Move Thumbprint enrichment to production

[soolidsnake]

Change Summary

Added thumbprint_sha256 field to the following, the enrichement feature is moving to production, this are some fields missing that are currently generating schemas violation in EAF of some tests.

• *.thread.Ext.call_stack_final_hook_module.code_signature
• *.thread.Ext.call_stack_final_user_module.code_signature
• threat.*.code_signature.thumbprint_sha256
• Target.*.code_signature.thumbprint_sha256
• process.Ext.dll.*.code_signature.thumbprint_sha256
• enrichments.indicator.file.code_signature.thumbprint_sha256
• enrichments.indicator.file.Ext.code_signature.thumbprint_sha256
• indicator.file.Ext.code_signature.thumbprint_sha256
• indicator.filecode_signature.thumbprint_sha256

Sample values

Sample document:

"call_stack_final_user_module": {
    "path": "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll",
    "code_signature": [
        {
            "thumbprint_sha256": "e4ab39116a7dc57d073164eb1c840b1fb8334a8c920b92efafea19112dce643b",
            "trusted": true,
            "subject_name": "Microsoft Corporation",
            "exists": true,
            "status": "trusted"
        }
    ],

"call_stack_final_hook_module": {
    "path": "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll",
    "code_signature": [
        {
            "thumbprint_sha256": "e4ab39116a7dc57d073164eb1c840b1fb8334a8c920b92efafea19112dce643b",
            "trusted": true,
            "subject_name": "Microsoft Corporation",
            "exists": true,
            "status": "trusted"
        }
    ],

Release Target

9.3

For mapping changes:

• I ran make after making the schema changes, and committed all changes

[pzl]

discussed elsewhere, but adding here:

CI should be unblocked once #707 merges

[soolidsnake]

discussed elsewhere, but adding here:

CI should be unblocked once #707 merges

thanks @pzl , it is fixed now

[pzl]

looks good, thank you for adding this to all the sample_event.json files!