Cherry-pick #16889 to 7.x: [Filebeat] Cisco FTD issues parsing Security Event messages

[andrewstucki]

Cherry-pick of PR #16889 to 7.x branch. Original message:

You'll want to take a look at this pr with ?w=1 since there was a lot of formatting changes for the pipeline.

What does this PR do?

Fixes a few bugs with the shared cisco parsing pipeline that was causing some fields to be dropped/misinterpreted

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works

Related issues

• Closes Cisco FTD issues parsing Security Event messages #16863

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[adriansr]

I've realized we forgot to add a CHANGELOG entry for this fix. I suggest you add it to the backport PRs and then open a separate PR to fix master.

[jsoriano]

Should this have had a changelog entry?

[jsoriano]

I've realized we forgot to add a CHANGELOG entry for this fix. I suggest you add it to the backport PRs and then open a separate PR to fix master.

Oh sorry, I missed this comment 😅

Waiting for changelog in backports as suggested by Adrian

Forgot about changelog