fix(fortiweb): repair parsing and align attack detections

[rvald26]

FortiWeb attack logs can miss detections because quoted classifications/messages are truncated, rules consume different sanitized names and decision values, and the deployed web-shell expression fails SDK CEL compilation. This draft repairs the filter and all seven existing rules, and adds dedicated XSS, Known Exploits and Trojans detections.

The meeting follow-up validates the selected vendor IP at its original promotion, preserving invalid values under canonical log.src/log.dst and rejecting expanded/mapped zero addresses before enrichment. It also recovers complete HTTP_agent values in log.httpagent and removes relative HTTP request URIs from the SDK's filesystem target.path; they remain in log.httpurl. Explicit absolute HTTP(S) URLs still use target.url. Alias precedence and actual network direction are preserved.

Vendor decisions remain in log.action; explicit blocks produce actionResult=denied. Alert and other decisions do not establish successful exploitation. Specific classified attacks have discrete triggers; generic attacks, upload violations and selected OWASP violations retain scoped history thresholds. All ten rule consumers were reviewed against actual filter output. SDK v1.1.31 protobuf and official wiki are authoritative.

Validation:

• 102 fabricated raw fixtures, including positive cases for all ten predicates, strict SDK decoding/CEL and Event conversion. The model exercises KV residuals, quoted-field/header boundaries, alias precedence, invalid/zero IPs and user-agent recovery.
• Actual SDK history queries against a local mock for all three threshold rules: count/window boundaries, source/target/classification separation, benign raw history exclusion and all 19 missing required placeholders.
• Bounded read-only replay of 24 current records from two instances and comparison with their deployed filter. All sampled IPs/ports are preserved; 23 truncated user-agents are recovered, all 24 complete values are checked, and eight explicit blocks gain denied outcomes. Five predicate candidates are not a claim of generated alerts or satisfied live thresholds.
• Shared schema/consumer and negative normalization controls, plus git diff --check. Public fixtures are synthetic; customer payloads and identifiers remain private.

The raw harness models documented transforms; it does not execute the closed EventProcessor, external enrichment or live alert publication. All sampled URLs are relative and usernames are placeholders. Unix-nanosecond event time remains vendor data pending a verified supported conversion. No production before/after alert-volume claim is made.

Stage filter and rules together, allow history windows to warm up, and verify parser throughput, alert IDs and burst behavior. Existing indexed truncation is not repaired. Custom consumers of root decision action must migrate to log.action; relative target.path consumers of the earlier draft must use log.httpurl. Review shared grouping #2590 separately. Details: filters/audits/fortiweb.md.

Draft only against official utmstack/UTMStack:v11. No merge, auto-merge, deployment or customer configuration changes.