Making observables Required in the Base Class

[pagbabian-splunk]

Today observables, and array of Observable objects is an optional Base Event class attribute.

If it optional, consumers and analysts will not be able to count on it being populated. Given its importance in things like IOC matching, I think there is an argument to be made that it should be required.

There is another argument that it should be recommended, but that is more of a hint.

[rroupski]

I voted recommended for the following reasons.
The observables is enrichment and they are useful for some use cases, but not all the time. The observables data can be recreated from the event data, thus no need to transmit observables from one system to another. Having the attribute as recommended helps to reduce the space when they are not used.

[mavam]

I doubled down on "recommended" for the same reasoning.

[pagbabian-splunk]

Thank you - I'll create a PR to make it Recommended.