From 0ba70efa478a7e80ebc2da38557540015299747d Mon Sep 17 00:00:00 2001 From: Kylie Meli Date: Fri, 3 Apr 2026 16:11:19 -0400 Subject: [PATCH] Annotate 34 in-flight RFCs with process transition status notes --- rfcs/text/0002-rfc-environment.md | 2 ++ rfcs/text/0003-object-field.md | 2 ++ rfcs/text/0004-session.md | 2 ++ rfcs/text/0006-host-identifiers.md | 2 ++ rfcs/text/0009-data_stream-fields.md | 2 ++ rfcs/text/0011-sip-fields.md | 2 ++ rfcs/text/0013-network-headers.md | 2 ++ rfcs/text/0015-create-file-elf.md | 2 ++ rfcs/text/0019-rpc-fieldset.md | 2 ++ rfcs/text/0024-ticket-fields.md | 2 ++ rfcs/text/0026-database-object.md | 2 ++ rfcs/text/0027-faas-fields.md | 2 ++ rfcs/text/0028-cgroups.md | 2 ++ rfcs/text/0029-enforce-single-value-fields.md | 2 ++ rfcs/text/0032-definition-of-ecs-compliance.md | 2 ++ rfcs/text/0033-new-cloud-fields.md | 2 ++ rfcs/text/0034-device-fields.md | 2 ++ rfcs/text/0035-tty-output.md | 2 ++ rfcs/text/0036-authentication-fields.md | 2 ++ rfcs/text/0037-host-metrics.md | 2 ++ rfcs/text/0038-event-kind-asset.md | 2 ++ rfcs/text/0039-tsdb-dimensions.md | 2 ++ rfcs/text/0041-asset-integration.md | 2 ++ rfcs/text/0042-risk-score-extensions.md | 2 ++ rfcs/text/0043-risk-input-fields.md | 2 ++ rfcs/text/0044-add-apple-platform-specific-fields.md | 1 + rfcs/text/0045-additional-vulnerability-fields.md | 2 ++ rfcs/text/0046-additional-rule-field.md | 2 +- rfcs/text/0047-fileless-execution-linux.md | 2 ++ rfcs/text/0048-fileorigin-fields.md | 2 ++ rfcs/text/0049-entity-fields.md | 2 ++ rfcs/text/0050-gen_ai-security-fields.md | 2 ++ rfcs/text/0052-gen_ai-additional-fields.md | 4 +++- rfcs/text/0053-new-device-fields.md | 4 +++- 34 files changed, 68 insertions(+), 3 deletions(-) diff --git a/rfcs/text/0002-rfc-environment.md b/rfcs/text/0002-rfc-environment.md index f9804d0ca9..797ca341de 100644 --- a/rfcs/text/0002-rfc-environment.md +++ b/rfcs/text/0002-rfc-environment.md @@ -4,6 +4,8 @@ - Stage: **2 (candidate)** - Date: **2021-07-28** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. + diff --git a/rfcs/text/0003-object-field.md b/rfcs/text/0003-object-field.md index 2d0528922e..9d59d47cf3 100644 --- a/rfcs/text/0003-object-field.md +++ b/rfcs/text/0003-object-field.md @@ -4,6 +4,8 @@ - Stage: **0 (strawperson)** - Date: **2020-07-27** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + diff --git a/rfcs/text/0004-session.md b/rfcs/text/0004-session.md index 2617ea441c..2d3b84f4d3 100644 --- a/rfcs/text/0004-session.md +++ b/rfcs/text/0004-session.md @@ -4,6 +4,8 @@ - Stage: **0 (strawperson)** - Date: 7/30/2020 +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + diff --git a/rfcs/text/0006-host-identifiers.md b/rfcs/text/0006-host-identifiers.md index 21b2f72261..07f622342c 100644 --- a/rfcs/text/0006-host-identifiers.md +++ b/rfcs/text/0006-host-identifiers.md @@ -4,6 +4,8 @@ - Stage: **0 (strawperson)** - Date: **2020-09-08** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2021-04-19** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. + When introducing the new indexing strategy for Elastic Agent which uses data streams, we found that adding a few [constant_keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) fields corresponding to the central components in the new indexing strategy would be advantageous. diff --git a/rfcs/text/0011-sip-fields.md b/rfcs/text/0011-sip-fields.md index f37d35950c..f5fad9067f 100644 --- a/rfcs/text/0011-sip-fields.md +++ b/rfcs/text/0011-sip-fields.md @@ -4,6 +4,8 @@ - Stage: **1 (proposal)** - Date: **2020-12-04** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2021-02-05** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2021-04-14** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + We would like to introduce a new, top-level, `rpc` fieldset. This fieldset would be suitable for recording information pertaining to RPCs (Remote Procedure Calls), such as the RPC system (e.g. gRPC, Thrift, Java RMI), service name, method name, and response status code. diff --git a/rfcs/text/0024-ticket-fields.md b/rfcs/text/0024-ticket-fields.md index d2d4b9842a..4ace7f1821 100644 --- a/rfcs/text/0024-ticket-fields.md +++ b/rfcs/text/0024-ticket-fields.md @@ -4,6 +4,8 @@ - Stage: **0 (strawperson)** - Date: **2021-05-11** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2021-06-01** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2021-09-14** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema. The `faas.*` fields are **GA**. The `service.origin` and `service.target` reuse entries remain **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. + - Date: **2021-11-05** +> **Status (process transition, April 2026):** The experimental `cgroup.*` fields proposed in this RFC have been removed from the repository. Analysis found zero adoption: no integration imports these fields, Metricbeat handles cgroup v1/v2 differences internally via its own `system.process.cgroup.