cisco_meraki: handle blocked ARP packet, auth and port messages

[efd6]

What does this PR do?

See title.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes cisco_meraki: parse out details from Blocked ARP Packet log events #7770

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-19T23:23:06.705+0000

• Duration: 18 min 2 sec

Test stats 🧪

Test	Results
Failed	0
Passed	19
Skipped	0
Total	19

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (9/9)	💚
Classes	100.0% (9/9)	💚
Methods	100.0% (66/66)	💚
Lines	98.142% (1162/1184)	❕
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[LaZyDK]

LGTM

[efd6]

@LaZyDK Are you happy with the subtype? I was also wondering whether we should be retaining the fact that it's a ARP packet that's being blocked somewhere other than in the event.original.

[LaZyDK]

If you want to follow the current format then arp_blocked is probably better.

Do you want some more log lines that are not normalized?

[LaZyDK]

I just found something that could be optimized in the Meraki integrations.
The subtype usually is the same as event.action but sometimes this field is empty.

[efd6]

@LaZyDK Added your new events and changed the subtype.

That optimisation is worth considering, please open an issue for it.

[LaZyDK]

You don't have to implement my suggestions. I will add it to another PR to be reviewed later on.

[elasticmachine]

Package cisco_meraki - 1.13.0 containing this change is available at https://epr.elastic.co/search?package=cisco_meraki

[elasticmachine]

Package cisco_meraki - 1.13.0 containing this change is available at https://epr.elastic.co/search?package=cisco_meraki

[elasticmachine]

Package cisco_meraki - 1.13.0 containing this change is available at https://epr.elastic.co/search?package=cisco_meraki