Skip to content

ECS 1.11.0
Compare
Choose a tag to compare
@ebeahan ebeahan released this 12 Aug 15:29
· 3 commits to 1.11 since this release
v1.11.0
0751f1b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

The following RFCs have advanced as part of this release:

Stage 3 (GA)

Stage 2 (beta)

Stage 1 (experimental)

The event.agent_id_status field is also new in 1.11 to reflect the status of the agent.id verification performed by a receiving system or data pipeline.

Lastly, many tooling and documentation improvements, including the --exclude flag. The --exclude flag adds the ability to remove individual fields from the schema. More detail is available in the usage doc.

Changelog

Schema Changes

Added

  • elf.* field set added as beta. #1410
  • Remove beta from orchestrator field set. #1417
  • Extend threat.* field set beta. #1438
  • Added event.agent_id_status field. #1454
  • process.target and process.target.parent added to experimental schema. #1467
  • Threat indicator fields progress to beta stage. #1471, #1504
  • threat.enrichments beta fields. #1478, #1504

Improvements

  • Fix ecs GitHub repo link source branch #1393
  • Add --exclude flag to Generator to support field removal testing #1411
  • Explicitly include user identifiers in relater.user description. #1420
  • Improve descriptions for cloud.region and cloud.availability fields. #1452
  • Clarify event.kind descriptions for alert and signal. #1548

Deprecated

  • Note deprecation of the host.user.* field reuse. #1422
  • Note deprecation of log.original superseded by event.original #1469

Tooling and Artifact Changes

Bugfixes

  • Remove ignore_above when index: false and doc_values: false. #1483
  • Ensure doc_values is carried into Beats artifacts. #1488

Added

  • Support match_only_text data type in Go code generator. #1418
  • Support for multi-level, self-nestings. #1459
  • beta attribute now supported on categorization allowed values. #1511

Improvements

  • Swap Location and Field Set columns in Field Reuse table for better readability. #1472, #1476
  • Use a bullet points to list field reuses. #1473
  • Improve wording in Threat schema #1505
Assets 2
Loading