[filebeat] panw.panos indexing denied twice in event.type

[willemdh]

panw.panos dataset's event.type field is populated with the value 'denied' twice.

Elastic 7.9.2

https://discuss.elastic.co/t/siem-rule-override-not-working-as-expected/253933/4

In /usr/share/filebeat/module/panw/panos/ingest/pipeline.yml I can find:

 - append:
     field: event.type
     value:
       - denied
       - connection
     if: 'ctx?._temp_?.message_subtype == "deny"'

 - append:
     field: event.type
     value: denied
     if: "ctx?.panw?.panos?.action != null && ['deny', 'drop', 'reset-client', 'reset-server', 'reset-both', 'block-url', 'block-ip', 'random-drop', 'sinkhole', 'block'].contains(ctx.panw.panos.action)"

So my guess is that the first block should possibly be removed? And the second block should maybe add connection too?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[legoguy1000]

This should be an easy fix