etc/schema: add missing ftp fields

[jlucovsky]

Add ftp detect keywords to metadata

Issue: 7502, 7503, 7507, 7505, 7508, 7506

python3 scripts/eve-parity.py unmapped-fields | grep ^ftp identified the following are unmapped:

  ftp.command
  ftp.command_data
  ftp.command_truncated
  ftp.completion_code
  ftp.mode
  ftp.reply
  ftp.reply_received
  ftp.reply_truncated
  ftp_data.command
  ftp_data.filename

Of these, the following do not have detect keywords:

  ftp.command_truncated
  ftp.reply_truncated
  ftp_data.filename

Changes (if applicable):

Link to ticket: https://redmine.openinfosecfoundation.org/issues/6476

Describe changes:

• Added unmapped fields highlighted with command (see descr)

Provide values to any of the below to override the defaults.

• To use a Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=
SU_REPO=
SU_BRANCH=

[suricata-qa]

Information: QA skipped due to no C or rust code changed detected. Set to force a run.

Pipeline = code

[catenacyber]

Of these, the following do not have detect keywords:

  ftp.command_truncated
  ftp.reply_truncated
  ftp_data.filename

Does not file.name keyword work for ftp_data.filename field ?

Also would not ftp.command; bsize > 4096; work for ftp.command_truncated ?

[jlucovsky]

Of these, the following do not have detect keywords:

  ftp.command_truncated
  ftp.reply_truncated
  ftp_data.filename

Does not file.name keyword work for ftp_data.filename field ?

Also would not ftp.command; bsize > 4096; work for ftp.command_truncated ?

These fields cannot be mapped to detection keywords; are the changes in the PR sufficient for the unmapped fields that do have detection keywords?

[catenacyber]

These fields cannot be mapped to detection keywords;

I think they can : I think file.name keyword works for ftp_data.filename field

are the changes in the PR sufficient for the unmapped fields that do have detection keywords?

I think the changes are good (did not fully check), but your sentence struck me as wrong

the following do not have detect keywords: ftp_data.filename

[catenacyber]

Replaced by #15435