[RFC] Stage 0 - Threat Enrichment

[rylnd]

As documented in the existing threat intel RFC, this proposal aims to solve the threat intel enrichment use case by reusing the threat.indicator fieldset under a new name and as an array of objects, where each object represents an indicator that matched the (now enriched) event, and the matched.* fields on each object provide context for that particular indicator match.

Moving this list of indicators to a new field allows us to:

• reuse the existing threat.indicator fieldset
• sidestep the documentation/mapping complexities around when threat.indicator is an object (indicator) vs. when it's an array of objects (enrichment)

Preview of markdown document

Stage 0 (Strawperson) Criteria:

• Discuss with domain or subject matter experts the utility of these changes
• Discuss with ECS team whether these changes seem appropriate for ECS

[ebeahan]

LGTM for stage 0.

Thanks, @rylnd!