Update Cortex XDR telemetry for macOS Network and Trust features

[malwr4n6]

Description

This PR updates the Palo Alto Cortex XDR telemetry matrix mappings on macOS for Network Connections, DNS Queries, Binary Signature recording, and SHA-256 process availability. Mappings have been transitioned from unpopulated/pending states to "Yes" based on log verification directly from a running endpoint sensor.

Environment Details

• Operating System: Apple macOS
• Vendor/Sensor: Palo Alto Networks Cortex XDR Agent
• Telemetry Type Verified: Cloud Console Structured Schema Output

Telemetry Capability Proof Matrix

Based on log telemetry matching, the following standard capabilities are cleanly recorded by the sensor and passed up to queryable indexes:

1. Network Connections (Status: Yes)

   • Log Validation: action_type matches "Network Connections".
   • Captured Fields: Explicit capture of tracking metrics including protocol (TCP/UDP), local socket configurations (src_ip/src_port), remote endpoints (dst_ip/dst_port), and connection outcomes (session_status = Success/Failed).
   • Contextual Fields: full multi-generational process context mapping is natively bound (src_process_path, src_cmd, os_parent_path, src_cgo_path).

2. DNS Query tracking (Status: Yes)

   • Log Validation: Captured standalone resolution entries on port 53.
   • Captured Fields: Successfully populates dns_query_name with exact requested domains (e.g., identity.walmart.com, beacon.walmart.ca, slackb.com) tied down to the unique process path that generated the outbound query.

3. Binary Signature Info Recorded (Status: Yes)

   • Log Validation: Verification fields tracking binary signature structures are captured natively.
   • Captured Fields: Populates src_signature, os_parent_signature, and dst_cgo_signature status fields as "Signed" directly inline with executable execution streams.

4. SHA-256 Available (Status: Yes)

   • Log Validation: Cryptographic process hashes are tracked in the same log entries.
   • Captured Fields: Provides full 64-character process sequence checksum hashes within fields like src_sha256 and src_cgo_sha256.

[tsale]

Hi @malwr4n6, thanks for this PR. I think you forgot to provide the evidence. Please provide evidence as per our guidelines.