Fix AWS CloudTrail outcomes, field mappings and correlation consumers

[rvald26]

CloudTrail fields were removed before their consuming rules ran, normal successful calls were rejected because errorCode was absent, and console failures containing only errorMessage could be classified as successful. This replacement repairs the AWS filter and all 73 rule consumers across both AWS rule directories.

• Preserve original nested vendor fields and existing aliases; normalize caller identity, usable IPs, time and explicit outcomes using SDK v1.1.31. Accept both original and sanitized nested S3 header spellings; the closed parser’s recursion is not assumed.
• Fix structured JSON predicates, root/MFA handling, exact cross-account comparison, Route 53 Domains names, GuardDuty finding envelopes and exposure/removal distinctions.
• Scope all 22 historical correlations to the relevant event population and account/collector/actor; repair SAML sequencing and Secrets Manager OR thresholds. Correct titles and classifications that claimed more than the API event establishes.
• Retain mutually exclusive grouping/deduplication settings and add account scope. Shared alert value-resolution support is in draft fix(alerts): resolve last-event grouping and document its rollout #2627.

Validation: 190 synthetic raw cases with positive/negative assertions for every rule, 31 official AWS examples with explicit expectations, and 22 actual SDK history suites against an isolated mock. The source suite passes 278 records with zero failures/skips. An integration of the ten completed replacement heads against official v11 a1214909caae5957a3005a5ddf131b32410d7054 passes 1,607 records with no conflicts or failures; eight private/documentation tests are skipped there and covered by separate source runs. The newer Microsoft 365 changes remain intact; rejected pending-source branches are not overlaid in this check.

Limits: no AWS records were retained on the 30 reachable instances; one other instance was unavailable. No live AWS parser/alert or false-positive reduction is claimed. Nested service parameter variants need customer/staging confirmation. Legacy S3 byte-direction mappings remain explicitly unverified and unchanged in direction; invalid numeric values are now guarded. Existing administrative heuristics still require tuning. The filter and rules must ship together, with up to 24 hours of new correlation history.

Full evidence, migration notes and limitations: filters/audits/aws.md.

Historical review input: #2596 at cd4034746a957520acad719929678029d6a2a36f, left untouched. This is a new draft against the actual UTMStack v11 repository, for team review only. Nothing was deployed or merged, and auto-merge is not enabled.