[Filebeat] Allow cef and checkpoint modules to override network directionality based off of zones

[andrewstucki]

What does this PR do?

This adopts the same logic as #22998 by classifying internal/external/inbound/outbound traffic based off of zones.

It differs due to the fact that the checkpoint module (and the cef module when used with checkpoint) already fill in a network direction based off of a field in the actual event payload that says either "inbound" or "outbound". That said, this change would allow internal/external traffic classification and classifying logically based off of logical network segments in a partitioned network where some zones are considered inside of a DMZ v. outside.

By default the classification overriding is turned off.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #23066 updated

• Start Time: 2020-12-10T19:15:25.680+0000

• Duration: 69 min 42 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2422
Skipped	261
Total	2683

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	2422
Skipped	261
Total	2683

[andrewstucki]

Since there's no way of overriding the config on a per golden file basis. Here's a diff to demonstrate this working:

With the following configuration change

diff --git a/x-pack/filebeat/module/checkpoint/firewall/manifest.yml b/x-pack/filebeat/module/checkpoint/firewall/manife
st.yml
index 5d5d3dd4d..83475c65a 100644
--- a/x-pack/filebeat/module/checkpoint/firewall/manifest.yml
+++ b/x-pack/filebeat/module/checkpoint/firewall/manifest.yml
@@ -11,7 +11,9 @@ var:
     default: syslog
   - name: ssl
   - name: internal_zones
+    default: ['Internal'] # I want it backwards for effect
   - name: external_zones
+    default: ['Local'] # I want it backwards for effect

 ingest_pipeline:
   - ingest/pipeline.yml

We see the following change:

@@ -176,7 +176,7 @@
         "input.type": "log",
         "log.offset": 1739,
         "network.application": "https",
-        "network.direction": "outbound",
+        "network.direction": "inbound",
         "network.iana_number": "6",
         "network.name": "Network",
         "observer.egress.interface.name": "eth0",