[Filebeat] Use ingress/egress for crowdstrike and auditd modules

[andrewstucki]

What does this PR do?

This changes the crowdstrike module to use ingress/egress and adds a bit of functionality into the auditd module to set network.direction by syscall. Since they're both modeling host-oriented data, updated both of them to use ingress/egress.

Interestingly enough, I took a look at some of the pipeline and there are a bunch of cases where we have conditionals that try and categorize syscalls by name, but we don't have any name resolution in the pipeline, so I don't think that they actually work normally. I can create an issue to add resolution based off of the syscall number.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #23041 updated

• Start Time: 2020-12-09T22:21:05.467+0000

• Duration: 53 min 1 sec

Test stats 🧪

Test	Results
Failed	0
Passed	5095
Skipped	570
Total	5665

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	5095
Skipped	570
Total	5665