Skip to content

crowdstrike: add ECS categorization and fields for new FDR event types#20079

Merged
navnit-elastic merged 6 commits into
elastic:mainfrom
navnit-elastic:crowdstrike-15341
Jul 14, 2026
Merged

crowdstrike: add ECS categorization and fields for new FDR event types#20079
navnit-elastic merged 6 commits into
elastic:mainfrom
navnit-elastic:crowdstrike-15341

Conversation

@navnit-elastic

@navnit-elastic navnit-elastic commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

crowdstrike: add ECS categorization and fields for new FDR event types

Expand FDR ingest categorization for additional event types, including
IDP telemetry, Active Directory account changes, DBus/systemd activity,
network containment, host firewall matches, sensor diagnostics, and container
events. Add field mappings for newly supported events.

Map Active Directory account-management events to ECS user fields from
SamAccountName, AccountObjectSid, and AccountDomain when SourceAccount*
fields are absent. Add DNS enrichment for DNSRequestDetectInfo by matching
DNS request actions case-insensitively so dns.question and network.protocol
are populated.

The anonymized samples are derived from live CrowdStrike instance.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@navnit-elastic navnit-elastic self-assigned this Jul 10, 2026
@navnit-elastic navnit-elastic added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Jul 10, 2026
@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

navnit-elastic
navnit-elastic commented Jul 10, 2026
View reviewed changes
Comment thread packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml
kind: event
outcome: unknown
type:
- start

@navnit-elastic navnit-elastic Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like Git did not show the diff properly.

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package crowdstrike 👍(10) 💚(2) 💔(2)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
falcon 5000 3022.06 -1977.94 (-39.56%) 💔
identity_protection_assessment 29239.77 14556.04 -14683.73 (-50.22%) 💔

To see the full report comment with /test benchmark fullreport

@navnit-elastic navnit-elastic marked this pull request as ready for review July 10, 2026 10:03
@navnit-elastic navnit-elastic requested review from a team as code owners July 10, 2026 10:03
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 10, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@navnit-elastic navnit-elastic mentioned this pull request Jul 10, 2026
Open
efd6
efd6 reviewed Jul 13, 2026
View reviewed changes
Comment thread packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml
Comment thread packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@vera-review-bot

vera-review-bot Bot commented Jul 13, 2026

Copy link
Copy Markdown

No issues across the latest commits 3de7d93.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 13, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @navnit-elastic

@mergify

mergify Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@navnit-elastic navnit-elastic merged commit 8750fa7 into elastic:main Jul 14, 2026
11 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Package crowdstrike - 4.3.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/4.3.0/

@navnit-elastic navnit-elastic mentioned this pull request Jul 14, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@efd6 efd6 efd6 approved these changes

Assignees

@navnit-elastic navnit-elastic

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:crowdstrike CrowdStrike Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@navnit-elastic @efd6