[Pulse Connect Secure] Authentication failure logs with "Short Password" cannot be parsed

### Integration Name

Pulse Connect Secure [packages/pulse_connect_secure]

### Dataset Name

_No response_

### Integration Version

2.6.1

### Agent Version

8.19.18

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.19.18

### OS Version and Architecture

Red Hat Enterprise Linux 9.6 (Plow)

### Software/API Version

_No response_

### Error Message

The event fails during ingest pipeline processing with the following error:

```text
Provided Grok expressions do not match field value:

<134>1 2026-08-02T09:39:14+07:00 vpn.example.com PulseSecure: - - - 2026-08-02 09:39:14 - ive - [198.51.100.10] Default Network::user123!([Example Authentication Realm])[][] - Login failed for 'Primary' authentication using auth server 'ldap.example.local' ('LDAP Server'). Reason: 'Short Password'
```

The event is not parsed and no ECS fields are extracted.

### Event Original

<134>1 2026-08-02T09:39:14+07:00 vpn.example.com PulseSecure: - - - 2026-08-02 09:39:14 - ive - [198.51.100.10] Default Network::user123!([Example Authentication Realm])[][] - Login failed for 'Primary' authentication using auth server 'ldap.example.local' ('LDAP Server'). Reason: 'Short Password'

### What did you do?

- Installed the Pulse Connect Secure integration using the default ingest pipeline.
- Configured the integration to receive RFC5424 Syslog messages.
- Enabled "Preserve original event".
- Sent authentication failure logs from Pulse Connect Secure.
- Verified that the event reached Elasticsearch but failed during Grok parsing.

### What did you see?

The event was ingested but the ingest pipeline failed during Grok parsing.

The following error was returned:

```text
Provided Grok expressions do not match field value
```

As a result:

- The event is not parsed correctly.
- ECS fields such as `source.ip`, `user.name`, `event.action`, and `event.outcome` are not extracted.
- The pipeline processing stops at the Grok processor.

### What did you expect to see?

The authentication failure log should be parsed successfully.

Expected ECS fields include:

- `source.ip`
- `user.name`
- `event.action`
- `event.outcome`
- `event.reason`
- `observer.type`
- `observer.product`
- Authentication realm
- LDAP server name

The event should indicate a failed authentication with the reason:

```text
Short Password
```

### Anything else?

The issue appears to be related to the current Grok pattern not matching this valid Pulse Connect Secure authentication failure log.

Possible causes include:

- Username contains a `!` character.
- Authentication realm contains spaces and parentheses.
- Empty optional fields are represented as `[][]`.
- The log ends with:

```text
Reason: 'Short Password'
```

The attached sample has been sanitized but preserves the original log structure.

If helpful, I can provide additional sanitized samples that exhibit the same parsing failure.

Start in packages/pulse_connect_secure and inspect the default ingest pipeline's Grok processors. Reproduce the failure with the supplied sanitized Pulse Connect Secure event, then verify that the authentication failure is parsed and the listed ECS fields, authentication realm, LDAP server, and “Short Password” reason are extracted successfully.

Written by the indexing model from the issue text.