add a feature for describing network activity

This feature should allow rule authors to describe pertinent network activity such as: a specific dest ip, a specific protocol, a specific port, specific bytes in a network packet, etc.

The initial suggestion is to implement that using a syntax similar to that of the filtering language for wireshark-filter and tshark; and to add support for applying those filters on sandbox-extracted pcap files or network activity reported by the sandbox.

(part of: #1533)

more information on the filtering language: https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/

example:

- network-traffic: http.request or ssl.handshake.type == 1 or tcp.flags eq 0x0002

pros:

• allows for a much more expressive rule syntax: various port scanning methods could be described using this language, which would give rule authors the ability to tell if a sample is running a specific port scanning method.

cons:

• might slow down performance

Start by reviewing the proposed Wireshark/tshark-like filtering syntax and the sandbox's extracted pcap files or reported network activity. Define the supported rule syntax and how filters apply to both activity sources, then verify that the example and packet fields such as destination IP, protocol, port, and bytes work as intended without unacceptable performance loss.