[Mapping] Refactor VMWareNSX.xif for improved log parsing

[content-bot]

Original External PR

external pull request

Contributor

@simonsigre

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• [] In Progress
• Ready
• In Hold - (Reason for hold)

Description

Replaces the shipped VMware NSX modelling rule to correctly support RFC 3164
syslog from NSX Manager, Edge and Node appliances. The rule is now fully
self-contained, parsing directly from _raw_log rather than relying on
parsed_fields, which the bundled parser never populates for RFC 3164 events.

Key improvements:

• Parses the complete syslog envelope (PRI, hostname, process and PID),
  including relay-forwarded messages.
• Supports both RFC 3164 and ISO 8601 timestamp formats.
• Corrects PRI-to-severity mapping using valid Cortex log levels.
• Fixes incorrect source port mapping and removes invalid device model fields.
• Adds per-record classification for authentication, network, command,
  audit and system events, with an unmodelled catch-all.
• Correctly handles NSX login success/failure events that the bundled rule
  fails to detect.
• Preserves compatibility with the existing VMware NSX dataset while
  providing improved field coverage and event classification.

Must have

• Tests
• Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-17349

[content-bot]

🤖 AI-Powered Code Review Available

You can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[content-bot]

⚠️ The PR is missing the ready-for-pipeline-running label. Please add the label when the PR is ready in order to proceed.

[content-bot]

Validate summary
The following errors were thrown as a part of this pr: RN106.
The following errors cannot be ignored: RN106.
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.
The following errors don't run as part of the nightly flow and therefore can be force merged: RN106.

Verdict: PR can be force merged from validate perspective? ✅

[content-bot]

🔍 AI Triage Report Available

An automated triage report has been generated for this pipeline.

Status: failed
Report ID: e4c5356b58a455cb

📋 Triage Report
💡 Resolutions are available in the full report.

⚠️ AI-generated triage. Validate before acting.