Proposal for reserved attributes

[rroupski]

This vote is about defining a list of reserved attributes that must not be used by the event producers.

• _time: timestamp_t, required
  The normalized event occurrence time. Normalized time means the original event time ref_time was corrected for the clock skew and it was converted to the OCSF timestamp_t.

• _uid: string, required
  The unique identifier of an event instance. The attribute is used in the metadata object: metadata._uid.

• _raw_data: string, optional
  The event data as received from the event source. This attribute must be used when events are translated from some other that OCSF format. If the event is created using the OCSF schema, then the _raw_data must not be used.

[paveljos]

To clarify, _uid is the new base_event field for base_event.type_uid or what is currently in metadata.uid? I just want to ensure we are not implying a system generated uuid for each event record.

[rroupski]

We are implying a system generated uuid for each event record. This vote is for the metadata._uid