Skip to content

Pull requests: elastic/detection-rules

New pull request New
16 Open 3,236 Closed
16 Open 3,236 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Tuning] Unusual Network Connection to Suspicious Web Service backport: auto Domain: Endpoint OS: macOS Rule: Tuning tweaking or tuning an existing rule
#5008 opened Aug 26, 2025 by Samirbous Loading…
@DefSecSentinel @Samirbous
2
[Tuning] First Occurrence of STS GetFederationToken Request by User backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5007 opened Aug 25, 2025 by imays11 Loading…
@imays11
1
[Rule Tuning] Multi-Factor Authentication Disabled for User backport: auto Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#5006 opened Aug 25, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
1
[New/Tuning] Windows Rules to detect top threats/TTPs 24/25 backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule Rule: Tuning tweaking or tuning an existing rule
#5001 opened Aug 21, 2025 by Samirbous Loading…
@Samirbous
15
[Rule Tuning] Microsoft Entra ID Suspicious Session Reuse to Graph Access backport: auto Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#4997 opened Aug 20, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
2
[New Rule] Threat Intelligence Signal - Microsoft Defender for Office 365 backport: auto Domain: Cloud Domain: Email Integration: Microsoft 365 Rule: New Proposal for new rule
#4994 opened Aug 19, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
6
feat: ESQL query validation against Elastic cluster
#4955 opened Aug 1, 2025 by traut • Draft
5 tasks
@eric-forte-elastic
7
[New Rule] Toolshell Exploit Chain Detections backport: auto bbr Building Block Rules Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#4928 opened Jul 23, 2025 by terrancedejesus Loading…
5 tasks
@terrancedejesus
26
[New Rule/Tuning] Linux User or Group Deletion/Creation backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#4861 opened Jun 30, 2025 by Aegrah • Draft
@Aegrah
8
[New Rule] Kubectl Secret Access container OS: Linux Rule: New Proposal for new rule Team: TRADE
#4834 opened Jun 19, 2025 by Aegrah • Draft
@Aegrah
6
[New Rules] Potential Relay Attack against a Computer Account backport: auto blocked Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule Rule: Tuning tweaking or tuning an existing rule
#4826 opened Jun 18, 2025 by w0rk3r Loading…
@w0rk3r
3
[Rule: New] Potential Web Server Fuzzing Attempts Detected backlog backport: auto community
#4720 opened May 12, 2025 by MakoWish Loading…
1 of 5 tasks
1
[New] Microsoft Entra ID Protection Alert and Device Registration backport: auto Domain: Cloud Workloads Domain: Cloud Integration: Azure azure related rules Integration: Microsoft 365 patch Rule: New Proposal for new rule
#4688 opened Apr 30, 2025 by Samirbous Loading…
@Samirbous
6
[New] Potential SAP NetWeaver Exploitation rules backlog backport: auto OS: Linux OS: Windows windows related rules Rule: New Proposal for new rule
#4666 opened Apr 26, 2025 by Samirbous Loading…
@Samirbous
11
[New Rule] Active Directory Forced Authentication from Linux Host backlog backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#3912 opened Jul 22, 2024 by w0rk3r • Draft
@w0rk3r
15
[Rule Tuning] Update rules using NPC integration and non-ECS fields backlog backport: auto blocked Domain: Network Rule: Tuning tweaking or tuning an existing rule
#3194 opened Oct 16, 2023 by brokensound77 Loading…
@brokensound77
11
ProTip! Add no:assignee to see everything that’s not assigned.