fix(filters): Deceptive Bytes normalization and rule contracts

filters/antivirus/deceptive-bytes.yml

@@ -184,7 +184,7 @@ pipeline:
               pattern: '\,{{.data}}\,'
             - fieldName: origin.path
               pattern: '{{.greedy}}\,'
-            - fieldName: command
+            - fieldName: origin.command
               pattern: '{{.greedy}}'
           source: log.restMessage
 
@@ -412,14 +412,12 @@ pipeline:
           function: prefix
           substring: '"'
           fields:
-            - command
-
+            - origin.command
       - trim:
           function: suffix
           substring: '"'
           fields:
-            - command
-
+            - origin.command
       - trim:
           function: prefix
           substring: '['
@@ -455,31 +453,45 @@ pipeline:
           function: string
           params:
             key: actionResult
-            value: "blocked"
-          where: 'exists("log.action") && oneOf("log.action", ["blocked", "prevented"])'
+            value: denied
+          where: exists("log.action") && oneOf("log.action", ["blocked", "prevented"])
 
       # Adding severity based on log.severityLabelCharacter
       - add:
-          function: 'string'
+          function: string
           params:
             key: severity
-            value: 'high'
+            value: error
           where: oneOf("log.severityLabelCharacter", ["C", "A", "E"])
 
       - add:
-          function: 'string'
+          function: string
           params:
             key: severity
-            value: 'medium'
+            value: warning
           where: equals("log.severityLabelCharacter", "W")
 
       - add:
-          function: 'string'
+          function: string
           params:
             key: severity
-            value: 'low'
+            value: info
           where: oneOf("log.severityLabelCharacter", ["D", "V", "N", "I", "T"])
 
+      # Normalize the source event severity.
+      - add:
+          function: string
+          params:
+            key: severity
+            value: critical
+          where: oneOf("log.severityLabelCharacter",["C","A"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: debug
+          where: oneOf("log.severityLabelCharacter",["D","V","T"])
+
       # Removing unused fields
       - delete:
           fields:
@@ -493,4 +505,4 @@ pipeline:
             - log.restMessageToKv
             - log.pidStatusToKv
             - log.userWithTrash
-            - log.severityLabelCharacter
+            - log.severityLabelCharacter

filters/audits/deceptive-bytes.md

@@ -0,0 +1,40 @@
+# Deceptive Bytes normalization and rule review
+
+Use origin.command, canonical denied outcomes, and classify severity before cleanup.
+
+This draft targets UTMStack `v11`. It contains 1 filter changes
+and 0 rule changes for this technology only. Review covered
+1 filter configurations and 16 matching shipped rule files.
+Unchanged rules are listed in the regression manifest; they are not duplicated in the diff.
+
+## Contract and validation
+
+- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries.
+- Checked documented pipeline ordering, rename/move behavior, open vendor log fields,
+  event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping.
+- Strict SDK configuration decoding and actual CEL compilation pass for this scope.
+- 5 synthetic normalization cases pass, including SDK Event conversion and any
+  trigger predicate assertions recorded in the manifest.
+- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied.
+
+The shared alert-contract PR supplies the reusable Go runner for the manifest in
+`plugins/alerts/testdata/filter-contracts/deceptive-bytes.json`. Apply that support before running `go test ./...` in `plugins/alerts`.
+
+The model starts from synthetic extraction results. It does not run complex grok,
+JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch
+queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must
+still be checked in staging before rollout. No customer false-positive reduction
+has been measured and no production rollout is included.
+
+
+
+## References
+
+- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto)
+- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference)
+- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema)
+- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules)
+
+`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom
+`log.*` fields are accepted. Existing textual protocol casing and vendor action names
+are preserved unless a concrete consumer mismatch requires correction.

