[Crowdstrike Alert] adjust batch size to API limit (elastic#13862)

The CrowdStrike alert integrations uses 2 API endpoints from CrowdStrike:

* /alerts/queries/alerts/v2 → to get the composite IDs of all open alerts
  with a limit of 10000[1].
  The returned composite_ids of the first API call are then sent with a
  post again to the next endpoint:
* /alerts/entities/alerts/v2 → to get the alert details with a limit of
  1000[2], which causes the integration to get an HTTP 413 request too
  large error if there are more than 1000 composite IDs returned from the
  first endpoint.

The current default value for the batch size is 10,000, potentially resulting
in requests to the second endpoint being rejected due to too many alert IDs.

Fix this by setting the maximum and default to 1000 instead of 10000.

[1]https://www.falconpy.io/Service-Collections/Alerts.html#getqueriesalertsv2
[2]https://www.falconpy.io/Service-Collections/Alerts.html#postentitiesalertsv2

Author: SimonKoetting

packages/crowdstrike/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.65.1"
+  changes:
+    - description: Adjust alert batch size to 1000 to match the API limit.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/13862
 - version: "1.65.0"
   changes:
     - description: Remove redundant installation instructions.

packages/crowdstrike/data_stream/alert/manifest.yml

@@ -26,8 +26,8 @@ streams:
       - name: batch_size
         type: integer
         title: Batch Size
-        description: Batch size for the response of the CrowdStrike API. It must be between 1 - 10000.
-        default: 10000
+        description: Batch size for the response of the CrowdStrike API. It must be between 1 - 1000.
+        default: 1000
         multi: false
         required: true
         show_user: false

packages/crowdstrike/manifest.yml

@@ -1,6 +1,6 @@
 name: crowdstrike
 title: CrowdStrike
-version: "1.65.0"
+version: "1.65.1"
 description: Collect logs from Crowdstrike with Elastic Agent.
 type: integration
 format_version: "3.3.1"