[CiscoIOS] Restore system Message handling for Cisco IOS

[gogochan]

Proposed commit message

https://github.com/elastic/sdh-beats/issues/4823

The changes introduced in #9102 caused Cisco IOS integration not to handle system messages anymore. This PR fixes it.

‼️ The payload generated in the previous branch derived event.timezone from syslog timestamp, which I don't think is accurate representation. But customer may find it annoying.

Before

+            "cisco": {
+                "ios": {
+                    "facility": "ILPOWER"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "category": [
+                    "network"
+                ],
+                "code": "IEEE_DISCONNECT",
+                "original": "<189>Jun 12 18:10:50 10.53.35.85 %ILPOWER-5-IEEE_DISCONNECT: Interface Gi1/0/20: PD removed",
+                "provider": "firewall",
+                "severity": 5,
+                "timezone": "UTC",
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "notification",
+                "syslog": {
+                    "priority": 189
+                }
+            },
+            "message": "Interface Gi1/0/20: PD removed",
+            "observer": {
+                "product": "IOS",
+                "type": "firewall",
+                "vendor": "Cisco"
+            },
+            "tags": [
+                "preserve_original_event"
+            ]

After

+            "cisco": {
+                "ios": {
+                    "facility": "ILPOWER"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "category": [
+                    "network"
+                ],
+                "code": "IEEE_DISCONNECT",
+                "original": "<189>Jun 12 18:10:50 10.53.35.85 %ILPOWER-5-IEEE_DISCONNECT: Interface Gi1/0/20: PD removed",
+                "provider": "firewall",
+                "severity": 5,
+                "type": [
+                    "info"
+                ]
+            },
+            "log": {
+                "level": "notification",
+                "syslog": {
+                    "priority": 189
+                }
+            },
+            "message": "Interface Gi1/0/20: PD removed",
+            "observer": {
+                "product": "IOS",
+                "type": "firewall",
+                "vendor": "Cisco"
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
         }

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a3029ff

History

• 💚 Build #12533 succeeded 6e83d4b
• 💚 Build #12532 succeeded a3bd140

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[taylor-swanson]

LGTM

[elasticmachine]

Package cisco_ios - 1.26.10 containing this change is available at https://epr.elastic.co/search?package=cisco_ios