fix(kaspersky): parse native KSC logs and repair CEF rule contracts

[rvald26]

Security Center native event@23668 records were indexed with only priority parsed. This draft adds the observed structured-syslog format, restores managed-device identity and source time, and repairs the legacy CEF filter/rule contract against ThreatWinds go-sdk v1.1.31 and its wiki.

• Parse bounded native/CEF envelopes and quoted fields, validate original IPs before enrichment, and keep reporting-server identity separate from the managed target. Preserve vendor values and do not infer an attacker or successful connection from device-health messages.
• Use explicit allow/block outcomes; remediation and unknown action names alone no longer imply a connection outcome. All 19 CEF rule consumers are format-qualified. Correct moved/missing field references and quoted-path lookups, and prevent a generic NetworkThreat category or missed block spelling from becoming an unblocked C2 claim.
• Scope four histories to actual candidates and collector/source identity, preserving thresholds, windows and the existing exfiltration history category. Document the up-to-two-hour warm-up and saved-search migration.

Validation: 85 synthetic raw cases, positive/negative predicates for every rule, four actual-SDK history suites against an isolated local mock, and ten bounded private native records. The shared contract overlay passes 115 test/subtest records with no failures or skips. Offline raw replay recovers target IP, host and time in all ten records; none matches an attack predicate, and no actor or action result is invented. Privacy scanning found no sampled device-identifying literals in the changed source/test files.

Limits: the live sample consists of critical-status and unmanaged-device records, not CEF attacks. CEF custom-slot meanings, attack-side semantics and legacy text-heuristic precision remain unverified against real attack telemetry. Official support URLs redirected to generic pages; HTTP success was not treated as format documentation. The extraction model does not run the closed EventProcessor, external enrichment or live historical queries. Staging must verify additional formats, parsing cost and alert-volume effects. Full evidence and migration notes: filters/audits/kaspersky.md.

Filter and rules must ship together. Indexed lastEvent.* grouping depends separately on #2627. No customer writes, deployment, merge or auto-merge is included.

This is a fresh draft requested after rejection/review of historical #2594. That earlier PR is retained and unchanged. Target: the actual utmstack/UTMStack:v11 repository.