[Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones

[andrewstucki]

What does this PR do?

This adopts the same logic as #22998 by classifying internal/external/inbound/outbound traffic based off of zones. The implementation is similar to #23066 in that the zone-based classification is off by default, since the cisco logs already classify inbound/outbound for you.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #23068 updated

• Start Time: 2020-12-10T20:28:27.978+0000

• Duration: 56 min 53 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2422
Skipped	261
Total	2683

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	2422
Skipped	261
Total	2683

[andrewstucki]

Since there's no way of overriding the config on a per golden file basis. Here's a diff to demonstrate this working:

With the following configuration change

diff --git a/x-pack/filebeat/module/cisco/ftd/manifest.yml b/x-pack/filebeat/module/cisco/ftd/manifest.yml
index 31eb9659a..6c07bdf33 100644
--- a/x-pack/filebeat/module/cisco/ftd/manifest.yml
+++ b/x-pack/filebeat/module/cisco/ftd/manifest.yml
@@ -25,7 +25,9 @@ var:
   - name: internal_PREFIX
     default: FTD
   - name: external_zones
+    default: [ "output-zone" ]
   - name: internal_zones
+    default: [ "input-zone" ]

 ingest_pipeline: ../shared/ingest/asa-ftd-pipeline.yml
 input: config/input.yml

We see the following change:

diff --git a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json
index 093665fca..b6a5aa94f 100644
--- a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json
+++ b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json
@@ -74,6 +74,7 @@
         "log.level": "alert",
         "log.offset": 0,
         "network.application": "dns client",
+        "network.direction": "outbound",
         "network.iana_number": 17,
         "network.protocol": "dns",
         "network.transport": "udp",