Syntax simplification

[subbyte]

Is your feature request related to a problem? Please describe.
Discussion and planning for syntax revision. Some ideas under discussion:

1. redundant entity type in GET

x = GET process FROM datasource WHERE [process:pid = 123]

Simplified

x = GET process FROM datasource WHERE pid = 123

2. redundant entity type in GET from variable

w = GET process FROM z WHERE [process:pid = 123]

Simplified

w = z WHERE pid = 123

3. expression

<var> [FILTER] [ AGG [ FILTER]] [SORT] [OFFSET] [LIMIT]

may use in DISP and COPY

[pcoccoli]

For my "expression" idea (number 3 above), we should be able to use an expression just about anywhere we currently allow a variable. The exceptions would be in APPLY (since this modifies a var in-place) and "parameterized STIX patterns" (although maybe they could actually work here too?).

[pcoccoli]

Maybe we should split this into 2 issues: the first is not requiring STIX patterns after WHERE but also allowing SQL-like "predicates" (e.g. pid = 123 instead of [process:pid = 123]).
The second issue would be 2/3 above: "expressions"

[subbyte]

Agree

[pcoccoli]

Resolved in develop