[Filebeat] Update Threatinteal Anomali pipeline

[legoguy1000]

What does this PR do?

Populates the tags field the same way the MISP dataset is populated and populates the threatintel.indicator.provider field like the Abuse URL dataset.

Why is it important?

Standardizes the Threat Intel datasets

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

cd beats/x-pack/filebeat
TESTING_FILEBEAT_MODULES=threatintel TESTING_FILEBEAT_FILESETS=anomali mage -v pythonIntegTest

Related issues

• Closes [Filebeat] Threat Intel Module - Adjust Anomali Fields #24746

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-08-06T11:43:09.405+0000

• Duration: 86 min 1 sec

• Commit: 141ac7b

Test stats 🧪

Test	Results
Failed	0
Passed	7908
Skipped	1201
Total	9109

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	7908
Skipped	1201
Total	9109

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 24746-anomili-fields upstream/24746-anomili-fields
git merge upstream/master
git push upstream 24746-anomili-fields

[marc-gr]

/test