Skip to content

Pull requests: elastic/detection-rules

New pull request New
37 Open 3,706 Closed
37 Open 3,706 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[New/Tuning] Misc. New D4C Rules and Tunings backport: auto container Integration: Cloud Defend Cloud Defend Integration OS: Linux Rule: New Proposal for new rule Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5692 opened Feb 6, 2026 by Aegrah Loading…
@Aegrah
2
[New Rules] AWS IAM new identity federation provider rules backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule Team: TRADE
#5691 opened Feb 6, 2026 by imays11 Loading…
@imays11
1
[Bug] CLI adds frequency field to system actions (.cases), causing import failure backport: auto bug Something isn't working patch python Internal python for the repository schema
#5690 opened Feb 5, 2026 by eric-forte-elastic Loading…
5 tasks
1
@eric-forte-elastic
1
WIP - Add Exception Duplication Checking
#5689 opened Feb 5, 2026 by eric-forte-elastic • Draft
5 tasks
1
[New Rule] AWS GuardDuty Member Account Manipulation backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule Team: TRADE
#5688 opened Feb 5, 2026 by imays11 Loading…
@imays11
1
[New Rule] AWS EC2 Serial Console Access Enabled backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule Team: TRADE
#5687 opened Feb 5, 2026 by imays11 Loading…
@imays11
3
[Rule Tuning] Entra ID Suspicious Cloud Device Registration Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#5683 opened Feb 5, 2026 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
1
[Rule Tuning] Transform Dormant SharePoint Rule to Detect OAuth Phishing Domain: Cloud Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#5681 opened Feb 4, 2026 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
1
[Rule Tuning] Deprecate Individual MSFT Defender Rules / Create BBR MSFT Defender Rule bbr Building Block Rules Domain: Cloud Domain: Identity Domain: SaaS Integration: Microsoft 365 Rule: New Proposal for new rule Rule: Tuning tweaking or tuning an existing rule
#5679 opened Feb 4, 2026 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
1
[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported Domain: Identity Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
#5677 opened Feb 4, 2026 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
1
[New Rule] Kubernetes Anonymous User Bound to ClusterRole container Integration: Kubernetes Kubernetes Integration Rule: New Proposal for new rule Team: TRADE
#5674 opened Feb 4, 2026 by Aegrah • Draft
@Aegrah
1
[Rule Tuning] Okta User Assigned Administrator Role backport: auto Domain: Cloud Domain: Identity Integration: Okta okta related rules Rule: Tuning tweaking or tuning an existing rule
#5671 opened Feb 3, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
6
[New Rule] Okta Admin Console Login Failure backport: auto bbr Building Block Rules Domain: Identity Integration: Okta okta related rules Rule: New Proposal for new rule
#5669 opened Feb 3, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
3
[New] Endpoint Rule Conversion PR backport: auto Domain: Endpoint OS: macOS Rule: New Proposal for new rule
#5658 opened Jan 30, 2026 by DefSecSentinel Loading…
@DefSecSentinel
72
[New Rule] Potential Service Masquerading backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#5650 opened Jan 29, 2026 by Aegrah Loading…
@Aegrah
7
Update actions/checkout digest backport: auto community
#5613 opened Jan 25, 2026 by elastic-renovate-prod bot Loading…
1 task
Update fjogeleit/http-request-action digest to c0b95d0 backport: auto community
#5605 opened Jan 23, 2026 by elastic-renovate-prod bot Loading…
1 task
[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries backport: auto Hunt: Tuning Hunting
#5566 opened Jan 16, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
8
[New Rule] Multiple High-Severity Alerts for Privileged AD User backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5555 opened Jan 13, 2026 by w0rk3r • Draft
@w0rk3r
2
[New Rule] Potential PowerShell Obfuscated Script via High Entropy backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5554 opened Jan 12, 2026 by w0rk3r Loading…
@w0rk3r
16
[New Rule] PowerShell Script Block Entropy Outlier via MAD Z-Score backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5539 opened Jan 8, 2026 by w0rk3r • Draft
@w0rk3r
6
Add investigation fields to beaconing rules
#5536 opened Jan 7, 2026 by susan-shu-c • Draft
5 tasks
Update actions/setup-python digest to a309ff8 backport: auto community
#5527 opened Jan 3, 2026 by elastic-renovate-prod bot Loading…
1 task
Update actions/checkout action to v6 backport: auto community
#5349 opened Nov 20, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency marshmallow to v4 backport: auto community
#5330 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
ProTip! What’s not been updated in a month: updated:<2026-01-06.