[cisco_ise] Extract av-pairs into attributes mapping

[taylor-swanson]

Proposed commit message

• Improved script for extracting nested sub-keys from cisco-av-pair attribute/value pairs.
• Add pipeline test for passed authentications.
• Added mappings for known sub-keys to satisfy tests. Dynamic mappings is enabled for cisco_av_pair, so any unknown keys will be created on-demand.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
  - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/cisco_ise
elastic-package test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 706efba

History

• 💔 Build #35582 failed 5002fa7
• 💚 Build #35581 succeeded 3c140b2
• 💚 Build #35520 succeeded 49af2f6
• 💔 Build #35516 failed b19a144
• 💔 Build #35099 failed 5c1aa8c

cc @taylor-swanson

[elasticmachine]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[qcorporation]

This looks good.
The only way that I can see this fail is if there's a third level nesting which I don't think is the case.

[taylor-swanson]

This looks good. The only way that I can see this fail is if there's a third level nesting which I don't think is the case.

cisco-av-pair=mdm-tlv=this=can=go=quite=deep=no-real-limit=device-platform-version=10.0.26100

yields (cisco-av-pair, mdm-tlv omitted because it wasn't shown in the test diff and I don't feel like adding it:

+                            "device-uid-global": "2897F9C5734F41A03F0E89064463F6FAB5EEDBF1",
+                            "this": {
+                                "can": {
+                                    "go": {
+                                        "quite": {
+                                            "deep": {
+                                                "no-real-limit": {
+                                                    "device-platform-version": "10.0.26100"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }

There is no imposed limit, it can handle any depth. I did try to test with escaped quotes in the key (since we talked about that), but it struggled with that (given how I'm detecting when the last key happens). I'm not really going to address that unless I see real evidence that there's a key with an escaped quote in it. It handles values with escaped quotes just fine.

[elastic-vault-github-plugin-prod]

Package cisco_ise - 1.31.0 containing this change is available at https://epr.elastic.co/package/cisco_ise/1.31.0/