crowdstrike.fdr: fix processing of crowdstrike.User.Name field

[chemamartinez]

Proposed commit message

Following error appears:

failed to parse field [crowdstrike.User] of type [keyword] in document with id '[doc_id]'. Preview of field's value: '{Name=[user]}'

when a Crowdstrike FDR event contains the following set of fields:

{ "Policy": { "RuleGroupName": "[name]", "RuleBasePath": "[path]", "Name": "[name]" }, "eid": "[eid]", "User": { "Name": "[user]" }, "Prevalence": { "Key": "[KEY]" }, "CustomerIdString": "[id]", "EventUUID": "[id]", "EventType": "Event_ExternalApiEvent", "Suppression": { "Suppressed": false }, "UTCTimestamp": 1756291914047, "Host": { "Name": "[host]" }, "ContentDiff": { "SHA256": "", "Exists": false }, "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", "ChangeId": "[id]", "Nonce": "num", "AgentIdString": "[id]", "cid": "[id]", "timestamp": "2025-08-27T10:51:54Z" }

crowdstrike.User.Name is not processed so it conflicts when ingesting the event as crowdstrike.User is expected to be a keyword.

This PR renames the crowdstrike.User.Name field to user.name.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3b0ac34

History

• 💔 Build #31123 failed c5d8edf
• 💔 Build #31119 failed ae62592
• 💔 Build #31098 failed d35b455

cc @chemamartinez

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
33.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chrisberkhout]

Good 👍

I was wondering what happens to the crowdstrike.User: {} wrapper, but that's cleaned up by the remove-nulls script at the end.

[elastic-vault-github-plugin-prod]

Package crowdstrike - 2.2.1 containing this change is available at https://epr.elastic.co/package/crowdstrike/2.2.1/