The event.type values are constrained based on the event.category values. Each category value has an expected list of event.type values that can be used. ECS lists these values expected_event_types in ecs_flat.yml ¹.

As a package developer I would like elastic-package to validate the event.category and event.type combinations used events to ensure they are allowed by ECS.

Related

• Field validator should check for ECS fields marked as arrays #615
• fix ECS schema on system/auth package integrations#3424 (comment)