[8.11] Add process.Ext.services field to telemetry allowlist (#168147) (

#168279)

# Backport

This will backport the following commits from `main` to `8.11`:
- [Add process.Ext.services field to telemetry allowlist
(#168147)](#168147)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Mark
Mager","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-10-06T17:21:25Z","message":"Add
process.Ext.services field to telemetry allowlist (#168147)\n\n##
Summary\r\n\r\nAdding `process.Ext.services` to the endpoint telemetry
allowlist. The\r\nEndpoint Protections team would like to have
visibility of this field in\r\norder to write more accurate
exceptionlist entries.\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [ ] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"87b4a6546fc4f18a38387316fe8d4b8650caf6d1","branchLabelMapping":{"^v8.12.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Feature:Telemetry","release_note:skip","Team:
SecuritySolution","v8.6.3","v8.11.0","v8.12.0"],"number":168147,"url":"https://github.com/elastic/kibana/pull/168147","mergeCommit":{"message":"Add
process.Ext.services field to telemetry allowlist (#168147)\n\n##
Summary\r\n\r\nAdding `process.Ext.services` to the endpoint telemetry
allowlist. The\r\nEndpoint Protections team would like to have
visibility of this field in\r\norder to write more accurate
exceptionlist entries.\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [ ] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"87b4a6546fc4f18a38387316fe8d4b8650caf6d1"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.11"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.3","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.11","label":"v8.11.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.12.0","labelRegex":"^v8.12.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/168147","number":168147,"mergeCommit":{"message":"Add
process.Ext.services field to telemetry allowlist (#168147)\n\n##
Summary\r\n\r\nAdding `process.Ext.services` to the endpoint telemetry
allowlist. The\r\nEndpoint Protections team would like to have
visibility of this field in\r\norder to write more accurate
exceptionlist entries.\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [ ] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"87b4a6546fc4f18a38387316fe8d4b8650caf6d1"}}]}]
BACKPORT-->

Co-authored-by: Mark Mager <[email protected]>

x-pack/plugins/security_solution/server/lib/telemetry/filterlists/endpoint_alerts.ts

@@ -29,6 +29,7 @@ const baseAllowlistFields: AllowlistFields = {
     malware_signature: true,
     memory_region: true,
     protection: true,
+    services: true,
     session_info: true,
     real: {
       entity_id: true,

x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts

@@ -187,6 +187,7 @@ describe('TelemetryEventsSender', () => {
             env_vars: [{ name: 'foo', value: 'bar' }],
             Ext: {
               protection: 'PsProtectedSignerAntimalware-Light',
+              services: ['SepScanService'],
               relative_file_creation_time: 48628704.4029488,
               relative_file_name_modify_time: 48628704.4029488,
               device: {
@@ -384,6 +385,7 @@ describe('TelemetryEventsSender', () => {
             env_vars: [{ name: 'foo', value: 'bar' }],
             Ext: {
               protection: 'PsProtectedSignerAntimalware-Light',
+              services: ['SepScanService'],
               relative_file_creation_time: 48628704.4029488,
               relative_file_name_modify_time: 48628704.4029488,
               device: {