Update to TLP

[kgeller]

Continuation of #2034

Addresses #2073

[djptek]

LGTM

[vpiserchia]

Dear all, I see discrepancies between every other ECS fields related to versioning information (e.g. http.version, agent.version, etc). All of them are of keyword type while this one is a float. Provided that I do no see a use case for this to be a number (ordering/sorting) I would recomment to keep the same coherence for these fields:

• threat.threat.indicator.marking.tlp.version
• threat.indicator.marking.tlp.version

[kgeller]

Dear all, I see discrepancies between every other ECS fields related to versioning information (e.g. http.version, agent.version, etc). All of them are of keyword type while this one is a float. Provided that I do no see a use case for this to be a number (ordering/sorting) I would recomment to keep the same coherence for these fields:

@vpiserchia great catch, I didn't notice that discrepancy. I have updated the new version fields here to keyword for parity.