Allow 'observables' in attributes

[query-jeremy]

Background

While discussing #960 today, it was raised that altering the type of attributes from string_t or int_t to more specific types like user_agent_t is a breaking change.

We could wait until the 2.x line to introduce this, or we could break with semver and accept a breaking change in 1.x. But neither of these are desirable.

Proposal

An alternative solution is to add the observable property to attributes. Currently, only types and objects support the observable property.

This could be defined in any event, object, or dictionary.

Example:

{
  "attributes": {
    "user_agent": {
      "observable": 19,
      ...
    },
    ...
}

Upside

• As this is an additive change, it is non-breaking and does not require a major semver bump. Consumers and producers that don't support it will continue to operate as before.
• This provides a (slightly) more flexible way to define observables.

Downside

• This would need to be implemented in the OCSF server.
• It (slightly) increases effort involved in troubleshooting observables.
• All validators will need to be updated.
• Platform implementations of observables may need to be updated.

[pagbabian-splunk]

Thanks Jeremy, late comment but we are going down this path that you suggest.

[query-jeremy]

Should we delete this issue? I wrote it to capture the outcome of our discussion about #960, but it may now be redundant to #960...

[rmouritzen-splunk]

I'll sort it out as I dig in. I might just close both when this is resolve.

[rmouritzen-splunk]

@query-jeremy : This will work now and be properly validated.