[7.12][Telemetry] Add missing fields for security telemetry

x-pack/plugins/security_solution/server/lib/telemetry/sender.ts

@@ -296,10 +296,12 @@ interface AllowlistFields {
 // Allow list for the data we include in the events. True means that it is deep-cloned
 // blindly. Object contents means that we only copy the fields that appear explicitly in
 // the sub-object.
+/* eslint-disable @typescript-eslint/naming-convention */
 const allowlistEventFields: AllowlistFields = {
   '@timestamp': true,
   agent: true,
   Endpoint: true,
+  Memory_protection: true,
   Ransomware: true,
   data_stream: true,
   ecs: true,
@@ -335,20 +337,95 @@ const allowlistEventFields: AllowlistFields = {
     pid: true,
     uptime: true,
     Ext: {
+      architecture: true,
       code_signature: true,
+      dll: true,
+      token: {
+        integrity_level_name: true,
+      },
     },
     parent: {
       name: true,
       executable: true,
       command_line: true,
       hash: true,
       Ext: {
+        architecture: true,
         code_signature: true,
+        dll: true,
+        token: {
+          integrity_level_name: true,
+        },
       },
       uptime: true,
       pid: true,
       ppid: true,
     },
+    Target: {
+      process: {
+        Ext: {
+          architecture: true,
+          code_signature: true,
+          dll: true,
+          token: {
+            integrity_level_name: true,
+          },
+        },
+        parent: {
+          process: {
+            Ext: {
+              architecture: true,
+              code_signature: true,
+              dll: true,
+              token: {
+                integrity_level_name: true,
+              },
+            },
+          },
+        },
+        thread: {
+          Ext: {
+            call_stack: true,
+            start_address: true,
+            start_address_details: {
+              address_offset: true,
+              allocation_base: true,
+              allocation_protection: true,
+              allocation_size: true,
+              allocation_type: true,
+              base_address: true,
+              bytes_start_address: true,
+              compressed_bytes: true,
+              dest_bytes: true,
+              dest_bytes_disasm: true,
+              dest_bytes_disasm_hash: true,
+              pe: {
+                Ext: {
+                  legal_copyright: true,
+                  product_version: true,
+                  code_signature: {
+                    status: true,
+                    subject_name: true,
+                    trusted: true,
+                  },
+                  company: true,
+                  description: true,
+                  file_version: true,
+                  imphash: true,
+                  original_file_name: true,
+                  product: true,
+                },
+              },
+              pe_detected: true,
+              region_protection: true,
+              region_size: true,
+              region_state: true,
+              strings: true,
+            },
+          },
+        },
+      },
+    },
     token: {
       integrity_level_name: true,
     },