Add RFC for extended entity fields by uri-weisman · Pull Request #2598 · elastic/ecs

uri-weisman · 2026-03-31T18:29:46Z

Summary

add a 9.4 strawperson RFC proposing new entity.attributes.*, entity.lifecycle.*, and entity.relationships.* leaves
document entity.risk.* reuse under entity for normalized entity-level risk
align the RFC field descriptions with the wording captured in issue RFC: extend entity schema with additional attributes, lifecycle and relationships fields, and enable entity.risk reuse #2597

Introduce a 9.4 strawperson RFC for new entity attributes, lifecycle, and relationship leaves, and propose enabling entity.risk reuse for normalized entities. Made-with: Cursor

github-actions · 2026-03-31T18:29:57Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

- Add stage-0 header comments and link to RFC 0049 - Merge entity-type guidance into Fields table; keyword (list) for arrays - Document flat relationship object shape and Field Re-use nesting - Fix entity.last_seen_timestamp reference; restore administered_by row - Match People, Source data, References, and Concerns style to other RFCs - Update usage example entity.type to array form Made-with: Cursor

chemamartinez

LGTM! My review is mostly focused on conversation's I've been involved and from an integration perspective so please wait for the rest of reviewer's approval.

erikh-elastic

LGTM

trisch-me

lgtm in general with some minor feedback

Co-authored-by: Alexandra Konrad <alexandra.konrad@elastic.co>

…m/uri-weisman/ecs into entity_fields_9_4_rfc_strawperson

uri-weisman · 2026-05-04T13:51:33Z

@andrewkroh can I please ask you to have a second look?

uri-weisman · 2026-05-05T04:28:37Z

We decided to wait with follow up PRs that utilize the fields defined in this RFC until it's merged

Can I get another reviewer with write access to be able to merge this one? @trisch-me asking for your assistance.

trisch-me · 2026-05-05T08:58:51Z

@taylor-swanson @andrewkroh could you check this out?

bhapas

LGTM

uri-weisman · 2026-05-06T14:59:00Z

Thanks everyone, @trisch-me I need your assistance with pushing this one?

trisch-me · 2026-05-06T15:19:42Z

@uri-weisman can you create a follow up PR with fields put into yaml files? Or do you need help with it?

uri-weisman · 2026-05-06T16:21:53Z

@uri-weisman can you create a follow up PR with fields put into yaml files? Or do you need help with it?

Will create one, thanks!

narph · 2026-05-11T09:39:35Z

@uri-weisman can you create a follow up PR with fields put into yaml files? Or do you need help with it?

Will create one, thanks!

@uri-weisman Is the PR already in? We want to make sure the ECS fields are added in before we make changes to our integrations, so we can reduce future friction or potential breaking changes for users.

uri-weisman · 2026-05-11T10:46:50Z

Hey @narph, IIUC @trisch-me is working on introducing the follow up PR - ticket.

trisch-me · 2026-05-11T11:53:04Z

hey @narph - the PR is there, but actual fields are not yet in ECS, I was going to introduce them, but there is a technical question I need to solve first, I hope it will be ready soon

taylor-swanson · 2026-05-11T12:41:53Z

We want to make sure the ECS fields are added in before we make changes to our integrations, so we can reduce future friction or potential breaking changes for users.

@narph, just as a heads up, the dynamic ECS templates in elasticsearch won't be updated until the next stack release, so any new fields that don't already match the dynamic template won't map properly if relying on that method. Looking at the list of fields, entity.lifecycle.last_activity (date) is one of those fields. The field can be mapped statically through external: ecs as long as the ECS reference in the integration is updated to the next ECS release that includes these fields.

