Fix active response decoders

[frgv]

Adds compatibility with default netsh.cmd script.

08/28/2018 09:25 "active-response/bin/netsh.cmd" delete "-" "1.2.3.4" "1535465731.23945822 18258 (some-hostname) any->WinEvtLog (null)"

**Phase 1: Completed pre-decoding.
       full event: '08/28/2018  09:25 "active-response/bin/netsh.cmd" delete "-" "1.2.3.4" "1535465731.23945822 18258 (some-hostname) any->WinEvtLog (null)"'
       timestamp: '(null)'
       hostname: 'manager1'
       program_name: '(null)'
       log: '08/28/2018  09:25 "active-response/bin/netsh.cmd" delete "-" "1.2.3.4" "1535465731.23945822 18258 (some-hostname) any->WinEvtLog (null)"'

**Phase 2: Completed decoding.
       decoder: 'ar_log'
       script: 'netsh.cmd'
       type: 'delete'
       srcip: '1.2.3.4'
       id: '1535465731.23945822'
       extra_data: '18258'

**Phase 3: Completed filtering (rules).
       Rule id: '607'
       Level: '3'
       Description: 'Active response: netsh.cmd - delete'
**Alert to be generated.