[m365_defender] Unique entity_id values

[chrisberkhout]

Proposed commit message

[m365_defender] Unique `entity_id` values

Set values in `entity_id` that uniquely identify a process, rather than
using the OS PID value, which may not be unique. Since PIDs can repeat
across hosts and be reused on a single host, additional fields are
necessary to identify the process.

This change should prevent irrelevant documents being shown in the Event
Analyzer due to ID clashes.

ECS defines `process.entity_id` as:

> Unique identifier for the process.
>
> The implementation of this is specified by the data source, but some
> examples of what could be used here are a process-generated UUID,
> Sysmon Process GUIDs, or a hash of some uniquely identifying
> components of a process.
>
> Constructing a globally unique identifier is a common practice to
> mitigate PID reuse as well as to identify a specific process over
> time, across multiple monitored hosts.

Although that defintion says it should identify a process globally, in
practice, other EDR integrations such as `crowdstrike` and
`sentinel_one_cloud_funnel` use globally unique IDs assigned by an
agent, not a value based on the OS PID. That means the ID for a process
won't clash with another, but may also not match the ID used for the
same process in data from a different source.

The [Resolver Schemas](1) document in Kibana refers to `entity_id` but
provides no further guidance on this point.

[1]: https://github.com/elastic/kibana/blob/fb26c1c/x-pack/solutions/security/plugins/security_solution/public/resolver/documentation/schema.md

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: edce411

History

• 💚 Build #42545 succeeded 78973fb

cc @chrisberkhout