pipelines: backfill ingest_mode and auth_type on transform_ocsf/ entries

Adds the new metadata fields introduced by #59 to all 129 existing
transform_ocsf/ pipeline metadata.yaml files. The fields are inserted
immediately after the existing ingestion_method line in each file. No
serializer logic, no pipeline JSON, no other metadata changed.

Values were derived per entry by combining:

1. Bound parser metadata (parsers/community/<source_name>/metadata.yaml)
   when the parser declares format=syslog/CEF/RFC/w3c/custom-syslog or
   ingestion_method containing "Syslog" or "HEC" -- the parser is
   authoritative when its declaration is unambiguous.

2. Vendor and product knowledge for the ~90 entries where the parser
   metadata is unclear (gron format with "streaming" or "unknown"
   ingestion_method, or no parser binding at all). Examples:
   - Cisco network kit (firewalls, ASA, Meraki, ISE, etc.) -> Syslog
   - Microsoft 365 / Entra / Defender management surfaces -> API Call (OAuth)
   - AWS managed services delivering to S3 (CloudTrail, ELB, Route53
     Resolver, GuardDuty export, VPC flow) -> Other - {object store with
     SQS notifications} (IAM Role)
   - Azure Event Hub-delivered streams (signin, defender email) ->
     Other - {Azure Event Hub stream (AMQP/Kafka protocol)} (OAuth)
   - SaaS REST APIs (Okta, Snyk, Wiz, Tenable, Mimecast, Netskope,
     Proofpoint, GitHub, Google Workspace, Cloudflare, etc.) -> API Call
     with the vendor's typical auth (Bearer Token, API Key & Secret,
     or OAuth)

Confidence per entry is recorded in
.reorg-prep/inventory/transform_ocsf_classifications.tsv as one of
high (103), medium (17), or low (9). Low-confidence entries are
genuinely generic placeholders (json_generic_logs, sample_test_logs,
microservice_tracing_logs, etc.) where a more specific value is not
derivable; they use Other - {Explain: ...} with the reason inline.

palo_alto_networks_firewall/ is intentionally not modified because it is
being removed in PR #60 (open).

Resulting distribution:
  Syslog                                              56
  API Call                                            39
  Other - {object store / Event Hub / agent / etc.}   34

Auth distribution:
  N/A (syslog / file-based / generic)                 75
  API Key & Secret                                    20
  OAuth                                               18
  IAM Role                                             8
  Bearer Token                                         7
  Other (Kafka SASL)                                   1

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Nate Smalley

pipelines/community/transform_ocsf/agent_metrics_logs/metadata.yaml

@@ -13,6 +13,8 @@ metadata_details:
   format: json
   ocsf_version: 1.3.0
   ingestion_method: "Observo OCSFSerializer (Lua-based transform)"
+  ingest_mode: "Other - {Explain: SentinelOne agent self-reported telemetry}"
+  auth_type: "N/A"
   ocsf_mapping:
     class_uid: 5001
     class_name: "Device Inventory Info"

pipelines/community/transform_ocsf/akamai_cdn/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"2026-04-20T02:26:52Z AkamaiCDN streamId=\\\"stream-735\\\" cp=\\\"87876\\\
     \" reqId=\\\"tsuzt53unx\\\" statusCode=304 cliIP=\\\"176.105.197.188\\\" reqHost=\\\"img.example.com\\\
     \" reqMethod=\\\"GET\\\" reqPath=\\\"/js/app.js\\\" bytes=525284 cacheStatus=\\\"TCP_MISS\\\" turnAroundTimeMSec=331\

pipelines/community/transform_ocsf/akamai_dns/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"2026-04-19T19:07:52Z AkamaiDNS streamId=\\\"dns-662\\\" cliIP=\\\"4.61.218.110\\\
     \" resolverIP=\\\"8.8.8.8\\\" domain=\\\"app.example.net\\\" recordType=\\\"AAAA\\\" responseCode=\\\
     \"REFUSED\\\" answer=\\\"\\\" edge=\\\"edge-nyc\\\" ttl=0 bytes=64\"\n}"

