fix: align VMware ESXi filter and rule contracts

Author: kryonsx

filters/audits/vmware.md

@@ -0,0 +1,42 @@
+# VMware ESXi normalization and rule review
+
+Use origin.host, canonical authentication failures, and corresponding alert-side grouping names.
+
+This draft targets UTMStack `v11`. It contains 1 filter changes
+and 14 rule changes for this technology only. Review covered
+1 filter configurations and 14 matching shipped rule files.
+Unchanged rules are listed in the regression manifest; they are not duplicated in the diff.
+
+## Contract and validation
+
+- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries.
+- Checked documented pipeline ordering, rename/move behavior, open vendor log fields,
+  event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping.
+- Strict SDK configuration decoding and actual CEL compilation pass for this scope.
+- 1 synthetic normalization cases pass, including SDK Event conversion and any
+  trigger predicate assertions recorded in the manifest.
+- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied.
+
+The shared alert-contract PR supplies the reusable Go runner for the manifest in
+`plugins/alerts/testdata/filter-contracts/vmware.json`. Apply that support before running `go test ./...` in `plugins/alerts`.
+
+The changed rules also require the shared alert-grouping fix to resolve `lastEvent.*` values correctly at runtime.
+
+The model starts from synthetic extraction results. It does not run complex grok,
+JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch
+queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must
+still be checked in staging before rollout. No customer false-positive reduction
+has been measured and no production rollout is included.
+
+
+
+## References
+
+- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto)
+- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference)
+- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema)
+- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules)
+
+`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom
+`log.*` fields are accepted. Existing textual protocol casing and vendor action names
+are preserved unless a concrete consumer mismatch requires correction.

filters/vmware/vmware-esxi.yml

@@ -19,7 +19,7 @@ pipeline:
               pattern: '\<{{.data}}\>'
             - fieldName: log.deviceTime
               pattern: '{{.year}}(-){{.monthNumber}}(-){{.monthDay}}(T){{.time}}(Z)'
-            - fieldName: origin.hostname
+            - fieldName: origin.host
               pattern: '{{.hostname}}'
             - fieldName: log.process
               pattern: '{{.hostname}}(\:)'
@@ -40,7 +40,7 @@ pipeline:
               pattern: '\<{{.data}}\>'
             - fieldName: log.deviceTime
               pattern: '{{.year}}(-){{.monthNumber}}(-){{.monthDay}}(T){{.time}}(Z)'
-            - fieldName: origin.hostname
+            - fieldName: origin.host
               pattern: '{{.hostname}}'
             - fieldName: log.process
               pattern: '{{.hostname}}'
@@ -55,7 +55,7 @@ pipeline:
               pattern: '\<{{.data}}\>'
             - fieldName: log.deviceTime
               pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}T{{.time}}Z'
-            - fieldName: origin.hostname
+            - fieldName: origin.host
               pattern: '{{.hostname}}'
             - fieldName: log.process
               pattern: '{{.hostname}}'
@@ -136,14 +136,14 @@ pipeline:
           function: string
           params:
             key: actionResult
-            value: "failed"
-          where: 'exists("log.message") && contains("log.message", "authentication failed")'
+            value: failure
+          where: exists("log.message") && contains("log.message", "authentication failed")
       - add:
           function: string
           params:
             key: actionResult
-            value: "failed"
-          where: 'exists("log.message") && contains("log.message", "authentication of user") && contains("log.message", "failed") && !exists("actionResult")'
+            value: failure
+          where: exists("log.message") && contains("log.message", "authentication of user") && contains("log.message", "failed") && !exists("actionResult")
       - add:
           function: string
           params:

