From 7b8b18cb20241cbbeb390551c87c8b22ca77027f Mon Sep 17 00:00:00 2001
From: Ross Wolf <31489089+rw-access@users.noreply.github.com>
Date: Thu, 26 Aug 2021 14:23:55 -0600
Subject: [PATCH] Update main to point to 7.16 (#1457)

* Update main to point to 7.16
* Add 7.16 -> 7.15 migration
* Update stack-schema-map
* Update conditions.kibana.version
---
 .github/workflows/backport.yml                |   2 +-
 detection_rules/schemas/__init__.py           |   6 +
 etc/api_schemas/7.15/7.15.base.json           | 334 +++++++++++++
 etc/api_schemas/7.15/7.15.eql.json            | 345 ++++++++++++++
 .../7.15/7.15.machine_learning.json           | 347 ++++++++++++++
 etc/api_schemas/7.15/7.15.query.json          | 347 ++++++++++++++
 etc/api_schemas/7.15/7.15.threat_match.json   | 438 ++++++++++++++++++
 etc/api_schemas/7.15/7.15.threshold.json      | 396 ++++++++++++++++
 etc/packages.yml                              |   6 +-
 etc/stack-schema-map.yaml                     |   4 +
 10 files changed, 2221 insertions(+), 4 deletions(-)
 create mode 100644 etc/api_schemas/7.15/7.15.base.json
 create mode 100644 etc/api_schemas/7.15/7.15.eql.json
 create mode 100644 etc/api_schemas/7.15/7.15.machine_learning.json
 create mode 100644 etc/api_schemas/7.15/7.15.query.json
 create mode 100644 etc/api_schemas/7.15/7.15.threat_match.json
 create mode 100644 etc/api_schemas/7.15/7.15.threshold.json

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 3930a3d62..0e74fbfd1 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -55,7 +55,7 @@ jobs:
     strategy:
       max-parallel: 1
       matrix:
-        target_branch: [7.13, 7.14]
+        target_branch: [7.13, 7.14, 7.15]
 
     steps:
       - name: Checkout repo
diff --git a/detection_rules/schemas/__init__.py b/detection_rules/schemas/__init__.py
index c3b508fdb..18d66f064 100644
--- a/detection_rules/schemas/__init__.py
+++ b/detection_rules/schemas/__init__.py
@@ -166,6 +166,12 @@ def migrate_to_7_14(version: Version, api_contents: dict) -> dict:
     return strip_additional_properties(version, api_contents)
 
