Releases Specifications opentide spec index Conformance

Core

Versioning Metadata Workspace layout Configuration and overrides Deployment lifecycle Deployment state Validation Metaschema keywords

Platforms

Microsoft Sentinel (`platform::sentinel::1.0`)Microsoft Defender for Endpoint (`platform::defender_for_endpoint::1.0`)Splunk (`platform::splunk::1.0`)SentinelOne (`platform::sentinel_one::1.0`)VMware Carbon Black Cloud (`platform::carbon_black_cloud::1.0`)CrowdStrike Falcon (`platform::crowdstrike::1.0`)HarfangLab (`platform::harfanglab::1.0`)Elastic Security (`platform::elastic::1.0`)

Objects

Threat vector (TVM)Detection objective (DOM)Detection rule (MDR)

Vocabularies

Vocabulary format Vocabulary catalog

Governance

RFCs

Proposed

0003 Per-key vocabulary versioning and schema pinsProposed 0002 Vocabulary identifier versioning and schema pinsProposed

Draft

0012 Rules should read like the other objectsDraft 0011 Signal reuse across detection objectivesDraft 0009 RFCDraft 0008 Optional review date on detection rulesDraft 0005 RFCDraft

Accepted

0010 Deployment external idsAccepted 0007 Elastic Security detection platformAccepted 0006 Sharing on the production mergeAccepted 0005 Sharing system and MISP connectorAccepted 0001 Authority model and change processAccepted

Template

RFC templateTemplate

RFCs

RFC template

Starting point for a new proposal. Not a live RFC.

TemplateRFC 0000

Copy this file when drafting a proposal. It is not a live RFC.

Copy this file to rfcs/NNNN-your-title.md and fill in each section. Do not edit this template for proposals.

RFC: NNNN
Title: (short title)
Author: (name or handle)
Status: draft | accepted | rejected | superseded
Created: YYYY-MM-DD

Summary

One paragraph overview of the proposal.

Motivation

Why is this change needed? What problem does it solve? Who is affected?

Detailed design

Describe spec changes concretely:

Affected paths under specs/
New or changed requirements (MUST/SHOULD/MAY)
Schema ID impact (metadata.schema)
Fixture changes under fixtures/
Vocabulary impact under vocabularies/

Drawbacks

Trade-offs, migration cost, complexity added.

Alternatives

Other approaches considered and why they were rejected.

Unresolved questions

Open items for reviewer discussion.

References

Links to GitHub issues (opentidehq/specifications, opentidehq/opentide), prior art, opentide implementation notes
Never Linear — opentide tracking is public GitHub only

0001 Authority model and change processAccepted

This RFC establishes the normative authority chain for opentide: markdown specs in the specifications repository are canonical; opentide Pydantic models implement them; JSON…

On this page

Summary Motivation Detailed design Drawbacks Alternatives Unresolved questions References