Update the decoder to add the operation. This seems important for
determining how malicious some action is.
Add arule to alert on DENIED messages.

The examples provided by @RealRancor illustrate an issue. The
original examples that were provided were in a syslog format
with "kernel" as the program_name. This made them identify as
iptables log messages. The DENIED examples did not have the syslog
header, and identified as auditd log messages. This work should
probably duplicate what was already done for auditd.