Add event.reason field

[ebeahan]

Summary

Adds a new field under event.*, event.reason, which provides a location to capture the reason why an event occurred.

Example usage

• A web proxy event shows a denied connection request. event.action:"request-denied" describes the action captured and why the action took place is captured in event.reason:"Blocked site: example.com"
• An endpoint agent terminates a process on a host system. event.action:"process-terminated" with reason describing why as event.reason:"Terminated an unexpected process"`

Discussion Points

Two items I wanted to call to attention:

1. event.reason is currently defined as type: extended. This felt most appropriate starting off.
2. A text multi-field is included. event.reason could possibly hold a longer string (e.g. File Sharing site URL blocked).

Closes #613

[webmat]

Looking good so far. I agree with adding this as extended.

[webmat]

Perhaps we should phrase this more naturally. E.g.

"Reason why this event happened, according to the source"

[webmat]

Do we expect event.reason to be complex often enough to warrant this? Not opposed to this, just wondering out loud :-)

[ebeahan]

I had a similar internal debate...

I can see value in having the text indexing available since event.reason could possibly be longer string (e.g. something like this Okta event), but the extra complexity may not be warranted the majority of the time.

As I type this out, I'm leaning towards removing the multi-field. If a user was trying to search for allowed events across sources using event.reason.text:allow, using the categorization fields like `event.type:"allowed" would be the better practice to encourage I think.

[webmat]

Let's remove it for now. Adding .text later is non-breaking, so it'll be fine if it becomes necessary.

Also, I think this will be one of the fields we move to wildcard ultimately. I'm sure we'll get to wildcard before there's a need to add the .text interim solution.

[webmat]

CI fails because you're missing a make run. I think after .text is removed this will be ready.

[ebeahan]

@webmat should be good to merge if you wanna give it once last 👀

[webmat]

LGTM