Fix Azure event mappings, outcomes and correlated detections

[rvald26]

Azure records can lose the initiating identity or nested HTTP/Kubernetes fields, and a Key Vault request can report successful logging while access was unauthorized. This replacement for #2597 corrects those mappings, gives explicit denial evidence precedence, and updates the consuming rules and their historical populations together.

The draft reviews all 46 original rules: 40 survive with corrected predicates, five redundant definitions are consolidated, and the managed-identity token-substring heuristic is proposed for retirement. The latter is a coverage decision for review, not a claimed replacement detection. Requested Owner roles and public-access settings require explicit values; the caller's authorization role is never treated as the granted role. The audit lists every retired rule and the native evidence.

Validation: 449 passing source test records, including 185 synthetic raw cases under both nested-key models, 21 private native records, all 40 surviving predicates and ten actual-SDK history scenarios using an isolated mock. A separate native before/after comparison confirms both sampled Key Vault Authentication records change from modeled success/401 to denied/401. On current v11 (a1214909), the combined completed draft set has 2,027 passes, nine explicitly skipped private/reference tests, zero failures, with no file collisions or upstream overlap. The private Azure checks pass in the separate source run.

Rollout limits: both inspected active Azure pipeline directories currently lack an Azure filter. This repository change does not enable a missing customer configuration. Tests model extraction and use go-sdk v1.1.31 for schemas/CEL/history; they do not execute the closed EventProcessor or prove live alerts. Some families use documented-schema fixtures because qualifying native events were not observed. Deploy the filter and consumers together only after review, allow four hours for new history markers, retire database-loaded duplicate/unsupported rules explicitly, and review saved searches plus parsing cost in staging. Shared draft #2627 supplies indexed lastEvent.* grouping support and the contract tests.

No customer writes, production deployment, merge or auto-merge. Historical #2597 is preserved. Details and primary references: filters/audits/azure.md.