From e0dda91f26eaa5ebf64fd829dfc3d33106a418eb Mon Sep 17 00:00:00 2001
From: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Date: Tue, 8 Feb 2022 21:43:55 -0600
Subject: [PATCH] Prep for creation of 8.2 branch (#1762)

---
 .github/workflows/backport.yml                |   2 +-
 .github/workflows/lock-versions.yml           |   2 +-
 detection_rules/schemas/__init__.py           |   6 +
 etc/api_schemas/8.1/8.1.base.json             | 336 +++++++++++++
 etc/api_schemas/8.1/8.1.eql.json              | 347 ++++++++++++++
 etc/api_schemas/8.1/8.1.machine_learning.json | 349 ++++++++++++++
 etc/api_schemas/8.1/8.1.query.json            | 349 ++++++++++++++
 etc/api_schemas/8.1/8.1.threat_match.json     | 440 ++++++++++++++++++
 etc/api_schemas/8.1/8.1.threshold.json        | 398 ++++++++++++++++
 etc/api_schemas/master/master.base.json       |   2 +
 etc/api_schemas/master/master.eql.json        |   2 +
 .../master/master.machine_learning.json       |   2 +
 etc/api_schemas/master/master.query.json      |   2 +
 .../master/master.threat_match.json           |   2 +
 etc/api_schemas/master/master.threshold.json  |   2 +
 etc/packages.yml                              |   6 +-
 etc/stack-schema-map.yaml                     |   4 +
 17 files changed, 2246 insertions(+), 5 deletions(-)
 create mode 100644 etc/api_schemas/8.1/8.1.base.json
 create mode 100644 etc/api_schemas/8.1/8.1.eql.json
 create mode 100644 etc/api_schemas/8.1/8.1.machine_learning.json
 create mode 100644 etc/api_schemas/8.1/8.1.query.json
 create mode 100644 etc/api_schemas/8.1/8.1.threat_match.json
 create mode 100644 etc/api_schemas/8.1/8.1.threshold.json

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 0ee30539f..b70df8270 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -56,7 +56,7 @@ jobs:
       max-parallel: 1
       matrix:
         # 7.17 was intentionally skipped because it was added late and was bug fix only
-        target_branch: [7.13, 7.14, 7.15, 7.16, '8.0']
+        target_branch: [7.13, 7.14, 7.15, 7.16, '8.0', 8.1]
 
     steps:
       - name: Checkout repo
diff --git a/.github/workflows/lock-versions.yml b/.github/workflows/lock-versions.yml
index a03539ff2..136b79ee8 100644
--- a/.github/workflows/lock-versions.yml
+++ b/.github/workflows/lock-versions.yml
@@ -6,7 +6,7 @@ on:
           description: 'List of branches to lock versions (ordered, comma separated)'
           required: true
           # 7.17 was intentionally skipped because it was added late and was bug fix only
-          default: '7.13,7.14,7.15,7.16,8.0'
+          default: '7.13,7.14,7.15,7.16,8.0,8.1'
 
 jobs:
   pr:
diff --git a/detection_rules/schemas/__init__.py b/detection_rules/schemas/__init__.py
index 6f8283e83..dd7a1a1f4 100644
--- a/detection_rules/schemas/__init__.py
+++ b/detection_rules/schemas/__init__.py
@@ -184,6 +184,12 @@ def migrate_to_8_0(version: Version, api_contents: dict) -> dict:
     return strip_additional_properties(version, api_contents)
 
