T1621 PingID: add UPN and multiple-reset regression fixture

Add five synthetic PingID device-pairing events and six Windows 4723/4724
password events for PingID New MFA Method After Credential Reset.
Cover UPN-to-bare username matching, multiple resets and nearest-reset
selection, exclusion outside the one-hour window, and simultaneous
pairings from distinct source IPs. Register both files in the manifest.

Use lab identities and reserved documentation IPs. Companion to
splunk/security_content#4298.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: sbaker-gre

datasets/attack_techniques/T1621/pingid/pingid.yml

@@ -15,3 +15,11 @@ datasets:
   path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset.log
   sourcetype: XmlWinEventLog
   source: XmlWinEventLog:Security
+- name: pingid_upn_multi_reset
+  path: /datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log
+  sourcetype: _json
+  source: PINGID
+- name: windows_pw_reset_upn_multi_reset
+  path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security

datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:88c40b8ac88a337232ef97a5abb41c9a02eaf00eab0222d5035e1992b1f71030
+size 1605

datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:955603e9fd6db90ebea96592c2c3a2cf75039227b1120033d3a4d60ecc6df88b
+size 5728