Add network category and related types

[MikePaquette]

This PR adds a new value of event.category:"network" and the corresponding values of event.type to be able to represent all network events and metrics in ECS.

• event.category:"network"
• event.type:"allowed"
• event.type:"denied"
• event.type:"connection"
• event.type:"protocol"

[dainperkins]

Are we putting flow to be under connection? Or would that be dependent on event.kind?

[webmat]

I think we should add "allowed" and "denied" to category "authentication" as well. WDYT?

[dainperkins]

authentication should be success, failure - allowed/denied is authorization (which iirc we are typically reporting on under the resource that access was attempted on - e.g. file access allowed / denied)

[MikePaquette]

@dainperkins re:

Are we putting flow to be under connection? Or would that be dependent on event.kind?

Not sure what you mean by "flow" in that question, but indeed anything that would be included in flow analysis would have event.type:connection

[webmat]

One small formatting change required. Otherwise I think we're good!

[webmat]

Please make sure to always use straight quotes, not the fancy ones Google Docs and the others use.

Suggested change

	`event.category:”network” AND event.type:denied` (to indicate a network
	`event.category:"network" AND event.type:denied` (to indicate a network

[dainperkins]

looks good to me

[dcode]

Need to tweak the formatting but the content otherwise looks good.

[andrewkroh]

LGTM. Just some minor comments (on the wrong/generated file).