diff --git a/.github/workflows/lock-versions.yml b/.github/workflows/lock-versions.yml
index c5a8003adc3..36463c30eaf 100644
--- a/.github/workflows/lock-versions.yml
+++ b/.github/workflows/lock-versions.yml
@@ -6,7 +6,7 @@ on:
           description: 'List of branches to lock versions (ordered, comma separated)'
           required: true
           # 7.17 was intentionally skipped because it was added late and was bug fix only
-          default: '7.16,8.0,8.1,8.2,8.3'
+          default: '7.16,8.0,8.1,8.2,8.3,8.4'
 
 jobs:
   pr:
diff --git a/detection_rules/etc/api_schemas/8.4/8.4.base.json b/detection_rules/etc/api_schemas/8.4/8.4.base.json
new file mode 100644
index 00000000000..aceecbb628d
--- /dev/null
+++ b/detection_rules/etc/api_schemas/8.4/8.4.base.json
@@ -0,0 +1,383 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e",
+        "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
+        "e70679c2-6cde-4510-9764-4823df18f7db",
+        "300afc76-072d-4261-864d-4149714bf3f1",
+        "3e47ef71-ebfc-4520-975c-cb27fc090799"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline",
+        "Comprehensive File Timeline",
+        "Comprehensive Process Timeline",
+        "Comprehensive Network Timeline",
+        "Comprehensive Registry Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "query",
+        "saved_query",
+        "machine_learning",
+        "eql",
+        "threshold",
+        "threat_match"
+      ],
+      "enumNames": [],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "name",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/detection_rules/etc/api_schemas/8.4/8.4.eql.json b/detection_rules/etc/api_schemas/8.4/8.4.eql.json
new file mode 100644
index 00000000000..30a8bd69d9a
--- /dev/null
+++ b/detection_rules/etc/api_schemas/8.4/8.4.eql.json
@@ -0,0 +1,394 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "eql"
+      ],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e",
+        "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
+        "e70679c2-6cde-4510-9764-4823df18f7db",
+        "300afc76-072d-4261-864d-4149714bf3f1",
+        "3e47ef71-ebfc-4520-975c-cb27fc090799"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline",
+        "Comprehensive File Timeline",
+        "Comprehensive Process Timeline",
+        "Comprehensive Network Timeline",
+        "Comprehensive Registry Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "eql"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/detection_rules/etc/api_schemas/8.4/8.4.machine_learning.json b/detection_rules/etc/api_schemas/8.4/8.4.machine_learning.json
new file mode 100644
index 00000000000..9b96c959aa2
--- /dev/null
+++ b/detection_rules/etc/api_schemas/8.4/8.4.machine_learning.json
@@ -0,0 +1,396 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "anomaly_threshold": {
+      "format": "integer",
+      "type": "number"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "machine_learning_job_id": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ]
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e",
+        "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
+        "e70679c2-6cde-4510-9764-4823df18f7db",
+        "300afc76-072d-4261-864d-4149714bf3f1",
+        "3e47ef71-ebfc-4520-975c-cb27fc090799"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline",
+        "Comprehensive File Timeline",
+        "Comprehensive Process Timeline",
+        "Comprehensive Network Timeline",
+        "Comprehensive Registry Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "machine_learning"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "anomaly_threshold",
+    "author",
+    "description",
+    "machine_learning_job_id",
+    "name",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/detection_rules/etc/api_schemas/8.4/8.4.query.json b/detection_rules/etc/api_schemas/8.4/8.4.query.json
new file mode 100644
index 00000000000..941548a7c8d
--- /dev/null
+++ b/detection_rules/etc/api_schemas/8.4/8.4.query.json
@@ -0,0 +1,396 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e",
+        "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
+        "e70679c2-6cde-4510-9764-4823df18f7db",
+        "300afc76-072d-4261-864d-4149714bf3f1",
+        "3e47ef71-ebfc-4520-975c-cb27fc090799"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline",
+        "Comprehensive File Timeline",
+        "Comprehensive Process Timeline",
+        "Comprehensive Network Timeline",
+        "Comprehensive Registry Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "query"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/detection_rules/etc/api_schemas/8.4/8.4.threat_match.json b/detection_rules/etc/api_schemas/8.4/8.4.threat_match.json
new file mode 100644
index 00000000000..e0100422221
--- /dev/null
+++ b/detection_rules/etc/api_schemas/8.4/8.4.threat_match.json
@@ -0,0 +1,487 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "concurrent_searches": {
