Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] Multiple Device Token Hashes for Single Okta Session
backport: auto
Domain: Cloud
Domain: Identity
Domain: SaaS
Integration: Okta
okta related rules
Rule: Tuning
tweaking or tuning an existing rule
#5948
opened Apr 13, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[FR] Workflow Updates for Automatically Bumping Stack Version
backport: auto
ci/cd
enhancement
New feature or request
#5941
opened Apr 9, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rules] False Negatives for New BPFDoor Variants
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5939
opened Apr 9, 2026 by
Aegrah
Contributor
Loading…
[New Rule] DNS to Commonly Abused Web Services
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5938
opened Apr 9, 2026 by
Aegrah
Contributor
Loading…
[Hunt Tuning] Entra ID Device Code Phishing / Update Drifted Docs
backport: auto
Domain: Cloud
Domain: Identity
Hunt: Tuning
Hunting
Integration: AWS
AWS related rules
Integration: Azure
azure related rules
#5936
opened Apr 8, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet
backport: auto
Domain: Network
Integration: Network Traffic
integration: PANW
integration: Zeek
patch
Rule: Tuning
tweaking or tuning an existing rule
#5932
opened Apr 8, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[Rule Tuning] Update MDE tags to "Microsoft Defender XDR"
backport: auto
bbr
Building Block Rules
Domain: Endpoint
OS: Windows
windows related rules
patch
Rule: Tuning
tweaking or tuning an existing rule
#5927
opened Apr 7, 2026 by
w0rk3r
Contributor
Loading…
[Rule Tuning] Abnormally Large DNS Response
backport: auto
Domain: Network
Integration: Network Traffic
#5922
opened Apr 6, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New] Diverse AWS rules
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#5913
opened Apr 3, 2026 by
Samirbous
Contributor
Loading…
Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0
backport: auto
Integration: DED
Integration: DGA
Integration: LMD
Integration: LotL
integration: ProblemChild
ML
machine learning related rule
Rule: Tuning
tweaking or tuning an existing rule
#5909
opened Apr 1, 2026 by
susan-shu-c
Member
Loading…
5 tasks
[Tuning] Execution via GitHub Actions Runner
backport: auto
Domain: Endpoint
Rule: Tuning
tweaking or tuning an existing rule
#5892
opened Mar 27, 2026 by
Samirbous
Contributor
Loading…
[New] Long Base64 Encoded Command via Scripting Interpreter
backport: auto
Domain: Endpoint
Rule: New
Proposal for new rule
#5891
opened Mar 27, 2026 by
Samirbous
Contributor
Loading…
[New Rule] Kubernetes Pod Creation Using Common Debug or Base Images
backport: auto
container
Integration: Kubernetes
Kubernetes Integration
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5890
opened Mar 27, 2026 by
Aegrah
Contributor
Loading…
[New Rules] macOS Unified Logs Login Window and XProtect Detections
backport: auto
dev
rule meant to be non-prod / non-shipping
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5874
opened Mar 23, 2026 by
DefSecSentinel
Contributor
Loading…
4 tasks
[New Rules] macOS Unified Logs TCC Detection Rules
backport: auto
dev
rule meant to be non-prod / non-shipping
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5870
opened Mar 23, 2026 by
DefSecSentinel
Contributor
Loading…
6 tasks
[New Rules] macOS Unified Logs Apple Event Detections
backport: auto
dev
rule meant to be non-prod / non-shipping
Hunting
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5867
opened Mar 23, 2026 by
DefSecSentinel
Contributor
Loading…
5 tasks
[Feature] Add support for immutable and rule_source fields in TOML export/import
backport: auto
python
Internal python for the repository
#5840
opened Mar 17, 2026 by
aarju
Contributor
Loading…
5 tasks
ProTip!
Type g p on any issue or pull request to go back to the pull request listing page.