[1.7] Clarify x509 definition guidance for network events with only one cert (#1114)#1124

webmat merged 1 commit intoelastic:1.7elastic/ecs:1.7from

webmat:backport/1.7/pr-1114webmat/ecs:backport/1.7/pr-1114Copy head branch name to clipboard