[RFC] Extend Threat Fieldset - Stage 2 Proposal

rfcs/text/0018-extend-threat-group-software.md

@@ -1,8 +1,8 @@
 # 0018: Extend Threat Fieldset
 <!-- Leave this ID at 0000. The ECS team will assign a unique, contiguous RFC number upon merging the initial stage of this RFC. -->
 
-- Stage: **1 (draft)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
-- Date: **2021-04-06** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
+- Stage: **2 (candidate)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
+- Date: **2021-00-00** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
 
 <!--
 As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
@@ -31,7 +31,7 @@ Field | Type | Example | Description
 --- | --- | --- | ---
 threat.software.id | keyword | S0552 | The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software id.
 threat.software.name | keyword | AdFind | The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software name.
-threat.software.platforms | keyword | Windows | The platform of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software platform.
+threat.software.platforms | keyword | Windows | The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software platforms.
 threat.software.reference | keyword | https://attack.mitre.org/software/S0552/ | The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software reference URL.
 threat.software.type | keyword | Tool | The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software type.
 threat.group.alias | keyword | FIN6, ITG08, Magecart Group 6, etc | The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community. While not required, you can use a MITRE ATT&CK® group alias(es).
@@ -103,6 +103,7 @@ Stage 2: Included a real world example source document. Ideally this example com
 Examples are from MITRE's [enterprise matrix](https://github.com/mitre/cti/blob/master/enterprise-attack/enterprise-attack.json).
 
 ```yml
+// Software Source Data
 {
     "external_references": [
         {
@@ -118,6 +119,7 @@ Examples are from MITRE's [enterprise matrix](https://github.com/mitre/cti/blob/
 }
 ```
 ```yml
+// Group Source Data
 {
     "name": "FIN6",
     "external_references": [
@@ -203,6 +205,7 @@ e.g.:
 
 * Stage 0: https://github.com/elastic/ecs/pull/1300
 * Stage 1: https://github.com/elastic/ecs/pull/1335
+* Stage 2: https://github.com/elastic/ecs/pull/1395
 
 <!--
 * Stage 1: https://github.com/elastic/ecs/pull/NNN

rfcs/text/0018/threat.yml

@@ -24,11 +24,11 @@
   - name: software.platforms
     level: extended
     type: keyword
-    short: Platform of the software.
+    short: platforms of the software.
     description: >
-      The platform of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software platform.
+      The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software platforms.
 
-      Expected values
+      Recommended Values:
         * AWS
         * Azure
         * Azure AD
@@ -37,7 +37,6 @@
         * macOS
         * Network
         * Office 365
-        * PRE
         * SaaS
         * Windows
 
@@ -59,7 +58,7 @@
     description: >
       The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. While not required, you can use a MITRE ATT&CK® software type.
 
-      Expected values
+      Recommended values
         * Malware
         * Tool