Cherry-pick #18381 to 7.8: Improve ECS field mappings in Sysmon module. (#18381)

[marc-gr]

Cherry-pick #18381 to 7.8 branch. Original message:

What does this PR do?

Improve ECS field mappings in Sysmon module.

• related.hash, related.ip and related.user are now populated.
• hashes are now also populated to the corresponding process.hash or file.hash
• file.name, file.directory and file.extension are now populated.
• rule.name is populated for all events when present.

Why is it important?

Sysmon module was not reporting some fields and was reporting others in a namespace that was not aligned with ECS. This adds changes to improve the ECS field mapping for it.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• Set related.hash, related.ip and related.user
• Set file.extension/name/directory.
• hash.* is not part of ECS. It should be used as file.hash., process.hash. or process.parent.hash.*.
• Drop the rule.name field when it has a tack - value

NOTES:

• process.parent.hash is not present in any event (you can check here), so nothing was done for it.
• rule.name has been added to all events that can have it according to the previous schema, but will be ignored if empty or its value is -.
• as mentioned in [Winlogbeat] More ECS changes for Sysmon #18364, the previous root level hash object will not be removed until 8.0 since it is a breaking change.

Related issues

Closes #18364

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request Cherry-pick #18381 to 7.8: Improve ECS field mappings in Sysmon module. (#18381) #18518 opened]

• Start Time: 2020-05-14T13:09:55.259+0000

• Duration: 70 min 34 sec (4174477)

Test stats 🧪

Test	Results
Failed	0
Passed	81
Skipped	0
Total	81