crowdstrike: add ECS categorization and fields for new FDR event types

[navnit-elastic]

Proposed commit message

crowdstrike: add ECS categorization and fields for new FDR event types

Expand FDR ingest categorization for additional event types, including
IDP telemetry, Active Directory account changes, DBus/systemd activity,
network containment, host firewall matches, sensor diagnostics, and container
events. Add field mappings for newly supported events.

Map Active Directory account-management events to ECS user fields from
SamAccountName, AccountObjectSid, and AccountDomain when SourceAccount*
fields are absent. Add DNS enrichment for DNSRequestDetectInfo by matching
DNS request actions case-insensitively so dns.question and network.protocol
are populated.

The anonymized samples are derived from live CrowdStrike instance.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Relates [CrowdStrike]: Expand event categorization for FDR event types #15341

Screenshots

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[navnit-elastic]

It seems like Git did not show the diff properly.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package crowdstrike 👍(10) 💚(2) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
falcon	5000	3022.06	-1977.94 (-39.56%)	💔
identity_protection_assessment	29239.77	14556.04	-14683.73 (-50.22%)	💔

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 5f9248d

History

• 💔 Build #45853 failed d0c3c95

cc @navnit-elastic

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

No issues across the latest commits 5f9248d.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.