GitHub / elastic/ecs issues and pull requests

#2374 - Update actions/setup-python digest to f677139

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 11 months ago - 1 comment

#2372 - LogsDB compatibility: specify if the ordering of arrays needs to be preserved

Issue - State: closed - Opened by felixbarny 11 months ago - 3 comments
Labels: enhancement

#2371 - Adding new entity/item/object fields for configuration and business changes usecases

Issue - State: open - Opened by double-facepalm 11 months ago - 1 comment
Labels: enhancement

#2370 - [RFC] Stage 2: Adding Apple Platform specific fields

Pull Request - State: closed - Opened by txhaflaire 11 months ago - 1 comment

#2369 - Update the stale PR bot message

Pull Request - State: closed - Opened by mjwolf 12 months ago

#2368 - Update dependency ubuntu to v22

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2367 - Update dependency mock to v5

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2366 - Update dependency autopep8 to v2

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2365 - Update actions/stale action to v9

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2364 - Update actions/setup-python action to v5

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2363 - Update actions/github-script action to v7

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2362 - Update actions/checkout action to v4

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2361 - Update dependency yamllint to v1.35.1

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2360 - Add `related.entity` field

Pull Request - State: open - Opened by romulets 12 months ago - 7 comments
Labels: stale

#2359 - Update dependency autopep8 to v1.7.0

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2358 - Update dependency gitpython to v3.1.43

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2357 - Dependency Dashboard

Issue - State: open - Opened by elastic-renovate-prod[bot] 12 months ago

#2356 - Update dependency PyYAML to v6.0.2

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2355 - Pin dependencies

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago - 1 comment

#2354 - Update templated fields in RFC0044

Pull Request - State: closed - Opened by mjwolf 12 months ago

#2353 - Resolve discrepancy between text subfield handling for `*.name` fields in `ecs@mappings`

Issue - State: open - Opened by felixbarny 12 months ago - 11 comments
Labels: discuss

#2352 - Configure Renovate

Pull Request - State: closed - Opened by elastic-renovate-prod[bot] 12 months ago

#2351 - Add email.mailfrom.address to email fields

Issue - State: open - Opened by mbudge about 1 year ago - 2 comments
Labels: enhancement

#2350 - Revert "Add .caseless subfield to process.name & process.executable"

Pull Request - State: closed - Opened by andrewkroh about 1 year ago - 1 comment
Labels: review

#2349 - Add lowercase normaliser to related fields

Issue - State: open - Opened by mbudge about 1 year ago
Labels: enhancement

#2348 - Add new fields file.origin_referrer_url & file.origin_url

Pull Request - State: closed - Opened by AsuNa-jp about 1 year ago - 9 comments
Labels: review, endpoint, Team: ECS, New Field Request, stale

#2342 - ECS Tooling - Mapping & Template Settings

Issue - State: closed - Opened by daniel-rhoades about 1 year ago - 1 comment

#2341 - Add .caseless subfield to process.name & process.executable

Pull Request - State: closed - Opened by w0rk3r about 1 year ago - 10 comments

#2340 - [Discuss] Add `agent.group` and `host.group` field

Issue - State: open - Opened by adrianchen-es about 1 year ago
Labels: enhancement, discuss, New Field Request

#2339 - Bump jinja2 from 3.1.3 to 3.1.4 in /scripts

Pull Request - State: closed - Opened by dependabot[bot] about 1 year ago
Labels: dependencies, python

#2338 - [RFC] Apple Platform specific fields

Pull Request - State: closed - Opened by txhaflaire about 1 year ago - 9 comments

#2337 - [RFC] Stage 0: Introducing GenAI fields

Pull Request - State: open - Opened by susan-shu-c over 1 year ago - 18 comments
Labels: RFC:candidate, Team: ECS

#2336 - Add a multi-field user.id.text to the user.id field.

Issue - State: open - Opened by leandrojmp over 1 year ago - 1 comment
Labels: enhancement

#2335 - Add `process.group` fields to generated schemas

Pull Request - State: closed - Opened by mjwolf over 1 year ago

#2334 - Allow risk object to be nested under network.