+      "description": "PositiveInteger",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "items_per_search": {
+      "description": "PositiveInteger",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat_indicator_path": {
+      "type": "string"
+    },
+    "threat_language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "threat_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "entries": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "field": {
+                  "description": "NonEmptyStr",
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": {
+                  "enum": [
+                    "mapping"
+                  ],
+                  "type": "string"
+                },
+                "value": {
+                  "description": "NonEmptyStr",
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "field",
+                "type",
+                "value"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "entries"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threat_query": {
+      "type": "string"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e",
+        "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
+        "e70679c2-6cde-4510-9764-4823df18f7db",
+        "300afc76-072d-4261-864d-4149714bf3f1",
+        "3e47ef71-ebfc-4520-975c-cb27fc090799"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline",
+        "Comprehensive File Timeline",
+        "Comprehensive Process Timeline",
+        "Comprehensive Network Timeline",
+        "Comprehensive Registry Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "threat_match"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "threat_index",
+    "threat_mapping",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/detection_rules/etc/api_schemas/8.4/8.4.threshold.json b/detection_rules/etc/api_schemas/8.4/8.4.threshold.json
new file mode 100644
index 00000000000..62c7cae60fc
--- /dev/null
+++ b/detection_rules/etc/api_schemas/8.4/8.4.threshold.json
@@ -0,0 +1,445 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "author": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "building_block_type": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "exceptions_list": {
+      "items": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "array"
+    },
+    "false_positives": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "filters": {
+      "items": {
+        "additionalProperties": {
+          "type": [
+            "string",
+            "number",
+            "object",
+            "array",
+            "boolean"
+          ]
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "from": {
+      "type": "string"
+    },
+    "index": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "interval": {
+      "description": "Interval",
+      "pattern": "^\\d+[mshd]$",
+      "type": "string"
+    },
+    "language": {
+      "enum": [
+        "kuery",
+        "lucene"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "max_signals": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "minimum": 1,
+      "type": "number"
+    },
+    "meta": {
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "object",
+          "array",
+          "boolean"
+        ]
+      },
+      "type": "object"
+    },
+    "name": {
+      "description": "RuleName",
+      "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$",
+      "type": "string"
+    },
+    "note": {
+      "description": "MarkdownField",
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "references": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "risk_score": {
+      "description": "MaxSignals",
+      "format": "integer",
+      "maximum": 100,
+      "minimum": 1,
+      "type": "number"
+    },
+    "risk_score_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "rule_id": {
+      "description": "UUIDString",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "type": "string"
+    },
+    "rule_name_override": {
+      "type": "string"
+    },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
+    "severity": {
+      "enum": [
+        "low",
+        "medium",
+        "high",
+        "critical"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "severity_mapping": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "field": {
+            "type": "string"
+          },
+          "operator": {
+            "enum": [
+              "equals"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "tags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "threat": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "framework": {
+            "enum": [
+              "MITRE ATT&CK"
+            ],
+            "type": "string"
+          },
+          "tactic": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "reference": {
+                "description": "TacticURL",
+                "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "reference"
+            ],
+            "type": "object"
+          },
+          "technique": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                },
