M365 Defender integration - fix on process.command_line

[daverick]

process.command_line was overwritten by process.parent.command_line due to a typo in the script parsing the parent.command line

Proposed commit message

fix process.command_line overwritten by process.parent.command_line

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[kcreddy]

Can you add an entry into changelog.yml like this: https://github.com/elastic/integrations/blob/main/packages/m365_defender/changelog.yml#L12-L16. Since this is a bugfix, the version here would be 2.5.1

Can you also update manifest.yml here with version 2.5.1?

[daverick]

@kcreddy done.
I have update the tests too. I don't have a way to really test these changes are corrects ;-(

[kcreddy]

/test

[kcreddy]

I don't have a way to really test these changes are corrects ;-(

After the change to the painless script, your change is valid according to this block of code:

integrations/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log-expected.json

Lines 988 to 1013 in cc9a87e

	"process": {
	"args": [
	"smartscreen.exe",
	"-Embedding"
	],
	"args_count": 2,
	"command_line": "smartscreen.exe -Embedding",
	"executable": "C:\\Windows\\System32\\smartscreen.exe",
	"hash": {
	"md5": "b9d697df9e883f0d99720b0430448cb1",
	"sha1": "9dec87de894f5228033f87cf874441502bfa4f97",
	"sha256": "8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781"
	},
	"name": "smartscreen.exe",
	"parent": {
	"args": [
	"svchost.exe",
	"-k",
	"DcomLaunch",
	"-p"
	],
	"args_count": 4,
	"code_signature": {
	"status": "Valid"
	},
	"command_line": "svchost.exe -k DcomLaunch -p",

[elasticmachine]

🚀 Benchmarks report

Package m365_defender 👍(2) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
event	723.07	578.03	-145.04 (-20.06%)	💔

To see the full report comment with /test benchmark fullreport

[kcreddy]

LGTM 👍🏼

[elasticmachine]

Package m365_defender - 2.5.1 containing this change is available at https://epr.elastic.co/search?package=m365_defender