Add RFC for extended entity fields

9a3f98d

Introduce a 9.4 strawperson RFC for new entity attributes, lifecycle, and relationship leaves, and propose enabling entity.risk reuse for normalized entities. Made-with: Cursor

uri-weisman requested a review from a team March 31, 2026 18:29

chemamartinez reviewed Apr 1, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

andrewkroh reviewed Apr 1, 2026

View reviewed changes

trisch-me reviewed Apr 7, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 7, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 7, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 7, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 7, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 7, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

uri-weisman added 2 commits April 9, 2026 10:51

make identifiers dotted

463a00c

trisch-me reviewed Apr 13, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

cr changes

4445e6f

uri-weisman requested review from andrewkroh, chemamartinez, erikh-elastic and trisch-me April 21, 2026 14:07

chemamartinez approved these changes Apr 21, 2026

View reviewed changes

erikh-elastic approved these changes Apr 21, 2026

View reviewed changes

trisch-me reviewed Apr 22, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 22, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 22, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 22, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 22, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md

trisch-me approved these changes Apr 22, 2026

View reviewed changes

uri-weisman and others added 3 commits April 26, 2026 12:48

Update rfcs/text/0054-extend-entity-fields.md

dcd9a58

Co-authored-by: Alexandra Konrad <alexandra.konrad@elastic.co>

Update rfcs/text/0054-extend-entity-fields.md

53ee704

Co-authored-by: Alexandra Konrad <alexandra.konrad@elastic.co>

Update rfcs/text/0054-extend-entity-fields.md

5b6cb9b

Co-authored-by: Alexandra Konrad <alexandra.konrad@elastic.co>

uri-weisman and others added 3 commits April 26, 2026 12:49

Update rfcs/text/0054-extend-entity-fields.md

54e7b9a

Co-authored-by: Alexandra Konrad <alexandra.konrad@elastic.co>

change from administered_by to administers

2bb4b49

add user.domain as a possible identifier

3644884

trisch-me reviewed Apr 27, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md Outdated

trisch-me reviewed Apr 27, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md

chemamartinez reviewed Apr 30, 2026

View reviewed changes

Comment thread rfcs/text/0054-extend-entity-fields.md

uri-weisman and others added 5 commits May 3, 2026 12:25

Update rfcs/text/0054-extend-entity-fields.md

2d16159

Co-authored-by: Alexandra Konrad <alexandra.konrad@elastic.co>

Refine administers and supervises desc

919d5be

Merge branch 'entity_fields_9_4_rfc_strawperson' of https://github.co…

82149d0

…m/uri-weisman/ecs into entity_fields_9_4_rfc_strawperson

small fix

e6a3ec7

Merge branch 'main' into entity_fields_9_4_rfc_strawperson

217206c

chemamartinez mentioned this pull request May 5, 2026

EntityAnalytics AD: add support for ECS entity fields elastic/integrations#18337

Open

5 tasks

bhapas approved these changes May 6, 2026

View reviewed changes

taylor-swanson approved these changes May 6, 2026

View reviewed changes

Merge branch 'main' into entity_fields_9_4_rfc_strawperson

e04a926

trisch-me merged commit 7745837 into elastic:main May 6, 2026
7 checks passed

uri-weisman deleted the entity_fields_9_4_rfc_strawperson branch May 6, 2026 16:22

trisch-me mentioned this pull request May 11, 2026

added new fieldset and new fields to entity set as per RFC 0054 #2648

Merged

Conversation

uri-weisman commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

github-actions Bot commented Mar 31, 2026

🤖 GitHub comments

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chemamartinez left a comment

Choose a reason for hiding this comment

Uh oh!

erikh-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

trisch-me left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

uri-weisman commented May 4, 2026

Uh oh!

uri-weisman commented May 5, 2026

Uh oh!

trisch-me commented May 5, 2026

Uh oh!

bhapas left a comment

Choose a reason for hiding this comment

Uh oh!

uri-weisman commented May 6, 2026

Uh oh!

Uh oh!

trisch-me commented May 6, 2026

Uh oh!

uri-weisman commented May 6, 2026

Uh oh!

narph commented May 11, 2026

Uh oh!

uri-weisman commented May 11, 2026

Uh oh!

trisch-me commented May 11, 2026

Uh oh!

taylor-swanson commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

uri-weisman commented Mar 31, 2026 •

edited

Loading