Kit Resources: document expected fields in shipped resources that cannot automatically resolve

[kris-watts-gravwell]

What is the feature to be added?

Add documentation into kits that ship resources when the resource cannot "auto resolve" field names. For example, the maxmind DB formats that we ship in the network enrichment kit cannot automatically resolve fields because it is not a pure column store, each IP walks a B-tree and grabs an object with arbitrary key/value pairs associated with that leave node. This type of DB structure cannot actually be auto hinted or dumped with the dump module.

So we need to call out the field names that we know exist in each db (like the ASN, country, city, etc...)

Why should we add this feature? (Business justification? What problem is the feature trying to solve?)

It is unclear exactly what is available in our two DBs, so call them out explicitly in the description or playbook.

How does this feature address the above problem?

Lets users know in a concrete way what exists in these network enrichment DBs.

Any other comments?

I think this could be documented in the resource description AND network enrichment playbook (as a nice markdown table).