Proposal for reserved attribute naming convention

[rroupski]

Attributes that are either generated or derived by the collection, post-collection processing, or storage systems other than the mapping process are designated Reserved. While attribute requirements are set per class in which they are used, this does not apply to reserved attributes which are invariant in this respect. This is the status quo.

Currently reserved attributes use the OCSF naming convention and are not distinguishable from non-reserved attributes.

Reserved attributes SHOULD use a consistent attribute naming convention using an underscore (_) prefix to be easily identified which aids with mapping and avoids confusion as to how they are handled.

Note that reserved attributes are not necessarily required to be populated by the processing system.

There are currently 6 reserved scalar attributes in the base class proper, and 2 in the required metadata object of the base class.

The current list of 8 attributes are:

log_name (from metadata)
log_time (from metadata)
event_uid
event_name
time
observables
raw_data
unmapped

The new names SHOULD be:

_log_name
_log_time
_event_uid (subject to change in another proposal)
_event_name (subject to change in another proposal)
_time
_observables
_raw_data
_unmapped