Add event fieldset under threat.indicator fieldset

This is used to preserve the event fields of the original indicator event in the case of said indicator enriching another event.
elastic · Apr 12, 2021 · fb057b0 · fb057b0
1 parent b48f6e3
commit fb057b0
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/rfcs/text/0008/event.yml b/rfcs/text/0008/event.yml
@@ -0,0 +1,5 @@
+---
+- name: event
+  reusable:
+    expected:
+      - threat.indicator