Update sysmon and security modules

[andrewkroh]

• Add event.module for both modules.
• Add event.output to Security log authentication events.
• Add event.category=process and event.type=process_start/process_end to Sysmon process events (event ID 1 and 5).

[elasticmachine]

Pinging @elastic/secops

[adriansr]

Some tests seem to be failing due to different case in GUID fields

[andrewkroh]

I'm guessing this GUID casing is some kind of subtle difference in Windows 2019. This job ran on a 2019 worker machine which I think are relatively new. I'll run some tests there and try to reproduce.

[andrewkroh]

I found that Windows 2019 generates GUID values with lowercase hex (as per the RFC). So I've update the test case to normalize any uppercase GUIDs to lowercase. I also improved the diff output to make it easier to read.

        testing_windows.go:68: Expected and actual are different:
            --- Expected
            +++ Actual
            @@ -34,3 +34,3 @@
                 },
            -    "provider_guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
            +    "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
                 "provider_name": "Microsoft-Windows-Sysmon",