juniper_srx: improve {IKE,IPSec} negotiation log coverage

[efd6]

The Juniper SRX integrations fails to correctly parse/enrich the following syslog lines:

<27>1 2023-07-04T12:22:36.461+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW, Local: 10.11.22.444/500, Remote: 198.1.124.8/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator
<30>1 2023-07-04T10:21:11.590+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation successfully completed. IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder
<27>1 2023-07-04T11:48:31.702+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IPSec negotiation failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6

The resulting documents (returned by pipeline tests) are below.

These events should be handled by the system pipeline, but the grok patterns in the pipeline do not match them.

{
    "expected": [
        {
            "@timestamp": "2023-07-04T02:22:36.461Z",
            "ecs": {
                "version": "8.8.0"
            },
            "event": {
                "category": [
                    "network"
                ],
                "kind": "event",
                "original": "\u003c27\u003e1 2023-07-04T12:22:36.461+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW, Local: 10.11.22.444/500, Remote: 198.1.124.8/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator",
                "severity": 27
            },
            "juniper": {
                "srx": {
                    "log_type": "system",
                    "process": "kmd",
                    "tag": "Role"
                }
            },
            "log": {
                "level": "error"
            },
            "observer": {
                "name": "AC004-PR-VPN01-DMZ",
                "product": "SRX",
                "type": "firewall",
                "vendor": "Juniper"
            },
            "process": {
                "name": "kmd",
                "pid": 9812
            },
            "tags": [
                "preserve_original_event"
            ]
        },
        {
            "@timestamp": "2023-07-04T00:21:11.590Z",
            "ecs": {
                "version": "8.8.0"
            },
            "event": {
                "category": [
                    "network"
                ],
                "kind": "event",
                "original": "\u003c30\u003e1 2023-07-04T10:21:11.590+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation successfully completed. IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder",
                "severity": 30
            },
            "juniper": {
                "srx": {
                    "log_type": "system",
                    "process": "kmd"
                }
            },
            "log": {
                "level": "informational"
            },
            "message": "- - IKE negotiation successfully completed. IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder",
            "observer": {
                "name": "AC004-PR-VPN01-DMZ",
                "product": "SRX",
                "type": "firewall",
                "vendor": "Juniper"
            },
            "process": {
                "name": "kmd",
                "pid": 9812
            },
            "tags": [
                "preserve_original_event"
            ]
        },
        {
            "@timestamp": "2023-07-04T01:48:31.702Z",
            "ecs": {
                "version": "8.8.0"
            },
            "event": {
                "category": [
                    "network"
                ],
                "kind": "event",
                "original": "\u003c27\u003e1 2023-07-04T11:48:31.702+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IPSec negotiation failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6",
                "severity": 27
            },
            "juniper": {
                "srx": {
                    "log_type": "system",
                    "process": "kmd"
                }
            },
            "log": {
                "level": "error"
            },
            "message": "- - IPSec negotiation failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6",
            "observer": {
                "name": "AC004-PR-VPN01-DMZ",
                "product": "SRX",
                "type": "firewall",
                "vendor": "Juniper"
            },
            "process": {
                "name": "kmd",
                "pid": 9812
            },
            "tags": [
                "preserve_original_event"
            ]
        }
    ]
}

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[P1llus]

Seems like I created a duplicate of this, however I did add fair amount of new info and tasks on how to resolve it, will keep that one open for now: #6963