From 8f880e8218454f93c6e97030e156a73a6aeec228 Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Fri, 5 Apr 2024 12:31:12 +0200 Subject: [PATCH 1/8] Update 0000-rfc-template.md Updating the temaplate for RFC Stage 0 for adding 2 new rule fields: rule.tags and rule.remediation --- rfcs/0000-rfc-template.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/rfcs/0000-rfc-template.md b/rfcs/0000-rfc-template.md index 1ac7c95052..82f0b5c488 100644 --- a/rfcs/0000-rfc-template.md +++ b/rfcs/0000-rfc-template.md @@ -12,6 +12,7 @@ Feel free to remove these comments as you go along. +This RFC proposes addition of 2 new fields (rule.tags and rule.remediation) in rule fieldset to the Elastic Common Schema (ECS). The goal of these fields is to provide more context to the users in the rule fieldset, rule.tags will be used to track the set of tags applied to the rule, customers can use it to indicate metadata about the rule, and rule.remediation will be used to capture the remediation instructions associated with rules, it is generally provided by the benchmark or framework from which the rule is published. @@ -79,7 +87,10 @@ Stage 3: Document resolutions for all existing concerns. Any new concerns should The following are the people that consulted on the contents of this RFC. -* TBD | author +* @smriti0321 | author +* @tinnytintin10 | Product Manager Cloud Security +* @oren-zohar | Engineering Manager Cloud Security +* @orouz | Engineer +EPIC with detailed discussion on addition of these fields - https://github.com/elastic/security-team/issues/7658 ### RFC Pull Requests From 0bee3ac821ffb862b3cd18e324119f85fee6008f Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 25 Apr 2024 12:40:17 +0200 Subject: [PATCH 2/8] Update 0000-rfc-template.md Incorporating review comments. --- rfcs/0000-rfc-template.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rfcs/0000-rfc-template.md b/rfcs/0000-rfc-template.md index 82f0b5c488..d2770cdef4 100644 --- a/rfcs/0000-rfc-template.md +++ b/rfcs/0000-rfc-template.md @@ -27,8 +27,8 @@ Stage X: Provide a brief explanation of why the proposal is being marked as aban The `rule` fields being proposed are as follows: Field | Type | Description /Usage --- | -- | -- | -- | -- -rule.tags | array | Used to track the set of tags applied to a rule | Customers can use it to indicate: author, benchmark partial name, rule number, rule category etc. It will be useful when we extend the capability to add more rules +-- | -- | -- + rule.remediation | array | Used to capture remediation instructions that come from the benchmark / framework the rule is from -EPIC with detailed discussion on addition of these fields - https://github.com/elastic/security-team/issues/7658 + ### RFC Pull Requests From 0dce6ad47437c3129a66a638291e67ca45b87f36 Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 27 Jun 2024 14:21:28 +0200 Subject: [PATCH 3/8] Renaming the template file with recommended name --- ...plate.md => 0000-additional-rule-field.md} | 50 ++++++++++--------- 1 file changed, 27 insertions(+), 23 deletions(-) rename rfcs/{0000-rfc-template.md => 0000-additional-rule-field.md} (77%) diff --git a/rfcs/0000-rfc-template.md b/rfcs/0000-additional-rule-field.md similarity index 77% rename from rfcs/0000-rfc-template.md rename to rfcs/0000-additional-rule-field.md index d2770cdef4..3d4bf4702d 100644 --- a/rfcs/0000-rfc-template.md +++ b/rfcs/0000-additional-rule-field.md @@ -1,29 +1,29 @@ -# 0000: Name of RFC +# 0000: Additional Rule Field - Stage: **0 (strawperson)** - Date: **TBD** - +<<<<<<< HEAD +======= This RFC proposes addition of 2 new fields (rule.tags and rule.remediation) in rule fieldset to the Elastic Common Schema (ECS). The goal of these fields is to provide more context to the users in the rule fieldset, rule.tags will be used to track the set of tags applied to the rule, customers can use