From 90ca1ffcfbb4f043d10c137b75a35bca6e68a1ad Mon Sep 17 00:00:00 2001
From: jamiehynds <62879768+jamiehynds@users.noreply.github.com>
Date: Thu, 27 Aug 2020 15:42:53 +0100
Subject: [PATCH 1/4] Create 0000-Data-Source-Categorization-Fields.md

---
 .../0000-Data-Source-Categorization-Fields.md | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 rfcs/text/0000-Data-Source-Categorization-Fields.md

diff --git a/rfcs/text/0000-Data-Source-Categorization-Fields.md b/rfcs/text/0000-Data-Source-Categorization-Fields.md
new file mode 100644
index 0000000000..8f699baddc
--- /dev/null
+++ b/rfcs/text/0000-Data-Source-Categorization-Fields.md
@@ -0,0 +1,73 @@
+# 0000: Data Source Categorization Fields
+<!-- Leave this ID at 0000. The ECS team will assign a unique, contiguous RFC number upon merging the initial stage of this RFC. -->
+
+- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
+- Date: **August 26 2020** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
+
+<!--
+As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
+Feel free to remove these comments as you go along.
+-->
+
+<!--
+Stage 0: Provide a high level summary of the premise of these changes. Briefly describe the nature, purpose, and impact of the changes. ~2-5 sentences.
+-->
+
+Elastic currently supports ingestion of data from 180+ sources, and growing. However, we do not have a coherent way to categorise these sources. This has resulted in a disconnect in how we categorize these sources from the Elastic website, in-product experiences and ECS. 
+
+The fieldset we use to describe the data source is up for discussion, data_stream.category is a possibility. Here are proposed allowed values:
+
+- apm
+- application
+- audit
+- CASB
+- cloud
+- collaboration
+- Config Management
+- containers
+- CRM
+- EDR
+- email
+- firewall
+- Identity and access management
+- IDS/IPS
+- Operating System
+- productivity
+- proxy
+- queue/message queue
+- security
+- storage
+- threat intelligence
+- ticketing
+- VPN
+- vulnerability scanner
+- Web server
+
+## Usage
+Categorization fields in ECS can govern how we categorize these data source, but only a limited set of event.category values are supported by the schema today. The event categorisation fields are catered to individual events, but don't categorise the data source.  Expanding the values we support, allows us to align the user experience from ECS, Ingest Manager and the Elastic Website (elastic.co/integrations). Some additional context here: #845 (comment).
+
+These categories could also be used to categorise detection rules, to map data sources to corresponding rules. This would improve our onboarding experience by suggesting detection rules to users based on the sources they are ingesting data from.
+
+
+## People
+
+The following are the people that consulted on the contents of this RFC.
+
+* @jamiehynds | author
+* @exekias | sponsor
+
+## References
+
+https://github.com/elastic/ecs/issues/901
+https://github.com/elastic/ecs/pull/845
+
+### RFC Pull Requests
+
+<!-- An RFC should link to the PRs for each of it stage advancements. -->
+
+* Stage 0: https://github.com/elastic/ecs/pull/954
+
+<!--
+* Stage 1: https://github.com/elastic/ecs/pull/NNN
+...
+-->

From 2155e4e503ba4ac087ea777eb6fecd52d483c7f5 Mon Sep 17 00:00:00 2001
From: Eric Beahan <eric.beahan@elastic.co>
Date: Thu, 27 Aug 2020 13:02:29 -0500
Subject: [PATCH 2/4] update stage 0 PR reference

---
 rfcs/text/0000-Data-Source-Categorization-Fields.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/rfcs/text/0000-Data-Source-Categorization-Fields.md b/rfcs/text/0000-Data-Source-Categorization-Fields.md
index 8f699baddc..defe7e8209 100644
--- a/rfcs/text/0000-Data-Source-Categorization-Fields.md
+++ b/rfcs/text/0000-Data-Source-Categorization-Fields.md
@@ -13,7 +13,7 @@ Feel free to remove these comments as you go along.
 Stage 0: Provide a high level summary of the premise of these changes. Briefly describe the nature, purpose, and impact of the changes. ~2-5 sentences.
 -->
 
-Elastic currently supports ingestion of data from 180+ sources, and growing. However, we do not have a coherent way to categorise these sources. This has resulted in a disconnect in how we categorize these sources from the Elastic website, in-product experiences and ECS. 
+Elastic currently supports ingestion of data from 180+ sources, and growing. However, we do not have a coherent way to categorise these sources. This has resulted in a disconnect in how we categorize these sources from the Elastic website, in-product experiences and ECS.
 
 The fieldset we use to describe the data source is up for discussion, data_stream.category is a possibility. Here are proposed allowed values:
 
@@ -58,14 +58,14 @@ The following are the people that consulted on the contents of this RFC.
 
 ## References
 
-https://github.com/elastic/ecs/issues/901
-https://github.com/elastic/ecs/pull/845
+* https://github.com/elastic/ecs/issues/901
+* https://github.com/elastic/ecs/pull/845
 
 ### RFC Pull Requests
 
 <!-- An RFC should link to the PRs for each of it stage advancements. -->
 
-* Stage 0: https://github.com/elastic/ecs/pull/954
+* Stage 0: https://github.com/elastic/ecs/pull/958
 
 <!--
 * Stage 1: https://github.com/elastic/ecs/pull/NNN

From c49647a937ba7daa3fb0a02348806469c3347ae8 Mon Sep 17 00:00:00 2001
From: Eric Beahan <eric.beahan@elastic.co>
Date: Thu, 27 Aug 2020 13:03:14 -0500
Subject: [PATCH 3/4] lowering case filename for consistency

---
 ...zation-Fields.md => 0000-data-source-categorization-fields.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename rfcs/text/{0000-Data-Source-Categorization-Fields.md => 0000-data-source-categorization-fields.md} (100%)

diff --git a/rfcs/text/0000-Data-Source-Categorization-Fields.md b/rfcs/text/0000-data-source-categorization-fields.md
similarity index 100%
rename from rfcs/text/0000-Data-Source-Categorization-Fields.md
rename to rfcs/text/0000-data-source-categorization-fields.md

From 873512c582267308588e3e3a182d776b2d9c2c3e Mon Sep 17 00:00:00 2001
From: jamiehynds <62879768+jamiehynds@users.noreply.github.com>
Date: Thu, 17 Sep 2020 09:50:18 +0100
Subject: [PATCH 4/4] Update 0000-data-source-categorization-fields.md

---
 rfcs/text/0000-data-source-categorization-fields.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rfcs/text/0000-data-source-categorization-fields.md b/rfcs/text/0000-data-source-categorization-fields.md
index defe7e8209..a8443bb4c3 100644
--- a/rfcs/text/0000-data-source-categorization-fields.md
+++ b/rfcs/text/0000-data-source-categorization-fields.md
@@ -26,15 +26,17 @@ The fieldset we use to describe the data source is up for discussion, data_strea
 - Config Management
 - containers
 - CRM
+- datastore
 - EDR
 - email
 - firewall
 - Identity and access management
 - IDS/IPS
 - Operating System
+- orchestration
 - productivity
 - proxy
-- queue/message queue
+- message queue
 - security
 - storage
 - threat intelligence