[RFC] Threat Enrichment - Stage 2 #1460
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@rylnd We've found separating the RFC PR from the implementation PR is cleaner, and it lets us focus more on the content and details of the proposal vs. clogging up the RFC discussion with potential ECS build issues, testing, tooling challenges, etc. |
devonakerr
approved these changes
Jun 24, 2021
ebeahan
approved these changes
Jun 24, 2021
There was a problem hiding this comment.
LGTM 👍
Review Criteria for Stage 2
- Opened pull request for this draft revising the existing proposal
- Completed field definitions
- Included a real world example source document
- Identifies scope of impact of changes to ingestion mechanisms (e.g. beats/logstash), usage mechanisms (e.g. Kibana applications, detections), and the ECS project (e.g. docs, tooling)
- Subject matter experts weighed in on technical utility of field definitions in the pull request
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As follow up to #1400, this is the stage 2 RFC for threat enrichment. I believe that most of the stage 2 work has already been done, but I'm happy to be told otherwise.
RFC Preview
TODO
makeand committed those changes?