pipelines/community/transform_ocsf/akamai_general/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"2026-04-19T09:18:52Z AkamaiSecurity clientIP=\\\"144.165.201.238\\\"\
     \ host=\\\"blog.example.com\\\" path=\\\"/login\\\" ruleId=\\\"925798\\\" attackType=\\\"Command_Injection\\\
     \" action=\\\"rate_limited\\\" httpMethod=\\\"HEAD\\\" status=400 userAgent=\\\"Googlebot/2.1\\\"\

pipelines/community/transform_ocsf/akamai_sitedefender/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"type\": \"akamai_siem\",\n  \"attackData\": {\n    \"clientIP\": \"198.51.100.2\"\
     ,\n    \"configId\": \"20933\",\n    \"policyId\": \"p_10245\",\n    \"rules\": []\n  },\n  \"httpMessage\"\
     : {\n    \"method\": \"DELETE\",\n    \"host\": \"api.example.com\",\n    \"path\": \"/search\",\n\

pipelines/community/transform_ocsf/apache_http_logs/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: file-based agent ingestion (Apache access/error log)}"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"10.29.72.231 - - [20/Apr/2026:03:40:52 +0000] \\\"HEAD /settings HTTP/1.1\\\
     \" 200 5305\"\n}"
   dependency_summary: Requires Observo OCSFSerializer template with Lua runtime (lupa). Source events

pipelines/community/transform_ocsf/aws_cloudtrail/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: object store (S3) with SQS/SNS notifications}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"eventCategory\": \"Management\",\n  \"eventName\": \"CreateUser\",\n  \"eventSource\"\
     : \"iam.amazonaws.com\",\n  \"eventTime\": \"2026-04-20T03:40:52Z\",\n  \"eventVersion\": \"1.09\"\
     ,\n  \"eventID\": \"4ad68099-cad0-4172-8711-dd15c4d352c9\",\n  \"eventType\": \"AwsApiCall\",\n  \"\

pipelines/community/transform_ocsf/aws_elasticloadbalancer_logs/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: object store (S3) for ELB access logs}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"type\": \"https\",\n  \"time\": \"2026-04-20T03:40:52.700664Z\",\n  \"alb\":\
     \ \"corporate-alb-3\",\n  \"client_ip\": \"192.168.10.200\",\n  \"client_port\": 41655,\n  \"backend_ip\"\
     : \"172.16.1.50\",\n  \"backend_port\": 443,\n  \"request_processing_time\": 0.029082,\n  \"backend_processing_time\"\

pipelines/community/transform_ocsf/aws_guardduty/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: AWS EventBridge or S3 export of GuardDuty findings}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"schemaVersion\": \"2.0\",\n  \"accountId\": \"222708836859\",\n  \"region\":\
     \ \"us-east-1\",\n  \"partition\": \"aws\",\n  \"id\": \"8db850b8-f1b1-4dfd-8676-efd7b4e8ee85\",\n\
     \  \"arn\": \"arn:aws:guardduty:us-east-1::84378c5c8013403891eb51ada1b2a47b:detector/84378c5c8013403891eb51ada1b2a47b/finding/8db850b8-f1b1-4dfd-8676-efd7b4e8ee85\"\

pipelines/community/transform_ocsf/aws_guardduty_logs/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: AWS EventBridge or S3 export of GuardDuty findings}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"schemaVersion\": \"2.0\",\n  \"accountId\": \"200759122295\",\n  \"region\":\
     \ \"ap-south-1\",\n  \"partition\": \"aws\",\n  \"id\": \"eb19bf82-4550-40d2-a0b8-ae97533cc0f2\",\n\
     \  \"arn\": \"arn:aws:guardduty:ap-south-1::e5485011576b45629ceb37d38e001440:detector/e5485011576b45629ceb37d38e001440/finding/eb19bf82-4550-40d2-a0b8-ae97533cc0f2\"\