Skip to content

Pull requests: elastic/detection-rules

New pull request New
35 Open 3,805 Closed
35 Open 3,805 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Tuning] Misc GenAI Tuning backport: auto Domain: GenAI llm Rule: Tuning tweaking or tuning an existing rule
#5825 opened Mar 10, 2026 by Mikaayenson Loading…
1 of 5 tasks
@Mikaayenson
5
[New Rule] Azure Arc Kubernetes Cluster Connect Abuse Domain: Cloud Domain: Containers Domain: Identity Integration: Azure azure related rules Integration: Kubernetes Kubernetes Integration Rule: New Proposal for new rule
#5824 opened Mar 10, 2026 by terrancedejesus • Draft
5 tasks
1
@terrancedejesus
1
WIP - [FR] [DAC] Initial Yaml Support backport: auto enhancement New feature or request patch python Internal python for the repository
#5821 opened Mar 10, 2026 by eric-forte-elastic • Draft
5 tasks
@eric-forte-elastic
1
[Tuning] Mis Rules Tuning backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5817 opened Mar 9, 2026 by Samirbous Loading…
@Samirbous
2
Includes deprecated rule stubs to the package
#5813 opened Mar 5, 2026 by dplumlee • Draft
5 tasks
[New Rule] M365 SharePoint Site Administrator Added backport: auto Domain: Cloud Domain: Identity Domain: SaaS Integration: Microsoft 365 Rule: New Proposal for new rule
#5806 opened Mar 2, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
3
Update dependency nodeenv to v1.10.0 backport: auto community
#5800 opened Feb 28, 2026 by elastic-renovate-prod bot Loading…
1 task
Update Entity related rules with new _ea ML job ID and update minimum stack versions Rule: Tuning tweaking or tuning an existing rule
#5794 opened Feb 27, 2026 by susan-shu-c • Draft
5 tasks
@susan-shu-c
10
[New Rules] New Terms rules for malicious Python/Pickle model activity on macOS backport: auto Domain: Endpoint OS: macOS Rule: New Proposal for new rule
#5780 opened Feb 25, 2026 by DefSecSentinel Loading…
@DefSecSentinel
25
[Bug] KQL Validation Add Wildcard w/ Space token value backport: auto bug Something isn't working patch python Internal python for the repository Team: TRADE
#5753 opened Feb 20, 2026 by imays11 Loading…
5 tasks done
@imays11
11
Update dependency marko to v2.2.2 backport: auto community patch
#5735 opened Feb 18, 2026 by elastic-renovate-prod bot Loading…
1 task
2
[Rule Tuning & Deprecation] Tuning & Deprecating Promotion Rule backport: auto Integration: Cloud Defend Cloud Defend Integration Rule: Deprecation removal of a rule Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5712 opened Feb 10, 2026 by Aegrah • Draft
@Aegrah
3
fix: Change bulk rule actions by updating deprecated rule_ids to ids backport: auto community
#5711 opened Feb 10, 2026 by IOITI Loading…
2 tasks done
1
[New Rule] AWS API Activity from Uncommon S3 Client by Rare User backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule Team: TRADE
#5694 opened Feb 6, 2026 by imays11 • Draft
@imays11
12
[FR] [DAC] Add Exception Duplication Checking backport: auto detections-as-code enhancement New feature or request patch python Internal python for the repository
#5689 opened Feb 5, 2026 by eric-forte-elastic Loading…
5 tasks
1
@eric-forte-elastic
8
[New Rule] Kubernetes Anonymous User Bound to ClusterRole container Integration: Kubernetes Kubernetes Integration Rule: New Proposal for new rule Team: TRADE
#5674 opened Feb 4, 2026 by Aegrah • Draft
@Aegrah
1
[New Rule] Potential Service Masquerading backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#5650 opened Jan 29, 2026 by Aegrah • Draft
@Aegrah
7
Update actions/checkout digest backport: auto community
#5613 opened Jan 25, 2026 by elastic-renovate-prod bot Loading…
1 task
Update fjogeleit/http-request-action digest to c0b95d0 backport: auto community
#5605 opened Jan 23, 2026 by elastic-renovate-prod bot Loading…
1 task
[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries backport: auto Hunt: Tuning Hunting
#5566 opened Jan 16, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
8
[New Rule] Multiple High-Severity Alerts for Privileged AD User backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5555 opened Jan 13, 2026 by w0rk3r • Draft
@w0rk3r
2
[New Rule] PowerShell Script Block Entropy Outlier via MAD Z-Score backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5539 opened Jan 8, 2026 by w0rk3r • Draft
@w0rk3r
20
Update actions/setup-python digest to a309ff8 backport: auto community
#5527 opened Jan 3, 2026 by elastic-renovate-prod bot Loading…
1 task
1
Update actions/checkout action to v6 backport: auto community
#5349 opened Nov 20, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency marshmallow to v4 backport: auto community
#5330 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
ProTip! What’s not been updated in a month: updated:<2026-02-10.