Add CEF and LEEF parsers (SIEM event formats)

[copyleftdev]

Implements the CEF / LEEF SIEM plugins — issue #9.

Two parsers for the ArcSight/QRadar wire formats (one row per event). The
category fields — signatureId/name (CEF), eventId (LEEF) — and severity
are exactly what dist.chi2 reads as a signature/category mix shift, and a
value never seen in the baseline surfaces as a new category automatically.

CefParser

CEF:Version|Vendor|Product|Version|SignatureID|Name|Severity|ext. 7
pipe-delimited header fields with \| / \\ escaping, then a space-separated
extension whose values may contain spaces — a new key begins only at a
space-preceded ident=, with \= / \\ / \n value escaping. severity is
type-inferred (numeric, or a named level); extension values inferred. Extension
absent (7-field) and escaped pipes handled. Extension .cef.

LeefParser

LEEF:Version|Vendor|Product|Version|EventID|[Delimiter|]ext. 5 header fields;
LEEF 2.0 adds an explicit delimiter field (a char or xHH hex), LEEF 1.0 uses a
tab. Extension is plain key=value. Extension .leef.

Routing & errors

Detected by the CEF: / LEEF: prefix (STRONG). A line missing the prefix or
with too few header fields is a clean AxError::Parse.

Gates

• fmt / clippy -D warnings / full workspace tests green (both feature sets).
• Mutation gate: 0 surviving mutants on cef.rs (73 caught, 4 unviable, 4
  loop-bound timeouts). The CEF extension-scan i = j + 1 advance has one
  documented-equivalent variant (+→* sets i = j, which skips the =
  next iteration → identical keys); the +→- variant re-detects a 1-char key
  forever and is caught as a timeout (a=1 b=2 test).
• Smoke: CEF & LEEF route by content/extension; a signatureId mix shift is
  flagged by dist.chi2 --baseline (exit 1).

Closes #9

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@copyleftdev, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 35 minutes and 9 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e555b35-fe4e-4856-be47-82c79e4317c9

📥 Commits

Reviewing files that changed from the base of the PR and between 90bde12 and 1d6675d.

📒 Files selected for processing (4)

• .cargo/mutants.toml
• crates/ax-normalize/src/parser.rs
• crates/ax-normalize/src/parsers/cef.rs
• crates/ax-normalize/src/parsers/mod.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/cef-leef

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}