plugins/alerts/testdata/filter-contracts/deceptive-bytes.json

@@ -0,0 +1,136 @@
+{
+  "technology": "Deceptive Bytes",
+  "filters": [
+    "filters/antivirus/deceptive-bytes.yml"
+  ],
+  "rules": [
+    "rules/antivirus/deceptive-bytes/advanced_threat_tactic_identification.yml",
+    "rules/antivirus/deceptive-bytes/criminal_group_signatures.yml",
+    "rules/antivirus/deceptive-bytes/data_theft_attempt_indicators.yml",
+    "rules/antivirus/deceptive-bytes/deception_api_call_tracking.yml",
+    "rules/antivirus/deceptive-bytes/deception_token_access_patterns.yml",
+    "rules/antivirus/deceptive-bytes/decoy_share_access_monitoring.yml",
+    "rules/antivirus/deceptive-bytes/decoy_system_enumeration.yml",
+    "rules/antivirus/deceptive-bytes/fake_user_authentication_attempts.yml",
+    "rules/antivirus/deceptive-bytes/honey_table_query_detection.yml",
+    "rules/antivirus/deceptive-bytes/lateral_movement_trap_triggers.yml",
+    "rules/antivirus/deceptive-bytes/living_off_the_land_detection.yml",
+    "rules/antivirus/deceptive-bytes/nation_state_tactic_detection.yml",
+    "rules/antivirus/deceptive-bytes/privilege_escalation_bait_detection.yml",
+    "rules/antivirus/deceptive-bytes/ransomware_behavior_patterns.yml",
+    "rules/antivirus/deceptive-bytes/threat_actor_attribution.yml",
+    "rules/antivirus/deceptive-bytes/zero_day_behavior_patterns.yml"
+  ],
+  "fixtures": [
+    {
+      "name": "deceptive_severity_C",
+      "filter": "antivirus/deceptive-bytes.yml",
+      "input": {
+        "log": {
+          "severityLabelCharacter": "[C]",
+          "action": "blocked"
+        },
+        "origin": {
+          "command": "\"example --flag\""
+        }
+      },
+      "expected": {
+        "severity": "critical",
+        "actionResult": "denied",
+        "origin.command": "example --flag"
+      },
+      "absent": [
+        "command"
+      ],
+      "rules": {}
+    },
+    {
+      "name": "deceptive_severity_D",
+      "filter": "antivirus/deceptive-bytes.yml",
+      "input": {
+        "log": {
+          "severityLabelCharacter": "[D]",
+          "action": "blocked"
+        },
+        "origin": {
+          "command": "\"example --flag\""
+        }
+      },
+      "expected": {
+        "severity": "debug",
+        "actionResult": "denied",
+        "origin.command": "example --flag"
+      },
+      "absent": [
+        "command"
+      ],
+      "rules": {}
+    },
+    {
+      "name": "deceptive_severity_E",
+      "filter": "antivirus/deceptive-bytes.yml",
+      "input": {
+        "log": {
+          "severityLabelCharacter": "[E]",
+          "action": "blocked"
+        },
+        "origin": {
+          "command": "\"example --flag\""
+        }
+      },
+      "expected": {
+        "severity": "error",
+        "actionResult": "denied",
+        "origin.command": "example --flag"
+      },
+      "absent": [
+        "command"
+      ],
+      "rules": {}
+    },
+    {
+      "name": "deceptive_severity_W",
+      "filter": "antivirus/deceptive-bytes.yml",
+      "input": {
+        "log": {
+          "severityLabelCharacter": "[W]",
+          "action": "blocked"
+        },
+        "origin": {
+          "command": "\"example --flag\""
+        }
+      },
+      "expected": {
+        "severity": "warning",
+        "actionResult": "denied",
+        "origin.command": "example --flag"
+      },
+      "absent": [
+        "command"
+      ],
+      "rules": {}
+    },
+    {
+      "name": "deceptive_severity_I",
+      "filter": "antivirus/deceptive-bytes.yml",
+      "input": {
+        "log": {
+          "severityLabelCharacter": "[I]",
+          "action": "blocked"
+        },
+        "origin": {
+          "command": "\"example --flag\""
+        }
+      },
+      "expected": {
+        "severity": "info",
+        "actionResult": "denied",
+        "origin.command": "example --flag"
+      },
+      "absent": [
+        "command"
+      ],
+      "rules": {}
+    }
+  ]
+}