feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall #4220

Is your feature request related to a problem? Please describe.

Cisco Secure Firewall Threat Defense analytics in ESCU already cover:

• High EVE threat confidence (ML-ish encrypted path) as an intermediate finding
• High-priority classic Snort intrusion classifications as stronger findings

Missing: an explicit SnortML (GeneratorID / GID 411) path that encodes the hard rule ML probability ≠ signature true positive, plus a signature + EVE corroboration analytic for dual-signal FIX_NOW-class triage.

Without that split, agentic / automated response consumers over-trust ML-only highs and under-train corroboration — inflating false containment.

Describe the solution you'd like

1. Detection: Cisco Secure Firewall - SnortML High Confidence ML-Only
   • EventType=IntrusionEvent GeneratorID=411 (elevated Impact)
   • Type: Anomaly / intermediate finding (escalate/corroborate — not auto-contain)
2. Detection: Cisco Secure Firewall - Signature Plus EVE Corroboration
   • Classic Snort (GeneratorID!=411) joined with ConnectionEvent EVE_ThreatConfidencePct >= 80
   • Type: TTP / higher finding score
3. Companion attack_data samples for unit tests under
   datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/ and .../dual_signal_corroboration/
4. Attach both detections to analytic story Cisco Secure Firewall Threat Defense Analytics

Describe alternatives you've considered

• Only tuning known_false_positives on High EVE — helpful but does not surface GID 411 as a first-class signal class.
• Risk-rule-only correlation outside ESCU — weaker distribution to ES customers.

Additional context

• Draft detection YMLs + attack_data samples prepared locally; will open PRs after CLA + maintainer feedback.
• Sister labeled corpus: feat: labeled dual-signal SnortML+signature and Splunk-notable triage corpus Cisco-Talos/EvidenceForge#389
• I will sign the Splunk Contributor License Agreement before any mergeable PR: https://www.splunk.com/goto/individualcontributions
• Prefer discussing approach here before opening the PR (per CONTRIBUTING).

CLA status: pending signature (will confirm in thread once completed).