elastic / elastic/detection-rules

Add ECS schemas for `kibana.*` and `signal.*` for validation

Open
#2,763 0 comments 0 reactions 0 assignees View on GitHub
backlog enhancement v8.10 v8.8.0
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

These schemas are not part of core ECS, but can be used in rules using the alert index. These only exist within Kibana, so we will need to see about building and versioning them from there, similar to how ECS schema is currently built.

Potential sources:
* https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index
* https://github.com/elastic/kibana/blob/main/api_docs/rule_registry.devdocs.json

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.