Pull requests: elastic/detection-rules
Pull requests list
[Tuning] Potential Data Exfiltration Through Curl
backport: auto
Domain: Endpoint
Rule: Tuning
tweaking or tuning an existing rule
#5883
opened Mar 25, 2026 by
Samirbous
Loading…
[New] Potential Credential Discovery via Recursive Grep
backport: auto
Domain: Endpoint
Rule: New
Proposal for new rule
#5882
opened Mar 25, 2026 by
Samirbous
Loading…
[Rule Tuning] Entra ID Federation Abuse to Production
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5881
opened Mar 25, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Python Path File (pth) Creation
backport: auto
Domain: Endpoint
OS: Linux
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5880
opened Mar 24, 2026 by
Aegrah
Loading…
[New Rule] M365 Azure Monitor Alert Email with Financial or Billing Theme
backport: auto
Domain: Email
Integration: Azure
azure related rules
patch
Rule: New
Proposal for new rule
schema
#5878
opened Mar 24, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Update Mitre Mappings and tags
backport: auto
Domain: Cloud
enhancement
New feature or request
Integration: AWS
AWS related rules
Integration: Azure
azure related rules
Integration: CyberArkPas
CyberArkPas integration
Integration: GCP
GCP related rules
Integration: Google Workspace
ML
machine learning related rule
Rule: Tuning
tweaking or tuning an existing rule
Security Content
test-suite
unit and other testing components
#5876
opened Mar 23, 2026 by
Mikaayenson
Loading…
1 of 5 tasks
[New Rules] macOS Unified Logs Login Window and XProtect Detections
backport: auto
dev
rule meant to be non-prod / non-shipping
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5874
opened Mar 23, 2026 by
DefSecSentinel
Loading…
4 tasks
[Rule Tuning] M365 SharePoint/OneDrive File Access via PowerShell - Convert to new_terms
backport: auto
Domain: Cloud
Domain: SaaS
Domain: Storage
Integration: Azure
azure related rules
Integration: Microsoft 365
Rule: Tuning
tweaking or tuning an existing rule
#5873
opened Mar 23, 2026 by
terrancedejesus
Loading…
5 tasks
[New Rules] macOS Unified Logs TCC Detection Rules
backport: auto
dev
rule meant to be non-prod / non-shipping
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5870
opened Mar 23, 2026 by
DefSecSentinel
Loading…
6 tasks
[New Rules] macOS Unified Logs Apple Event Detections
backport: auto
dev
rule meant to be non-prod / non-shipping
Hunting
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5867
opened Mar 23, 2026 by
DefSecSentinel
Loading…
5 tasks
[Rule Tuning] M365 Identity Login from Atypical Travel Location - Reduce FP Noise
backport: auto
Domain: Cloud
Domain: SaaS
Integration: Microsoft 365
Rule: Tuning
tweaking or tuning an existing rule
#5866
opened Mar 23, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Entra ID OAuth User Impersonation to Microsoft Graph
backport: auto
Domain: Cloud
Domain: Identity
Domain: Web
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5864
opened Mar 23, 2026 by
terrancedejesus
Loading…
5 tasks
[Feature] Add support for immutable and rule_source fields in TOML export/import
backport: auto
python
Internal python for the repository
#5840
opened Mar 17, 2026 by
aarju
Loading…
5 tasks
WIP - Add batch processing to Kibana import-rules
enhancement
New feature or request
patch
#5834
opened Mar 13, 2026 by
eric-forte-elastic
•
Draft
5 tasks
WIP - [FR] [DAC] Initial Yaml Support
backport: auto
enhancement
New feature or request
patch
python
Internal python for the repository
#5821
opened Mar 10, 2026 by
eric-forte-elastic
•
Draft
5 tasks
Update Entity related rules with new tweaking or tuning an existing rule
_ea ML job ID and update minimum stack versions
backport: auto
Rule: Tuning
#5794
opened Feb 27, 2026 by
susan-shu-c
Loading…
5 tasks
[Rule Tuning & Deprecation] Tuning & Deprecating Promotion Rule
backport: auto
Integration: Cloud Defend
Cloud Defend Integration
Rule: Deprecation
removal of a rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
fix: Change bulk rule actions by updating deprecated
rule_ids to ids
backport: auto
community
#5711
opened Feb 10, 2026 by
IOITI
Loading…
2 tasks done
[FR] [DAC] Add Exception Duplication Checking
backport: auto
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
#5689
opened Feb 5, 2026 by
eric-forte-elastic
Loading…
5 tasks
[New Rule] Kubernetes Anonymous User Bound to ClusterRole
container
Integration: Kubernetes
Kubernetes Integration
Rule: New
Proposal for new rule
Team: TRADE
[New Rule] Potential Service Masquerading
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
ProTip!
no:milestone will show everything without a milestone.