Cisco module ingest processor for ASA 304001 events doesn't account for all possibilities

[A-Hall]

• Version: 7.6.x
• Steps to Reproduce:

The ASA 304001 log event can produce log lines similar to both of the following:

Apr 27 04:18:49 some-random-vpn-fw-01 : %ASA-5-304001: 10.20.30.40 Accessed URL 10.20.30.40:http://10.20.30.40/
Apr 27 17:54:52 some-random-fw-01 : %ASA-5-304001: 10.20.30.40 Accessed JAVA URL 10.20.30.40:http://10.20.30.40/?class.classLoader.URLs[0]=struts_2_3_16_1_classloader_manipulation-1588024492

Currently the dissect processor used for this log type only account fro the first log line above.

beats/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml

Line 246 in 4b69bf2

pattern: "%{source.address} %{}ccessed URL %{destination.address}:%{url.original}"