Refactoring network DNS to use useSearchStrategy

[angorayc]

Summary

Steps to verify:

1. Create index mapping if you don't have winlogbeat data

PUT winlogbeat-7.16.2-2022.07.11-000001-myTest
{
  "mappings": {
    "properties": {
      "dns": {
        "properties": {
          "question": {
            "properties": {
              "name": {
                "type": "keyword"
              },
              "registered_domain": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}

2. Index some mock data to the winlogbeat index you just created

POST winlogbeat-7.16.2-2022.07.11-000001-myTest/_doc
{
  "agent": {
    "build_date": "2022-07-08 16:18:50 +0000 UTC",
    "commit": "279ca338188afcb3dcf6365f06ecb4348493e531",
    "name": "siem-windows-endpoint",
    "id": "59c1fb1a-f6ae-45e0-9943-306da3e79711",
    "type": "winlogbeat",
    "ephemeral_id": "013239d9-0d69-413e-ad9b-6d1a79d88b76",
    "version": "8.3.3"
  },
  "process": {
    "name": "GCEWindowsAgent.exe",
    "pid": 644,
    "entity_id": "{87a3bf96-8e67-62ca-1700-000000002500}",
    "executable": """C:\Program Files\Google\Compute Engine\agent\GCEWindowsAgent.exe"""
  },
  "winlog": {
    "computer_name": "siem-windows-endpoint",
    "process": {
      "pid": 2472,
      "thread": {
        "id": 4208
      }
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "opcode": "Info",
    "version": 5,
    "record_id": "352085",
    "event_id": "22",
    "task": "Dns query (rule: DnsQuery)",
    "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
    "api": "wineventlog",
    "provider_name": "Microsoft-Windows-Sysmon",
    "user": {
      "identifier": "S-1-5-18",
      "domain": "NT AUTHORITY",
      "name": "SYSTEM",
      "type": "User"
    }
  },
  "sysmon": {
    "dns": {
      "status": "SUCCESS"
    }
  },
  "log": {
    "level": "information"
  },
  "dns": {
    "resolved_ip": [
      "172.217.212.95"
    ],
    "question": {
      "registered_domain": "logging.googleapis.com",
      "top_level_domain": "googleapis.com",
      "name": "logging.googleapis.com"
    },
    "answers": [
      {
        "data": "172.217.212.95",
        "type": "A"
      }
    ]
  },
  "message": """Dns query:
RuleName: -
UtcTime: 2022-07-10 23:03:43.926
ProcessGuid: {87a3bf96-8e67-62ca-1700-000000002500}
ProcessId: 644
QueryName: logging.googleapis.com
QueryStatus: 0
QueryResults: ::ffff:172.217.212.95;
Image: C:\Program Files\Google\Compute Engine\agent\GCEWindowsAgent.exe
User: NT AUTHORITY\SYSTEM""",
  "network": {
    "protocol": "dns"
  },
  "cloud": {
    "availability_zone": "us-central1-c",
    "instance": {
      "name": "siem-windows-endpoint",
      "id": "8649121984684633303"
    },
    "provider": "gcp",
    "machine": {
      "type": "e2-custom-2-5120"
    },
    "service": {
      "name": "GCE"
    },
    "project": {
      "id": "elastic-siem"
    },
    "account": {
      "id": "elastic-siem"
    }
  },
  "@timestamp": "2022-07-10T23:03:43.926Z",
  "ecs": {
    "version": "1.12.0"
  },
  "related": {
    "hosts": [
      "logging.googleapis.com"
    ],
    "ip": [
      "172.217.212.95"
    ],
    "user": [
      "SYSTEM"
    ]
  },
  "host": {
    "hostname": "siem-windows-endpoint",
    "os": {
      "build": "17763.2928",
      "kernel": "10.0.17763.2928 (WinBuild.160101.0800)",
      "name": "Windows Server 2019 Datacenter",
      "type": "windows",
      "family": "windows",
      "version": "10.0",
      "platform": "windows"
    },
    "ip": [
      "fe80::b957:9fd7:cb39:9099",
      "10.200.0.200"
    ],
    "name": "siem-windows-endpoint",
    "id": "87a3bf96-38ff-4603-8381-1bce31f4a3be",
    "mac": [
      "42:01:0a:c8:00:c8"
    ],
    "architecture": "x86_64"
  },
  "event": {
    "ingested": "2022-07-10T23:03:48.579549339Z",
    "code": "22",
    "provider": "Microsoft-Windows-Sysmon",
    "created": "2022-07-10T23:03:47.557Z",
    "kind": "event",
    "module": "sysmon",
    "action": "Dns query (rule: DnsQuery)",
    "category": [
      "network"
    ],
    "type": [
      "connection",
      "protocol",
      "info"
    ]
  },
  "user": {
    "domain": "NT AUTHORITY",
    "name": "SYSTEM",
    "id": "S-1-5-18"
  }
}

3. Go to network page, and make sure winlogbeat is selected in Data View.
4. Go to network, DNS tab to check if DNS table is loaded

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[angorayc]

@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[angorayc]

@elasticmachine merge upstream

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: a61bc44
• Storybooks Preview

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	5.2MB	5.2MB	-860.0B

History

• 💚 Build #56594 succeeded 752c37d
• 💚 Build #56357 succeeded df257b4
• 💔 Build #56272 failed 02cd2b5

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[YulNaumenko]

LGTM