[7.12][Telemetry] Security telemetry allowlist fix.

[pjhampton]

Summary

There was a bug in the allowlist layout for security telemetry in #91920
We are working on ways to make this easier to extend / manage / test in backref'd protections issue.

Checklist

The allowlist is already covered with tests - see #77200
Additional fields have been vetted for PII compliance by senior managers.

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[Bamieh]

Does this fix affect the sent data downstream? do we need to reach out to infra about this change?

[pjhampton]

I have already updated the infra indexers @Bamieh. It was just this piece that is broken

[jeska]

🚢

[gabriellandau]

Thanks.

[gabriellandau]

Can we also add process.thread?

        "thread": {
            "Ext": {
                "call_stack": [
                    {
                        "instruction_pointer": 140722403727300,
                        "memory_section": {
                            "memory_address": 140722403086336,
                            "memory_size": 1159168,
                            "protection": "R-X"
                        },
                        "module_path": "c:\\windows\\system32\\ntdll.dll",
                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwCreateThreadEx+0x14"
                    },
                    {
                        "instruction_pointer": 140722362113391,
                        "memory_section": {
                            "memory_address": 140722361929728,
                            "memory_size": 1122304,
                            "protection": "R-X"
                        },
                        "module_path": "c:\\windows\\system32\\kernelbase.dll",
                        "symbol_info": "c:\\windows\\system32\\kernelbase.dll!CreateRemoteThreadEx+0x29f"
                    },
                    {
                        "instruction_pointer": 140722391791069,
                        "memory_section": {
                            "memory_address": 140722391683072,
                            "memory_size": 516096,
                            "protection": "R-X"
                        },
                        "module_path": "c:\\windows\\system32\\kernel32.dll",
                        "symbol_info": "c:\\windows\\system32\\kernel32.dll!CreateThread+0x3d"
                    },
                    {
                        "instruction_pointer": 140697069180492,
                        "memory_section": {
                            "memory_address": 140697069096960,
                            "memory_size": 1785856,
                            "protection": "R-X"
                        },
                        "module_path": "c:\\git\\endpoint-dev\\build\\elastic\\windows\\msvc14\\x64\\releasestatic\\memoryprotectiontests.exe",
                        "symbol_info": "c:\\git\\endpoint-dev\\build\\elastic\\windows\\msvc14\\x64\\releasestatic\\memoryprotectiontests.exe!0x7FF696D4564C"
                    }
                ]
            },
            "id": 7680
        },

[gabriellandau]

LGTM

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 58edf60
• Storybooks Preview
• Documentation Changes

Metrics [docs]

✅ unchanged

History

• 💚 Build #109473 succeeded 4cc7aab

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @pjhampton