…metadata allow-list

Derive `event.outcome` on the auth, server and xvpn families from the vendor `error` return code (`0` maps to success, other codes to failure). The official field documentation lists exactly these three families for `error`; on vpn logs the same key is a severity level and is left untouched. The vendor documentation pairs `0`-first numeric examples with `Success`-first display labels without stating the convention outright, so the mapping follows the strong implication of the field tables.

Map `domain` to `user.domain` and `usergroup` to `user.group.name`, splitting the comma-separated multi-valued form that SNS 5.x emits. On web logs, map `op` to `http.request.method` and `result` to `http.response.status_code`; on other families these keys carry protocol-specific codes (FTP, Modbus) and are not promoted. Map the module name in `service` to `process.name` on the system, sandboxing and routing families only — on pvm logs the same key names the vulnerable product detected on a scanned host. Set `observer.product`. All mappings are copies; the vendor keys remain available under `stormshield.metadata`.

Extend the `stormshield.metadata` allow-list with the documented vendor keys that previously leaked as undeclared `stormshield.*` fields: host and IP reputation (`srchostrep`, `dsthostrep`, `srciprep`, `dstiprep`), alarm packet captures (`pktlen`, `pktdump`, `pktdumplen`), Ethernet protocol (`etherproto`), SSO agent (`agentid`), IKE peer name (`peername`), and the industrial-protocol plugin fields (`unitid`/`unit_id`, `cipservicecode`, `cipclassid`, `requestmode`, `responsemode`, `UI`, `error_class`, `error_code`, `format`).

The NAT reading of the pipeline was verified against the official field tables while preparing this change: `origdst`/`origdstport` are documented as the destination before translation and map to `destination.ip`/`destination.port`; `dst` is the translated destination and maps to `destination.nat.ip` when it differs. A connection sample with the documented example values now locks this in the pipeline tests, alongside new samples for the alarm reputation and packet-capture fields, a Modbus plugin line (whose `result` stays under metadata and does not produce `http.*`), a server line, a system line, and multi- and single-valued `usergroup` forms.

Add three thematic dashboards keyed on the log families the pipeline now categorizes: Network Traffic (connection/filter events, verdicts, endpoints, rules, byte volumes), Web Activity (domains, HTTP methods and return codes, site categories, volumes) and Users & VPN (authentication, administration sessions and IPsec/SSL VPN events with their outcomes, users, directories, groups and peers). Every dashboard scopes its data with dashboard-level `data_stream.dataset` and `stormshield.logtype` filters, keeps panel queries empty, and drops the log-type control that its own filter would contradict.

Add a links panel at the top of the Overview pointing to the four other dashboards, extend it with an appliance health row covering the periodic statistics families (scoped with panel-level queries, since the Overview carries no log-type filter), title its event-count metric panel, and replace the terms aggregation on `event.duration` with a median over time. Fix the dashboard controls, which carried no data view reference and were silently dropped by Kibana at render time. Rename all dashboards to the `[Stormshield SNS]` title prefix so future Stormshield product integrations can share the vendor namespace unambiguously. Replace the outdated Overview screenshot with captures of the five dashboards rendered on a live stack.