Add module load event data

[nicholasberlin]

Change Summary

Add Linux kernel module loading events

Sample values :

  "event":{
    "action":["load_module"],
    "category":["process"],
  },

Sample document

{
  "@timestamp":"2025-11-12T17:34:01.69109Z",
  "agent":{"id":"","type":"endpoint","version":"9.3.0-SNAPSHOT"},
  "data_stream":{"dataset":"","namespace":"","type":""},
  "ecs":{"version":"8.10.0"},"elastic":{"agent":{"id":""}},
  "event":{
    "action":["load_module"],
    "category":["process"],
    "dataset":"",
    "id":"OFH30xVLkKg7iHog+++++++0",
    "kind":"event",
    "module":"endpoint",
    "outcome":"unknown",
    "sequence":355,
    "type":["start"]
  },
  "group":{
    "Ext":{
      "real":{"id":0}
    },
    "id":0
  },
  "host":{
    "id":"",
    "name":"",
    "os":{
      "type":"linux"
    }
  },
  "message":"Endpoint process event",
  "process":{
    "args":["modprobe","dummy"],
    "args_count":2,
    "command_line":"modprobe dummy",
    "executable":"/usr/bin/kmod",
    "group_leader":{
       "pid":244336
    },
    "name":"kmod",
    "parent":{
      "args":[],
      "args_count":0
    },
    "pid":244336,
    "working_directory":"/home/nberlin/git/endpoint-dev/main/Python/endpoint"
  },
  "user":{
    "Ext":{
      "real":{"id":0}
    },
    "id":0
  }
}

Release Target

9.3.0

For mapping changes:

• I ran make after making the schema changes, and committed all changes