add evidences to incident finding

[jonrau-at-queryai]

(ignore the branch name...)

This PR adds evidences to the Incident Finding Event Class. While the Incident Finding Event Class is supposed to be a meta-findings class that contains information about downstream Detection/Compliance/Vulnerability findings - that doesn't always reflect the search patterns or customer experience from consuming the data.

Likewise, there are several named "Incidents" APIs such as within Microsoft Sentinel, Microsoft Defender XDR, and Crowdstrike Falcon that provide incidents that function like a Detection Finding AND like an Incident Finding.

For instance, all Crowdstrike Falcon Incidents contain aggregated information on implicated Hosts (devices/resources) as well as Behaviors which can enumerate command lines, process trees, file names, and more data from the sensor. See here for the FalconPy implementation atop Incidents - but the details are spread across GetBehaviors and GetIncidents.

Here is a de-identified Behavior from an Incident

{
      "behavior_id": "ind:123:456-557-169378",
      "cid": "111",
      "aid": "777",
      "incident_id": "inc:123:456",
      "incident_ids": [
          "inc:123:456"
      ],
      "pattern_id": 999,
      "template_instance_id": 0,
      "timestamp": "2024-12-17T20:55:08.872Z",
      "cmdline": "/bin/zsh -il",
      "filepath": "/bin/zsh",
      "pattern_disposition": 0,
      "pattern_disposition_details": {
          "indicator": false,
          "detect": false,
          "inddet_mask": false,
          "sensor_only": false,
          "rooting": false,
          "kill_process": false,
          "kill_subprocess": false,
          "quarantine_machine": false,
          "quarantine_file": false,
          "policy_disabled": false,
          "kill_parent": false,
          "operation_blocked": false,
          "process_blocked": false,
          "registry_operation_blocked": false,
          "critical_process_disabled": false,
          "bootup_safeguard_enabled": false,
          "fs_operation_blocked": false,
          "handle_operation_downgraded": false,
          "kill_action_failed": false,
          "blocking_unsupported_or_disabled": false,
          "suspend_process": false,
          "suspend_parent": false
      },
      "sha256": "12345",
      "user_name": "user",
      "tactic": "Execution",
      "tactic_id": "TA0002",
      "technique": "Command and Scripting Interpreter",
      "technique_id": "T1059",
      "display_name": "FilelessScriptExecution",
      "objective": "Follow Through",
      "compound_tto": "FollowThrough__Execution__CommandandScriptingInterpreter__0__0__0__0"
  }

Likewise the main Incident also contains a list of Hosts.

{
      "incident_id": "inc:123:456",
      "incident_type": 1,
      "cid": "111",
      "host_ids": [
          "2222"
      ],
      "hosts": [
          {
              "device_id": "111",
              "cid": "111",
              "agent_load_flags": "0",
              "agent_local_time": "2024-12-09T12:43:44.009Z",
              "agent_version": "117.210.18904.0",
              "config_id_base": "111",
              "config_id_build": "111",
              "config_id_platform": "4111",
              "external_ip": "1.1.1.1",
              "hostname": "laptop",
              "first_seen": "2023-08-22T16:03:00Z",
              "last_login_timestamp": "2023-11-17T13:58:08Z",
              "last_login_user": "user",
              "last_seen": "2024-12-17T20:51:22Z",
              "local_ip": "192.168.0.210",
              "mac_address": "ab-cd-ef-gh-jk",
              "machine_domain": "",
              "major_version": "22",
              "minor_version": "6",
              "os_version": "Ventura (13)",
              "platform_id": "1",
              "platform_name": "Mac",
              "product_type_desc": "Workstation",
              "status": "normal",
              "system_manufacturer": "Apple Inc.",
              "system_product_name": "MacBookPro18,2",
              "tags": [
                  "FalconGroupingTags/CorporateMachine"
              ],
              "groups": [
                  "1111"
              ],
              "modified_timestamp": "2024-12-17T20:51:57Z"
          }
      ],
      "created": "2024-12-17T20:55:08Z",
      "start": "2024-12-17T20:55:08Z",
      "end": "2024-12-17T20:55:19Z",
      "state": "closed",
      "email_state": "START",
      "status": 20,
      "tactics": [
          "Execution",
          "Command and Control"
      ],
      "techniques": [
          "Command and Scripting Interpreter",
          "Non-Standard Port",
          "Ingress Tool Transfer"
      ],
      "objectives": [
          "Follow Through",
          "Contact Controlled Systems"
      ],
      "modified_timestamp": "2024-12-17T21:55:30.242Z",
      "users": [
          "111"
      ],
      "fine_score": 12
  }

Additionally, Incidents from Sentinel and Defender XDR contain the reports of Related Entities and Related Alerts that are integral to understanding the full context of a given set of Incidents.

I am sure there are other examples such as in other EDRs and XDRs. Adding evidences is the simplest way to extend the usefulness of Incident Finding and not confuse customers/consumers who see Incident Finding and immediately think to look for their own platform incidents there.