DS-22758 Use specific Device Product to distinguish system events

As system events will come from manager while all security events come from the agent, spcific the device product header to classify events.
Besides, with the change, the filter for system event signatureID will no longer needed, just remove it to include all DSM events as system events.

Author: chchhsiao

TrendMicroDeepSecurity/default/transforms.conf

@@ -15,36 +15,36 @@ FORMAT=$3::$2
 KEEP_EMPTY_VALS=True
 
 [deepsecurity-intrusion_prevention]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(10|[2-3][0-9][0-9]|[5-7][0-9][0-9]|8[0-4][0-9]|1[0-9][0-9][0-9][0-9][0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(10|[2-3][0-9][0-9]|[5-7][0-9][0-9]|8[0-4][0-9]|1[0-9][0-9][0-9][0-9][0-9][0-9])\|
 FORMAT = sourcetype::deepsecurity-intrusion_prevention
 DEST_KEY = MetaData:Sourcetype
 
 [deepsecurity-integrity_monitoring]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(30|2[0-9][0-9][0-9][0-9][0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(30|2[0-9][0-9][0-9][0-9][0-9][0-9])\|
 FORMAT = sourcetype::deepsecurity-integrity_monitoring
 DEST_KEY = MetaData:Sourcetype
 
 [deepsecurity-log_inspection]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(40|3[0-9][0-9][0-9][0-9][0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(40|3[0-9][0-9][0-9][0-9][0-9][0-9])\|
 FORMAT = sourcetype::deepsecurity-log_inspection
 DEST_KEY = MetaData:Sourcetype
 
 [deepsecurity-web_reputation]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(5[0-9][0-9][0-9][0-9][0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(5[0-9][0-9][0-9][0-9][0-9][0-9])\|
 FORMAT = sourcetype::deepsecurity-web_reputation
 DEST_KEY = MetaData:Sourcetype
 
 [deepsecurity-firewall]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(20|21|1[0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(20|21|1[0-9][0-9])\|
 FORMAT = sourcetype::deepsecurity-firewall
 DEST_KEY = MetaData:Sourcetype
 
 [deepsecurity-antimalware]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(4[0-9][0-9][0-9][0-9][0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(4[0-9][0-9][0-9][0-9][0-9][0-9])\|
 FORMAT = sourcetype::deepsecurity-antimalware
 DEST_KEY = MetaData:Sourcetype
 
 [deepsecurity-system_events]
-REGEX = CEF:(\s)?(\d+)\|([^|]*)\|([^|]*)\|([^|]*)\|(4[0-9][0-9]|85[0-4]|9[0-9][0-9]|[1-6][0-9][0-9][0-9]|7[0-4][0-9][0-9])\|
+REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Manager\|([^|]*)\|
 FORMAT = sourcetype::deepsecurity-system_events
 DEST_KEY = MetaData:Sourcetype