[BugFix] Remove script_block_signature - Performance Problems

[w0rk3r]

Proposed commit message

Remove the `script_block_signature` field to improve pipeline performance.

Summary

It seems that the gsub processor I added in #15834 to handle the way PowerShell scripts contain the signature is too expensive and it is causing performance problems.

As I mentioned in #15834, the field was not being populated in my cluster and detection rules telemetry, and will not be populated in most PowerShell scripts as it ends up being split in two different events, so I propose to remove it to solve the problem.

Another point is that most PowerShell scripts with signatures end up having them truncated, since PowerShell logs have size limits, the signature often gets split across two events (Example).

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 661ccc8

History

• 💔 Build #33864 failed 465e2a6

cc @w0rk3r