Add system test for Zeek FTP, OCSP

[andrewkroh]

What does this PR do?

Add system test for Zeek FTP

This adds a system test for the Zeek FTP data stream.

There were missing fields for

• network.protocol
• network.transport

Add system test for Zeek OCSP

This adds a system test for the Zeek OCSP data stream.

One field, zeek.ocsp.revoke.date was incorrectly named in fields.yml.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.

Related issues

• Relates Add automated tests for security packages #377

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

For future reference: The sample OSCP logs were generated from https://packetlife.net/captures/protocol/ocsp/ using

docker run --rm -v /Users/akroh/Downloads/pcap:/pcap:rw blacktop/zeek -r OCSP-Good.cap local LogAscii::use_json=T "policy/files/x509/log-ocsp.zeek"

docker run --rm -v /Users/akroh/Downloads/pcap:/pcap:rw blacktop/zeek -r OCSP-Revoked.cap local LogAscii::use_json=T "policy/files/x509/log-ocsp.zeek"

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #676 opened

• Start Time: 2021-02-09T01:54:03.435+0000

• Duration: 28 min 18 sec

• Commit: db18129

Test stats 🧪

Test	Results
Failed	0
Passed	119
Skipped	0
Total	119

Trends 🧪