sigma-rules/etc/stack-schema-map.yaml

# alignment of stack with beats and ecs versions
#    ECS versions do not align perfectly with stack releases (as of 7.13), so this will reflect MAX ecs version for a
#    given release
#
# refer to release branch in https://github.com/elastic/beats/blob/main/libbeat/_meta/fields.ecs.yml

"7.13.0":
  # beats release about the same time as the stack, so we cannot update this until it is released
  beats: "7.13.2"
  ecs: "1.9.0"

"7.14.0":
  beats: "7.14.0"
  ecs: "1.10.0"

"7.15.0":
  beats: "7.15.1"
  ecs: "1.11.0"

"7.16.0":
  beats: "7.16.2"  # TODO: update this once beats releases
  ecs: "1.12.1"

# 7.17 was intentionally skipped because it was added late and was bug fix only

"8.0.0":
  beats: "8.0.0-rc1"  # TODO: update this once beats releases
  ecs: "1.12.1"

"8.1.0":
  beats: "main"  # TODO: update this once beats releases
  ecs: "1.12.1"

"8.2.0":
  beats: "main"  # TODO: update this once beats releases
  ecs: "1.12.1"

"8.3.0":
  beats: "main"  # TODO: update this once beats releases
  ecs: "1.12.1"