ti_threatconnect: update pipeline to lowercase all hashes

[GShepherdTC]

Proposed commit message

Updated pipeline to lowercase all hashes

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Check code changes. Should be pretty straight forward.

How to test this PR locally

Run the pipeline test. I updated the response data to match.

Related issues

• Relates: Recommend lowercase format for hash values in schema guidance ecs#2586

Screenshots

No changes to UI.

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[efd6]

Suggested commit message:

ti_threatconnect: lowercase all hash values in indicator processing

Hash values should be normalized to lowercase for consistent matching
and deduplication across threat intelligence sources.

though this probably needs expansion. I think we want to know what visualisation and saved search impacts this will have.

[andrewkroh]

I opened a ECS issue to advise using lowercase for the hashes.

While reviewing I noticed that ECS threat.indicator.file.size and threat.indicator.geo.location were present in the TC data but completely missing from the ECS mapping. Can you please map those as well to improve ECS coverage?

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)