crowdstrike: fix FDR deduplication for CSPM findings

[navnit-elastic]

Proposed commit message

crowdstrike: fix FDR deduplication for CSPM findings

Classify aidmaster/userinfo/data from aws.s3.object.key when log.file.path
is absent, run CSPM pipelines before fingerprinting, and include rule.id
plus resource id so distinct Cloud Security findings stay unique.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes CrowdStrike FDR: enable_deduplication fingerprint drops distinct events and fails to dedup re-ingested data (CSPM/IOA) #20064
• Closes CrowdStrike FDR: classify aidmaster/userinfo/data from aws.s3.object.key, not just log.file.path #20113

Screenshots

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: b8c8ee0

History

• 💚 Build #46537 succeeded 9e2f133

cc @navnit-elastic

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

No issues across the latest commits b8c8ee0.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.