Add Linux load module events

[nicholasberlin]

Change Summary

Add knowledge of event.action = "load_module" for Linux kernel load module process events.

Sample document:

{
        "agent": {
            "id": "adsflkjasd;lfkjas;dlkfj",
            "type": "endpoint",
            "version": "9.4.0-SNAPSHOT"
        },
        "process": {
            "Ext": {
                "ancestry": [
                    "ngaLewF3DR+j1NtKw1HnfA",
                    "0JLCqorFrMVitXKojenDgQ",
                    "Sd/bwXD2L4Kg64pLk93LeA",
                    "HAyAzFnUq1AA7UvzKfZmOg",
                    "r0TIyLj8MxqKNvozQBeuIw"
                ]
            },
            "args": [
                "modprobe",
                "dummy"
            ],
            "parent": {
                "args": [
                    "sudo",
                    "modprobe",
                    "dummy"
                ],
                "name": "sudo",
                "pid": 1553452,
                "args_count": 3,
                "entity_id": "ngaLewF3DR+j1NtKw1HnfA",
                "command_line": "sudo modprobe dummy",
                "executable": "/usr/bin/sudo"
            },
            "name": "kmod",
            "pid": 1553453,
            "working_directory": "/home/nberlin/git/endpoint-dev/main/Python/endpoint",
            "args_count": 2,
            "entity_id": "rNspiYIcgXQIfA79krPVaA",
            "command_line": "modprobe dummy",
            "executable": "/usr/bin/kmod",
            "hash": {
                "sha256": "656354b09f8d2e81460fc233352b44ae7200347c681a843557b629d191a15e49"
            }
        },
        "@timestamp": "2026-03-16T18:19:14.5297547Z",
        "ecs": {
            "version": "8.10.0"
        },
        "data_stream": {
            "namespace": "default",
            "type": "logs",
            "dataset": "endpoint.events.process"
        },
        "elastic": {
            "agent": {
                "id": "adslfas;dlfkja;sldkfjaslkdjf;asdf"
            }
        },
        "host": {
            "os": {
                "type": "linux"
            },
            "name": "hodl",
            "id": "dabadaba-0000-0000-0000-000000000000"
        },
        "event": {
            "sequence": 2884,
            "created": "2026-03-16T18:19:14.5297547Z",
            "kind": "event",
            "module": "endpoint",
            "action": [
                "load_module"        <------- the important bit
            ],
            "id": "OPV7HsfUxGxJT6sT++++++hc",
            "category": [
                "process"
            ],
            "type": [
                "start"
            ],
            "dataset": "endpoint.events.process",
            "outcome": "unknown"
        },
        "message": "Endpoint process event",
        "user": {
            "Ext": {
                "real": {
                    "name": "root",
                    "id": 0
                }
            },
            "name": "root",
            "id": 0
        },
        "group": {
            "Ext": {
                "real": {
                    "name": "root",
                    "id": 0
                }
            },
            "name": "root",
            "id": 0
        }
    }

Release Target

v9.4.0

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes