crowdstrike: stop overwriting event.action with generic values in fdr data stream

[efd6]

Proposed commit message

crowdstrike: stop overwriting event.action with generic values in fdr data stream

Three processors in the FDR ingest pipeline overwrote event.action
with generic ECS vocabulary (load, modification, creation, deletion,
open, query) instead of preserving the CrowdStrike event_simpleName.
This lost the specificity needed by detection rules which filter on
the original SimpleEventName values.

Remove the driver event.action="load" processor, the *Written
event.action="creation" processor, and the event.action assignment
from the registry RegOperationType script. The event.type assignments
from these processors were already correct and are retained.

Remove the processor that copied event_simpleName into message. The
crowdstrike.event_simpleName keyword field serves the same purpose
without abusing a match_only_text field.

Add creation to the MachOFileWritten event.type in the categorize
pipeline, closing the one gap the *Written processor was covering.

Note

This is a counter proposal to #19808.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Fixes [CrowdStrike]: event.action, event.type, and message #19807
• Closes [CrowdStrike] Correct event.action, event.type, and message #19808

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/crowdstrike/changelog.yml	5	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

No issues across the latest commits 5e992a7.

I'll pick up this PR for review again after 15 minutes.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[navnit-elastic]

Nit only - Regenerate the sample_event.json to remove message field for consistency.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[efd6]

@navnit-elastic, for the event that was chosen, event.action does not get populated, but I've gone through all the generated output from the system test and it is properly generated in most of them, what it looks like is happening is that a host metadata document was chosen.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 8f089c8

History

• 💚 Build #45367 succeeded 5e992a7

cc @efd6

[navnit-elastic]

LGTM, Thanks!