[ESET PROTECT] Normalize ECS hash fields enabling indicator match rules

[kat-does-code]

[Enhancement]

This PR aims to improve compatibility with threat intelligence and other security integrations, including ESET Threat Intelligence #9255, by lowercasing the ECS hash fields threat.indicator.file.hash.sha1, file.hash.sha and related.hash, which is more in line with similar security integrations. This would enable one to use indicator match rules more easily as well.

Also fixes a parsing error when object_uri equals script.

Proposed commit message

Lowercase related hash and indicator hash to support indicator rule matching. Fixed grok parse error when object_uri equals script.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[efd6]

/test

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6108043

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

Thanks

[LaZyDK]

You are referencing the wrong pull request in the changelog

[kat-does-code]

You are referencing the wrong pull request in the changelog

@efd6 How do I go about fixing this, issue and PR?

[efd6]

Sorry about that, I should have caught it. You can send another PR to fix the line. No other change is required. Otherwise I can do it tomorrow.