Keylogging (Win32k ETW) API Event (production) (rename some fields)

[AsuNa-jp]

Change Summary

This PR renames the following ECS fileds at custom_api.yml and its sample_event.json

• metadata.module_name to metadata.start_address_module
• metadata.allocation_protection to metadata.start_address_allocation_protection

Sample values

Sample values/document are written in the previous PR.

Release Target

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

For Transform changes:

• The new transform successfully starts in Kibana
• The corresponding transform destination schema was updated if necessary

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-12-01T10:13:29.174+0000

• Duration: 7 min 5 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[ashokaditya]

Thanks for making a quick fix!

[elasticmachine]

Package endpoint - 8.12.0 containing this change is available at https://epr.elastic.co/search?package=endpoint