Refresh ECS (1.12.1) and beats (7.15.1) schemas (#1584)

* Refresh ECS (1.12.1) and beats (7.15.1) schemas

* update ecs to 1.10 for 7.14 stack validation

* add note with reference url

etc/stack-schema-map.yaml

@@ -1,6 +1,8 @@
 # alignment of stack with beats and ecs versions
 #    ECS versions do not align perfectly with stack releases (as of 7.13), so this will reflect MAX ecs version for a
 #    given release
+#
+# refer to release branch in https://github.com/elastic/beats/blob/master/libbeat/_meta/fields.ecs.yml
 
 "7.13.0":
   # beats release about the same time as the stack, so we cannot update this until it is released
@@ -9,12 +11,12 @@
 
 "7.14.0":
   beats: "7.14.0"
-  ecs: "1.11.0"
+  ecs: "1.10.0"
 
 "7.15.0":
-  beats: "master"  # TODO: update this once beats releases
+  beats: "7.15.1"
   ecs: "1.11.0"
 
 "7.16.0":
-  beats: "master"  # TODO: update this once beats releases
-  ecs: "1.11.0"
+  beats: "7.15.1"  # TODO: update this once beats releases
+  ecs: "1.12.1"

rules/cross-platform/defense_evasion_agent_spoofing_mismatched_id.toml

@@ -3,7 +3,7 @@ creation_date = "2021/07/14"
 maturity = "production"
 updated_date = "2021/07/14"
 min_stack_comments = "The field `event.agent_id_status` was not introduced until 7.14"
-min_stack_version = "7.14.0"
+min_stack_version = "7.15.0"
 
 [rule]
 author = ["Elastic"]

rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml

@@ -3,7 +3,7 @@ creation_date = "2021/07/14"
 maturity = "production"
 updated_date = "2021/07/14"
 min_stack_comments = "The field `event.agent_id_status` was not introduced until 7.14"
-min_stack_version = "7.14.0"
+min_stack_version = "7.15.0"
 
 [rule]
 author = ["Elastic"]