[cisco_meraki] Fix handling of security events without dhost and with action.

[marc-gr]

Proposed commit message

Pipeline assumed a closed set of fields for security events. This fixes that since some events have different field sets than previously expected.

It does so by simplifying the pipeline logic from several dissect steps to a single grok+kv one.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-11-02T11:39:33.774+0000

• Duration: 19 min 45 sec

Test stats 🧪

Test	Results
Failed	0
Passed	19
Skipped	0
Total	19

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (9/9)	💚
Classes	100.0% (9/9)	💚
Methods	100.0% (68/68)	💚 2.632
Lines	98.478% (1165/1183)	👍 3.051
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Package cisco_meraki - 1.18.1 containing this change is available at https://epr.elastic.co/search?package=cisco_meraki