+                "reference": {
+                  "description": "TechniqueURL",
+                  "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
+                  "type": "string"
+                },
+                "subtechnique": {
+                  "items": {
+                    "additionalProperties": false,
+                    "properties": {
+                      "id": {
+                        "type": "string"
+                      },
+                      "name": {
+                        "type": "string"
+                      },
+                      "reference": {
+                        "description": "SubTechniqueURL",
+                        "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "id",
+                      "name",
+                      "reference"
+                    ],
+                    "type": "object"
+                  },
+                  "type": "array"
+                }
+              },
+              "required": [
+                "id",
+                "name",
+                "reference"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "framework",
+          "tactic"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "threshold": {
+      "additionalProperties": false,
+      "properties": {
+        "cardinality": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "field": {
+                "type": "string"
+              },
+              "value": {
+                "description": "ThresholdValue",
+                "format": "integer",
+                "minimum": 1,
+                "type": "number"
+              }
+            },
+            "required": [
+              "field",
+              "value"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "field": {
+          "description": "CardinalityFields",
+          "items": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "maxItems": 3,
+          "type": "array"
+        },
+        "value": {
+          "description": "ThresholdValue",
+          "format": "integer",
+          "minimum": 1,
+          "type": "number"
+        }
+      },
+      "required": [
+        "field",
+        "value"
+      ],
+      "type": "object"
+    },
+    "throttle": {
+      "type": "string"
+    },
+    "timeline_id": {
+      "description": "TimelineTemplateId",
+      "enum": [
+        "db366523-f1c6-4c1f-8731-6ce5ed9e5717",
+        "91832785-286d-4ebe-b884-1a208d111a70",
+        "76e52245-7519-4251-91ab-262fb1a1728c",
+        "495ad7a7-316e-4544-8a0f-9c098daee76e",
+        "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
+        "e70679c2-6cde-4510-9764-4823df18f7db",
+        "300afc76-072d-4261-864d-4149714bf3f1",
+        "3e47ef71-ebfc-4520-975c-cb27fc090799"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timeline_title": {
+      "description": "TimelineTemplateTitle",
+      "enum": [
+        "Generic Endpoint Timeline",
+        "Generic Network Timeline",
+        "Generic Process Timeline",
+        "Generic Threat Match Timeline",
+        "Comprehensive File Timeline",
+        "Comprehensive Process Timeline",
+        "Comprehensive Network Timeline",
+        "Comprehensive Registry Timeline"
+      ],
+      "enumNames": [],
+      "type": "string"
+    },
+    "timestamp_override": {
+      "type": "string"
+    },
+    "to": {
+      "type": "string"
+    },
+    "type": {
+      "enum": [
+        "threshold"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "author",
+    "description",
+    "language",
+    "name",
+    "query",
+    "risk_score",
+    "rule_id",
+    "severity",
+    "threshold",
+    "type"
+  ],
+  "type": "object"
+}
\ No newline at end of file
diff --git a/detection_rules/etc/api_schemas/master/master.base.json b/detection_rules/etc/api_schemas/master/master.base.json
index 6d0410a71fc..aceecbb628d 100644
--- a/detection_rules/etc/api_schemas/master/master.base.json
+++ b/detection_rules/etc/api_schemas/master/master.base.json
@@ -106,6 +106,41 @@
       },
       "type": "array"
     },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
     "risk_score": {
       "description": "MaxSignals",
       "format": "integer",
@@ -145,6 +180,10 @@
     "rule_name_override": {
       "type": "string"
     },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
     "severity": {
       "enum": [
         "low",
diff --git a/detection_rules/etc/api_schemas/master/master.eql.json b/detection_rules/etc/api_schemas/master/master.eql.json
index d8d86eef263..30a8bd69d9a 100644
--- a/detection_rules/etc/api_schemas/master/master.eql.json
+++ b/detection_rules/etc/api_schemas/master/master.eql.json
@@ -121,6 +121,41 @@
       },
       "type": "array"
     },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
     "risk_score": {
       "description": "MaxSignals",
       "format": "integer",
@@ -160,6 +195,10 @@
     "rule_name_override": {
       "type": "string"
     },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
     "severity": {
