fix: replace hyphen with empty string in event ID handling

[fukusuket]

What Changed

• Closed Remove - for integer fields #1692

Evidence

Integration-Test

• https://github.com/Yamato-Security/hayabusa/actions/runs/17780593976

I’d appreciate it if you could check it when you have time🙏

[Copilot]

Pull Request Overview

This PR fixes event ID handling by replacing hyphen fallback values with empty strings. The change ensures that when event IDs cannot be parsed or are missing, an empty string is used instead of a hyphen character.

• Replace hyphen with empty string in event ID fallback handling
• Update both event ID extraction and profile converter initialization

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[fukusuket]

./hayabusa-3.5.0-mac-aarch64 csv-timeline -d ../data/windows/hayabusa-sample-evtx-main -w -q -o timeline.csv -C -s
./hayabusa csv-timeline -d ../data/windows/hayabusa-sample-evtx-main -w -q -o timeline-new.csv -C -s
diff timeline.csv timeline-new.csv
9496c9496
< "2016-09-20 01:50:06.513 +09:00","PW Guessing","med","DESKTOP-M5SN04R","Sec",4625,"-","Count:3558 ¦ TargetUserName:Administrator ¦ TargetDomainName:. ¦ IpAddress:192.168.198.149 ¦ LogonType:3 ¦ ProcessName:- ¦ LogonProcessName:NtLmSsp","-","23179f25-6fce-4827-bae1-b219deaf563e"
---
> "2016-09-20 01:50:06.513 +09:00","PW Guessing","med","DESKTOP-M5SN04R","Sec",4625,"","Count:3558 ¦ TargetUserName:Administrator ¦ TargetDomainName:. ¦ IpAddress:192.168.198.149 ¦ LogonType:3 ¦ ProcessName:- ¦ LogonProcessName:NtLmSsp","-","23179f25-6fce-4827-bae1-b219deaf563e"
19925c19925
< "2019-05-01 04:27:02.847 +09:00","PW Spray","med","DESKTOP-JR78RLP","Sec",4648,"-","Count:41 ¦ TargetUserName:Administrator/baker/bgalbraith/bgreenwood/bhostetler/bking/cdavis/celgee/cfleener/cmoody/cragoso/cspizor/dmashburn/dpendolino/drook/ebooth/econrad/edygert/eskoudis/gsalinas/jkulikowski/jlake/jleytevidal/jorchilles/jwright/kperryman/lpesce/lschifano/mdouglas/melliott/mtoussain/psmith/rbowes/sanson/sarmstrong/smisenar/ssims/tbennett/thessman/wstrzelec/zmathis ¦ IpAddress:172.16.144.128 ¦ Computer:DESKTOP-JR78RLP","-","49d15187-4203-4e11-8acd-8736f25b6608"
---
> "2019-05-01 04:27:02.847 +09:00","PW Spray","med","DESKTOP-JR78RLP","Sec",4648,"","Count:41 ¦ TargetUserName:Administrator/baker/bgalbraith/bgreenwood/bhostetler/bking/cdavis/celgee/cfleener/cmoody/cragoso/cspizor/dmashburn/dpendolino/drook/ebooth/econrad/edygert/eskoudis/gsalinas/jkulikowski/jlake/jleytevidal/jorchilles/jwright/kperryman/lpesce/lschifano/mdouglas/melliott/mtoussain/psmith/rbowes/sanson/sarmstrong/smisenar/ssims/tbennett/thessman/wstrzelec/zmathis ¦ IpAddress:172.16.144.128 ¦ Computer:DESKTOP-JR78RLP","-","49d15187-4203-4e11-8acd-8736f25b6608"
20206c20206
< "2019-05-01 04:32:03.525 +09:00","PW Spray","med","DESKTOP-JR78RLP","Sec",4648,"-","Count:14 ¦ TargetUserName:baker/bgalbraith/bgreenwood/bking/cragoso/cspizor/dmashburn/drook/edygert/jlake/jorchilles/mdouglas/smisenar/ssims ¦ IpAddress:172.16.144.128 ¦ Computer:DESKTOP-JR78RLP","-","49d15187-4203-4e11-8acd-8736f25b6608"
---
> "2019-05-01 04:32:03.525 +09:00","PW Spray","med","DESKTOP-JR78RLP","Sec",4648,"","Count:14 ¦ TargetUserName:baker/bgalbraith/bgreenwood/bking/cragoso/cspizor/dmashburn/drook/edygert/jlake/jorchilles/mdouglas/smisenar/ssims ¦ IpAddress:172.16.144.128 ¦ Computer:DESKTOP-JR78RLP","-","49d15187-4203-4e11-8acd-8736f25b6608"

[YamatoSecurity]

@fukusuket Thanks so much!! LGTM!