Issue - State: open - Opened by willem-dhaese over 1 year ago - 1 comment
Labels: enhancement

#2333 - Support multi-key fields from SemConv

Issue - State: open - Opened by gregkalapos over 1 year ago - 7 comments
Labels: enhancement

#2332 - Clarification of ECS release process during Otel donation period

Pull Request - State: closed - Opened by norrietaylor over 1 year ago

#2331 - [RFC] Stage 0: Introducing new fields in ECS vulnerability field set

Pull Request - State: closed - Opened by smriti0321 over 1 year ago - 5 comments

#2330 - [RFC] Stage 0: Introducing new field in rule namespace

Pull Request - State: closed - Opened by smriti0321 over 1 year ago - 4 comments

#2329 - Define a standard way to identify prevention and detection security alerts

Issue - State: closed - Opened by ferullo over 1 year ago - 5 comments
Labels: enhancement

#2328 - Fix broken link for vulnerabilty.id (correct commits)

Pull Request - State: closed - Opened by nicpenning over 1 year ago - 2 comments

#2327 - [vulnerability] Fix broken link for vulnerabilty.id

Pull Request - State: closed - Opened by nicpenning over 1 year ago - 6 comments

#2326 - ECS can no longer map all components out of the box

Issue - State: open - Opened by Mpdreamz over 1 year ago - 13 comments
Labels: enhancement

#2325 - Special guidance for ECS contributions during OTel donation

Pull Request - State: closed - Opened by norrietaylor over 1 year ago

#2324 - [RFC] added new field: threat.indicator.id - resolves GH-2252

Pull Request - State: closed - Opened by brett-fitz over 1 year ago - 2 comments

#2322 - Add Stage0 RFC for new fields for fileless execution on Linux

Pull Request - State: closed - Opened by stanek-michal over 1 year ago - 5 comments
Labels: RFC:candidate

#2321 - Update mapping-network-events.asciidoc

Pull Request - State: open - Opened by vishnukumarn4 over 1 year ago - 3 comments
Labels: stale

#2319 - Remove ECS project board workflow

Pull Request - State: closed - Opened by ebeahan over 1 year ago

#2318 - Update docs-preview link

Pull Request - State: closed - Opened by nkammah over 1 year ago

#2317 - Promote process.io and process.tty fields to GA

Pull Request - State: closed - Opened by mjwolf over 1 year ago - 3 comments

#2316 - Update `CONTRIBUTING` doc

Pull Request - State: closed - Opened by ebeahan over 1 year ago
Labels: DOCS

#2315 - Promote process.env_vars to GA

Pull Request - State: closed - Opened by mjwolf over 1 year ago - 1 comment

#2314 - Bump jinja2 from 3.0.3 to 3.1.3 in /scripts

Pull Request - State: closed - Opened by dependabot[bot] over 1 year ago
Labels: dependencies, python

#2313 - Bump gitpython from 3.1.37 to 3.1.41 in /scripts

Pull Request - State: closed - Opened by dependabot[bot] over 1 year ago - 1 comment
Labels: dependencies, stale, python

#2312 - Better abstraction of the type event.kind: alert

Issue - State: open - Opened by SebastianHuettersen over 1 year ago
Labels: bug

#2311 - [RFC] Stage 0: New field set for cyber observables

Pull Request - State: open - Opened by brett-fitz over 1 year ago - 3 comments
Labels: RFC

#2309 - Support cloud events in schema

Issue - State: closed - Opened by thompson-tomo over 1 year ago - 1 comment
Labels: enhancement

#2308 - Addition of additional allowed values for event.type

Issue - State: open - Opened by thompson-tomo over 1 year ago
Labels: enhancement

#2307 - [RFC] added new field: threat.indicator.id - resolves GH-2252

Pull Request - State: closed - Opened by brett-fitz over 1 year ago - 6 comments

#2306 - Add event.zone and event.environment fields

Issue - State: open - Opened by mbudge over 1 year ago - 3 comments
Labels: enhancement

#2305 - Add `related.url` field

Issue - State: open - Opened by chrisberkhout over 1 year ago
Labels: enhancement, discuss, New Field Request

#2304 - [main] Adding changelog for volume field set addition

Pull Request - State: closed - Opened by kgeller over 1 year ago

#2303 - [8.11] Removing entry for volume field set addition

Pull Request - State: closed - Opened by kgeller over 1 year ago

#2302 - Elastic-Agent Integrations Use of Legacy Mapping Types Impacts .fleet_globals & prevents agents from being upgraded

Issue - State: open - Opened by iamhowardtheduck over 1 year ago
Labels: bug

#2298 - Release notes for 8.11

Pull Request - State: closed - Opened by taylor-swanson over 1 year ago - 1 comment
Labels: forward_port

#2291 - Add hint to RFC 5424 in `log.syslog.severity.name` and `log.syslog.severity.code`

Pull Request - State: open - Opened by fgierlinger almost 2 years ago - 5 comments
Labels: stale

#2290 - Fix description of syslog.severity.name and syslog.severity.code

Pull Request - State: open - Opened by fgierlinger almost 2 years ago - 3 comments
Labels: bug, stale

#2288 - Addition of related.mac and related.port

Pull Request - State: open - Opened by hisecu almost 2 years ago - 8 comments
Labels: stale

#2287 - Add lowercase normaliser to ECS fields which support security incident response process