       "enum": [
         "low",
diff --git a/detection_rules/etc/api_schemas/master/master.machine_learning.json b/detection_rules/etc/api_schemas/master/master.machine_learning.json
index 968f899e18b..9b96c959aa2 100644
--- a/detection_rules/etc/api_schemas/master/master.machine_learning.json
+++ b/detection_rules/etc/api_schemas/master/master.machine_learning.json
@@ -123,6 +123,41 @@
       },
       "type": "array"
     },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
     "risk_score": {
       "description": "MaxSignals",
       "format": "integer",
@@ -162,6 +197,10 @@
     "rule_name_override": {
       "type": "string"
     },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
     "severity": {
       "enum": [
         "low",
diff --git a/detection_rules/etc/api_schemas/master/master.query.json b/detection_rules/etc/api_schemas/master/master.query.json
index e5f48689576..941548a7c8d 100644
--- a/detection_rules/etc/api_schemas/master/master.query.json
+++ b/detection_rules/etc/api_schemas/master/master.query.json
@@ -123,6 +123,41 @@
       },
       "type": "array"
     },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
     "risk_score": {
       "description": "MaxSignals",
       "format": "integer",
@@ -162,6 +197,10 @@
     "rule_name_override": {
       "type": "string"
     },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
     "severity": {
       "enum": [
         "low",
diff --git a/detection_rules/etc/api_schemas/master/master.threat_match.json b/detection_rules/etc/api_schemas/master/master.threat_match.json
index 90a9fcc50cb..e0100422221 100644
--- a/detection_rules/etc/api_schemas/master/master.threat_match.json
+++ b/detection_rules/etc/api_schemas/master/master.threat_match.json
@@ -135,6 +135,41 @@
       },
       "type": "array"
     },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
     "risk_score": {
       "description": "MaxSignals",
       "format": "integer",
@@ -174,6 +209,10 @@
     "rule_name_override": {
       "type": "string"
     },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
     "severity": {
       "enum": [
         "low",
diff --git a/detection_rules/etc/api_schemas/master/master.threshold.json b/detection_rules/etc/api_schemas/master/master.threshold.json
index 03f9f91043c..62c7cae60fc 100644
--- a/detection_rules/etc/api_schemas/master/master.threshold.json
+++ b/detection_rules/etc/api_schemas/master/master.threshold.json
@@ -123,6 +123,41 @@
       },
       "type": "array"
     },
+    "related_integrations": {
+      "items": {
+        "type": "string"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
+    "required_fields": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "ecs": {
+            "type": "boolean"
+          },
+          "name": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": {
+            "description": "NonEmptyStr",
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "ecs",
+          "name",
+          "type"
+        ],
+        "type": "object"
+      },
+      "min_compat": "8.3",
+      "type": "array"
+    },
     "risk_score": {
       "description": "MaxSignals",
       "format": "integer",
@@ -162,6 +197,10 @@
     "rule_name_override": {
       "type": "string"
     },
+    "setup": {
+      "min_compat": "8.3",
+      "type": "string"
+    },
     "severity": {
       "enum": [
         "low",
diff --git a/detection_rules/etc/beats_schemas/main.json.gz b/detection_rules/etc/beats_schemas/main.json.gz
index cfc9708ba91..0a212abc730 100644
Binary files a/detection_rules/etc/beats_schemas/main.json.gz and b/detection_rules/etc/beats_schemas/main.json.gz differ
diff --git a/detection_rules/etc/beats_schemas/v8.2.3.json.gz b/detection_rules/etc/beats_schemas/v8.2.3.json.gz
new file mode 100644
index 00000000000..02ce6d8629a
Binary files /dev/null and b/detection_rules/etc/beats_schemas/v8.2.3.json.gz differ
diff --git a/detection_rules/etc/beats_schemas/v8.3.3.json.gz b/detection_rules/etc/beats_schemas/v8.3.3.json.gz
new file mode 100644
index 00000000000..a8114edd18c
Binary files /dev/null and b/detection_rules/etc/beats_schemas/v8.3.3.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz
new file mode 100644
index 00000000000..4793376b54d
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz
new file mode 100644
index 00000000000..b691f4286ce
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz
new file mode 100644
index 00000000000..5ec35c80e23
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz
new file mode 100644
index 00000000000..a9a263b6589
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz
new file mode 100644
index 00000000000..421f3271531
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.0.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.0.0/ecs_nested.json.gz
new file mode 100644
index 00000000000..bafe1c61a71
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.0.0/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.2.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.2.0/ecs_flat.json.gz