it to indicate metadata about the rule, and rule.remediation will be used to capture the remediation instructions associated with rules, it is generally provided by the benchmark or framework from which the rule is published. +>>>>>>> 8ee34ce1711cf2650998fffac178295a89396c56 - ## Fields +<<<<<<< HEAD +======= The `rule` fields being proposed are as follows: Field | Type | Description /Usage @@ -34,10 +34,16 @@ rule.remediation | array | Used to capture remediation instructions that come fr +>>>>>>> 8ee34ce1711cf2650998fffac178295a89396c56 + +The `rule` fields being proposed are as follows: + +Field | Type | Example | Description/Usage +-- | -- | -- +rule.tags | array | Used to track the set of tags applied to a rule | Customers can use it to indicate: author, benchmark partial name, rule number, rule category etc. It will be useful when we extend the capability to add more rules +rule.remediation | array | Enable encryption on all S3 buckets | Used to capture remediation instructions that come from the benchmark / framework the rule is from + - ## Usage @@ -87,27 +93,25 @@ Stage 3: Document resolutions for all existing concerns. Any new concerns should The following are the people that consulted on the contents of this RFC. +<<<<<<< HEAD +* @smriti0321 | author +* @tinnytintin10 | Product Manager +* @oren-zohar | Engineering Manager +* @orouz | Engineer +* @trisch-me | Security ECS team +======= * @smriti0321 | author * @tinnytintin10 | Product Manager Cloud Security * @oren-zohar | Engineering Manager Cloud Security * @orouz | Engineer +>>>>>>> 8ee34ce1711cf2650998fffac178295a89396c56 - ## References +* EPIC- https://github.com/elastic/security-team/issues/7658 ### RFC Pull Requests From 6a66ed158de30f2547ca696085b94dd6de805b26 Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 27 Jun 2024 14:31:12 +0200 Subject: [PATCH 4/8] Resolving conflicts --- rfcs/0000-additional-rule-field.md | 31 ++---------------------------- 1 file changed, 2 insertions(+), 29 deletions(-) diff --git a/rfcs/0000-additional-rule-field.md b/rfcs/0000-additional-rule-field.md index 3d4bf4702d..e1018a09eb 100644 --- a/rfcs/0000-additional-rule-field.md +++ b/rfcs/0000-additional-rule-field.md @@ -5,37 +5,16 @@ - Date: **TBD** -<<<<<<< HEAD -======= + This RFC proposes addition of 2 new fields (rule.tags and rule.remediation) in rule fieldset to the Elastic Common Schema (ECS). The goal of these fields is to provide more context to the users in the rule fieldset, rule.tags will be used to track the set of tags applied to the rule, customers can use it to indicate metadata about the rule, and rule.remediation will be used to capture the remediation instructions associated with rules, it is generally provided by the benchmark or framework from which the rule is published. ->>>>>>> 8ee34ce1711cf2650998fffac178295a89396c56 - ## Fields -<<<<<<< HEAD -======= -The `rule` fields being proposed are as follows: - -Field | Type | Description /Usage --- | -- | -- - -rule.remediation | array | Used to capture remediation instructions that come from the benchmark / framework the rule is from - - ->>>>>>> 8ee34ce1711cf2650998fffac178295a89396c56 - The `rule` fields being proposed are as follows: Field | Type | Example | Description/Usage @@ -93,18 +72,12 @@ Stage 3: Document resolutions for all existing concerns. Any new concerns should The following are the people that consulted on the contents of this RFC. -<<<<<<< HEAD * @smriti0321 | author * @tinnytintin10 | Product Manager * @oren-zohar | Engineering Manager * @orouz | Engineer * @trisch-me | Security ECS team -======= -* @smriti0321 | author -* @tinnytintin10 | Product Manager Cloud Security -* @oren-zohar | Engineering Manager Cloud Security -* @orouz | Engineer ->>>>>>> 8ee34ce1711cf2650998fffac178295a89396c56 + From af356f60538a62acb681fe911a06f079b91a5a33 Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 27 Jun 2024 14:35:08 +0200 Subject: [PATCH 5/8] Removing Tag Field --- rfcs/0000-additional-rule-field.