ECS 8.1.0
What's new in ECS 8.1
The email.*
field set
Proposed in RFC 0010, this release introduces a beta email.*
field set. These fields capture event details from email message headers, bodies, and attachments.
Additional hash fields
ECS 8.1 also adds three additional hash fields:
hash.sha384
hash.tlsh
pe.pehash
These fields help align ECS with Threat Intelligence features available in the Elastic platform.
Changelog
Schema Changes
Added
- Added two new fields (sha384,tlsh) to hash schema and one field to pe schema (pehash). #1678
- Added
email.*
beta field set. ##1688, #1705
Removed
- Removing
process.target.*
reuses from experimental schema. #1666 - Removing RFC 0014
pe.*
fields from experimental schema. #1670
Tooling and Artifact Changes
Bugfixes
- Fix invalid documentation link generation in component templates
_meta
. #1728