add support for actions

[samcornwell]

CAR analytics have a concept of actions associated with analytics. For example:

process = search Process:Create
cmd = filter process where (exe == "cmd.exe")
output cmd

Add support for STIX for these actions. This could several forms, such as a special term, or a simple property. For example:

[process:create:name = 'cmd.exe']

or

[process:name = 'cmd.exe' and process:action = 'create']

or

create:[process:name = 'cmd.exe]

[samcornwell]

wiki proposal: Action-Proposal

[johnwunder]

Based on our team discussion we're going to go with Option 1 for this and are starting development.