[RFC] Extend Threat Fieldset - Stage 0 Proposal

[peasead]

• Have you signed the contributor license agreement? Yes
• Have you followed the contributor guidelines? Yes
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? Yes
• If submitting code/script changes, have you verified all tests pass locally using make test? Yes
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? Yes
• Is your pull request against master? Unless there is a good reason otherwise, we prefer pull requests against master and will backport as needed. Yes
• Have you added an entry to the CHANGELOG.next.md? Yes

Preview of the markdown proposal

[ebeahan]

LGTM for stage 0 👍

[devonakerr]

Looks good, for the sake of posterity (and perhaps an eye on the horizon) someday we may want to update the Threat RFC's ATT&CK commentary to reflect ATT&CK-defined elements vs calling them ATT&CK elements (ex: ATT&CK-defined software vs ATT&CK software). It's a very minor point, and one which is unlikely to confuse the user, so no change recommended or required.

[ebeahan]

Thanks, all! I'll set the advance date, RFC #, and merge it! 🚢