RFC Stage 0: Create 0000-authentication-fields.md

[mr1716]

• Have you signed the contributor license agreement? Yes
• Have you followed the contributor guidelines? Yes
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? Yes
• If submitting code/script changes, have you verified all tests pass locally using make test?
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes?
• Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed.
• Have you added an entry to the CHANGELOG.next.md?

[UcanInfosec]

@kgeller Any progress on this request?

[kgeller]

@kgeller Any progress on this request?

Hi @UcanInfosec ! Apologies for the delayed review, I somehow missed this popping up. I performed an initial review and left specific questions along the way.

I think one thing that would be a great addition would be definitions of the proposed fields. I see the type and value, but the definition / overview of what you expect the field to represent would really add beneficial context.

[UcanInfosec]

@kgeller thanks. Much appreciated. So if these changes are made, what would the next step(s) be? Would it be likely to move forward if changes are made?

[kgeller]

@UcanInfosec If these changes were made, we would continue to move through the process. This is just stage 0, which essentially is the ECS team agreeing that this RFC and proposed fields/concepts are a good fit (which I do believe we can get to).

This outlines the stages of the RFC process, and what we are looking for in order to advance through.

This outlines the process itself, and how each 'group' involved works together.

[mr1716]

@kgeller The proposed changes have been made. The next step would be to add in definitions, which has been done. May you please review and provide feedback as necessary?

[mr1716]

@kgeller This has been updated accordingly. Wanted to say thanks for helping get this process started.

[kgeller]

@mr1716 I think this is coming along nicely!

One ask: can we consolidate the table tables with the new field details? I see some slight divergence between the two, and I think it would be clearer if only source of truth. The Faas RFC has a great example of the table for modeling.

Once completed, I think we should be good to go to merge this as stage 0.

[mr1716]

@kgeller Thanks. I made the change to have everything be 1 table

[kgeller]

@mr1716 Thanks for combining! Now it looks like everything is duplicated, would you mind consolidating so we have only one entry per suggested field, and then the columns Proposed field name, Type, Value, Description ?

[mr1716]

@kgeller Thanks. The changes have been made to the table to make it more consistent.

[UcanInfosec]

@kgeller would it also be possible to get the RFC tag/label for this for easier tracking? What needs to get done for this to move forward?

[ebeahan]

Added some minor feedback. Otherwise, I believe this is fine to merge as a strawperson proposal for Stage 0.

[mr1716]

Hey, @kgeller what would the next step(s) be?

[kgeller]

Hey, @kgeller what would the next step(s) be?

Hi @mr1716 apologies for the delay. The next step would be finishing up the last couple of outstanding questions from @ebeahan 's last review and then we should be good to merge!

[mr1716]

@kgeller Thank you very much. The changes proposed have been made

[mr1716]

@kgeller thanks for helping. What is the next step in this? How would we get this into ECS?

[kgeller]

@mr1716 you'll want to continue to iterate through the RFC process.

This provides a really nice overview of which stage equates to what level of the fields being in ECS.

[mr1716]

@kgeller Thanks. How long does it typically take for steps 2 and 3? This case has been opened for almost 4 months and am curious to understand how long these things may take

[ebeahan]

@mr1716 The amount of time will vary with each RFC depending on the complexity/scope of the proposal and the extent of feedback and revision required. The team aim to provide timely feedback to allow contributors to iterate. But we also review RFC proposals thoroughly and thoughtfully, and we want to leave room for discussion and feedback from the ECS community.