new file mode 100644
index 00000000000..182b4e27a90
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.2.0/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.2.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.2.0/ecs_nested.json.gz
new file mode 100644
index 00000000000..ced04f8d8e1
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.2.0/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/master_8.5.0-dev/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.3.0/ecs_flat.json.gz
similarity index 99%
rename from detection_rules/etc/ecs_schemas/master_8.5.0-dev/ecs_flat.json.gz
rename to detection_rules/etc/ecs_schemas/8.3.0/ecs_flat.json.gz
index b9f48e6e0cf..e597a14c4d5 100644
Binary files a/detection_rules/etc/ecs_schemas/master_8.5.0-dev/ecs_flat.json.gz and b/detection_rules/etc/ecs_schemas/8.3.0/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.3.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.3.0/ecs_nested.json.gz
new file mode 100644
index 00000000000..8478b8ffc0c
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.3.0/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.3.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.3.1/ecs_flat.json.gz
new file mode 100644
index 00000000000..e64483e702c
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.3.1/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.3.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.3.1/ecs_nested.json.gz
new file mode 100644
index 00000000000..0a10d98e65f
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.3.1/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_flat.json.gz
new file mode 100644
index 00000000000..5fc6f990748
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_nested.json.gz
new file mode 100644
index 00000000000..4324328545d
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_nested.json.gz differ
diff --git a/detection_rules/etc/ecs_schemas/master_8.6.0-dev/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/master_8.6.0-dev/ecs_flat.json.gz
new file mode 100644
index 00000000000..df42b03c3c3
Binary files /dev/null and b/detection_rules/etc/ecs_schemas/master_8.6.0-dev/ecs_flat.json.gz differ
diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz
index 79d501d56e5..63f727a7974 100644
Binary files a/detection_rules/etc/integration-manifests.json.gz and b/detection_rules/etc/integration-manifests.json.gz differ
diff --git a/detection_rules/etc/stack-schema-map.yaml b/detection_rules/etc/stack-schema-map.yaml
index c3d8ccf8ab8..99d7898b311 100644
--- a/detection_rules/etc/stack-schema-map.yaml
+++ b/detection_rules/etc/stack-schema-map.yaml
@@ -1,29 +1,33 @@
-# alignment of stack with beats and ecs versions
-#    ECS versions do not align perfectly with stack releases (as of 7.13), so this will reflect MAX ecs version for a
-#    given release
-#
-# refer to release branch in https://github.com/elastic/beats/blob/main/libbeat/_meta/fields.ecs.yml
+# Purpose: Alignment of stack with beats and ecs versions
 
-# dropped backport support for 7.13.0, 7.14.0, 7.15.0 as of 8.4 branch creation
+# Notes
+## ECS versions do not align perfectly with stack releases (as of 7.13), so this will reflect MAX ecs version for a given release
+## To determine beats versions, visit https://github.com/elastic/beats/tags to determine latest version during preparation PR
+
+## Updates:
+## 7.17 was intentionally skipped because it was added late and was bug fix only
+## 06/2022 - dropped backport support for 7.13.0, 7.14.0, 7.15.0 as of 8.4 branch creation
+
+## Unsupported
 #"7.13.0":
 #  # beats release about the same time as the stack, so we cannot update this until it is released
 #  beats: "7.13.2"
 #  ecs: "1.9.0"
-#
+
 #"7.14.0":
 #  beats: "7.14.0"
 #  ecs: "1.10.0"
-#
+
 #"7.15.0":
 #  beats: "7.15.1"
 #  ecs: "1.11.0"
 
+## Supported
+
 "7.16.0":
   beats: "7.16.2"
   ecs: "1.12.2"
 
-# 7.17 was intentionally skipped because it was added late and was bug fix only
-
 "8.0.0":
   beats: "8.0.1"
   ecs: "8.0.1"
@@ -38,8 +42,12 @@
 
 "8.3.0":
   beats: "main"
-  ecs: "8.2.1"
+  ecs: "8.3.1"
 
 "8.4.0":
-  beats: "main"  # TODO: update this once beats releases
-  ecs: "8.2.1"
+  beats: "main"
+  ecs: "8.3.1"
+
+"8.5.0":
+  beats: "main"
+  ecs: "8.3.1"
diff --git a/detection_rules/schemas/__init__.py b/detection_rules/schemas/__init__.py
index 377237a18af..3bcbd175a58 100644
--- a/detection_rules/schemas/__init__.py
+++ b/detection_rules/schemas/__init__.py
@@ -206,6 +206,12 @@ def migrate_to_8_3(version: Version, api_contents: dict) -> dict:
     return strip_additional_properties(version, api_contents)
 
 
+@migrate("8.4")
+def migrate_to_8_4(version: Version, api_contents: dict) -> dict:
+    """Default migration for 8.4."""
+    return strip_additional_properties(version, api_contents)
+
+
 def downgrade(api_contents: dict, target_version: str, current_version: Optional[str] = None) -> dict:
     """Downgrade a rule to a target stack version."""
     from ..packaging import current_stack_version