plugins/alerts/testdata/filter-contracts/vmware.json

@@ -0,0 +1,44 @@
+{
+  "technology": "VMware ESXi",
+  "filters": [
+    "filters/vmware/vmware-esxi.yml"
+  ],
+  "rules": [
+    "rules/vmware/vmware-esxi/esxi_account_manipulation.yml",
+    "rules/vmware/vmware-esxi/esxi_disk_theft.yml",
+    "rules/vmware/vmware-esxi/esxi_firewall_modification.yml",
+    "rules/vmware/vmware-esxi/esxi_host_compromise.yml",
+    "rules/vmware/vmware-esxi/esxi_ransomware_detection.yml",
+    "rules/vmware/vmware-esxi/esxi_ssh_access.yml",
+    "rules/vmware/vmware-esxi/esxi_syslog_disruption.yml",
+    "rules/vmware/vmware-esxi/esxi_vib_sideloading.yml",
+    "rules/vmware/vmware-esxi/hypervisor_escape_attempts.yml",
+    "rules/vmware/vmware-esxi/powercli_script_execution.yml",
+    "rules/vmware/vmware-esxi/vcenter_server_attacks.yml",
+    "rules/vmware/vmware-esxi/vm_escape_detection.yml",
+    "rules/vmware/vmware-esxi/vmware_tools_vulnerabilities.yml",
+    "rules/vmware/vmware-esxi/vsphere_api_abuse.yml"
+  ],
+  "fixtures": [
+    {
+      "name": "vmware_auth_failure",
+      "filter": "vmware/vmware-esxi.yml",
+      "input": {
+        "origin": {
+          "host": "esxi-lab"
+        },
+        "log": {
+          "message": "authentication failed"
+        }
+      },
+      "expected": {
+        "origin.host": "esxi-lab",
+        "actionResult": "failure"
+      },
+      "absent": [
+        "origin.hostname"
+      ],
+      "rules": {}
+    }
+  ]
+}

rules/vmware/vmware-esxi/esxi_account_manipulation.yml

@@ -40,4 +40,4 @@ where: |
     ))
   )
 groupBy:
-  - adversary.hostname
+  - adversary.host

rules/vmware/vmware-esxi/esxi_disk_theft.yml

@@ -40,5 +40,5 @@ where: |
     (contains("log.message", "Datastore") && contains("log.message", "browse") && contains("log.message", ".vmdk"))
   )
 groupBy:
-  - adversary.hostname
+  - adversary.host
   - adversary.ip

rules/vmware/vmware-esxi/esxi_firewall_modification.yml

@@ -34,7 +34,7 @@ where: |
       contains("log.message", "set --allowed-all true") ||
       contains("log.message", "set --enabled")
     )) ||
-    (contains("log.message", "iptables") && exists("origin.hostname"))
+    (contains("log.message", "iptables") && exists("origin.host"))
   )
 groupBy:
-  - adversary.hostname
+  - adversary.host

rules/vmware/vmware-esxi/esxi_host_compromise.yml

@@ -42,6 +42,6 @@ where: |
    contains("log.message", "log events removed") ||
    (equals("log.process", "vmkernel") && contains("log.message", "SCSI sense")) ||
    (contains("log.eventInfo", "ransom") || contains("log.eventInfo", "encrypt"))) &&
-  exists("origin.hostname")
+  exists("origin.host")
 groupBy:
-  - adversary.hostname
+  - adversary.host

rules/vmware/vmware-esxi/esxi_ransomware_detection.yml

@@ -37,4 +37,4 @@ where: |
     (contains("log.message", "chmod") && contains("log.message", "+x") && contains("log.message", ".sh"))
   )
 groupBy:
-  - adversary.hostname
+  - adversary.host

rules/vmware/vmware-esxi/esxi_ssh_access.yml

@@ -33,5 +33,5 @@ where: |
     (contains("log.message", "ssh") && contains("log.message", "connection from"))
   )
 groupBy:
-  - adversary.hostname
+  - adversary.host
   - adversary.ip

rules/vmware/vmware-esxi/esxi_syslog_disruption.yml

@@ -37,4 +37,4 @@ where: |
     (contains("log.message", "Syslog.global.logHost") && contains("log.message", "changed"))
   )
 groupBy:
-  - adversary.hostname
+  - adversary.host