Summary:
We have documentation for each of the four buckets in ECS categorization, but we don't have examples of how all four buckets would be used together in real world examples.

Motivation:
Examples would help those implementing ECS to use the categorization buckets in a consistent manor.

Detailed Design:
Where in the documentation should we add these examples? Some options are:

• add to values_section_header in scripts/generators/asciidoc_fields.py
• add a new examples.yml file and generate a new page
• other?

Examples:

1. Firewall blocked a network connection

    event:
      kind: event
      category:
        - network
      type:
        - connection
        - denied
      outcome:
        - success

2. Failed attempt to add a user to Active Directory

    event:
      kind: event
      category:
        - iam
      type:
        - user
        - creation
      outcome:
        - failure

3. Information about a file

    event:
      kind: event
      category:
        - file
      type:
        - info

4. IDS failed to block a network connection

    event:
      kind: alert
      category:
        - intrusion_detection
        - network
      type:
        - connection
        - denied
      outcome: failure