Describe the bug:

Network ACL deny events are populated differently by different modules so we need to OR another field test in the DF query.

Kibana/Elasticsearch Stack version:

7.13

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Security ML Jobs