[Draft] Network Firewall OCSF Compatibility Update

[adplotzk]

Proposal for an updated Security Incidents event class using the new Finding Info object
It includes the following:
Security Incident (Create, Update, Close)
The Security Incident event class has the following goals:

Updates to endpoint object

1. add natip to src_endpoint/dst_endpoint
2. add natport to src_endpoint/dst_endpoint
3. add device to src_endpoint/dst_endpoint

Updates to traffic object

1. add chunks to traffic object
2. add chunks_out to traffic object
3. add chunks_in to traffic object

Updates to connection_info object

1. add process to connection_info
2. add nssai_type to connection_info
3. add nssai differentiator to connection_info

Create new object within connection_info object

5. create new object connection_info.{tunnel_information.uid}
6. create new object connection_info.{tunnel_information.type}

Updates to session object

1. add count to session
2. add end_reason to session

Updates to firewall_rule object

1. add wan_policy_name to firewall_rule
2. add wan_cluster_name to firewall_rule
3. add wan_device_type to firewall_rule
4. add wan_cluster_type to firewall_rule
5. add wan_site to firewall_rule