x-pack/winlogbeat: add parent process ID to new process creation events

[efd6]

What does this PR do?

Add parent process ID to new process creation events.

Why is it important?

Parent process ID is important information for security/threat detection.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes #Winlogbeat NewProcessFields Function Missing Parent Process #29237.

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-04-06T02:08:44.033+0000

• Duration: 38 min 59 sec

Test stats 🧪

Test	Results
Failed	0
Passed	12
Skipped	0
Total	12

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

@Mergifyio update

[mergify]

update

✅ Branch has been successfully updated

[andrewkroh]

Is this a sync of the pipeline from elastic/integrations#2966? Given this is without tests for the moment I wanted to make sure this is the same such that we know it was tested.

[efd6]

Yes, this is the sync. I'll also do the change mentioned here for this, but it's not without tests. There is a 4688 evtx that is ingested and tested.

[andrewkroh]

but it's not without tests.

What's running that test (if you didn't update that golden file what would fail)? I thought these were without tests due to #30406.

[efd6]

No, you are right. I have copied over the expectation from the integrations package, so when there are test this will be checked. Apologies.