Expansion of Author Field

[austinsonger]

What you think of this idea, or if you have your own input, be greatly appreciative.

Instead of just a author field like this author:

and add two fields for different types of authors

originating.author:
contributing.author:

• originating.author - the author (or authors) where the rule idea started from
• contributing.author - any contributors that comes afterwards that improves the rule from its original state.

[frack113]

I like the idea
Why not

author: (optional)
  original: str as it is the writer (need if author )
  contributor: str or list (optinal)

[frack113]

from the issue #1995 (comment)

We try to avoid complexity and number of fields whenever and wherever possible.
In this case, we would gain more clarity on the authorship. Up to now, we simply used the author field to indicate different forms of contribution. E.g. it's often the case that someone had the fundamental idea and someone else "just" created a rule around it.

e.g.
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_prompt_credentials.yml#L13
https://github.com/SigmaHQ/sigma/blob/master/rules-unsupported/win_access_fake_files_with_stored_credentials.yml#L5

So, introducing these two fields could then lead to situations in which someone else wants a idea.author field and more.

I don't think that the clarity that we'd gain justifies the additional fields and complexity.