[microsoft_defender_endpoint, m365_defender] extract process.name from process.command_line

[mohitjha-elastic]

Proposed Commit Message

m365_defender, microsoft_defender_endpoint: extract process.name from process.command_line

* m365_defender: updated process.name ECS mapping in alert, event, and incident
  data streams to extract the process name from process.command_line instead of
  relying on file.name.
* microsoft_defender_endpoint: updated process.name ECS mapping in log data stream
  to extract the process name from process.command_line.

M365 Defender:

* Alert – If process.name already exists, leave it as is. Otherwise, extract it
  from process.command_line(since process.executable is not available here).
* Event – Some pipelines already contain logic to parse process.executable and
  process.name. The script to set process.name from command_line will only be
  used when either of these fields is missing.
* Incident – Both process.name and process.executable are not available.
  Therefore, the script must be used to parse and populate process.name.

Microsoft Defender Endpoint:

* log - Both process.name and process.executable are not available. Therefore,
  the script must be used to parse and populate process.name.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

To test integration

Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/<integration_name> directory.
Run the following command to run tests.
elastic-package test -v

NOTE: To test individual integrations, replace <integration_name> with one of the following: m365_defender or microsoft_defender_endpoint.

Related issues

SDH 6382

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

nits only

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: ea8fd27

History

• 💚 Build #31005 succeeded cd533c8
• 💚 Build #30953 succeeded 289567a

cc @mohitjha-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
80.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

Thanks

[efd6]

I have manually tested this on a problematic sample and it behaves as wanted.

[elastic-vault-github-plugin-prod]

Package m365_defender - 4.0.1 containing this change is available at https://epr.elastic.co/package/m365_defender/4.0.1/

[elastic-vault-github-plugin-prod]

Package microsoft_defender_endpoint - 3.0.1 containing this change is available at https://epr.elastic.co/package/microsoft_defender_endpoint/3.0.1/