fix timestamps to int64 for higher resolution

[viktorbeck98]

Task

#271

Description

Changed timestamp resolution from int 32 to int 64.

How Has This Been Tested?

With new tests.

Checklist

• This Pull-Request goes to the development branch.
• I have successfully run prek locally.
• I have added tests to cover my changes.
• I have linked the issue-id to the task-description.
• I have performed a self-review of my own code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Copilot]

Pull request overview

This PR addresses timestamp overflows (Issue #271) by widening Protobuf timestamp fields from int32 to int64 and improving numeric-epoch parsing so millisecond/microsecond/nanosecond epochs are normalized down to seconds before being stored.

Changes:

• Update Protobuf schemas to use int64 for all timestamp-related fields (including extractedTimestamps).
• Improve numeric epoch parsing to repeatedly fold ms/us/ns values down to a plausible seconds epoch.
• Add/extend tests covering sub-second epochs, schema overflow regression, and >int32 timestamp capacity.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/test_common/test_extract_timestamp.py	Adds regression and capacity tests for epoch folding and int64 timestamp fields.
src/detectmatelibrary/utils/time_format_handler.py	Updates numeric-epoch parsing to fold ms/us/ns down to seconds.
src/detectmatelibrary/schemas/schemas.proto	Switches timestamp fields from int32 to int64 across schemas.
src/detectmatelibrary/schemas/schemas_pb2.py	Regenerated Protobuf Python output reflecting the int64 schema changes.

Files not reviewed (1)

• src/detectmatelibrary/schemas/schemas_pb2.py: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.