[adbhogeGit]

Fixes #

Proposed Changes

• Register all standard EmailEvent filtering parameters in both ASIM CI validators.
• Validate recipient matching across EmailToRecipients, EmailCCRecipients, and EmailBCCRecipients; test sender/subject has-any, direction/location membership, IP prefixes, event result, defaults, and pack behavior.
• Use the mapped EventStartTime/EventEndTime columns for datetime filtering and check in-range and out-of-range boundaries.
• For sparse, constant, or unavailable fields, keep match/default/absent checks and report non-selective coverage as partial instead of failing solely for low cardinality.
• Add deterministic regression tests and document the legacy validator behavior.

Required items, please complete

Change(s):

• Added EmailEvent support to .script/tests/asimParsersTest/ASimFilteringTest.py and ASIM/dev/ASimTester/filteringTest/ASimFilteringTest.py.
• Added focused regression tests for the EmailEvent catalog, dynamic recipient arrays, Message-like sender/subject data, sparse MailLog-like data, datetime boundaries, unavailable columns, pack/disabled controls, and existing schemas.

Reason for Change(s):

• Message and MailLog parser validation currently fails before exercising filters because EmailEvent is missing from the validator schema catalog.
• Parser PRs ASIM: Add Proofpoint POD Message EmailEvent parsers #15409 and ASIM: Add Proofpoint POD MailLog EmailEvent parsers #15410 depend on this shared fix; no parser changes are included here. Rerun their hosted filtering jobs after this PR merges.
• The hosted filtering job fetches its validator script from master, so it will use this implementation after merge.

Version Updated:

• N/A — this change does not update a detection or analytic rule template.

Testing Completed:

• & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s .script\tests\asimParsersTest -p 'test_asim_filtering_validator.py' -v — passed (12 tests).
• & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m py_compile .script\tests\asimParsersTest\ASimFilteringTest.py .script\tests\asimParsersTest\test_asim_filtering_validator.py ASIM\dev\ASimTester\filteringTest\ASimFilteringTest.py — passed.
• git --no-pager diff --check — passed.
• No live Azure workspace query or hosted parser-filter run was performed.

Checked that the validations are passing and have addressed any issues that are present:

• Local deterministic regression and syntax checks pass. Live workspace/hosted validation remains to be rerun after merge.