Sysmon v10.0 added OriginalFileName to process create and load image events. And ECS 1.5 added pe.original_file_name. Winlogbeat's Sysmon module should be updated to populate this field.

• https://github.com/elastic/ecs/blob/1.5/code/go/ecs/pe.go#L25-
• https://github.com/Neo23x0/sysmon-version-history#v100