoval, and RemediationMonitorServiceRemoval and others like it which only consider this to be configuration.

[navnit-elastic]

Thanks. Keeping both "registry" and "configuration".

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

No issues across the latest commits 3de7d93.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 3de7d93

History

• 💚 Build #45857 succeeded 5f9248d
• 💔 Build #45853 failed d0c3c95

cc @navnit-elastic