[IXI-2773]

Summary

• Recognize _time through the existing timestamp alias table; retain explicit-timezone validation, alias-conflict rejection, evidence references and identity quarantine.
• Add one shaped authentication CSV contract, a valid/malformed fixture pair and nine focused regression tests.
• Retain actual CLI JSON/HTML outputs for valid and mixed inputs, with input and implementation hashes. Refresh the existing demo artifacts for the changed implementation hash without changing its declared outcomes.
• Present the employer-facing case as Authentication Export → Analyst Case Report. Methodology clearly identifies synthetic input data; no live integration or production-telemetry claim.

Validation already completed on this exact head

• Nine new importer tests failed before the alias addition and passed after it.
• Four targeted existing regression checks passed.
• Valid CLI: 8 accepted, 0 rejected, 1 candidate; exit 0.
• Mixed CLI: 7 accepted, 7 rejected, 0 candidates; exit 2; all 14 source records retained.
• Existing 20-row demo: unchanged counts, rule IDs and resolvable references; retained outputs refreshed once to bind the changed source.
• All committed changed files read back and matched their checked contents.
• No full test suite, live Splunk session, PC/Commander access or external response action.

Merge scope

Only projects/10-soc-triage/**. User requested merge. Use normal repository validation and squash merge; no protection bypass or manual rerun of established importer checks.