[Auditbeat] auditd network.direction should use inbound/outbound

[andrewkroh]

As per ECS the network.direction values should be inbound or outbound or unknown.

https://github.com/elastic/ecs/blob/v1.0.1/schemas/network.yml#L88-L92

But the auditd modules uses incoming and outgoing for audit events that include a socket message.

beats/vendor/github.com/elastic/go-libaudit/aucoalesce/coalesce.go

Lines 112 to 120 in 6c55de4

	func (d Direction) String() string {
	switch d {
	case IncomingDir:
	return "incoming"
	case OutgoingDir:
	return "outgoing"
	}
	return "unknown"
	}

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[leehinman]

elastic/go-libaudit#76