The shared ingest pipeline sets `event.outcome` to _allow_ or _deny,_ instead of using one of the [values allowed by ECS: ](https://www.elastic.co/guide/en/ecs/1.5/ecs-allowed-values-event-outcome.html) - failure - success - unknown
The shared ingest pipeline sets
event.outcometo allow or deny, instead of using one of the values allowed by ECS: