For confirmed bugs, please report: - Version: 7.9 [Allowed values for ECS 1.5 are](https://www.elastic.co/guide/en/ecs/1.5/ecs-allowed-values-event-outcome.html#ecs-allowed-values-event-outcome): - failure - success - unknown [It appears the module will normalize these fields](https://github.com/elastic/beats/blob/89a7faf4ad5ef85330e5e0b6d09b2de2aaa2f9d1/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml#L1075) to `allow` or `deny`.
For confirmed bugs, please report:
Allowed values for ECS 1.5 are:
It appears the module will normalize these fields to
allowordeny.