fix(eset): align JSON parsing and endpoint detection contracts

[rvald26]

The ESET filter and its consumers disagreed on event classes, deleted fields and endpoint identity. Rules used a numeric syslog header as the event type, searched a JSON body removed by the filter, or correlated on the management relay instead of the managed endpoint. This draft repairs the producer/consumer contract for ESET's documented JSON export.

The filter now handles bounded JSON/syslog envelopes, actual sanitized vendor keys and original-field IP validation. It keeps network source/destination roles and assigns managed-host metadata according to direction. Additional verified mappings include users, processes, directories/basenames, OS, object URLs, SHA-1, detection metadata and UTC event time. It retains vendor severity/detail, removes temporary duplicate JSON storage, and assigns outcomes only from explicit class-appropriate evidence. Handling or deleting a detected object does not imply successful malicious execution or a network connection.

All thirteen existing rules were reviewed and aligned with structured fields; inbound botnet detection is split into a separate rule so both directions select the remote adversary correctly. Generic network detection excludes those botnet events to avoid contradictory attribution. Ordinary HIPS policy blocks and successful console administration do not establish malicious activity. The three history consumers count only matching candidates scoped by collector and managed endpoint; console history also scopes the attempted account.

Validation and limitations are detailed in filters/audits/eset.md. The standalone suite uses the pinned go-sdk v1.1.31 for real CEL and protobuf contracts over a bounded raw-extraction model. Its 155 raw cases cover positive and negative cases for every consumer, parser/field boundaries, explicit outcomes, IP-less endpoint identity and history-marker parity. All three SDK history consumers pass threshold, window, identity and noncandidate controls against a localhost mock. SDK Event/Alert field checks cover all fourteen consumers. The final shared-runner overlay passes 182 test/subtest records with no failures or skips; these are offline checks, not generated alerts.

No live ESET raw/normalized pair was available: fresh retained-source counts returned zero on thirty reachable v11 instances; one remained unreachable. Official current ESET export documentation provides the field shapes and meanings. Older references redirect to end-of-life notices, and the vendor explicitly does not enumerate every application/version's values. Detection-label examples and compatibility result spellings are synthetic, not claimed as observed live values. Unknown direction, missing endpoint identity and unsupported historical variants remain explicit gaps.

Stage filter and rules together, allow up to one hour for history markers, and verify actual alert output, volumes and parser cost before production approval. Thresholds count indexed events, not vendor aggregate occurrences. Review saved-search compatibility and the separate shared grouping rollout in #2627.

Draft only against official utmstack/UTMStack:v11. No merge, auto-merge, deployment or customer configuration changes.

Fresh draft review submission requested after review of #2593. That earlier PR is retained as historical context and was not modified by this publication. This PR targets the official utmstack/UTMStack:v11; it is not approved for merge.