Add custom lookup enrichment tables

[jusso-dev]

Problem

Threat intel enrichment is useful, but many investigation decisions depend on local context: asset criticality, user role, cloud account ownership, known service accounts, vulnerability exposure, and network zone.

Scope

Add tenant-scoped lookup tables that can enrich events, alerts, signals, and cases with local business/security context.

Implementation Notes

• Add lookup table models: soc_lookup_table, soc_lookup_row, and optional soc_lookup_version.
• Supported first-pass lookup types: asset inventory, user directory, cloud account map, network zone map, vulnerability exposure, allowlist or known-benign entities.
• Support CSV upload/paste for local development.
• Each lookup table needs a primary key and selector mapping.
• Enrichment should attach structured context to alerts/signals and be visible in alert detail.
• Risk scoring should account for asset criticality, user role, environment, and known-benign context.

Acceptance Criteria

• Admins can create a lookup table and add rows.
• Ingested or retained records can be enriched by matching canonical indicator fields.
• Alert detail shows matched lookup context separately from threat intel.
• Risk scoring can increase for critical assets and decrease for known-benign entities.
• Lookup changes are versioned or auditable.

Tests

• Unit test lookup matching by exact value.
• Unit test CIDR/network-zone matching if implemented in first pass.
• Unit test enrichment does not cross tenants.
• Workflow test alert risk changes based on lookup context.