Cherry-pick #16988 to 7.x: New input for CrowdStrike Falcon events

[tonymeehan]

Cherry-pick of PR #16988 to 7.x branch. Original message:

What does this PR do?

This adds a new input for CrowdStrike Falcon events forwarded by CrowdStrike's SIEM forwarder. This input uses the default JSON output format from the SIEM forwarder.

Why is it important?

We've had several users asks us for adding support for CrowdStrike Falcon in ECS. We strive to be data agnostic to help enable our SOC users aggregate all of their data in our SIEM. Using some log data provided by our users, I've put this new module together to ingest the data and convert many fields into ECS (including categorization).

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works

How to test this PR locally

mage update build integTest

Screenshots

Proof this works

[success] 0.85% test_xpack_modules.XPackTest.test_fileset_file_008_crowdstrike: 2.7708s
----------------------------------------------------------------------
Ran 135 tests in 326.929s

OK

I also ran make docs to validate the documentation looked good.

Other comments

I'll squash before merging.

[leehinman]

needs a small fix to CHANGELOG, otherwise looks great.

[tonymeehan]

@leehinman should I update this PR with the fix from #17819 so that tests pass here? Looks like the failing test is due to the issue identified in #17819.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)