extend intel.log with additional fields using corelight/ExtendIntel (part 2)

[mmguero]

Continuation of #502

• see if there's anything else we need to do in https://github.com/idaholab/Malcolm/blob/main/shared/bin/zeek_threat_feed_utils.py to make sure those new fields get populated (see also the zeek docs)
  • search for ZEEK_INTEL_META and my TODO comment about what still needs to be mapped
  • Mandiant provides some fields that might map well:
    • Mandiant's reports (enable via include_reports in mandiant.yaml to meta.reports
    • Mandiant's campaigns (enable via include_campaigns in mandiant.yaml to meta.campaigns
    • Mandiant's category (enable via include_category in mandiant.yaml to meta.category (these are currently already mapped to meta.cif_tags as well as a few other things, so we may have to deconflict this)
    • Mandiant's threat rating (enable via include_threat_rating in mandiant.yaml to meta.threat_score
  • check STIX/TAXII as well
  • check MISP as well
• see if there are any mutations or normalizations or time field conversions that need to be done for the new fields (depending on what we do above)
• as much as possible, rename all possible fields to be their ECS names
• add any remaining fields not covered by ECS to the template and config.ini and the allFields array for the value actions for Arkime
• update the intel dashboard if needed