feat(eval): built-in cloud/SaaS/container schema signatures

[mostafa]

Summary

Adds always-on, built-in schema signatures so rsigma recognizes common cloud, SaaS, and container event shapes out of the box and derives a SigmaHQ taxonomy-compatible logsource for conflict-based rule pruning.

Sources recognized:

• AWS CloudTrail (aws_cloudtrail) and VPC Flow Logs (aws_vpcflow)
• Azure Activity, SignIn, and Audit logs (azure_activitylogs, azure_signinlogs, azure_auditlogs)
• GCP Cloud Audit (gcp_audit)
• Microsoft 365 unified audit log (m365_audit)
• GitHub Audit (github_audit)
• Okta System Log (okta_system_log) and OneLogin (onelogin_events)
• Kubernetes audit (k8s_audit), Docker events (docker_events), and osquery (osquery_result)

Each signature uses multi-field markers for high specificity with no misfires, and maps to an implied product/service logsource. Off-taxonomy sources (Kubernetes, Docker, osquery) carry logsource.custom dimensions instead of inventing product values SigmaHQ does not use, and VPC Flow Logs ships as product: aws plus custom: {source: vpcflow}.

Details

• Signatures live in builtin_signatures() with the implied logsource in builtin_schema_logsource() and a specificity-ordered builtin_schema_names(), guarded by a consistency test.
• A gcp_audit.yml pipeline strips the data. prefix that SigmaHQ's gcp.audit rules use (data.protoPayload.*) so they match native Cloud Logging events (protoPayload.*). An end-to-end test proves a native event matches only after the pipeline runs.
• The Microsoft 365 signature targets the Office 365 Management Activity common schema and maps to service: audit, where SigmaHQ's native-field rules live. SigmaHQ's exchange, threat_detection, and threat_management services are written against a separately normalized shape (eventSource/eventName/status) that is not part of the Management Activity common schema, so raw events are intentionally not classified into those services.

Tests

• Per-source golden fixtures (test_event.json + expected_classification.yaml) with a walk test asserting the resolved schema name, specificity, and implied logsource, plus a check that every fixture maps to a known schema.
• Specificity-ordering and no-shadowing unit tests.
• End-to-end GCP routing test.

cargo test -p rsigma-eval, cargo clippy --all-targets --all-features -- -D warnings, cargo fmt --check, and docmd validate all pass.

Docs

• New cloud collection recipes guide with Vector, OTel, and Fluent Bit configs per source.
• Updated schema signature reference and schema routing tables.