Fix processing of crowdstrike.User.Name field

Author: chemamartinez

packages/crowdstrike/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.2.1"
+  changes:
+    - description: Fix processing of `crowdstrike.User.Name` field.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/15272
 - version: "2.2.0"
   changes:
     - description: >-

packages/crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log

@@ -1 +1,2 @@
 {"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":"DOMAIN\\BRADLEYA","UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserName":"Alan-One","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","event_platform":"Win","monthsincereset":"1.0"}
+{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"}

packages/crowdstrike/data_stream/fdr/_dev/test/system/test-keep-metadata-config.yml

@@ -14,4 +14,4 @@ data_stream:
     keep_metadata: true
     enable_deduplication: true
 assert:
-  hit_count: 131
+  hit_count: 132

packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml

@@ -2446,6 +2446,11 @@ processors:
       field: user.roles
       value: admin
       if: ctx.crowdstrike?.UserIsAdmin == "1"
+  - rename:
+      field: crowdstrike.User.Name
+      target_field: user.name
+      ignore_missing: true
+      if: ctx.crowdstrike?.User?.Name != null && ctx.user?.name == null
   - rename:
       field: crowdstrike.UserName
       target_field: user.name

packages/crowdstrike/manifest.yml

@@ -1,6 +1,6 @@
 name: crowdstrike
 title: CrowdStrike
-version: "2.2.0"
+version: "2.2.1"
 description: Collect logs from Crowdstrike with Elastic Agent.
 type: integration
 format_version: "3.4.0"