Use process.name and event.outcome in filebeat system auth module

[jsoriano]

Before migration to ECS (#9138), we could rely on the presence of specific
fields to know the process originating the events, but this is not so reliable
after some of these fields have been moved to common places. Add
process.name also for known messages so we keep this info in a known
place.

Also use event.outcome instead of event.action for the result of the
logged action.

[jsoriano]

Not adding changelog entry as this was not released yet and there was already one for ECS migration included in #9138.

[webmat]

Good stuff! Looks a bit like work I had started here but haven't had time to get back to yet.

Notice that over in my PR, I'm doing grok twice. Once for the syslog header (instead of repeating in every single pattern) and then a second grok for the various kinds of messages. No big deal if we keep as a single grok definition, though (I suspect it's faster this way).

One thing that worries me is that in this PR we're putting the source's raw values in event.outcome, when in fact we were hoping to make this a field an enumerated field, to ensure we have a very precise list of expected keywords, with regular capitalization.

On the other hand, nobody's had time to do significant work on building these lists of expected values yet. Perhaps it's ok to keep the raw values for now, and change around to the normalized values when these are ready.

Thoughts, @ruflin, @elastic/secops ?

[jsoriano]

@webmat your PR looks much more complete 🙂 if you plan to finish it for 7.0 I am fine with closing this PR.

If not I think that we could merge this as it addresses the main issues I see (loss of process information after migration to ECS and use of event.action for a result), also it doesn't change the result regarding the raw values stored as outcome, and you could still continue improving this in your PR.

So as you prefer.

[ruflin]

I'm good with both options as long as we hit 7.0 with it :-)

[webmat]

My PR will definitely not make 7.0, it was an experiment. Please proceed with yours.