Add missing custom documentation fields to logoff security events (#645)

* update custom documentation

* add generated file

Author: AsuNa-jp

custom_documentation/doc/endpoint/security/windows/windows_security_log_off.md

@@ -51,13 +51,19 @@ This event is generated when a user logs off of the computer.
 | process.Ext.code_signature.status |
 | process.Ext.code_signature.subject_name |
 | process.Ext.code_signature.trusted |
+| process.Ext.protection |
 | process.Ext.session_info.logon_type |
+| process.Ext.token.integrity_level_name |
 | process.code_signature.exists |
 | process.code_signature.status |
 | process.code_signature.subject_name |
 | process.code_signature.trusted |
+| process.command_line |
 | process.entity_id |
 | process.executable |
+| process.name |
+| process.parent.executable |
+| process.pid |
 | user.domain |
 | user.effective.domain |
 | user.effective.email |

custom_documentation/src/endpoint/data_stream/security/windows/windows_security_log_off.yaml

@@ -55,13 +55,19 @@ fields:
   - process.Ext.code_signature.status
   - process.Ext.code_signature.subject_name
   - process.Ext.code_signature.trusted
+  - process.Ext.protection
   - process.Ext.session_info.logon_type
+  - process.Ext.token.integrity_level_name
   - process.code_signature.exists
   - process.code_signature.status
   - process.code_signature.subject_name
   - process.code_signature.trusted
+  - process.command_line
   - process.entity_id
   - process.executable
+  - process.name
+  - process.parent.executable
+  - process.pid
   - user.domain
   - user.effective.domain
   - user.effective.email