Adding the Startup Application Query event class in the discovery category.

[maxhotta]

The Startup Application Query class captures the results of a discovery on target devices.
This class was refactored from a previous submission, while incorporating feedback from Paul.

Description of changes:

Made the Startup Application object more clear by factoring out unrelated items in the type_id list.
The list now describes only the type of application.
A run_mode attribute was added as an array to capture the other items.
Also added a run_state to capture the state of the application at the time the event was logged.

[davemcatcisco]

I have a number of concerns about this PR:

1. If scheduled tasks/jobs are a supported startup application type (and they seem to be because Scheduled is one of the values in start_type_id) then the file and cmd_line attributes should not be required and recommended respectively because Windows scheduled tasks don't necessarily have an associated executable file or command line. Also, the type_id enum should have an entry for a scheduled task/job.
2. Is there a reason why run_mode isn't run_mode_id with a corresponding run_mode companion attribute?
3. start_type_id should cross-reference start_type in its sibling property.
4. Instead of having attributes like start_type_id, cmd_line, file, run_state_id, etc. the startup_app object could (should?) reuse existing object types that describe the same properties of the relevent entities. For example, startup_app could have a win_service attribute that would apply when the type_id is Service. It could have a schedule_job attribute that would apply when the type_id is Scheduled Job. This would avoid the startup_app object having lots of required attributes that don't make sense for certain values of type_id.

[maxhotta]

@davemcatcisco Per further discussion on your point 4, the consensus was to use a 'just one' constraint on the different types that the startup_app could be, and add objects (as you suggest) to model the startup_app type. I will revise, and post an update with these changes.

[maxhotta]

Incorporated most items, except for adding the win_service object as one of the options for the target startup application.
It is defined in the extension dictionary file and thus trying to find a way to include it.

[maxhotta]

I've fixed the schema validation issue by 'patching' the startup_app object in windows extensions (per committee discussion). There was an issue in defining the constraints in the patched startup_app object which includes win_service. To address this, I've defined win_service and its corresponding constraint in the core startup_app object.

[mikeradka]

Thanks Max

[davemcatcisco]

Looks great. Thanks for addressing my picky comments. And my apologies for missing the notification asking me to re-review.