checkpoint: test and support R81 logs

[efd6]

What does this PR do?

This adds minimal representors of a corpus of ~3300 events from an R81.20 appliance. Some additional field definitions are added and missing type conversions for icmp_code and icmp_type are added.

In addition to this there was one case of a log line containing more than one time field. This line does not appear to be corrupted and has an outzonlags which may explain the presence of two times. Additional processing is added to support multiple times.

Finally error handling in script and kv processors is enhanced.

Corpus is available on request.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [Check Point] R81 Support #5079

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-03-08T10:29:57.187+0000

• Duration: 17 min 46 sec

Test stats 🧪

Test	Results
Failed	0
Passed	12
Skipped	0
Total	12

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚
Classes	100.0% (1/1)	💚
Methods	100.0% (17/17)	💚 66.667
Lines	87.379% (900/1030)	👎 -12.621
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

Thanks for working through this one @efd6. We'll also need to adjust the compatibility section of our docs to indicate support for R81. We can drop all mention of R77.30 as it's end of life.

[efd6]

R81 is listed there, I'll remove R77.

[jamiehynds]

R81 is listed there, I'll remove R77.

@efd6 I only see a reference to R80 - "This module has been tested against Check Point Log Exporter on R80.X but should also work with R77.30."

[efd6]

@jamiehynds In this change:

https://github.com/elastic/integrations/pull/5440/files#diff-5fb552715f306989284fc752ff67126271ad4742e795753cbe5287e46b27db73R12

https://github.com/elastic/integrations/pull/5440/files#diff-8b72ce11f0820ed604699ac39afe629fb3a3d6a48855b3797063e5411cbd6e8fR12

[elasticmachine]

Package checkpoint - 1.16.0 containing this change is available at https://epr.elastic.co/search?package=checkpoint

[elasticmachine]

Package checkpoint - 1.16.0 containing this change is available at https://epr.elastic.co/search?package=checkpoint

[elasticmachine]

Package checkpoint - 1.16.0 containing this change is available at https://epr.elastic.co/search?package=checkpoint

[elasticmachine]

Package checkpoint - 1.16.0 containing this change is available at https://epr.elastic.co/search?package=checkpoint