diff --git a/docs/release-notes/8.7.asciidoc b/docs/release-notes/8.7.asciidoc
index 5b5c8d701..44a8ee64f 100644
--- a/docs/release-notes/8.7.asciidoc
+++ b/docs/release-notes/8.7.asciidoc
@@ -1,4 +1,37 @@
 [[ecs-release-notes-8.7.0]]
 === 8.7.0
 
-coming[8.7.0]
+[[schema-changes-8.7.0]]
+[float]
+==== Schema changes
+
+[[schema-bugfixes-8.7.0]]
+[float]
+===== Bugfixes
+
+* Remove duplicated `client.domain` definition {ecs_pull}2120[#2120]
+
+[[schema-added-8.7.0]]
+[float]
+===== Added
+
+* Adding `name` field to `threat.indicator` {ecs_pull}2121[#2121]
+* Adding `api` option to `event.category` {ecs_pull}2147[#2147]
+* Adding `library` option to `event.category` {ecs_pull}2154[#2154]
+
+[[schema-improvements-8.7.0]]
+[float]
+===== Improvements
+
+* Description for `host.name` definition updated to encourage use of FDQN {ecs_pull}2122[#2122]
+
+[[tooling-changes-8.7.0]]
+[float]
+==== Tooling and artifact changes
+
+[[tooling-improvements-8.7.0]]
+[float]
+===== Improvements
+
+* Updated usage docs to include `threat.indicator.url.domain` and changed `indicator.marking.tlp` and `indicator.enrichments.marking.tlp` from "WHITE" to "CLEAR" to align with TLP 2.0. {ecs_pull}2124[#2124]
+* Bump `gitpython` from `3.1.27` to `3.1.30` in `/scripts`. {ecs_pull}2139[#2139]