[crowdstrike] Declare ANODE anomaly numeric leaves as float (falcon, fdr, alert)

[vatsaldesai93]

Proposed commit message

CrowdStrike's ANODE anomaly indicators include numeric values that are usually decimals but occasionally whole numbers. These fields aren't declared in the package, so each index infers their type from the first document it sees — an index that happens to see a whole number first maps the field as `long`, and every later decimal is then rejected to the failure store.

This declares those numeric leaves as `float` in the `falcon`, `fdr`, and `alert` data streams, so the type no longer
depends on ingest order. `float` is also what dynamic mapping already picks for a decimal, so existing indices stay
compatible — whole numbers simply coerce into it.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices (no dashboard changes).

How to test this PR locally

The managed data stream runs with index.mapping.coerce: false, so a decimal can't be squeezed into a long field —
it's rejected outright:

PUT anode-demo
{ "settings": { "index.mapping.coerce": false } }

PUT anode-demo/_doc/1
{ "crowdstrike": { "event": { "AnodeIndicators": [ { "Score": 10 } ] } } }

PUT anode-demo/_doc/2
{ "crowdstrike": { "event": { "AnodeIndicators": [ { "Score": 10.5 } ] } } }

The first document locks the field to long; the second is rejected. With the float declaration both index cleanly.
Then run elastic-package build and elastic-package test pipeline -C packages/crowdstrike.

Related issues

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

No issues across the latest commits 4539222.

Since this is a community PR, a new commit triggers another review — at most once every 30 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[efd6]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

Please add/modify system test events to test this.

[vatsaldesai93]

@efd6 added test events that exercise the new float leaves

[vera-review-bot]

⚠️ @vatsaldesai93 I couldn't complete the review for commits 7bd7353…ae9b5b5 (7 commits) after several attempts. A maintainer can re-run it with @vera-review-bot review.

[efd6]

/test

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: ae9b5b5

History

• 💚 Build #46570 succeeded 4539222

[efd6]

Thanks

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package crowdstrike - 4.4.1 containing this change is available at https://epr.elastic.co/package/crowdstrike/4.4.1/