crowdstrike: preserve event_simpleName field in FDR pipeline

[efd6]

Proposed commit message

crowdstrike: preserve event_simpleName field in FDR pipeline

The FDR ingest pipeline renamed crowdstrike.event_simpleName into
event.action, destroying the source field. For registry, driver,
and *Written events, event.action is then overwritten with a
generic operation name (per TRaDe requirements), leaving the
original CrowdStrike event name inaccessible as a keyword field.

Change the rename to a copy so crowdstrike.event_simpleName
survives in the indexed document alongside event.action.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package crowdstrike 👍(6) 💚(2) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
falcon	5555.56	3127.93	-2427.63 (-43.7%)	💔
host	4444.44	3603.6	-840.84 (-18.92%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7b6b8ee

History

• 💔 Build #40768 failed a408d17

cc @efd6

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[w0rk3r]

LGTM as it seems to not affect the way we populate the event.action. An alternative would be to append to the field, as that would preserve both TRaDE values and the original ones

[elastic-vault-github-plugin-prod]

Package crowdstrike - 3.13.1 containing this change is available at https://epr.elastic.co/package/crowdstrike/3.13.1/