Skip to content

Pull requests: elastic/detection-rules

New pull request New
44 Open 3,858 Closed
44 Open 3,858 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[New Rule] AWS AssumeRoleWithWebIdentity from unusual source ASN Domain: Cloud Domain: Identity Integration: AWS AWS related rules Rule: New Proposal for new rule
#5903 opened Mar 31, 2026 by terrancedejesus • Draft
3
[Rule Tuning] AWS suspicious user agents (TruffleHog, Kali CLI/Boto3) Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#5902 opened Mar 31, 2026 by terrancedejesus • Draft
@terrancedejesus
2
[Tuning] Remote Management Access Launch After MSI Install backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5901 opened Mar 30, 2026 by Samirbous Loading…
@Samirbous
2
[Rule Tuning] Windows High-Severity Rules Revamp - 2 backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5900 opened Mar 30, 2026 by w0rk3r • Draft
@w0rk3r
9
[Rule Tuning] Windows High-Severity Rules Revamp - 1 backport: auto Domain: Endpoint OS: Windows windows related rules patch Rule: Tuning tweaking or tuning an existing rule Security Content
#5899 opened Mar 30, 2026 by w0rk3r • Draft
@w0rk3r
8
Update dependency PyGithub to v2.9.0 backport: auto community
#5898 opened Mar 30, 2026 by elastic-renovate-prod bot Loading…
1 task
Move docs workflows to elastic/docs-actions backport: auto
#5897 opened Mar 30, 2026 by Mpdreamz Loading…
1 task
Add FreeIPA detection rules (16 ES|QL rules) community
#5896 opened Mar 28, 2026 by Oddly • Draft
[Rule Tuning] Entra ID Illicit Consent Grant via Registered Application - Fix New Terms Field Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#5894 opened Mar 27, 2026 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
1
[Tuning] Execution via GitHub Actions Runner backport: auto Domain: Endpoint Rule: Tuning tweaking or tuning an existing rule
#5892 opened Mar 27, 2026 by Samirbous Loading…
@Samirbous
9
[New] Long Base64 Encoded Command via Scripting Interpreter backport: auto Domain: Endpoint Rule: New Proposal for new rule
#5891 opened Mar 27, 2026 by Samirbous Loading…
@Samirbous
11
[New Rule] Kubernetes Pod Creation Using Common Debug or Base Images backport: auto container Integration: Kubernetes Kubernetes Integration OS: Linux Rule: New Proposal for new rule Team: TRADE
#5890 opened Mar 27, 2026 by Aegrah Loading…
@Aegrah
3
[Rule Tuning] Potential snap-confine Privilege Escalation backport: auto Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5889 opened Mar 27, 2026 by Aegrah Loading…
@Aegrah
4
Fix: Add comprehensive unit tests for non-ecs-schema.json and clean up data (#2322) backport: auto community
#5879 opened Mar 24, 2026 by chidoziemanagwu Loading…
6 of 7 tasks
1
2
[Rule Tuning] Add Supplemental Mitre Mappings backport: auto Domain: Cloud enhancement New feature or request Integration: AWS AWS related rules Integration: Azure azure related rules Integration: CyberArkPas CyberArkPas integration Integration: GCP GCP related rules Integration: Google Workspace ML machine learning related rule Rule: Tuning tweaking or tuning an existing rule Security Content test-suite unit and other testing components
#5876 opened Mar 23, 2026 by Mikaayenson Loading…
1 of 5 tasks
@Mikaayenson
47
[New Rules] macOS Unified Logs Login Window and XProtect Detections backport: auto dev rule meant to be non-prod / non-shipping integration: Unified_Logs OS: macOS patch Rule: New Proposal for new rule
#5874 opened Mar 23, 2026 by DefSecSentinel Loading…
4 tasks
@DefSecSentinel
23
[New Rules] macOS Unified Logs TCC Detection Rules backport: auto dev rule meant to be non-prod / non-shipping integration: Unified_Logs OS: macOS patch Rule: New Proposal for new rule
#5870 opened Mar 23, 2026 by DefSecSentinel Loading…
6 tasks
@DefSecSentinel
26
[New Rules] macOS Unified Logs Apple Event Detections backport: auto dev rule meant to be non-prod / non-shipping Hunting integration: Unified_Logs OS: macOS patch Rule: New Proposal for new rule
#5867 opened Mar 23, 2026 by DefSecSentinel Loading…
5 tasks
@DefSecSentinel
22
[Feature] Add support for immutable and rule_source fields in TOML export/import backport: auto python Internal python for the repository
#5840 opened Mar 17, 2026 by aarju Loading…
5 tasks
@aarju
2
WIP - Add batch processing to Kibana import-rules enhancement New feature or request patch
#5834 opened Mar 13, 2026 by eric-forte-elastic • Draft
5 tasks
1
@eric-forte-elastic
1
WIP - [FR] [DAC] Initial Yaml Support backport: auto enhancement New feature or request patch python Internal python for the repository
#5821 opened Mar 10, 2026 by eric-forte-elastic • Draft
5 tasks
@eric-forte-elastic
1
Update dependency nodeenv to v1.10.0 backport: auto community
#5800 opened Feb 28, 2026 by elastic-renovate-prod bot Loading…
1 task
Update Entity related rules with new _ea ML job ID and update minimum stack versions backport: auto Domain: Cloud Integration: AWS AWS related rules Integration: Azure azure related rules Integration: GCP GCP related rules ML machine learning related rule Rule: Tuning tweaking or tuning an existing rule
#5794 opened Feb 27, 2026 by susan-shu-c Loading…
2 of 5 tasks
@susan-shu-c
17
Update dependency marko to v2.2.2 backport: auto community patch
#5735 opened Feb 18, 2026 by elastic-renovate-prod bot Loading…
1 task
2
[Rule Tuning & Deprecation] Tuning & Deprecating Promotion Rule backport: auto Integration: Cloud Defend Cloud Defend Integration Rule: Deprecation removal of a rule Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5712 opened Feb 10, 2026 by Aegrah • Draft
@Aegrah
3
ProTip! What’s not been updated in a month: updated:<2026-02-28.