elastic / elastic/detection-rules
Add ECS schemas for `kibana.*` and `signal.*` for validation
Open
backlog
enhancement
v8.10
v8.8.0
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
These schemas are not part of core ECS, but can be used in rules using the alert index. These only exist within Kibana, so we will need to see about building and versioning them from there, similar to how ECS schema is currently built.
Potential sources:
* https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index
* https://github.com/elastic/kibana/blob/main/api_docs/rule_registry.devdocs.json
Contributor guide
Assessment
This issue has not been assessed yet.