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rfcs/0000-additional-rule-field.md b/rfcs/0000-additional-rule-field.md index e1018a09eb..55f407e6ce 100644 --- a/rfcs/0000-additional-rule-field.md +++ b/rfcs/0000-additional-rule-field.md @@ -18,8 +18,7 @@ This RFC proposes addition of 2 new fields (rule.tags and rule.remediation) in r The `rule` fields being proposed are as follows: Field | Type | Example | Description/Usage --- | -- | -- -rule.tags | array | Used to track the set of tags applied to a rule | Customers can use it to indicate: author, benchmark partial name, rule number, rule category etc. It will be useful when we extend the capability to add more rules +-- | -- | -- | -- rule.remediation | array | Enable encryption on all S3 buckets | Used to capture remediation instructions that come from the benchmark / framework the rule is from From 8fcb9b72ec9cdc04d9ccc018964d3b3f4243f614 Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 4 Jul 2024 14:39:05 +0200 Subject: [PATCH 6/8] Resolving comments from @trisch-me --- rfcs/0000-additional-rule-field.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rfcs/0000-additional-rule-field.md b/rfcs/0000-additional-rule-field.md index 55f407e6ce..f9354ce2f2 100644 --- a/rfcs/0000-additional-rule-field.md +++ b/rfcs/0000-additional-rule-field.md @@ -9,7 +9,7 @@ -This RFC proposes addition of 2 new fields (rule.tags and rule.remediation) in rule fieldset to the Elastic Common Schema (ECS). The goal of these fields is to provide more context to the users in the rule fieldset, rule.tags will be used to track the set of tags applied to the rule, customers can use it to indicate metadata about the rule, and rule.remediation will be used to capture the remediation instructions associated with rules, it is generally provided by the benchmark or framework from which the rule is published. +This RFC proposes addition of 1 new field (rule.remediation) in rule fieldset to the Elastic Common Schema (ECS). The goal of this field is to provide more context to the users in the rule fieldset, rule.remediation will be used to capture the remediation instructions associated with rules, it is generally provided by the benchmark or framework from which the rule is published. @@ -83,7 +83,7 @@ The following are the people that consulted on the contents of this RFC. ## References -* EPIC- https://github.com/elastic/security-team/issues/7658 + ### RFC Pull Requests From 63e9f397af39c452be49c5e0bc2fbc397651fffd Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 4 Jul 2024 15:20:11 +0200 Subject: [PATCH 7/8] Moving file to rfcs/text folder as per @trisch-me comment. using next number in series. --- .../0044-additional-rule-field.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename rfcs/{0000-additional-rule-field.md => text/0044-additional-rule-field.md} (100%) diff --git a/rfcs/0000-additional-rule-field.md b/rfcs/text/0044-additional-rule-field.md similarity index 100% rename from rfcs/0000-additional-rule-field.md rename to rfcs/text/0044-additional-rule-field.md From 9f2c00548e9c57d2bc92a3c5da083b1634523567 Mon Sep 17 00:00:00 2001 From: Smriti <152067238+smriti0321@users.noreply.github.com> Date: Thu, 4 Jul 2024 16:00:11 +0200 Subject: [PATCH 8/8] I saw number 44 was used in a recent RFC, using next number in series --- ...044-additional-rule-field.md => 0046-additional-rule-field.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename rfcs/text/{0044-additional-rule-field.md => 0046-additional-rule-field.md} (100%) diff --git a/rfcs/text/0044-additional-rule-field.md b/rfcs/text/0046-additional-rule-field.md similarity index 100% rename from rfcs/text/0044-additional-rule-field.md rename to rfcs/text/0046-additional-rule-field.md