Add support for threshold rules

[brokensound77]

Issues

resolves #63

Summary

This adds support for threshold rules in the schema and CLI. These rules are defined as type = threshold and have the additional required fields of field = string_field and value = int_greater_than 0

Support for the CLI is added as a temporary means, but the prompt will need complete refactoring and can be tracked in #64

Example

python -m detection_rules create-rule test/threshold.toml --required-only

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Rule type (machine_learning, saved_query, query, threshold): threshold
author (required)  (multi, comma separated): punt-threater
description (required): test threshold
license [Elastic License] ("n/a" to leave blank)  (required): 
name (required): Threshold Rule
risk_score [21] ("n/a" to leave blank)  (required): 
rule_id [3020317b-b402-41e7-8443-cc18c832ae0a] ("n/a" to leave blank)  (required): 
severity [low] ("n/a" to leave blank)  (required): 
language [kuery] ("n/a" to leave blank)  (required): 
query (required): process.name:david.exe
threshold field (required): process.parent.name
threshold value (required): 25
ecs_version (multi, comma separated): 
Rule Threshold Rule saved to /Users/jibarra/PycharmProjects/detection-rules-fork/test/threshold.toml

Creates this rule

[metadata]
creation_date = "2020/07/16"
ecs_version = ["1.5.0"]
maturity = "development"
updated_date = "2020/07/16"

[rule]
author = ["punt-threater"]
description = "test threshold"
language = "kuery"
license = "Elastic License"
name = "Threshold Rule"
risk_score = 21
rule_id = "3020317b-b402-41e7-8443-cc18c832ae0a"
severity = "low"
type = "threshold"

query = '''
process.name:david.exe
'''


[rule.threshold]
field = "process.parent.name"
value = 25

[brokensound77]

temporary workaround until #64

[rw-access]

LGTM. agreed on the CLI 🏈 punt on #64