ES - suggest changing signature field about splunk-apps

[btorresgil]

Hello, thanks for opening this issue.

One concern with this approach is that threat id's (the number portion) can be reused. So, you might end up with a situation where the signature field has the name of one signature and the threat:name field has a different threat name. This is unlikely with recent events, but the further you look back at older logs, it is possible the id could be reused. We're aware of this limitation and it will be solved in the future by always using unique threat id's.

Additionally, not everyone sets up the metadata sync feature to keep the threat lookup tables updated, so for some customer they could be out of sync with the firewall.

Due to those two reasons, I'm reluctant to use threat:name field over the signature field. I think threat:name should decorate the log fields, not replace them. However, if you decide to implement it and want to share your code, I'd be happy to add it to the documentation as an alternative approach. And both the concerns above will eventually be resolved, so we can revisit this in the future.

[btorresgil]

Closing out this issue, but if you have further concerns on this please feel free to comment.