Issue - State: open - Opened by mbudge almost 2 years ago - 1 comment
Labels: enhancement

#2282 - Tune container image fields to align with Otel SemConv

Pull Request - State: closed - Opened by ChrsMark almost 2 years ago - 5 comments

#2279 - [RFC] Stage 3 for volume device

Pull Request - State: closed - Opened by Trinity2019 almost 2 years ago - 1 comment

#2276 - [RFC] Risk Score Extensions - Stage 2

Pull Request - State: open - Opened by rylnd almost 2 years ago - 4 comments
Labels: RFC, stale

#2252 - [RFC] Support id in threat.indicator for STIX 2.1

Issue - State: closed - Opened by brett-fitz almost 2 years ago - 6 comments
Labels: enhancement

#2235 - Multiple nested fields are missing from generated yml

Issue - State: open - Opened by P1llus about 2 years ago - 2 comments
Labels: bug

#2234 - log.offset not ECS compliant?

Issue - State: open - Opened by nicpenning about 2 years ago - 16 comments
Labels: enhancement, discuss

#2233 - [RFC] Asset Integrations & Entity Store RFC - Stage 2

Pull Request - State: open - Opened by SourinPaul about 2 years ago - 22 comments
Labels: RFC, stale

#2213 - [main] adding release notes for ecs 8.8 (#2209)

Pull Request - State: closed - Opened by kgeller about 2 years ago - 1 comment
Labels: forward_port

#2212 - [main] Finalize 8.8 changelog (#2208)

Pull Request - State: closed - Opened by kgeller about 2 years ago
Labels: forward_port

#2211 - Introduce process.vpid

Pull Request - State: open - Opened by Tacklebox about 2 years ago

#2210 - Finalize 8.8 version

Pull Request - State: closed - Opened by kgeller about 2 years ago

#2209 - Release notes for 8.8

Pull Request - State: closed - Opened by kgeller about 2 years ago

#2208 - Finalize 8.8 changelog

Pull Request - State: closed - Opened by kgeller about 2 years ago

#2207 - event.type "access" not allowed for event.category "file"

Issue - State: closed - Opened by taylor-swanson about 2 years ago - 1 comment
Labels: bug

#2206 - Adding package.vendor to ECS package mapping

Pull Request - State: open - Opened by lkuik about 2 years ago - 5 comments

#2205 - Adding field vendor.name to Package ECS mapping

Pull Request - State: closed - Opened by lkuik about 2 years ago - 8 comments

#2204 - [8.8] Orchestrator additions for features coming in 8.8 (#2181)

Pull Request - State: closed - Opened by kgeller about 2 years ago
Labels: backport

#2203 - Add ECS field for package.vendor to ecs-packages

Issue - State: open - Opened by lkuik over 2 years ago - 1 comment
Labels: enhancement

#2202 - DO NOT MERGE - testing GH Action - docs comment

Pull Request - State: closed - Opened by ebeahan over 2 years ago - 1 comment

#2201 - [RFC] Stge 0 - New fieldset for volume device

Pull Request - State: open - Opened by Trinity2019 over 2 years ago
Labels: discuss, RFC:candidate

#2200 - [main] Changelog for 8.8 ff (#2198)

Pull Request - State: closed - Opened by kgeller over 2 years ago
Labels: forward_port

#2199 - Adding v8.8 to backport tool

Pull Request - State: closed - Opened by kgeller over 2 years ago

#2198 - 8.8 FF changelog updates

Pull Request - State: closed - Opened by kgeller over 2 years ago
Labels: needs_forward_port

#2197 - Bumping version to 8.9.0-dev for 8.8 FF

Pull Request - State: closed - Opened by kgeller over 2 years ago

#2196 - Add concern about automatic inclusion of dimensions

Pull Request - State: closed - Opened by jsoriano over 2 years ago - 1 comment

#2194 - [RFC] Faas fields - stage 2 - change faas.trigger type from nested to object

Pull Request - State: closed - Opened by gsantoro over 2 years ago - 1 comment

#2193 - update generated files

Pull Request - State: closed - Opened by gsantoro over 2 years ago - 1 comment

#2192 - Remove mapping for field `faas.trigger`

Issue - State: closed - Opened by gsantoro over 2 years ago - 3 comments
Labels: enhancement

#2191 - RFC 0038: Add `event.kind: asset` - stage 2 changes

Pull Request - State: closed - Opened by ebeahan over 2 years ago
Labels: 8.8.0

#2190 - New `agent.forwarder` for identifying relay and forwarding infrastructure

Issue - State: open - Opened by bonifield over 2 years ago
Labels: enhancement

#2189 - Nest cloud fields under source and destination for additional flexibility

Issue - State: open - Opened by bonifield over 2 years ago
Labels: enhancement