sigma-rules/detection_rules/etc/stack-schema-map.yaml

# alignment of stack with beats and ecs versions
#    ECS versions do not align perfectly with stack releases (as of 7.13), so this will reflect MAX ecs version for a
#    given release
#
# refer to release branch in https://github.com/elastic/beats/blob/main/libbeat/_meta/fields.ecs.yml

# dropped backport support for 7.13.0, 7.14.0, 7.15.0 as of 8.4 branch creation
#"7.13.0":
#  # beats release about the same time as the stack, so we cannot update this until it is released
#  beats: "7.13.2"
#  ecs: "1.9.0"
#
#"7.14.0":
#  beats: "7.14.0"
#  ecs: "1.10.0"
#
#"7.15.0":
#  beats: "7.15.1"
#  ecs: "1.11.0"

"7.16.0":
  beats: "7.16.2"
  ecs: "1.12.2"

# 7.17 was intentionally skipped because it was added late and was bug fix only

"8.0.0":
  beats: "8.0.1"
  ecs: "8.0.1"

"8.1.0":
  beats: "8.1.2"
  ecs: "8.1.0"

"8.2.0":
  beats: "8.2.1"
  ecs: "8.2.1"

"8.3.0":
  beats: "main"
  ecs: "8.2.1"

"8.4.0":
  beats: "main"  # TODO: update this once beats releases
  ecs: "8.2.1"