[RFC] Stage 1: Introducing new field in ECS Rule fields

[smriti0321]

• Have you signed the contributor license agreement? Yes
• Have you followed the contributor guidelines? Yes
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? Yes
• If submitting code/script changes, have you verified all tests pass locally using make test?
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes?
• Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed.
• Have you added an entry to the CHANGELOG.next.md?

[github-actions]

Hi!

We just realized that we haven't looked into this PR in a while. We're
sorry!

We're labeling this PR as Stale to make it hit our filters and
make sure we get back to it as soon as possible. In the meantime, it'd
be extremely helpful if you could take a look at it as well and confirm its
relevance. A simple comment with a nice emoji will be enough :+1.

Thank you for your contribution!

[github-actions]

Hi!

We just realized that we haven't looked into this PR in a while. We're
sorry!

We're labeling this PR as Stale to make it hit our filters and
make sure we get back to it as soon as possible. In the meantime, it'd
be extremely helpful if you could take a look at it as well and confirm its
relevance. A simple comment with a nice emoji will be enough :+1.

Thank you for your contribution!

[mjwolf]

@smriti0321, could you also update https://github.com/elastic/ecs/blob/main/rfcs/text/0046-additional-rule-field.md to add some examples of usage, source data and the other criteria from here: https://elastic.github.io/ecs/stages.html

[mjwolf]

Would remediations usually be human-readable? In that case, using text type could be better than wildcard: https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html#wildcard-field-type

[smriti0321]

@mjwolf I have created a PR (#2448) for the suggested changes in https://github.com/elastic/ecs/blob/main/rfcs/text/0046-additional-rule-field.md. Please let me know if thats the right way.