Initial commit: SIEM Toolkit for SentinelOne

Dockerized SecOps toolkit with:
- Coverage Map: STAR rule vs SDL parser field coverage analysis
- Ingest Dashboard: PowerQuery-powered event volume and source breakdown
- Onboarding Assistant: AI-guided log source onboarding with Claude
- Parser management via SDL MCP integration

Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose.
PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

parsers/cisco_duo-latest

@@ -0,0 +1,42 @@
+{
+  "attributes": {
+    "dataSource.vendor": "Cisco",
+    "dataSource.name": "Cisco Duo Security",
+    "dataSource.category": "security"
+  },
+  "formats": [
+    {
+      "format": "$unmapped.{parse=json}$",
+      "rewrites": [
+        { "input": "unmapped.timestamp", "output": "timestamp", "match": ".*", "replace": "$0" },
+        { "input": "unmapped.time", "output": "time", "match": ".*", "replace": "$0" }
+      ]
+    }
+  ],
+  "mappings": {
+    "version": 1,
+    "mappings": [
+      {
+        "predicate": "unmapped.class_uid = '3002'",
+        "transformations": [
+          { "copy": { "from": "unmapped.activity_id", "to": "activity_id" } },
+          { "copy": { "from": "unmapped.activity_name", "to": "activity_name" } },
+          { "copy": { "from": "unmapped.type_uid", "to": "type_uid" } },
+          { "copy": { "from": "unmapped.severity_id", "to": "severity_id" } },
+          { "copy": { "from": "unmapped.status_id", "to": "status_id" } },
+          { "copy": { "from": "unmapped.status", "to": "status" } },
+          { "copy": { "from": "unmapped.message", "to": "message" } },
+          { "copy": { "from": "unmapped.user.name", "to": "user.name" } },
+          { "copy": { "from": "unmapped.user.account_uid", "to": "user.account_uid" } },
+          { "copy": { "from": "unmapped.user.account_type", "to": "user.account_type" } },
+          { "copy": { "from": "unmapped.src_endpoint.ip", "to": "src_endpoint.ip" } },
+          { "copy": { "from": "unmapped.src_endpoint.location.desc", "to": "src_endpoint.location.desc" } },
+          { "copy": { "from": "unmapped.src_endpoint.location.city", "to": "src_endpoint.location.city" } },
+          { "copy": { "from": "unmapped.src_endpoint.location.country", "to": "src_endpoint.location.country" } },
+          { "copy": { "from": "unmapped.auth_protocol", "to": "auth_protocol" } },
+          { "copy": { "from": "unmapped.mfa_factors", "to": "mfa_factors" } }
+        ]
+      }
+    ]
+  }
+}