[stormshield] Add ECS event categorization and network mappings (#20031)

Set event.kind, event.category and event.type for every SNS log family
through a table-driven Painless script keyed on logtype, with allowed/denied
event.type modifiers derived case-insensitively from the rule action. The
periodic statistics families (monitor, filterstat, count, routerstat,
authstat, ipsecstat) are tagged event.kind: metric so health telemetry can
be excluded from detection scopes with a single filter. Unknown families
fall back to event.kind: event without asserting a category or type,
covered by a dedicated test sample. The
script only runs on documents without an error, so the pipeline_error kind
set by sub-pipeline failure handlers is preserved.

Add the ECS network mappings tracked in #10114: rcvd to destination.bytes
(mirroring the existing sent mapping), network.bytes as the sum of both,
srcif/srcifname/dstif/dstifname copied to observer.ingress and
observer.egress interface fields, and network.direction computed with
private ranges as internal networks. Promote alarm fields (alarmid to
event.code, risk to event.risk_score, pri to event.severity on the alarm
scale where 1 is major and 4 is minor), HTTP proxy fields (arg to
url.original, url.domain from destination.domain), and populate
related.hosts. All mappings are copies; no stormshield.* field moves or
changes location. Guard the ASN geoip processors with null checks, matching
the geo processors.

Fix the count sub-pipeline, which failed on every count log since creation:
the script called splitByToken, which does not exist in Painless, and
collapsed all rules into a single map. Rule counters are now a sorted array
under stormshield.metadata.rule_stats. Extend the metadata move list with
the documented alarm, proxy, vpn and auth fields so they land under
stormshield.metadata instead of being left unmapped.

Add pipeline test samples for the alarm, auth, web, vpn, xvpn, count and
filter families, derived from the log format examples in the official
Stormshield documentation with sanitized addresses, including uppercase and
empty action values. Add an Alarms (IPS) dashboard keyed on the new
categorization fields. Document the categorization table in the README.

Author: arenard

packages/stormshield/_dev/build/docs/README.md

@@ -207,6 +207,40 @@ For more information on architectures that can be used for scaling this integrat
 
 You'll find events from Stormshield SNS logs in the `log` data stream. This data stream includes logs of the following types: traffic, filter, protection, and system events.
 
+##### ECS event categorization
+
+Each log family (identified by the `logtype` field) is mapped to the ECS categorization fields. Alarms raised by the intrusion prevention engine produce `event.kind: alert`. The periodic statistics families (`monitor`, `filterstat`, `count`, `routerstat`, `authstat`, `ipsecstat`) produce `event.kind: metric`, so health telemetry can be excluded from detection rule scopes with a single filter. All other families produce `event.kind: event`.
+
+| logtype | event.kind | event.category | event.type |
+|---|---|---|---|
+| alarm | alert | intrusion_detection, network | info |
+| auth | event | authentication | start |
+| authstat | metric | authentication | info |
+| connection | event | network, session | connection, end |
+| count, filterstat, ipsecstat, routerstat | metric | network | info |
+| date | event | host | change |
+| dmrouting, routing | event | network, host | change |
+| filter | event | network | connection |
+| ftp | event | network | info |
+| monitor | metric | host | info |
+| plugin | event | network | protocol |
+| pop3, smtp | event | email, network | info |
+| pvm | event | vulnerability | info |
+| restapi | event | web, configuration | access |
+| sandboxing | event | network | info |
+| server | event | configuration | access |
+| ssl | event | network | connection |
+| system | event | host | info |
+| vpn | event | network | info |
+| web | event | web, network | access |
+| xvpn | event | network, session | connection |
+
+For the families that carry a rule action, `event.type` additionally receives `allowed` when the action is `pass` and `denied` when the action is `block` (matched case-insensitively). An empty action field corresponds to a rule set to Log, and no modifier is added. Unknown log families fall back to `event.kind: event` without `event.category` or `event.type`, so a family missing from the table is visible instead of being mislabeled.
+
+For alarm logs, `event.code` carries the Stormshield alarm identifier, `event.risk_score` the `risk` field (1-100), and `event.severity` the vendor alarm level from `pri`, where 1 is a major alarm and 4 a minor alarm. This scale is specific to the alarm family. In most other families, the appliance hardcodes the `pri` field to 5.
+
+`network.direction` is computed from the source and destination IP addresses, treating private (RFC 1918) address ranges as internal networks.
+
 ##### `log` fields
 
 You'll find a list of all exported fields in the following table:

packages/stormshield/changelog.yml

@@ -1,4 +1,21 @@
 # newer versions go on top
+- version: "1.6.0"
+  changes:
+    - description: Set ECS event categorization fields (`event.kind`, `event.category`, `event.type`) for every log family, including `event.kind` `metric` for the periodic statistics families.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20031
+    - description: Map `rcvd` to `destination.bytes`, sum `network.bytes`, map interface fields to `observer.ingress` and `observer.egress`, compute `network.direction`, and populate `related.hosts`.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20031
+    - description: Map alarm identifiers and levels to `event.code`, `event.risk_score` and `event.severity`, and HTTP proxy fields to `url.original` and `url.domain`.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20031
+    - description: Fix the count sub-pipeline, which failed with a Painless runtime error on every count log, and skip malformed counters instead of failing the whole document.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20031
+    - description: Add an Alarms dashboard and pipeline test samples for the alarm, auth, web, vpn, xvpn, count and filter log families.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20031
 - version: "1.5.3"
   changes:
     - description: Fix ingest pipeline descriptions and remove field definitions that never appear in events (`stormshield.tz`, `stormshield.duration`, `stormshield.msg`, `stormshield.origdst`, `stormshield.origdstport`).