Added a Notes object and an array of notes to the Findings classes.

[pagbabian-splunk]

Related Issue: 1659

Description of changes:

As mentioned in the above Issue, a simple comment attribute is not sufficient for findings that are modified over time, especially by multiple analysts.

This PR creates a Note object that includes a comment attribute but also a owner, created_time and modified_time to capture the details of who made the comment and when. The Finding classes and the Incident Finding class include a notes attribute with an array of Note objects to track comments over the lifecyle of the finding or incident.

The comment attribute is deprecated in favor of notes.

One small structural change was made: the Finding base class has a device attribute whose comment refers to resources which only appeared in the extended classes. This PR adds the resources attribute to Finding but preserves the overriddent descriptions in each of the extended finding classes.

[github-actions]

Schema Description Review

Automated suggestions for improving description clarity for LLM consumption. These are advisory — not required changes.

Looking at the compiled schema output and comparing it to my previous review, I can see that all the changes remain consistent with my earlier assessment. The PR introduces a well-structured note object and applies it consistently across finding classes.

Previous Suggestions Status

✅ All previous suggestions were already addressed - My previous review found no issues, and the current state maintains that quality level.

Current Review

Suggestions

None - all descriptions remain clear and self-contained.

CHANGELOG Issues

None - all entries follow proper conventions with correct PR references and proper sectioning.

Summary

The changes continue to demonstrate good schema design principles. The note object provides a clear structure for capturing analyst observations with proper attribution and timestamps. The consistent application across all finding classes maintains schema coherence, and all descriptions remain suitable for LLM comprehension with appropriate specificity and context.

✅ No description issues found — descriptions look clear for LLM consumption.

[floydtree]

@pagbabian-splunk do we want to deprecate comment in favor of this new notes attribute in the findings classes?

[pagbabian-splunk]

@pagbabian-splunk do we want to deprecate comment in favor of this new notes attribute in the findings classes?

Yes, that probably makes sense. I'll update with the deprecation. I wasn't sure whether for simple cases the single comment might be useful, but it's better that there is one place to view comments.