Filebeat module RabbitMQ - add ECS authentication fields for SIEM

[leweafan]

Describe the enhancement:

RabbitMQ log has authentication messages for successful and failed attempt. But ECS fields important for SIEM like
event.category, event.type, event.action, event.outcome and user.name are missing.

Describe a specific use case for the enhancement or feature:

2021-11-22 17:48:20.003114+03:00 [info] <0.1345.0> connection <0.1345.0> (127.0.0.1:64875 -> 127.0.0.1:5672): user 'guest' authenticated and granted access to vhost '/'
2021-11-22 17:48:20.003114+03:00 [warning] <0.8084.263> HTTP access denied: user 'guest' - Not monitor user

Successful authentication message should have fields:

• event.category = "authentication"
• event.type = "logged-in"
• event.action = "start"
• event.outcome = "success"
• user.name = "guest"

Failed authentication message should have fields:

• event.category = "authentication"
• event.type = "logon-failed"
• event.action = "start"
• event.outcome = "failure"
• user.name = "guest"

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

This should be Integrations rather than SEI, but I had a change before I read the code owners to find that out.

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)