Add event 'version' field to the data dictionary schema about ossem

[hxnoyd]

@Cyb3rWard0g no problem with the scripting part, that's an easy change. I was just concerned if we were OK with having a "version" field in the schema that, in most cases, will be 0 (i.e. when no version is available).

[Cyb3rWard0g]

That works @hxnoyd ! Thank you very much for the suggestion. it makes sense and it should be added agreed. I was wondering if you have that update in some of the scripts that you use to manipulate the YAML files.

[Cyb3rWard0g]

Idea:

• Adding a new field for each dictionary (It creates a column in the MD file)

[Cyb3rWard0g]

Can we do :

User can do this programmatically
event 4688.yml

name: 4688
version: 3

OSSEM provides
event 4688_v3.yml

name: 4688
version: 3

event 4688_v2.yml

name: 4688
version: 2

[Cyb3rWard0g]

It should be good to reference: https://github.com/jdu2600/Windows10EtwEvents