diff --git a/schemas/related.yml b/schemas/related.yml index b052fa3c00..a7631a1f63 100644 --- a/schemas/related.yml +++ b/schemas/related.yml @@ -70,3 +70,15 @@ identifiers include FQDNs, domain names, workstation names, or aliases. normalize: - array + + - name: entity + level: extended + type: keyword + short: All the entity identifiers + description: > + All the entity identifiers related to the document. If the document + contains multiple entities, identifiers belonging to different entities + will be present. Example identifiers include Cloud Resource Ids, ARNs, email + addresses, or hostnames. + normalize: + - array \ No newline at end of file