*` namespace (~80+ fields), and the ECS-level abstraction for container resource metrics already exists as `container.cpu.usage` and `container.memory.usage` (GA). The multi-stage RFC process has been retired in favor of the single-stage Proposal process. If there is renewed interest in ECS-level cgroup fields, a new proposal can be submitted under the current process. + - Date: **2022-05-16** +> **Status (process transition, April 2026):** This RFC proposed compliance definitions, not schema field changes. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. Compliance guidance will be revisited as part of the updated process documentation. + - Date: **2022-07-22** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2022-08-16** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. + - Date: **2022/08/16** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **GA**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. + - Date: **2023-03-01** +> **Status (process transition, April 2026):** A subset of the proposed fields (`host.network.ingress.bytes`, `host.network.egress.bytes`) were independently added to the ECS schema as **GA** through OTel alignment work. The remaining proposed fields (cpu, memory, load, filesystem) were never merged. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in the remaining fields, a new proposal can be submitted under the current process. + - Date: **2023-03-31** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **GA**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. + - Date: **2023-04-11** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2023-07-07** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2023-07-13** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + ### Summary This RFC aims to add a few general fields that, when defined on a document, will allow that document containing them to be consumed by Kibana's Risk Engine for the purposes of entity analytics. diff --git a/rfcs/text/0044-add-apple-platform-specific-fields.md b/rfcs/text/0044-add-apple-platform-specific-fields.md index 1c58a32b94..c9415f5ef6 100644 --- a/rfcs/text/0044-add-apple-platform-specific-fields.md +++ b/rfcs/text/0044-add-apple-platform-specific-fields.md @@ -4,6 +4,7 @@ - Stage: **2 (Candidate)** - Date: **2024-09-11** +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema. Some fields are **GA** (`code_signature.team_id`, `code_signature.signing_id`, `hash.sha384`) and others remain **beta** (`process.responsible`, `process.endpoint_security_client`, `process.platform_binary`, `macho.*`, `code_signature.flags`, `hash.cdhash`, `device.serial_number`). This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. ### Summary This RFC proposes the addition of Apple platform-specific fields to the ECS schema. This enhancement will enable security software vendors to more accurately map out data, particularly for Apple platforms. diff --git a/rfcs/text/0045-additional-vulnerability-fields.md b/rfcs/text/0045-additional-vulnerability-fields.md index 63b82105e9..b8c2afb3bb 100644 --- a/rfcs/text/0045-additional-vulnerability-fields.md +++ b/rfcs/text/0045-additional-vulnerability-fields.md @@ -4,6 +4,8 @@ - Stage: **0 (strawperson)** - Date: **TBD** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **TBD** - +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. - Date: **2024-09-26** +> **Status (process transition, April 2026):** The proposed fields were never merged into the ECS schema. The multi-stage RFC process has been retired in favor of the single-stage Proposal process. This RFC is considered inactive. If there is continued interest in these fields, a new proposal can be submitted under the current process. + - Date: **2025-02-07* +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. + - Date: 2025-06-02 +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process. + - Stage: **0 (strawperson)** -- Date: **TBD** +- Date: **2025-09-17** + +> **Status (process transition, April 2026):** The proposed fields have not yet been merged into the ECS schema. Implementation is in progress in [#2532](https://github.com/elastic/ecs/pull/2532). The multi-stage RFC process has been retired in favor of the single-stage Proposal process. - Stage: **0 (strawperson)** -- Date: **TBD** +- Date: **2025-09-12** + +> **Status (process transition, April 2026):** The fields proposed in this RFC have been merged into the ECS schema as **beta**. This RFC was not formally advanced through the remaining stages before the multi-stage RFC process was retired in favor of the single-stage Proposal process. No further action is needed on this RFC. Beta fields will be evaluated for GA promotion under the field lifecycle process.