Fix: WatchGuard Firebox LEEF with space separator

[vg-svitla]

No description provided.

[github-actions]

Smart descriptions generated from the latest tests at 2024-12-12 09:20:09:

Test File	Smart Description
WatchGuard/watchguard-firebox/tests/auth_was_rejected.json	User john.doe from 1.2.3.4 was rejected
WatchGuard/watchguard-firebox/tests/connection.json	Connection from 10.10.1.1 to 10.10.1.2 allowed
WatchGuard/watchguard-firebox/tests/connection_allow.json	Connection from 192.168.91.11 to 8.8.4.4 allowed
WatchGuard/watchguard-firebox/tests/connection_allow2.json	Connection from 192.168.91.253 to 192.168.91.37 allowed
WatchGuard/watchguard-firebox/tests/connection_allow3.json	Connection from 10.10.10.11 to 8.8.4.4 allowed
WatchGuard/watchguard-firebox/tests/connection_deny.json	Connection from 1.2.3.4 (UKR) to 192.168.1.2 blocked: tcp syn checking failed (expecting SYN packet for new TCP connection, but received ACK, FIN, or RST instead).
WatchGuard/watchguard-firebox/tests/connection_deny1.json	Connection from 1.2.3.4 to www.example.com blocked: ProxyDeny: HTTP Request categories
WatchGuard/watchguard-firebox/tests/dhcp_pack.json	dhcp ackownledge on 10.0.2.52 to 00:01:21:30:0f:a0
WatchGuard/watchguard-firebox/tests/dhcp_request.json	dhcp request for 10.0.2.52 from 00:01:21:30:0f:a0
WatchGuard/watchguard-firebox/tests/dpi_http_1.json	Connection from 10.10.1.22 to www.forbidden.com allowed
WatchGuard/watchguard-firebox/tests/dpi_http_2.json	Connection from 10.10.1.22 to 5.6.7.8 allowed
WatchGuard/watchguard-firebox/tests/dpi_http_deny.json	Connection from 10.10.1.22 to www.forbidden.com blocked: ProxyDeny: HTTP Request categories
WatchGuard/watchguard-firebox/tests/game_allow.json	Connection from 10.10.10.7 to 104.98.231.118 allowed
WatchGuard/watchguard-firebox/tests/geo_deny.json	Connection from 1.2.3.4 (UKR) to 192.168.1.2 blocked: blocked sites (geolocation source)
WatchGuard/watchguard-firebox/tests/no_rule_deny.json	Connection from 1.2.3.4 to 192.168.1.2 blocked
WatchGuard/watchguard-firebox/tests/test_dns_question.json	Connection from 1.2.3.4 to 5.6.7.8 allowed
WatchGuard/watchguard-firebox/tests/user_auth_was_accepted.json	Authentication of user john.doe from 1.2.3.4 was accepted
WatchGuard/watchguard-firebox/tests/user_logged_out.json	User john.doe from 1.2.3.4 logged out
WatchGuard/watchguard-firebox/tests/user_login.json	User john.doe from 1.2.3.4 logged in
WatchGuard/watchguard-firebox/tests/user_login_rejected.json	User from 1.2.3.4 was rejected
WatchGuard/watchguard-firebox/tests/user_login_rejected_2.json	User page from 127.0.0.1 was rejected
WatchGuard/watchguard-firebox/tests/virus_analysis.json	Anti-virus scan on request from 10.0.2.54 to 5.6.7.8

[squioc]

LGTM