Skip to content

Pull requests: elastic/detection-rules

New pull request New
103 Open 4,516 Closed
103 Open 4,516 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Tuning] AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#6740 opened Sep 5, 2026 by Samirbous Contributor Loading…
@Samirbous
2
[Tuning] AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule
#6739 opened Sep 5, 2026 by Samirbous Contributor Loading…
@Samirbous
2
[Tuning] Protected Storage Service Access via SMB backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6738 opened Sep 4, 2026 by Samirbous Contributor Loading…
@Samirbous
2
[Tuning] Web Server Cloud Metadata SSRF Request backport: auto Rule: Tuning tweaking or tuning an existing rule
#6737 opened Sep 4, 2026 by Samirbous Contributor Loading…
@Samirbous
4
Expand Clickfix Coverage backport: auto Domain: Endpoint OS: macOS Rule: Tuning tweaking or tuning an existing rule
#6735 opened Sep 4, 2026 by shashank-elastic Contributor Loading…
1 of 5 tasks
@shashank-elastic
7
feat(schemas): add EU DORA and NIST CSF 2.0 compliance tags backport: auto community Domain: Endpoint OS: Windows windows related rules python Internal python for the repository schema
#6733 opened Sep 4, 2026 by AAH20 Loading…
2 tasks done
1
3
[Tuning] Update Alert Suppression for Network Rules backport: auto currentrelease Domain: Network Rule: Tuning tweaking or tuning an existing rule
#6731 opened Sep 3, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
5
[Tuning] M365 Teams Rogue Help Desk Chat Created backport: auto Domain: Cloud Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
#6730 opened Sep 3, 2026 by Samirbous Contributor Loading…
@Samirbous
7
[New Rule] Entra ID End-User Consent to App With Mailbox and Offline Access Scopes backport: auto Domain: Cloud Integration: Azure azure related rules
#6729 opened Sep 3, 2026 by earbona23 Loading…
1
UnifiedLogs SIEM Detection Coverage.
#6728 opened Sep 3, 2026 by shashank-elastic Contributor • Draft
@shashank-elastic
4
[Bug] ES|QL Remote Validation: field_extract() on flattened types causes ambiguous schema mapping error backport: auto bug Something isn't working esql ES|QL patch python Internal python for the repository
#6727 opened Sep 2, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
7
[New Rule] AWS Root Console Login Password Spraying backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6723 opened Sep 1, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
6
[Bug] [DaC] Fix: validate threat_query against threat_index schemas backport: auto bug Something isn't working detections-as-code patch python Internal python for the repository
#6721 opened Aug 31, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
3
[New Rule] AWS Security Hub Disabled backport: auto Domain: Cloud Integration: AWS AWS related rules minor python Internal python for the repository Rule: New Proposal for new rule schema
#6719 opened Aug 31, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
6
[New Rule] AWS Backup Resource Enumeration via Long-Term Access Key backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6718 opened Aug 31, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
5
[New Rule] AWS SES Enumeration via Long-Term Access Key backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6717 opened Aug 31, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
7
[New Rule] AWS SES Account Email Sending Enabled backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6716 opened Aug 31, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
8
[New Rule] AWS Service Quota Increase Requested by Rare Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6715 opened Aug 31, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
6
[New Rule] AWS Organizations Delegated Administrator Registered backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6714 opened Aug 31, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
11
[New Hunt] Java_Ghost Threat Actor Infrastructure and Identity Markers backport: auto Domain: Cloud Hunt: New Hunting Integration: AWS AWS related rules
#6711 opened Aug 31, 2026 by bryans3c Contributor • Draft
5 tasks
@bryans3c
3
[Rule Tuning] Suspicious Windows Powershell Arguments backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6707 opened Aug 28, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
3
[New Rule] Entra ID device-bound PRT cookie replay from unusual IP backport: auto Domain: Cloud Integration: Azure azure related rules Rule: New Proposal for new rule
#6706 opened Aug 28, 2026 by terrancedejesus Contributor Loading…
8 tasks done
@terrancedejesus
6
[New Rule] Entra ID Named Location Modified backport: auto community Domain: Cloud Integration: Azure azure related rules
#6691 opened Aug 24, 2026 by descambiado Contributor Loading…
@terrancedejesus
[New Rule] First Seen Network Flow Exporter backport: auto bbr Building Block Rules currentrelease Domain: Network Integrations: Netflow patch Rule: New Proposal for new rule
#6689 opened Aug 21, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
40
fix(tests): allow same-day rule tunings without updated_date bump backport: auto bug Something isn't working patch python Internal python for the repository
#6681 opened Aug 20, 2026 by Mikaayenson Contributor Loading…
4 tasks
@Mikaayenson
5
ProTip! Type g i on any issue or pull request to go back to the issue listing page.