fix fields in README

Author: maxcold

packages/wiz/docs/README.md

@@ -445,7 +445,51 @@ An example event for `cloud_configuration_finding_full_posture` looks as followi
 
 **Exported fields**
 
-(no fields available)
+| Field | Description | Type |
+|---|---|---|
+| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
+| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions:   \* Must not contain `-`   \* No longer than 100 characters | constant_keyword |
+| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:   \* Must not contain `-`   \* No longer than 100 characters | constant_keyword |
+| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
+| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
+| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword |
+| input.type | Type of filebeat input. | keyword |
+| log.offset | Log offset. | long |
+| resource.id |  | keyword |
+| resource.name |  | keyword |
+| resource.sub_type |  | keyword |
+| resource.type |  | keyword |
+| result.evaluation |  | keyword |
+| result.evidence.cloud_configuration_link |  | text |
+| result.evidence.configuration_path |  | text |
+| result.evidence.current_value |  | text |
+| result.evidence.expected_value |  | text |
+| rule.remediation |  | keyword |
+| tags | List of keywords used to tag each event. | keyword |
+| wiz.cloud_configuration_finding_full_posture.analyzed_at |  | date |
+| wiz.cloud_configuration_finding_full_posture.evidence.cloud_configuration_link |  | text |
+| wiz.cloud_configuration_finding_full_posture.evidence.configuration_path |  | text |
+| wiz.cloud_configuration_finding_full_posture.evidence.current_value |  | text |
+| wiz.cloud_configuration_finding_full_posture.evidence.expected_value |  | text |
+| wiz.cloud_configuration_finding_full_posture.id |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.name |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.cloud_platform |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.id |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.name |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.native_type |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.provider_id |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.region |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.subscription.cloud_provider |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.subscription.external_id |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.subscription.name |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.resource.type |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.result |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.rule.description |  | text |
+| wiz.cloud_configuration_finding_full_posture.rule.id |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.rule.name |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.rule.remediation_instructions |  | text |
+| wiz.cloud_configuration_finding_full_posture.rule.short_id |  | keyword |
+| wiz.cloud_configuration_finding_full_posture.status |  | keyword |
 
 
 ### Issue