SIEM Command Line Auditing 4688 - 4689

@andrewkroh For now I created https://github.com/elastic/beats/issues/14038

Once PR 13530 has been done, I'll see if I can create a PR if I find some spare time