[Crowdstrike] Populate message field from crowdstrike.event_simpleName field for FDR data stream

[moxarth-rathod]

Proposed commit message

crowdstrike: populate a mapping of ECS 'message' field from 'crowdstrike.event_simpleName' field 
for FDR data stream.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/crowdstrike directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [Crowdstrike] Parse and Populate ECS message Field with Alert Title Crowdstrike FDR #14673

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 2ae85a1

cc @moxarth-rathod

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

LGTM. Couple of things I would like to have added:

1. Update system tests raw data with missing event_simpleName, so that message gets populated in sample_event.json.
2. Add screenshot to the PR similar to the one shown in the issue to satisfy the success criteria: The "External Alerts" rule correctly reflects the alert title from Crowdstrike instead of the generic "External Alerts" label.