Package everpure/flashblade Release Notes

Added threat detection rules for critical FlashBlade administrative operations (pass-through detections to NG-SIEM):
- PURE-FB-SYSLOG-CHANGE: Detects syslog target additions, modifications, or deletions (purelog setattr/create/delete)
- PURE-FB-NTP-CHANGE: Detects NTP server configuration changes (purearray setattr --ntpserver)
- PURE-FB-FS-DESTROY: Detects file system destruction (purefs destroy)
- PURE-FB-EXPORT-DELETE: Detects SMB/NFS export deletions (purefs export delete)
- PURE-FB-FS-PROTOCOL-REMOVE: Detects protocol/export removal from file systems (purefs remove)
- PURE-FB-S3-BUCKET-DESTROY: Detects S3 bucket destruction (purebucket destroy)
- PURE-FB-DNS-CHANGE: Detects DNS nameserver configuration changes (puredns setattr --nameservers)
Updated event.action to use coalesce([Vendor.Action, Vendor.Subcommand]) instead of lower(Vendor.Action)
Added event.provider field mapped from Vendor.UI
Updated process.command_line to include full command string formatted as Command Subcommand Arguments
Removed process.args[] array field (previously split from Vendor.Arguments)
Simplified host.hostname assignment to use inline lower() within coalesce()
Added network.protocol field for export/protocol-related detections
Added rule.id, rule.name, rule.category, and rule.description fields for threat detections
Updated ECS version to 9.4.0

Added support for GUI and CLI session logs (purity.guisession and purity.clisession)
Enhanced heartbeat message parsing for system monitoring
Improved source address handling with IP/domain classification
Updated ECS version to 9.3.0
Enhanced regex patterns for better alert message parsing
Added session authentication event categorization

Initial release with support for Pure Storage FlashBlade logs
Added parsing for purity.alert, purity.audit, and purity.test log categories
Normalized fields to ECS format including event.action, event.created, event.reason, and more
Implemented severity mapping from text values to numeric scores