 
+@migrate("8.1")
+def migrate_to_8_1(version: Version, api_contents: dict) -> dict:
+    """Default migration for 8.1."""
+    return strip_additional_properties(version, api_contents)
+
+
 def downgrade(api_contents: dict, target_version: str, current_version: Optional[str] = None) -> dict:
     """Downgrade a rule to a target stack version."""
     from ..packaging import current_stack_version
diff --git a/etc/api_schemas/8.1/8.1.base.json b/etc/api_schemas/8.1/8.1.base.json
new file mode 100644
index 000000000..b6c6afe45
--- /dev/null
+++ b/etc/api_schemas/8.1/8.1.base.json
@@ -0,0 +1,336 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "query",
+        "saved_query",
+        "machine_learning",
+        "eql",
+        "threshold",
+        "threat_match"
+      ],
+      "enumNames": [],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "name",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/8.1/8.1.eql.json b/etc/api_schemas/8.1/8.1.eql.json
new file mode 100644
index 000000000..1c81c7f71
--- /dev/null
+++ b/etc/api_schemas/8.1/8.1.eql.json
@@ -0,0 +1,347 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "eql"
+      ],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "eql"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/8.1/8.1.machine_learning.json b/etc/api_schemas/8.1/8.1.machine_learning.json
new file mode 100644
index 000000000..4d4472edb
--- /dev/null
+++ b/etc/api_schemas/8.1/8.1.machine_learning.json
@@ -0,0 +1,349 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "anomaly_threshold": {
+      "format": "integer",
+      "type": "number"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "machine_learning_job_id": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ]
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "machine_learning"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "anomaly_threshold",
+    "author",
+    "description",
+    "machine_learning_job_id",
+    "name",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/8.1/8.1.query.json b/etc/api_schemas/8.1/8.1.query.json
new file mode 100644
index 000000000..d0f43d89c
--- /dev/null
+++ b/etc/api_schemas/8.1/8.1.query.json
@@ -0,0 +1,349 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "query"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/8.1/8.1.threat_match.json b/etc/api_schemas/8.1/8.1.threat_match.json
new file mode 100644
index 000000000..f9ce1c1b1
--- /dev/null
+++ b/etc/api_schemas/8.1/8.1.threat_match.json
@@ -0,0 +1,440 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "concurrent_searches": {
+      "description": "PositiveInteger",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "items_per_search": {
+      "description": "PositiveInteger",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat_indicator_path": {
+      "type": "string"
+    },
+    "threat_language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "threat_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "entries": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "field": {
+                  "description": "NonEmptyStr",
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": {
+                  "enum": [
+                    "mapping"
+                  ],
+                  "type": "string"
+                },
+                "value": {
+                  "description": "NonEmptyStr",
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "field",
+                "type",
+                "value"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "entries"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_query": {
+      "type": "string"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "threat_match"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "threat_index",
+    "threat_mapping",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/8.1/8.1.threshold.json b/etc/api_schemas/8.1/8.1.threshold.json
new file mode 100644
index 000000000..28959a7bb
--- /dev/null
+++ b/etc/api_schemas/8.1/8.1.threshold.json
@@ -0,0 +1,398 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threshold": {
+      "additionalProperties": false,
+      "properties": {
+        "cardinality": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "field": {
+                "type": "string"
+              },
+              "value": {
+                "description": "ThresholdValue",
+                "format": "integer",
+                "minimum": 1,
+                "type": "number"
+              }
+            },
+            "required": [
+              "field",
+              "value"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "field": {
+          "description": "CardinalityFields",
+          "items": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "maxItems": 3,
+          "type": "array"
+        },
+        "value": {
+          "description": "ThresholdValue",
+          "format": "integer",
+          "minimum": 1,
+          "type": "number"
+        }
+      },
+      "required": [
+        "field",
+        "value"
+      ],
+      "type": "object"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "threshold"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "threshold",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/etc/api_schemas/master/master.base.json b/etc/api_schemas/master/master.base.json
index 1f5e717e2..b6c6afe45 100644
--- a/etc/api_schemas/master/master.base.json
+++ b/etc/api_schemas/master/master.base.json
@@ -92,6 +92,8 @@
       "type": "object"
     },
     "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
       "type": "string"
     },
     "note": {
diff --git a/etc/api_schemas/master/master.eql.json b/etc/api_schemas/master/master.eql.json
index 103e625c9..1c81c7f71 100644
--- a/etc/api_schemas/master/master.eql.json
+++ b/etc/api_schemas/master/master.eql.json
@@ -104,6 +104,8 @@
       "type": "object"
     },
     "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
       "type": "string"
     },
     "note": {
diff --git a/etc/api_schemas/master/master.machine_learning.json b/etc/api_schemas/master/master.machine_learning.json
index ccf730371..4d4472edb 100644
--- a/etc/api_schemas/master/master.machine_learning.json
+++ b/etc/api_schemas/master/master.machine_learning.json
@@ -109,6 +109,8 @@
       "type": "object"
     },
     "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
       "type": "string"
     },
     "note": {
diff --git a/etc/api_schemas/master/master.query.json b/etc/api_schemas/master/master.query.json
index 78cbdae7a..d0f43d89c 100644
--- a/etc/api_schemas/master/master.query.json
+++ b/etc/api_schemas/master/master.query.json
@@ -106,6 +106,8 @@
       "type": "object"
     },
     "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
       "type": "string"
     },
     "note": {
diff --git a/etc/api_schemas/master/master.threat_match.json b/etc/api_schemas/master/master.threat_match.json
index c46b4d6dd..f9ce1c1b1 100644
--- a/etc/api_schemas/master/master.threat_match.json
+++ b/etc/api_schemas/master/master.threat_match.json
@@ -118,6 +118,8 @@
       "type": "object"
     },
     "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
       "type": "string"
     },
     "note": {
diff --git a/etc/api_schemas/master/master.threshold.json b/etc/api_schemas/master/master.threshold.json
index e755b4616..28959a7bb 100644
--- a/etc/api_schemas/master/master.threshold.json
+++ b/etc/api_schemas/master/master.threshold.json
@@ -106,6 +106,8 @@
       "type": "object"
     },
     "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
       "type": "string"
     },
     "note": {
diff --git a/etc/packages.yml b/etc/packages.yml
index 66c862279..4ef27df77 100644
--- a/etc/packages.yml
+++ b/etc/packages.yml
@@ -1,6 +1,6 @@
 ---
 package:
-  name: "8.1"
+  name: "8.2"
   release: true
   # exclude rules which have any of the following index <-> field pairs
   #  exclude_fields:
@@ -26,7 +26,7 @@ package:
   registry_data:
     categories: ["security"]
     conditions:
-      kibana.version: "^8.1.0"
+      kibana.version: "^8.2.0"
     description: Prebuilt detection rules for Elastic Security
     format_version: 1.0.0
     icons:
@@ -40,4 +40,4 @@ package:
     release: ga
     title: Prebuilt Security Detection Rules
     type: integration
-    version: 1.0.1-dev.0
+    version: 1.2.0-dev.0
diff --git a/etc/stack-schema-map.yaml b/etc/stack-schema-map.yaml
index 27a04ac65..9a48995e5 100644
--- a/etc/stack-schema-map.yaml
+++ b/etc/stack-schema-map.yaml
@@ -30,3 +30,7 @@
 "8.1.0":
   beats: "master"  # TODO: update this once beats releases
   ecs: "1.12.1"
+
+"8.2.0":
+  beats: "master"  # TODO: update this once beats releases
+  ecs: "1.12.1"