feat: map IOC scores to Sigma-aligned log levels

[RuneCode14]

Summary

Map IOC scores (0–100) to Sigma-aligned log levels for both filename and C2 IOCs, so downstream consumers (SIEM, dashboards) can filter IOC matches the same way they filter Sigma alerts.

Score-to-Level Mapping

Score	Level	Log Level
0–39	info	log.Info
40–59	low	log.Info
60–74	medium	log.Warn
75–89	high	log.Error
90–100	critical	log.Error

Changes

C2 IOCs (c2.go)

• Parse optional ;SCORE suffix (e.g., evil.com;65)
• Default to score 80 (high) when no score is specified
• Reject indicators with invalid FQDN characters (whitelist: [a-zA-Z0-9.-])
• Specific warning when : is used instead of ; (common typo)
• Emit ioc_score and ioc_level fields in match logs

Unified scoreToLevel() (iocconsumer.go)

• Single mapping function used by both filename and C2 IOC consumers
• Returns both log.Level and human-readable level name
• Replaces old logLevelForFilenameScore() (kept as backwards-compat wrapper)

Example Log Output

{
  "ioc_type": "c2",
  "ioc_field": "DestinationIp",
  "ioc_value": "176.123.5.126",
  "ioc_indicator": "176.123.5.126",
  "ioc_score": 65,
  "ioc_level": "medium",
  "level": "warning",
  "message": "IOC match"
}

Tests

• TestC2IOCWithScoreParsing — scored + unscored C2 entries, correct level mapping
• TestLoadC2IOCsWithScores — score parsing at load time
• TestLoadC2IOCsRejectsMalformedEntries — colon typo, whitespace, underscores, empty indicator, non-numeric score
• TestLoadFilenameIOCsThreeFieldFormat — REGEX;SCORE;FP_REGEX format with FP exclusion validation
• TestLoadFilenameIOCsRejectsMalformedEntries — missing score, invalid regex, bad FP regex
• TestScoreToLevel — boundary tests for all level transitions
• TestFilenameIOCLevelField — ioc_level emitted at all 5 severity tiers
• TestValidateRealC2IOCs / TestValidateRealFilenameIOCs — integration tests against production IOC files

Production IOC Validation

Tested against /opt/aurora-linux/resources/iocs/:

• C2: 1,773 IOCs (1,655 domains, 118 IPs) — 100% accepted ✅
• Filename: 3,732 entries (30 with FP exclusions) — 100% accepted ✅

Backwards Compatibility

• Unscored C2 entries default to score 80 → error level (same as before)
• Filename IOC scoring unchanged (already had scores)
• logLevelForFilenameScore() preserved as wrapper for any external callers