Sophos v1.0.5: Support logs with hostname in syslog header

[adriansr]

What does this PR do?

Updates the sophos/utm datastream to support logs that include a hostname in their syslog header.

Note that this change in turn can cause problems with syslog headers that don't contain a hostname. Due to the way the logs are structured, it's not possible to reliably support both scenarios at the same time.

This prioritizes logs with a hostname, hoping that they are more common.

As an example, given the following log (without a hostname):

2016:01:29-06:09:59 smtpd[905]: MASTER[NNN]: QR globally disabled, status one set to 'disabled'

The current parser will take smtpd[905] as hostname, MASTER as the message ID and NNN as the process ID.

Because of this, is recommended that all logs include a hostname.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Related issues

• Closes Sophos UTM Integration incorrectly parses message header #1540

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-10-26T13:25:07.442+0000

• Duration: 22 min 44 sec

• Commit: 3729ea4

Test stats 🧪

Test	Results
Failed	0
Passed	14
Skipped	0
Total	14

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.