Sonicwall Global Category fixes, and add rule UUID

[ppalmieri]

se label this PR with one of the following labels, depending on the scope of your change:

• Bug
• Enhancement

Proposed commit message

Bug Fixes

This PR corrects the gcat (Global Category) mapping for Sonicwall messages, as they changed from version 6.x of SonicOS to 7.x. This documented on page 105. This also corrects a incorrect event action for log event [#]36 should be listed as packet-dropped, which is documented on page 12.

Enhancement

Added is a new ecs field called rule.uuid that adds the rule UUID when it appears in the log. This makes it alittle eaiser to identify rule hits, as the rule name (mapped to rule.id) can sometimes cover many rules, if they have the same name.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Verified that new mappings are working correctly

How to test this PR locally

Install the SonicWall integration, and configure to receive logs. After make the following changes to the logs-sonicwall-log ingest pipline.

• In the Script described as Maps SonicWall fields to ECS, Update the following mappings in the parameters section
  • Update the gcat mapping to reflect the updated categrories.
  • After the rule.id mapping, add in the mapping for rule.uuid
• In the Script described as Fills ECS categorization fields depending on message Event ID update the following:
  • In message-codes update 36 from connection-close to packet-dropped.

Related issues

N/A

Screenshots

N/A

[cla-checker-service]

💚 CLA has been signed

[ppalmieri]

I have completed the Contributor Agreement.

[elasticmachine]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[qcorporation]

You will also need to update the manifest.yml file with the new version 1.19.3