Fix Kerberos ticket StatusDescription case-sensitivity in Security pipelines

packages/system/changelog.yml

@@ -1,4 +1,9 @@
 # later versions go on top
+- version: "2.20.1"
+  changes:
+    - description: Fix Kerberos ticket StatusDescription not being populated when winlog.event_data.Status arrives in lower case in the Security event log ingest pipeline.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/19919
 - version: "2.20.0"
   changes:
     - description: Populate event.action and event.type for PAM authentication failure events across all modules.

packages/system/data_stream/security/elasticsearch/ingest_pipeline/standard.yml

@@ -1381,7 +1381,7 @@ processors:
             !["4768", "4769", "4770", "4771", "4793"].contains(ctx.event.code)) {
           return;
         }
-        ctx.winlog.event_data.put("StatusDescription", params[ctx.winlog.event_data.Status]);
+        ctx.winlog.event_data.put("StatusDescription", params[ctx.winlog.event_data.Status.toUpperCase()]);
   - date:
       field: winlog.event_data.ClientCreationTime
       tag: date_clientcreationtime

packages/system/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: system
 title: System
-version: "2.20.0"
+version: "2.20.1"
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration
 categories:

packages/windows/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.8.4"
+  changes:
+    - description: Fix Kerberos ticket StatusDescription not being populated when winlog.event_data.Status arrives in lower case in the forwarded Security event log ingest pipeline.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/19919
 - version: "3.8.3"
   changes:
     - description: Map Sysmon event 26 file delete hashes to `file.hash` instead of `process.hash`.

packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/security_standard.yml

@@ -1092,7 +1092,7 @@ processors:
             !["4768", "4769", "4770", "4771"].contains(ctx.event.code)) {
           return;
         }
-        ctx.winlog.event_data.put("StatusDescription", params[ctx.winlog.event_data.Status]);
+        ctx.winlog.event_data.put("StatusDescription", params[ctx.winlog.event_data.Status.toUpperCase()]);
   - script:
       lang: painless
       ignore_failure: false

packages/windows/manifest.yml

@@ -1,6 +1,6 @@
 name: windows
 title: Windows
-version: 3.8.3
+version: 3.8.4
 description: Collect logs and metrics from Windows OS and services with Elastic Agent.
 type: integration
 categories: