#8474 added host enrichment to the Crowdstrike FDR integration. Repeat that with user information. This makes use of the userinfo folder from FDR. The join key looks to be "UserName" or "UserSid"/"UserSid_readable", although this is not documented.