Cherry-pick #19713 to 7.x: Add 21 autogenerated filesets from rsa2elk devices

[adriansr]

Cherry-pick of PR #19713 to 7.x branch. Original message:

What does this PR do?

This adds the following experimental filesets based on Apache 2 license device parsers:

• tomcat.log (from apachetomcat)
• netscout.sightline (from arborpeakflowsp)
• barracuda.waf (from barracudawaf)
• f5.bigipapm (from bigipapm)
• bluecoat.director (from bluecoatdirector)
• cisco.nexus (from cisconxos)
• citrix.virtualapps (from citrixxa)
• cylance.protect (from cylance)
• f5.firepass (from firepass)
• fortinet.clientendpoint (from forticlientendpoint)
• imperva.securesphere (from impervawaf)
• infoblox.nios (from infobloxnios)
• juniper.junos (from junosrouter)
• kaspersky.av (from kasperskyav)
• microsoft.dhcp (from msdhcp)
• tenable.nessus_security (from nessusvs)
• rapid7.nexpose (from nexpose)
• radware.defensepro (from radwaredp)
• sonicwall.firewall (from sonicwall)
• squid.log (from squid)
• zscaler.zia (from zscalernss)

Why is it important?

This is an effort to generate as many as possible experimental input sources from a set of 300 Apache2-licensed log parsers.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Notes to reviewers

The modules in this PR are autogenerated. All follow the same format:

sonicwall/
├── README.md
├── _meta
│   ├── config.yml
│   ├── docs.asciidoc
│   └── fields.yml
└── firewall
    ├── _meta
    │   └── fields.yml
    ├── config
    │   ├── input.yml
    │   ├── liblogparser.js
    │   └── pipeline.js
    ├── ingest
    │   └── pipeline.yml
    ├── manifest.yml
    └── test
        ├── generated.log
        └── generated.log-expected.json

The README.md, config.yml, docs.asciidoc and fields.yml are the same, basically replacing the module/vendor/product name.

Same for input.yml and manifest.yml. They define the same variables and inputs (tcp, udp and file).

The generated.log files are autogenerated by the same program that converts the original XML files to Javascript. Generating logs using parser's patterns (some with overlap) and user-defined field names is hard. Some generated logs make more sense than others.

A few selected modules contain real logs that we were able to obtain from other sources. Currently:

• squid
• zscaler

The liblogparser.js is the helper Javascript library for the parser. It's important to review this file. It's the same for all filesets.

The pipeline.js is the autogenerated pipeline. Contains all the parsers and actions defined in the source XML. We're aware that some of these parsers are outdated and some partly broken regarding extra whitespace in patterns. There will be an ongoing effort to fix them.

A couple of modules already existed:

• cisco (new fileset nexus)
• fortinet (new fileset clientendpoint)

In this case the _meta/config.yml and _meta/docs.asciidoc have been merged automatically.

---

Some parsers are currently broken (have tags: dissect_parsing_error). I'm working on fixing those.

---

The code for the generator is in https://github.com/adriansr/nwdevice2filebeat

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[adriansr]

jenkins, test this

[adriansr]

rebased