 
+@migrate("7.15")
+def migrate_to_7_15(version: Version, api_contents: dict) -> dict:
+    """Default migration for 7.15."""
+    return strip_additional_properties(version, api_contents)
+
+
 def downgrade(api_contents: dict, target_version: str, current_version: Optional[str] = None) -> dict:
     """Downgrade a rule to a target stack version."""
     from ..packaging import current_stack_version
diff --git a/etc/api_schemas/7.15/7.15.base.json b/etc/api_schemas/7.15/7.15.base.json
new file mode 100644
index 000000000..edf996886
--- /dev/null
+++ b/etc/api_schemas/7.15/7.15.base.json
@@ -0,0 +1,334 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "\\d+[mshd]",
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "https://attack.mitre.org/tactics/TA[0-9]+/",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "https://attack.mitre.org/techniques/T[0-9]+/",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "query",
+        "saved_query",
+        "machine_learning",
+        "eql",
+        "threshold",
+        "threat_match"
+      ],
+      "enumNames": [],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "name",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/7.15/7.15.eql.json b/etc/api_schemas/7.15/7.15.eql.json
new file mode 100644
index 000000000..508abfda9
--- /dev/null
+++ b/etc/api_schemas/7.15/7.15.eql.json
@@ -0,0 +1,345 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "\\d+[mshd]",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "eql"
+      ],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "https://attack.mitre.org/tactics/TA[0-9]+/",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "https://attack.mitre.org/techniques/T[0-9]+/",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "eql"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/7.15/7.15.machine_learning.json b/etc/api_schemas/7.15/7.15.machine_learning.json
new file mode 100644
index 000000000..21258afc6
--- /dev/null
+++ b/etc/api_schemas/7.15/7.15.machine_learning.json
@@ -0,0 +1,347 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "anomaly_threshold": {
+      "format": "integer",
+      "type": "number"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "\\d+[mshd]",
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "machine_learning_job_id": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ]
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "https://attack.mitre.org/tactics/TA[0-9]+/",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "https://attack.mitre.org/techniques/T[0-9]+/",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "machine_learning"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "anomaly_threshold",
+    "author",
+    "description",
+    "machine_learning_job_id",
+    "name",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/7.15/7.15.query.json b/etc/api_schemas/7.15/7.15.query.json
new file mode 100644
index 000000000..278867840
--- /dev/null
+++ b/etc/api_schemas/7.15/7.15.query.json
@@ -0,0 +1,347 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "\\d+[mshd]",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "https://attack.mitre.org/tactics/TA[0-9]+/",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "https://attack.mitre.org/techniques/T[0-9]+/",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "query"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/7.15/7.15.threat_match.json b/etc/api_schemas/7.15/7.15.threat_match.json
new file mode 100644
index 000000000..3cfd48f6c
--- /dev/null
+++ b/etc/api_schemas/7.15/7.15.threat_match.json
@@ -0,0 +1,438 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "concurrent_searches": {
+      "description": "PositiveInteger",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "\\d+[mshd]",
+      "type": "string"
+    },
+    "items_per_search": {
+      "description": "PositiveInteger",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "https://attack.mitre.org/tactics/TA[0-9]+/",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "https://attack.mitre.org/techniques/T[0-9]+/",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat_indicator_path": {
+      "type": "string"
+    },
+    "threat_language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "threat_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "entries": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "field": {
+                  "description": "NonEmptyStr",
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": {
+                  "enum": [
+                    "mapping"
+                  ],
+                  "type": "string"
+                },
+                "value": {
+                  "description": "NonEmptyStr",
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "field",
+                "type",
+                "value"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "entries"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_query": {
+      "type": "string"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "threat_match"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "threat_index",
+    "threat_mapping",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/7.15/7.15.threshold.json b/etc/api_schemas/7.15/7.15.threshold.json
new file mode 100644
index 000000000..a53dad8cb
--- /dev/null
+++ b/etc/api_schemas/7.15/7.15.threshold.json
@@ -0,0 +1,396 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "\\d+[mshd]",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "https://attack.mitre.org/tactics/TA[0-9]+/",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "https://attack.mitre.org/techniques/T[0-9]+/",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threshold": {
+      "additionalProperties": false,
+      "properties": {
+        "cardinality": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "field": {
+                "type": "string"
+              },
+              "value": {
+                "description": "ThresholdValue",
+                "format": "integer",
+                "minimum": 1,
+                "type": "number"
+              }
+            },
+            "required": [
+              "field",
+              "value"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "field": {
+          "description": "CardinalityFields",
+          "items": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "maxItems": 3,
+          "type": "array"
+        },
+        "value": {
+          "description": "ThresholdValue",
+          "format": "integer",
+          "minimum": 1,
+          "type": "number"
+        }
+      },
+      "required": [
+        "field",
+        "value"
+      ],
+      "type": "object"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "threshold"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "threshold",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/packages.yml b/etc/packages.yml
index 049d59e66..d13521c87 100644
--- a/etc/packages.yml
+++ b/etc/packages.yml
@@ -1,6 +1,6 @@
 ---
 package:
-  name: "7.15"
+  name: "7.16"
   release: true
   # exclude rules which have any of the following index <-> field pairs
   #  exclude_fields:
@@ -26,7 +26,7 @@ package:
   registry_data:
     categories: ["security"]
     conditions:
-      kibana.version: "^7.15.0"
+      kibana.version: "^7.16.0"
     description: Prebuilt detection rules for Elastic Security
     format_version: 1.0.0
     icons:
@@ -40,4 +40,4 @@ package:
     release: beta
     title: Prebuilt Security Detection Rules
     type: integration
-    version: 0.15.0-dev.0
+    version: 0.16.0-dev.0
diff --git a/etc/stack-schema-map.yaml b/etc/stack-schema-map.yaml
index f5e1d5fd3..d8f19789f 100644
--- a/etc/stack-schema-map.yaml
+++ b/etc/stack-schema-map.yaml
@@ -14,3 +14,7 @@
 "7.15.0":
   beats: "master"  # TODO: update this once beats releases
   ecs: "1.11.0"
+
+"7.16.0":
+  beats: "master"  # TODO: update this once beats releases
+  ecs: "1.11.0"