crowdstrike: migrate to combined alerts endpoint

[navnit-elastic]

Proposed commit message

crowdstrike: migrate to combined alerts endpoint

Modify the CEL program to use "/alerts/combined/alerts/v1"
API endpoint in alert data stream.
Previously, it was making two API calls, first fetch alerts IDs
and then fetch the full details of each alert.

Migrate from "timestamp" field to "updated_timestamp" field
for sorting and cursor logic.

This commit modifies the system test configuration files
to use the new API endpoint.

Update the configuration variables and README
to ensure compatibility with the new API endpoint.

The previous implementation had few issues:

1. It wasn't handling empty resources correctly in the first API call, resulted in duplicate records.
2. The logic for updating page.start was not correct, See here.

API Documentation references (You will need CrowdStrike falcon credentials to open these):

• https://assets.falcon.us-2.crowdstrike.com/support/api/swagger-us2.html#/Alerts/PostCombinedAlertsV1
• https://falcon.us-2.crowdstrike.com/documentation/page/adf2fd07/incident-detection-and-alert-monitoring-apis#fbc91340

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For Enhance CrowdStrike Integrations with Comprehensive Testing and Coverage Expansion #14135

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 98dd8b9

History

• 💚 Build #31188 succeeded 93c942b

cc @navnit-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)