[Crowdstrike Falcon] Fix parse of CommandLine in Falcon pipeline

[sakurai-youhei]

What does this PR do?

Adding a quick fix for #4746 since I heard it resolved at least one user's issue.

If you prefer a different approach or want to rewrite the script rather than this sort of patch, please feel free to decline this PR.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• Bump up the version to 1.8.2 according to doc.

How to test this PR locally

Tested by elastic-package test pipeline. test-falcon-sample.log is adjusted to cover the case of consecutive spaces.

Run pipeline tests for the package
--- Test results for package: crowdstrike - START ---
╭─────────────┬─────────────┬───────────┬──────────────────────────────┬────────┬──────────────╮
│ PACKAGE     │ DATA STREAM │ TEST TYPE │ TEST NAME                    │ RESULT │ TIME ELAPSED │
├─────────────┼─────────────┼───────────┼──────────────────────────────┼────────┼──────────────┤
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-audit-events.log │ PASS   │     5.4071ms │
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-events.log       │ PASS   │     5.0659ms │
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-sample.log       │ PASS   │     6.7446ms │
│ crowdstrike │ fdr         │ pipeline  │ test-fdr.log                 │ PASS   │    45.4947ms │
╰─────────────┴─────────────┴───────────┴──────────────────────────────┴────────┴──────────────╯
--- Test results for package: crowdstrike - END   ---
Done

Related issues

• Closes [Crowdstrike Falcon] unsupported_operation_exception on removeIf #4746

Screenshots

n/a

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-12-05T10:14:34.319+0000

• Duration: 15 min 30 sec

Test stats 🧪

Test	Results
Failed	0
Passed	14
Skipped	0
Total	14

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (9/9)	💚 3.0
Classes	100.0% (9/9)	💚 3.0
Methods	100.0% (53/53)	💚 12.903
Lines	95.127% (2655/2791)	👍 3.195
Conditionals	100.0% (0/0)	💚

[efd6]

Rather than changing an existing test case, would you please add a new reduced case for this. Otherwise LGTM.

[sakurai-youhei]

@efd6 Thanks. Hope the one I added meets your intention.

Run pipeline tests for the package
--- Test results for package: crowdstrike - START ---
╭─────────────┬─────────────┬───────────┬──────────────────────────────┬────────┬──────────────╮
│ PACKAGE     │ DATA STREAM │ TEST TYPE │ TEST NAME                    │ RESULT │ TIME ELAPSED │
├─────────────┼─────────────┼───────────┼──────────────────────────────┼────────┼──────────────┤
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-audit-events.log │ PASS   │     5.2803ms │
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-commandline.log  │ PASS   │     4.1016ms │
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-events.log       │ PASS   │     4.7026ms │
│ crowdstrike │ falcon      │ pipeline  │ test-falcon-sample.log       │ PASS   │     7.1575ms │
│ crowdstrike │ fdr         │ pipeline  │ test-fdr.log                 │ PASS   │    39.4163ms │
╰─────────────┴─────────────┴───────────┴──────────────────────────────┴────────┴──────────────╯
--- Test results for package: crowdstrike - END   ---
Done

[efd6]

Thanks

[elasticmachine]

Package crowdstrike - 1.8.2 containing this change is available at https://epr.elastic.co/search?package=crowdstrike