[Crowdstrike] FDR - Fixes parsing errors in aip and ContextTimeStamp fields

[kcreddy]

What does this PR do?

For FDR datastreaM:

• Fixes aip and ContextTimeStamp fields parsing errors
• Adds additional fields

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Related issues

• Closes [Crowdstrike] aip and ContextTimeStamp parsing errors #5654

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-03-23T10:54:35.090+0000

• Duration: 14 min 19 sec

Test stats 🧪

Test	Results
Failed	0
Passed	14
Skipped	0
Total	14

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (9/9)	💚
Classes	100.0% (9/9)	💚
Methods	100.0% (54/54)	💚 6.667
Lines	95.194% (2694/2830)	👎 -1.847
Conditionals	100.0% (0/0)	💚

[bhapas]

Just a thought looking at lot of repeated code..
Can we not run a painless script before all convert / set with copy_from processors to remove fields that are empty [""] / null

Like

Suggested change

	if: (ctx.crowdstrike?.localipCount != null && ctx.crowdstrike?.localipCount != "")
	- script:
	lang: painless
	description: This script processor iterates over the whole document to remove fields with null / empty values.
	source: |
	void handleMap(Map map) {
	for (def x : map.values()) {
	if (x instanceof Map) {
	handleMap(x);
	} else if (x instanceof List) {
	handleList(x);
	}
	}
	map.values().removeIf(v -> v == null || v == "" || v == "-" || v == "\"-\"" || ((v instanceof List || v instanceof Map) && v.isEmpty()));
	}
	void handleList(List list) {
	for (def x : list) {
	if (x instanceof Map) {
	handleMap(x);
	} else if (x instanceof List) {
	handleList(x);
	}
	}
	}
	handleMap(ctx.crowdstrike);

[P1llus]

Its a shame that observer.* ends up as an array, but not much we can do if aip can often be arrays, because its impossible to know which to choose.
Since the field type is still keyword then its still fine.

[elasticmachine]

Package crowdstrike - 1.11.1 containing this change is available at https://epr.elastic.co/search?package=crowdstrike