Ecs: event reason?

[enotspe]

Regarding

event.category / event.action / event.outcome

I think we also need event.reason

For example:

- event.category: user-management
- event.action: user-password-change
- event.outcome: failure
- event.reason: password policy violation

[MikePaquette]

@enotspe would the ECS message field be appropriate here?

[d-almeida]

I also have been adding event.reason as a keyword for terms aggregations in visualizations. The message field is meant to always be of type text and kibana doesn't yet support Significant Text aggregations https://github.com/elastic/kibana/issues/31614.

[enotspe]

@MikePaquette
message seems to me that it is more detailed and extended (text). event.reason should be something shorter and categorizable (aggregatable).

[scathatheworm]

event.reason seems like a great addition.

I am currently processing data from at least these sources that provide a reason field of some kind:

• crowdstrike edr
• forcepoint
• cylance
• ssh
• sudo
• juniper
• palo alto

In addition to that a lot of internal application logging ends up providing a reason for action taken.

At the time being I am using event.reason as a keyword plus a .text field for full text search on it, but it seems like a good candidate for getting an official sport in the ECS.

[jamiehynds]

We are in the process of adding event.reason to the schema. Another related discussion here.