fix(deceptive-bytes): align parsed fields and correlation consumers - #2666

The Deceptive Bytes filter discarded commands at finalization, emitted errors for absent optional KV inputs, and wrote a nonstandard blocked outcome. Several rules also compared KV values with native booleans, although KV stores strings, and four history rules searched on placeholders an event may lack. This draft preserves commands as origin.command, guards the three optional KV steps, maps explicit blocked/prevented outcomes to denied, and changes seven existing rules. The original vendor action remains available.

Five rules use string-boolean comparisons that also accept native true in go-sdk v1.1.36; the data theft, advanced threat tactic, zero-day and ransomware rules now require the fields their history searches use (origin.ip, and log.tacticName or log.processName; the ransomware rule log.process and log.source_ip). Otherwise a missing placeholder fails the search, and five failures switch the rule off with a Circuit Breaker alert. Existing event labels, thresholds, time windows, attribution and severity-letter mappings are retained.

Re-validated on the latest versions (2026-09-24): official v11 d2479c1a (merged into this branch, no conflicts; plugins/alerts now pins go-sdk v1.1.36) and EventProcessor main 8a3ade7, the same source revision as the newest published engine image (eventprocessor:v11.2.14), compiled natively here. Since go-sdk v1.1.35 the field-name sanitizer keeps underscores, so KV stores the vendor's own keys (log.event_type, log.source_ip). An earlier revision of this draft respelled 18 such names in six rules without underscores, as the older SDK stored them; on the latest engine those names never match, so this revision restores the original names. Lateral movement, living off the land and privilege escalation are again identical to v11; ransomware differs from v11 only by its placeholder guard.

Validation (EventProcessor 8a3ade7, go-sdk v1.1.36):

• Original/corrected raw parser comparison: four fabricated input pairs verify command retention, present-KV preservation, blocked outcome normalization and missing-source error removal. The results equal those of the earlier build.
• KV names: the committed fabricated lines carry all 18 underscored keys, and the playground stored every one with its underscore and none without it.
• Rules in the playground: with the respelled names the Living Off The Land positive raised no alert; with the restored names the Living Off The Land, nation-state and privilege-escalation positives each raised exactly one intended alert, and the near-miss and other lines none.
• go-sdk v1.1.36 rule replay over those events, plus copies given an origin.ip and synthetic events for the boolean rules: each rule matched only its intended case, every history placeholder resolved on those matches, and the respelled names matched nothing (89/89 checks). With the ransomware guard, two copies of the ransomware line that each lack one placeholder field no longer match (65/65 checks); the unguarded rule matched both with unresolved placeholders.
• The history-guard test covers the four history rules: no match without any one of the fields a search needs, a match with them, and every placeholder resolved.
• A committed, reproducible EventProcessor runner includes eleven fabricated raw cases, common regex definitions, exact field/error assertions and positive/negative alert assertions. It stages only local parser/CEL/file-writer plugins.
• Full plugins/alerts Go suite on go-sdk v1.1.36: 48 pass, 11 skip (other technologies' private-evidence tests, same as the base), 0 fail, also after the ransomware guard. All 16 source rules compile; boolean compatibility controls cover strings, native booleans and negative types.

Evidence limits: source discovery found no retained Deceptive Bytes documents in 29 successful queries; two discovery attempts failed. These corrections are grounded in SDK/wiki and public parser behavior, not claimed as customer-log validation. The tested EventProcessor commit is 8a3ade72bd9d12db21f6b273200588fb49540f14, with go-sdk v1.1.36 in the playground and every plugin, the version this module pins; it is not asserted to match a customer deployment. Actual vendor event populations, deployed extraction, history, grouping and notifications remain unverified. The source audit documents these limits and reproduction commands.

Replaces closed #2592 with raw-input extraction and executable rule-alert checks addressing its review feedback. Draft against v11 for team review; no deployment or merge is requested.

Hosted CI: the architecture, bugs and security review jobs in run 35892985326 all stop before review at ai-review.sh:29 because THREATWINDS_API_KEY is required. All three job logs were checked. Prompt discovery passed; Go dependency checking was still running. This infrastructure failure is separate from the passing local tests and is not a completed AI review.

🤖 Generated with Claude Code