Add malware_signature for Memory protection alert

custom_schemas/custom_malware_signature.yml

@@ -0,0 +1,40 @@
+---
+- name: malware_signature
+  title: Malware Signature
+  group: 2
+  short: These fields contain the yara malware signature.
+  description: >
+    These fields contain the yara malware signature.
+  reusable:
+    order: 1
+    top_level: false
+    expected:
+      - process.Ext
+      - file.Ext
+  type: group
+  fields:
+    - name: all_names
+      level: custom
+      type: keyword
+      example: "Windows.EICAR.Not-a-virus"
+      description: A sequence of signature names matched.
+
+    - name: identifier
+      level: custom
+      type: keyword
+      description: The model's unique identifier.
+
+    - name: primary
+      level: custom
+      type: object
+      description: The first matching details.
+
+    - name: secondary
+      level: custom
+      type: array
+      description: Additional matching details if available.
+
+    - name: version
+      level: custom
+      type: keyword
+      description: The version of the model used.

custom_subsets/elastic_endpoint/alerts/malware_event.yaml

@@ -315,6 +315,8 @@ fields:
                       buffer: {}
                       decompressed_size: {}
                       encoding: {}
+          malware_signature:
+            fields: "*"
           macro:
             fields:
               errors:
@@ -469,6 +471,8 @@ fields:
                 exceptionable: true
               status:
                 exceptionable: true
+          malware_signature:
+            fields: "*"
           malware_classification:
             fields:
               score: {}