[Cisco ASA]: tls_version field handling error

### Integration Name

Cisco ASA [cisco_asa]

### Dataset Name

cisco_asa.log

### Integration Version

2.43.8

### Agent Version

9.1.3

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.1.3

### OS Version and Architecture

Ubuntu 22.04.5 LTS x86/64

### Software/API Version

ASA 9.16(2)14

### Error Message

Processor conditional with tag parse_tls_version in pipeline logs-cisco_asa.log-2.43.8 failed with message: Provided Grok expressions do not match field value: [unknown]

### Event Original

"<166>Sep 19 2025 09:21:11: %ASA-6-725001: Starting SSL handshake with client OUTSIDE:55.55.55.55/9377 to 11.11.11.11/443 for unknown session"

### What did you do?

ASA integration config is as follows:
"Collect logs from Cisco ASA via UDP" is the only enabled method
Listen address: 0.0.0.0
Listen port: 9001
Preserve original event: enabled (for debugging, normally disabled)
Preserve searchable message text: enabled
All other options blank or default

logs-cisco_asa.log@custom pipeline does not exist
logs-cisco_asa.log@custom template exists, but is empty
No changes to managed pipeline or template

### What did you see?

error.message "_Processor conditional with tag parse_tls_version in pipeline logs-cisco_asa.log-2.43.8 failed with message: Provided Grok expressions do not match field value: [unknown]_" in records.

"Integrations" dashboard shows a large volume of errors for the agent running the Cisco ASA integration.

Manually running the pipeline with a raw input message results in this error:
_{
"processor_type": "grok",
"status": "error",
"tag": "parse_tls_version",
"if": {
"condition": "ctx._temp_?.cisco?.tls_version != null",
"result": true
},
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Provided Grok expressions do not match field value: [unknown]"
}
],
"type": "illegal_argument_exception",
"reason": "Provided Grok expressions do not match field value: [unknown]"
}
},_

The relevant grok processor statements are:
_%{PROTO:tls.version_protocol}v%{NUMBER:tls.version}
%{PROTO:tls.version_protocol}_
with pattern definition _"PROTO": "[A-Z]+"_

"ctx._temp_.cisco.tls_version" from the manual ingest test:
_...
"_source": {
"_temp_": {
"raw_date": "Sep 19 2025 08:42:36",
"full_message": "%ASA-6-725001: Starting SSL handshake with client OUTSIDE:55.55.55.55/11051 to 11.11.11.11/443 for unknown session",
"cisco": {
"peer_type": "client",
"message_id": "725001",
"tls_version": "unknown",
"source_interface": "OUTSIDE"
},
...._

### What did you expect to see?

Graceful handling for "tls_version": "unknown" that does not produce a pipeline error

### Anything else?

Search through older records shows the error has been occurring since at least v2.43.5.
The issue became very evident after recently adding an ASA for ingest, but has also appeared for an existing ASA running 9.12(4)65, though at far lower volume.