Add system test for CrowdStrike Falcon

[andrewkroh]

What does this PR do?

Add a system test for CrowdStrike Falcon and fix the issues it detected.
These were the errors initially detected.

crowdstrike/falcon :
[0] field "crowdstrike.event.PatternDispositionFlags.Detect" is undefined
[1] field "crowdstrike.event.PatternDispositionFlags.InddetMask" is undefined
[2] field "crowdstrike.event.PatternDispositionFlags.Indicator" is undefined
[3] field "crowdstrike.event.PatternDispositionFlags.KillParent" is undefined
[4] field "crowdstrike.event.PatternDispositionFlags.KillProcess" is undefined
[5] field "crowdstrike.event.PatternDispositionFlags.KillSubProcess" is undefined
[6] field "crowdstrike.event.PatternDispositionFlags.OperationBlocked" is undefined
[7] field "crowdstrike.event.PatternDispositionFlags.PolicyDisabled" is undefined
[8] field "crowdstrike.event.PatternDispositionFlags.ProcessBlocked" is undefined
[9] field "crowdstrike.event.PatternDispositionFlags.QuarantineFile" is undefined
[10] field "crowdstrike.event.PatternDispositionFlags.QuarantineMachine" is undefined
[11] field "crowdstrike.event.PatternDispositionFlags.Rooting" is undefined
[12] field "crowdstrike.event.PatternDispositionFlags.SensorOnly" is undefined
[13] parsing field value failed: field "crowdstrike.event.LocalPort"''s Go type, string, does not match the expected field type: long
[14] parsing field value failed: field "crowdstrike.event.PID"''s Go type, string, does not match the expected field type: long
[15] parsing field value failed: field "crowdstrike.event.ProcessEndTime"''s Go type, float64, does not match the expected field type: date
[16] parsing field value failed: field "crowdstrike.event.RemotePort"''s Go type, string, does not match the expected field type: long
[17] parsing field value failed: field "destination.port"''s Go type, string, does not match the expected field type: long
[18] parsing field value failed: field "process.pid"''s Go type, string, does not match the expected field type: long
[19] parsing field value failed: field "source.port"''s Go type, string, does not match the expected field type: long

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all datasets collect metrics or logs.

How to test this PR locally

elastic-package stack up -d
$(elastic-package stack shellinit)
cd crowdstrike/data_stream/falcon
elastic-package test system -v

Related issues

• Relates Add automated tests for security packages #377

[andrewkroh]

The pipeline needs updated to correct the JSON data types to match the mapping.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Branch indexing

• Start Time: 2020-12-08T22:28:41.977+0000

• Duration: 18 min 3 sec

Test stats 🧪

Test	Results
Failed	0
Passed	73
Skipped	0
Total	73

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[leehinman]

run tests