[RFC] Extend Threat Fieldset - Stage 2 Proposal

[peasead]

• Have you signed the contributor license agreement? Yes
• Have you followed the contributor guidelines? Yes
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? Yes
• If submitting code/script changes, have you verified all tests pass locally using make test? Yes
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? Yes
• Is your pull request against master? Unless there is a good reason otherwise, we prefer pull requests against master and will backport as needed. Yes
• Have you added an entry to the CHANGELOG.next.md? Yes

Preview of the markdown proposal doc

Stage 2 Criteria

• Opened pull request for this draft revising the existing proposal
• Completed field definitions
• Included a real world example source document
• Identifies scope of impact of changes to ingestion mechanisms (e.g. beats/logstash), usage mechanisms (e.g. Kibana applications, detections), and the ECS project (e.g. docs, tooling)
• Subject matter experts weighed in on technical utility of field definitions in the pull request

[ebeahan]

Noted from reviewing the field definitions added in the last stage, do we want to keep threat.software.platforms plural? Based on the example, the field is expecting a single value:

https://github.com/elastic/ecs/blob/master/experimental/schemas/threat.yml#L216

[peasead]

Noted from reviewing the field definitions added in the last stage, do we want to keep threat.software.platforms plural? Based on the example, the field is expecting a single value:

https://github.com/elastic/ecs/blob/master/experimental/schemas/threat.yml#L216

Thanks Eric.

Yes, platforms should be plural. I made the changes in the descriptions to be plural.

[ebeahan]

Thanks for adjusting platforms. 👍

I added a note about the using expected values for software.platforms, but I also think the same question around enumerating an expected value list for software.type.

[ebeahan]

LGTM 👍

@devonakerr as the sponsor, would you also review?

[devonakerr]

Yessir.

[devonakerr]

LGTM - Andy, I appreciate the attention to detail.

[ebeahan]

Opened #1429 to set the correct advancement date on the RFC.