[CiscoIOS] Restore system Message handling for Cisco IOS

[gogochan]

Proposed commit message

https://github.com/elastic/sdh-beats/issues/4823

The changes introduced in #9102 caused Cisco IOS integration not to handle system messages anymore. This PR fixes it.

‼️ The payload generated in the previous branch derived event.timezone from syslog timestamp, which I don't think is accurate representation. But customer may find it annoying.

Before

+ "cisco": { + "ios": { + "facility": "ILPOWER" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "IEEE_DISCONNECT", + "original": "<189>Jun 12 18:10:50 10.53.35.85 %ILPOWER-5-IEEE_DISCONNECT: Interface Gi1/0/20: PD removed", + "provider": "firewall", + "severity": 5, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "notification", + "syslog": { + "priority": 189 + } + }, + "message": "Interface Gi1/0/20: PD removed", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] 

After

+ "cisco": { + "ios": { + "facility": "ILPOWER" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "IEEE_DISCONNECT", + "original": "<189>Jun 12 18:10:50 10.53.35.85 %ILPOWER-5-IEEE_DISCONNECT: Interface Gi1/0/20: PD removed", + "provider": "firewall", + "severity": 5, + "type": [ + "info" + ] + }, + "log": { + "level": "notification", + "syslog": { + "priority": 189 + } + }, + "message": "Interface Gi1/0/20: PD removed", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] } 

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a3029ff

History

• 💚 Build #12533 succeeded 6e83d4b
• 💚 Build #12532 succeeded a3bd140

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[taylor-swanson]

LGTM

[elasticmachine]

Package cisco_ios - 1.26.10 containing this change is available at https://epr.elastic.co/search?package=cisco_ios