Cherry-pick #23766 to 7.x: [Filebeat] Improve ASA/FTD Ingest Pipeline

[andrewkroh]

Cherry-pick of PR #23766 to 7.x branch. Original message:

What does this PR do?

Fixes #21658

For messages 716002:

• Changed to GROK; allows for better parsing of event.reason
• Added field for cisco.webvpn.group_name
• Added field for event.reason per cisco docs for why session was terminated
• Added field for cisco.termination_user for the AAA username terminating the connection

For messages 722051:

• Add angle brackets to dissect to properly dissect the message, per cisco docs
• Added field for cisco.webvpn.group.name

For messages 305011:

• Change to GROK; allows for variance in message format with identity firewall

For messages 302020:

• Added GROK pattern to allows for variance in message format with identity firewall

For messages 302014/302016/302021:

• Added patterns and modified order of patterns of GROK to better match teardown messages
• Note that order of processing is important as the most specific messages are matched first, falling through to the appropriate match.
• Added temp fields for teardown initiator and user; defined in cisco docs but currently no real place to put them, but could be in future.
• Added icmp_type and icmp_code parsing for 302021 messages
• Changed duration matching from TIME to NOTSPACE, as long-lived connections (over 24 hours) don't match TIME.

And:

• Added descriptions to many fields to make them easier to find in 7.9+ Kibana Ingest Node Pipeline editor.
• Changed source.bytes field type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.
• Changed destination.bytes type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.

Why is it important?

Improved parsing of ASA/FTD messages mentioned above.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

cd x-pack/filebeat
PYTEST_ADDOPTS="-k cisco" TESTING_FILEBEAT_FILESETS=asa,ftd mage -v pythonIntegTest

Related issues

• Closes Filebeat Cisco module doesn't correctly parse 305011, 302015, 302013, or 722051 message types #21658

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: andrewkroh commented: run tests

• Start Time: 2021-03-25T11:32:54.615+0000

• Duration: 61 min 49 sec

• Commit: be87dc9

Test stats 🧪

Test	Results
Failed	0
Passed	13130
Skipped	2257
Total	15387

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	13130
Skipped	2257
Total	15387

[andrewkroh]

This is waiting on #24718 to be backported to 7.12 to fix the AMP tests.

[andrewkroh]

run tests