[Cisco ASA]: ASA Event Code 106023 "Deny" parse failure due to unexpected protocol field

### Integration Name

Cisco ASA [cisco_asa]

### Dataset Name

cisco_asa.log

### Integration Version

2.44.1

### Agent Version

9.2.3

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.3

### OS Version and Architecture

Ubuntu 22.04.5 LTS (AMD64)

### Software/API Version

Cisco ASA 9.16(2)14

### Error Message

Processor 'conditional' with tag 'parse_106023' in pipeline 'logs-cisco_asa.log-2.44.1' failed with message 'Provided Grok expressions do not match field value

### Event Original

<166>Jan 11 2026 07:44:45: %ASA-6-106023: Deny protocol 0 src OUTSIDE:20.20.20.20 dst INSIDE:10.10.10.10 by access-group "ACL-OUTSIDE-IN" [0x0, 0x0]

### What did you do?

Default Cisco ASA integration installation, no pipeline or other customizations

### What did you see?

ASA 106023 events with error.message indicating grok parse failure when "protocol 0" is present in the original message

### What did you expect to see?

Message should be correctly parsed and ingested without error

### Anything else?

The parsing failure can be corrected by using the 'INT' predefined pattern in place of the 'POSINT' pattern.

Current grok expression (produces error):
`^Deny ((protocol %{POSINT:network.iana_number})|%{NOTSPACE:network.transport}) src %{DATA:_temp_.cisco.source_interface}:%{IPORHOST:source.address}(/%{NUMBER:source.port})?\s*(\(%{CISCO_USER_OR_SGT_SRC}\) )?dst %{DATA:_temp_.cisco.destination_interface}:%{IPORHOST:destination.address}(/%{NUMBER:destination.port})?[(\s]+%{DATA}by access-group "%{NOTSPACE:_temp_.cisco.list_id}?"`

Adjusted grok expression (correctly parses "protocol 0"):
`^Deny ((protocol %{INT:network.iana_number})|%{NOTSPACE:network.transport}) src %{DATA:_temp_.cisco.source_interface}:%{IPORHOST:source.address}(/%{NUMBER:source.port})?\s*(\(%{CISCO_USER_OR_SGT_SRC}\) )?dst %{DATA:_temp_.cisco.destination_interface}:%{IPORHOST:destination.address}(/%{NUMBER:destination.port})?[(\s]+%{DATA}by access-group "%{NOTSPACE:_temp_.cisco.list_id}?"`

The corresponding field "network.iana_number" is explicitly mapped as a keyword in the 'logs-cisco_asa.log@package' component template, so other predefined patterns could serve just as well without creating type issues, such as 'NONNEGINT', 'NUMBER' or even 'NOTSPACE'