[Filebeat] add panos type and sub_type

[leehinman]

What does this PR do?

adds panw.panos.type & panw.panos.sub_type fields

Why is it important?

Original type & sub_type may be useful instead of event.category &
event.type that have ECS specified values.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=panw mage -v pythonIntegTest

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

It looks like type=3 and subtype=4 are common across all of the log types in PAN-OS. So maybe the pipeline should set them for all log types by placing this around line 38?

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #20912 updated]

• Start Time: 2020-09-15T16:06:40.820+0000

• Duration: 51 min 20 sec

Test stats 🧪

Test	Results
Failed	0
Passed	5594
Skipped	825
Total	6419

[gimmic]

Is there a reason this is destined to be panw.panos.* and not just panw.* ?

[leehinman]

Is there a reason this is destined to be panw.panos.* and not just panw.* ?

@gimmic Do you know if type & sub_type are used in every panw product? If so I'll move them.

[gimmic]

Is there a reason this is destined to be panw.panos.* and not just panw.* ?

@gimmic Do you know if type & sub_type are used in every panw product? If so I'll move them.

While it could be assumed there are non PAN-OS based palo alto logging functions, I have not been able to find any documentation on them in my searching. I think any modern palo product will fit under pan-os, and instead if it isn't pan-os that outlier could be the additional demarcated field. (and having pan-os be the default, if that makes sense?)

panw.subtype and for non-panos, it could be panw.subproduct.fields

In the end it's probably inconsequential it is just from a human-analyst standpoint I get leery about unnecessary nesting in field names just from a memorization/typing standpoint.

[andrewkroh]

LGTM

[jenback]

Hi,
i'm not sure if that comment is correct under this topic.
We already use the latest Pipeline from here: https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml and we saw, that the
event.kind-Field ist not always correct.
In PanOS the URL-Events are THREAT-Events too, so all URL-Events are also THREAT-Events.
I think the line 233 ( if: 'ctx?.panw?.panos?.type == "THREAT"' ) should be:
if: 'ctx?.panw?.panos?.type == "THREAT"' && ctx?.panw?.panos?.threat?.id != '9999'

Kind Regards
Jens Backs