[RFC 0030] - Linux event model (Stage-2)

[mitodrummer]

• Have you signed the contributor license agreement? yes
• Have you followed the contributor guidelines? yes
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? yes
• If submitting code/script changes, have you verified all tests pass locally using make test? n/a
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? n/a
• Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed. yes
• Have you added an entry to the CHANGELOG.next.md? not yet.

[ebeahan]

Content and examples look great! There are some markdown issues, and I noted a few grammar nits.

Stage 2 criteria:

• Opened pull request for this draft revising the existing proposal
• Completed field definitions
• Included a real-world example source document
• Identifies scope of impact of changes to ingestion mechanisms (e.g. beats/logstash), usage mechanisms (e.g. Kibana applications, detections), and the ECS project (e.g. docs, tooling)
• Subject matter experts weighed in on the technical utility of field definitions in the pull request

[mitodrummer]

Content and examples look great! There are some markdown issues, and I noted a few grammar nits.

Stage 2 criteria:

• Opened pull request for this draft revising the existing proposal
• Completed field definitions
• Included a real-world example source document
• Identifies scope of impact of changes to ingestion mechanisms (e.g. beats/logstash), usage mechanisms (e.g. Kibana applications, detections), and the ECS project (e.g. docs, tooling)
• Subject matter experts weighed in on the technical utility of field definitions in the pull request

Calling all subject matter experts @norrietaylor @m-sample @ferullo @mattnite @rhysre

[mattnite]

I've gone over this RFC a number of times during it's development, there are some fields in here that we're not implementing for AWP's first milestone but everything defined is implementable and useful for capturing linux process information.

[m-sample]

LGTM +1

[kgeller]

LGTM!

Just one house keeping note, we'll want to make sure we add this PR to the list when we update the stage and date before merge.

[m-sample]

@kgeller @ebeahan - is there something we need to do to kick the CLA check? Karl is on PTO today.