fix(meraki): parse native events and scope security alerts

[rvald26]

The Meraki filter did not reliably expose the native event classes and fields consumed by its seven security rules. The documented native envelope starts with fractional epoch, device and event group; the older parser expected a calendar-time wrapper. This draft adds bounded native parsing, preserves legacy event handling, and aligns all seven consumers with the produced fields.

Addresses are captured in vendor fields, cleaned and validated before standard promotion or enrichment. Invalid and alternate zero-address forms stay vendor data. Physical switch interface numbers no longer become transport ports; wireless response timing is not geolocated. Full AMP URLs and valid SHA-256 values populate SDK fields. Header and quoted-field boundaries prevent message content from manufacturing endpoints, classifications or success.

Detection behavior:

• VPN history counts explicit AnyConnect authentication failures from the same source IP, collector and appliance: ten in fifteen minutes. Ordinary same-IP traffic and tunnel negotiation do not fill that threshold.
• AMP keeps the downloading client as network origin and the remote server as network target, then selects the server as the alert adversary. Retrospective events remain eligible without IPs. Valid hashes group by file; absent/malformed hashes use the actual ingress event ID to keep records separate. No execution/compromise claim is inferred from a malicious disposition.
• IDS supports documented legacy source-only records. Evil Twin requires the spoofing class; a generic rogue SSID does not establish spoofing. Wireless packet-flood start events qualify, while end events do not.

Validation uses the pinned go-sdk v1.1.31 for strict configuration decoding, CEL, Event/Alert conversion and actual history-query construction. Standalone raw fixtures cover positive and negative cases for all seven consumers, native/legacy examples, quoted payloads, header injection, IPv6/zero addresses, outcome semantics and grouping identities. SDK history tests use a localhost mock. The shared contract runner also passes. Detailed counts and scope are in filters/audits/cisco-meraki.md.

Live-data limitation: the inspected carrier's nine bounded records were unrelated or unrecognized syslog under the Meraki label. They pass as negative controls, not positive Meraki validation. Searches for documented native signatures found none in the selected window; that is not exhaustive absence proof. Upstream classification remains unresolved, and no customer routing was changed. Public fixtures derive from official vendor examples and contain no customer records.

The raw model does not execute the closed EventProcessor, live enrichment or alert publication. Legacy built-in regex approximations and unobserved firmware variants remain staging limits. Stage filter/rules together, allow VPN history to warm up, inspect alert volumes and parser cost, and review shared grouping #2627 separately. Existing rogue-rule overlap and RSSI policy are retained for team review; the vendor documents removal of those legacy rogue/spoofing events in MR29 and later.

Draft only against official utmstack/UTMStack:v11. No merge, auto-merge, deployment or customer configuration changes.

Fresh draft review submission requested after review of #2601. That earlier PR is retained as historical context and was not modified by this publication. This PR targets the official utmstack/UTMStack:v11; it is not approved for merge.