Pull requests: elastic/detection-rules
Pull requests list
[New Rules] External Promotion Alerts
patch
Rule: New
Proposal for new rule
#4903
opened Jul 11, 2025 by
Mikaayenson
•
Draft
1 of 5 tasks
[Rule Tuning] AWS IAM API Calls via Temporary Session Tokens
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#4901
opened Jul 10, 2025 by
imays11
Loading…
[New Rule] Azure Key Vault Secret Key Usage by Unusual Identity
backport: auto
Domain: Cloud
Domain: Identity
Domain: Storage
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#4900
opened Jul 10, 2025 by
terrancedejesus
Loading…
5 tasks
[New Rule] Excessive Secret or Key Retrieval from Azure Key Vault
backport: auto
Domain: Cloud
Domain: Identity
Domain: Storage
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#4898
opened Jul 10, 2025 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Azure Key Vault Modified
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#4896
opened Jul 10, 2025 by
terrancedejesus
Loading…
5 tasks
[Rule Tunings] Reduce Usage of Flattened Fields in AWS Rules
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#4892
opened Jul 10, 2025 by
imays11
Loading…
[Rule Deprecation] Azure Virtual Network Device Modified or Deleted
backport: auto
Domain: Cloud
Domain: Network
Integration: Azure
azure related rules
Rule: Deprecation
removal of a rule
#4889
opened Jul 9, 2025 by
terrancedejesus
Loading…
5 tasks
[New Rule/Tuning] Linux User or Group Deletion/Creation
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#4861
opened Jun 30, 2025 by
Aegrah
Loading…
[New] Command Line Obfuscation via Whitespace Padding
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#4860
opened Jun 30, 2025 by
Samirbous
Loading…
[New Rule] Potential Impersonation Attempt via Kubectl
backport: auto
container
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#4833
opened Jun 19, 2025 by
Aegrah
Loading…
[New Rule] Kubernetes Unusual Decision by User Agent
backport: auto
Integration: Kubernetes
Kubernetes Integration
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#4829
opened Jun 19, 2025 by
Aegrah
Loading…
[New Rules] Potential Relay Attack against a Computer Account
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#4826
opened Jun 18, 2025 by
w0rk3r
Loading…
[New] Microsoft Entra ID Protection Alert and Device Registration
backport: auto
Domain: Cloud Workloads
Domain: Cloud
Integration: Azure
azure related rules
Integration: Microsoft 365
patch
Rule: New
Proposal for new rule
#4688
opened Apr 30, 2025 by
Samirbous
Loading…
[New] Potential SAP NetWeaver Exploitation rules
backport: auto
OS: Linux
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#4666
opened Apr 26, 2025 by
Samirbous
Loading…
[enhancement] In esql validation, allow any order of metadata
backport: auto
community
patch
python
Internal python for the repository
#4579
opened Mar 28, 2025 by
frederikb96
Loading…
5 tasks done
[Security Content] Windows Audit Policies Config Guides - Repo Edition
backlog
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Security Content
#4501
opened Feb 26, 2025 by
w0rk3r
Loading…
[New Rule] Active Directory Forced Authentication from Linux Host
backlog
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
[FR] Add white space checking for KQL parse
backport: auto
enhancement
New feature or request
kql
related to the kql module
patch
python
Internal python for the repository
#3789
opened Jun 14, 2024 by
eric-forte-elastic
Loading…
WIP: [POC] Refactor: port unittest to pytest
backlog
backport: auto
bug
Something isn't working
detections-as-code
enhancement
New feature or request
python
Internal python for the repository
test-suite
unit and other testing components
#3361
opened Jan 3, 2024 by
Mikaayenson
•
Draft
[Rule Tuning] Update rules using NPC integration and non-ECS fields
backlog
backport: auto
blocked
Domain: Network
Rule: Tuning
tweaking or tuning an existing rule
#3194
opened Oct 16, 2023 by
brokensound77
Loading…
ProTip!
Find all pull requests that aren't related to any open issues with -linked:issue.