Adding risk.* as beta

[kgeller]

No description provided.

[ajosh0504]

Overall LGTM- I admittedly don't understand enough about the process. Some high-level q's:

• Any reason why the fields should still be included under experimental/generated if they will no longer be experimental?
• I also didn't see the risk fields being added for host in the experimental directory- was this intentional?

[kgeller]

@ajosh0504

• Any reason why the fields should still be included under experimental/generated if they will no longer be experimental?

The experimental section is the actual experimental fields + all the GA & beta fields.

• I also didn't see the risk fields being added for host in the experimental directory- was this intentional?

I think this is just Github not recognizing it, I see them there

ecs/experimental/generated/csv/fields.csv

Line 412 in 8542d8a

8.6.0-dev+exp,true,host,host.risk.calculated_level,keyword,extended,,High,A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.

[ajosh0504]

@kgeller In that case, this LGTM!

[MikePaquette]

Thanks @kgeller for creating this Pull request.

Could we enhance the description a bit to help users avoid confusion with the event.risk_score and event.risk_score_norm fields?
Maybe by updating the title, short, and description as follows:

1. title: Risk information
2. short: Fields for describing risk score and level.
3. description: > Fields for describing risk score and risk level of entities such as hosts and users. These fields are not allowed to be nested under event.*. Please continue to use event.risk_score and event.risk_score_norm for event risk.

[kgeller]

@MikePaquette updated!

[ajosh0504]

@kgeller I will also clarify this in the Stage 3 PR as per your request.

[MikePaquette]

LGTM, thanks!