Merge branch 'main' into transform-ocsf-backfill

Author: nate-smalls-s1

CHANGELOG.md

@@ -32,18 +32,24 @@ removed. It is functionally subsumed by
 Activity, `class_uid=4001`) for a broader range of log types. The now-empty
 `pipelines/community/serializers/` umbrella has been removed alongside it.
 
-### Changed - backfilled `ingest_mode` and `auth_type` on transform_ocsf/
-
-All 129 existing `pipelines/community/transform_ocsf/*/metadata.yaml` files
-now declare the `ingest_mode` and `auth_type` fields introduced by the
-pipelines reorganization above. Values were derived per entry by combining
-each transform's bound-parser metadata (when authoritative) with vendor and
-product knowledge for the entries where the parser metadata is unclear
-(`format: gron` with `ingestion_method: streaming` or `unknown`, or no
-parser binding). Resulting distribution: 56 Syslog, 39 API Call, and 34
-varied `Other - {Explain: ...}` (object store, Azure Event Hub, file-based
-agent, etc.). No serializer logic, pipeline JSON, or other metadata fields
-changed.
+### Removed - F-graded `palo_alto_networks_firewall` transform
+
+`pipelines/community/transform_ocsf/palo_alto_networks_firewall/` has been
+removed. It was graded F (`analyzer_limit`, 0% required-field coverage), used
+a non-standard `class_uid=99602001` (SentinelOne Security Alert Extended) that
+diverged from the rest of the PAN-OS cluster (`class_uid=4001` Network
+Activity), and had no matching upstream parser in `parsers/community/` (its
+`source_name` lacked the `-latest` versioning suffix used by every other
+PAN-OS entry). The three remaining PAN-OS transforms (`paloalto_logs/`,
+`paloalto_alternate_logs/`, `paloalto_vpn_logs/`) are unaffected.
+
+### Documented - PAN-OS transform variant binding
+
+The three remaining PAN-OS OCSF transforms in
+`pipelines/community/transform_ocsf/` now declare in their `metadata.yaml`
+`purpose` field which upstream parser in `parsers/community/` they bind to
+and the field-name convention each expects, so users can choose between them
+without reading the Lua. No serializer logic changes.
 
 ## [1.3.0] - 2025-10-28