[PANW] Split field panw.panos.url_category_list in threat logs

[kcreddy]

What does this PR do?

This PR splits panw.panos.url_category_list field which contains comma-separated list of values.
Example:
panw.panos.url_category_list: " ADFS Servers,computer-and-internet-info,low-risk"

This PR adds a trim and a split processor on field panw.panos.url_category_list

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

$ elastic-package stack down && elastic-package build && elastic-package stack up --version=8.8.0 -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test pipeline --generate 2023/06/09 10:06:00 INFO New version is available - v0.81.0. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.81.0 Detected shell: bash 2023/06/09 10:06:01 INFO New version is available - v0.81.0. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.81.0 Run pipeline tests for the package --- Test results for package: panw - START --- ╭─────────┬─────────────┬───────────┬──────────────────────────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────┼─────────────┼───────────┼──────────────────────────────────────────────┼────────┼──────────────┤ │ panw │ panos │ pipeline │ test-panw-panos-authentication-sample.log │ PASS │ 3.269666ms │ │ panw │ panos │ pipeline │ test-panw-panos-config-sample.log │ PASS │ 2.8135ms │ │ panw │ panos │ pipeline │ test-panw-panos-correlated-events-sample.log │ PASS │ 2.265875ms │ │ panw │ panos │ pipeline │ test-panw-panos-decryption-sample.log │ PASS │ 3.855666ms │ │ panw │ panos │ pipeline │ test-panw-panos-globalprotect-sample.log │ PASS │ 8.091167ms │ │ panw │ panos │ pipeline │ test-panw-panos-gtp-sample.log │ PASS │ 3.464583ms │ │ panw │ panos │ pipeline │ test-panw-panos-hipmatch-sample.log │ PASS │ 3.495167ms │ │ panw │ panos │ pipeline │ test-panw-panos-inc-other-sample.log │ PASS │ 8.501792ms │ │ panw │ panos │ pipeline │ test-panw-panos-inc-threat-sample.log │ PASS │ 49.745625ms │ │ panw │ panos │ pipeline │ test-panw-panos-inc-traffic-sample.log │ PASS │ 49.6245ms │ │ panw │ panos │ pipeline │ test-panw-panos-inc-traffic.json │ PASS │ 13.872375ms │ │ panw │ panos │ pipeline │ test-panw-panos-ip-tag-sample.log │ PASS │ 11.248417ms │ │ panw │ panos │ pipeline │ test-panw-panos-sctp-sample.log │ PASS │ 11.647333ms │ │ panw │ panos │ pipeline │ test-panw-panos-system-sample.log │ PASS │ 3.298459ms │ │ panw │ panos │ pipeline │ test-panw-panos-threat-sample.log │ PASS │ 101.998667ms │ │ panw │ panos │ pipeline │ test-panw-panos-traffic-sample.log │ PASS │ 103.195041ms │ │ panw │ panos │ pipeline │ test-panw-panos-tunnel-inspection-sample.log │ PASS │ 8.027542ms │ │ panw │ panos │ pipeline │ test-panw-panos-userid-sample.log │ PASS │ 17.936708ms │ ╰─────────┴─────────────┴───────────┴──────────────────────────────────────────────┴────────┴──────────────╯ --- Test results for package: panw - END --- Done 

Related issues

• Closes [PANW] Split field panw.panos.url_category_list #6519

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-06-09T06:29:08.578+0000

• Duration: 17 min 38 sec

Test stats 🧪

Test	Results
Failed	0
Passed	52
Skipped	0
Total	52

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (15/15)	💚 3.022
Classes	100.0% (15/15)	💚 3.022
Methods	98.63% (72/73)	👍 6.896
Lines	94.356% (3277/3473)	👍 2.312
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

LGTM after changelog entry is up-to-date.

[bhapas]

bugfix ?

[kcreddy]

In a way its also an enhancement as we are adding support to split the field 😄

[bhapas]

Ok. Is this a new feature in threat logs by Palo Alto? Or did it exist before and we missed to implement. I would look at it this way to see if it qualifies an enhancement or bugfix and I think a patch step semantically informs the users that something is fixed which could be useful to upgrade to. Just my way of thinking though. WDYT?

[kcreddy]

Does make sense. Although I am not sure if it existed before.

[elasticmachine]

Package panw - 3.11.0 containing this change is available at https://epr.elastic.co/search?package=panw