[SessionView] cloud_defend process index as a source + merged process event handling

[mitodrummer]

Summary

This PR adds logs-cloud_defend.process as a source to load process events in SessionView. (note: I have plans to optimize sessionview so it only pulls from the index that the session leader came from).

The cloud-defend service (WIP) implements a technique to reduce process event volume by squishing the 3 lifecycle event.action s (fork, exec, end) into a single event. SessionView has been updated to handle these new merged events.

Much of the information across a fork, exec and end event does not change, so given a short window, the cloud-defend service buffers the events, and merges the values from event.action and event.type into an array of the values from each event.

In most cases an SSH session leader process (e.g bash) will have two events. One event containing event.action: ['fork', 'exec'] (2
merged events), and one final event with event.action: 'end' when the user exits the session.

The nice thing about the above is that in the majority of situations processes are short lived, and so most events should contain all three actions [fork, exec, end]. In our tests, this has provided roughly a 50% savings in process event volume. It should also be noted that any rules using event.action or event.type should be unaffected by this change, as the query languages don't care if it's comparing a single value, or an array of values.

A minor change has also been made in the process analyzer feature to handle the merging of event.type
e.g event.type = ['start', 'end']
cc @kqualters-elastic if you know of any other places I need to update.

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[opauloh]

lgtm just a minor suggestion

[kqualters-elastic]

@mitodrummer is there an endpoint build available with this change? or is it already in main?

[mitodrummer]

@mitodrummer is there an endpoint build available with this change? or is it already in main?

The merging of process events is not implemented in endpoint. We are working on a new bpf sensor which which isn't quite ready yet for prime time. Though it should show up soon once 8.8 snapshot is fixed.

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 3acbf37

Failed CI Steps

• FTR Configs #54

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
cloudDefend	254.2KB	255.0KB	+783.0B
sessionView	383.0KB	384.1KB	+1.2KB
total			+2.0KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	433	436	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	513	516	+3

History

• 💚 Build #114893 succeeded b504013
• 💔 Build #114872 failed bc770e6
• 💔 Build #114846 failed b651159
• 💔 Build #114843 failed 9830215
• 💔 Build #114769 failed 4061095
• 💔 Build #114748 failed daebe9f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)