[Filebeat] Threat Intel Module - Adjust Anomali Fields

[peasead]

Describe the enhancement:

The Anomali dataset has fields that I think should be adjusted.

1. Move threatintel.anomali.labels to tags

  "anomali": {
...
        "labels": [
          "anomalous-activity",
          "threatstream-severity-low",
          "threatstream-confidence-100"
        ]
...
}

Possibly add in x-pack/filebeat/module/threatintel/anomali/ingest/pipeline.yml?

- rename:
    field: labels
    target_field: tags
    ignore_missing: true

2. Move threatintel.anomali.description.source to threatintel.indicator.provider

  "anomali": {
...
    "description": "TS ID: 56790822922; iType: bot_ip; State: active; 
     Org: Tencent Cloud Computing (Beijing) Co.; Source: Emerging Threats - Compromised",
...
}

So threatintel.indicator.provider:Emerging Threats - Compromised

Describe a specific use case for the enhancement or feature:
This would populate the tags field from this dataset the same way the MISP dataset is populated and also to populate the threatintel.indicator.provider field like the Abuse URL data is.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[legoguy1000]

I can implement this if it's wanted.

[peasead]

Yeah, I think any help would be appreciated.

@P1llus may have some unchecked-in code though, so I'll let him make the call.

[P1llus]

Feel free @legoguy1000 :)

[legoguy1000]

PR Ready