Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] AWS IAM Brute Force of Assume Role Policy
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS IAM CompromisedKeyQuarantine Policy Attached to User
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS IAM Virtual MFA Device Rules
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[Rule Tuning] AWS GetSessionToken Abuse
bbr
Building Block Rules
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
rule-tuning: Elastic Agent service termination improve for detection
backport: auto
community
Domain: Endpoint
Rule: Tuning
tweaking or tuning an existing rule
#5272
opened Nov 3, 2025 by
alstolten
Loading…
[Rule Tunings] AWS Group Creation, User Added to Group, Group Deletion
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5269
opened Oct 31, 2025 by
imays11
Loading…
[Rule Tuning][New Rule] AWS S3 Bucket Policy Added to Share with External Account/ to Allow Public Access
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5268
opened Oct 30, 2025 by
imays11
Loading…
[New Rule] Privilege Escalation via SUID/SGID Proxy Execution
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5266
opened Oct 30, 2025 by
Aegrah
Loading…
[Rule Tuning] AWS S3 Bucket Configuration Deletion
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5265
opened Oct 29, 2025 by
imays11
Loading…
[Rule Tuning] AWS S3 Static Site Javascript File Uploaded
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5264
opened Oct 29, 2025 by
imays11
Loading…
[Rule Tuning] AWS S3 Object Versioning Suspended
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5261
opened Oct 29, 2025 by
imays11
Loading…
Renovate Updates
backport: auto
enhancement
New feature or request
patch
#5258
opened Oct 28, 2025 by
shashank-elastic
Loading…
5 tasks
[Bug] [DAC] Auto Gen Schema Fails on Certain Subqueries
backport: auto
bug
Something isn't working
patch
python
Internal python for the repository
schema
#5256
opened Oct 28, 2025 by
eric-forte-elastic
Loading…
5 tasks
[Rule Tuning] AWS S3 Bucket Server Access Logging Disabled
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5254
opened Oct 27, 2025 by
imays11
Loading…
[Rule Tuning] Azure Diagnostic Settings Deletion
backport: auto
Domain: Cloud
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5253
opened Oct 27, 2025 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] AWS S3 Bucket Expiration Lifecycle Configuration Added
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5251
opened Oct 27, 2025 by
imays11
Loading…
[New] Windows Server Update Service Spawning Suspicious Processes
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#5250
opened Oct 24, 2025 by
Samirbous
Loading…
[New Rule][Deprecation] AWS EC2 Export Task Rules
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Deprecation
removal of a rule
Rule: New
Proposal for new rule
Team: TRADE
#5248
opened Oct 24, 2025 by
imays11
Loading…
[Rule Tuning] AWS EC2 Full Network Packet Capture Detected
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5244
opened Oct 23, 2025 by
imays11
Loading…
[New Rule] Okta Multiple OS Names Detected for a Single DT Hash
Domain: Identity
Integration: Okta
okta related rules
Rule: New
Proposal for new rule
#5241
opened Oct 22, 2025 by
terrancedejesus
•
Draft
5 tasks
[Rule Tunings] AWS Multiple API Calls ESQL rules
backport: auto
bbr
Building Block Rules
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5238
opened Oct 21, 2025 by
imays11
Loading…
[Tuning] Potential Ransomware Behavior - Note Files by System
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5235
opened Oct 21, 2025 by
Samirbous
Loading…
[Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules
backport: auto
bbr
Building Block Rules
Domain: Endpoint
OS: Linux
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5232
opened Oct 17, 2025 by
Aegrah
Loading…
ProTip!
Type g p on any issue or pull request to go back to the pull request listing page.