Handle extracting IP address from unnamed Data element that isn't the first child of EventData

[Aldaviva]

Event log entries have the IP address in one of the child Data elements inside the EventData element.

Currently, there are two ways to specify which Data element to search for the IP address in:

• by name, if the Data element happens to have a Name attribute, set ipAddressEventDataName to the attribute value (e.g. payload)

  <EventData>
      <Data Name="process">sshd</Data>
      <Data Name="payload">Failed password for invalid user foo bar from 192.168.1.7 port 49721 ssh2</Data>
  </EventData>

• the first one, if the Data element does not have a Name attribute

  <EventData>
      <Data>Failed password for invalid user foo bar from 192.168.1.7 port 49721 ssh2</Data>
  </EventData>

This does not handle the case where there are multiple unnamed Data elements, and the IP address is not in the first one.

<EventData>
    <Data>a</Data>
    <Data>b</Data>
    <Data>c</Data>
    <Data>1.2.3.4</Data>
</EventData>

I can think of two approaches that may help:

• if ipAddressEventDataName is empty, iterate through all child Data elements until a match is found, instead of only looking at the first one
• allow the rule to specify the index of the unnamed data element, such as 3, not just the Name attribute value