Skip to content

Pull requests: elastic/detection-rules

New pull request New
36 Open 3,632 Closed
36 Open 3,632 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Tuning] Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource backport: auto Domain: Identity Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
#5589 opened Jan 20, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
1
[Rule Tuning] M365 Threat Intelligence Signal backport: auto bbr Building Block Rules Domain: Cloud Domain: SaaS Integration: Microsoft 365 Rule: Tuning tweaking or tuning an existing rule
#5587 opened Jan 20, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
1
[New] Newly Observed High Severity Suricata Alert backport: auto Domain: Network Rule: New Proposal for new rule
#5585 opened Jan 20, 2026 by Samirbous Loading…
@Samirbous
6
[Tuning] Suricata and Elastic Defend Network Correlation backport: auto Rule: Tuning tweaking or tuning an existing rule
#5583 opened Jan 20, 2026 by Samirbous Loading…
@Samirbous
5
[Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules backport: auto bbr Building Block Rules container Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5578 opened Jan 19, 2026 by Aegrah • Draft
@Aegrah
6
[Rule Tuning] Removing host.os.type from K8s Rules backport: auto container Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5577 opened Jan 19, 2026 by Aegrah Loading…
@Aegrah
1
[Tuning] ESQL Dynamic unique value fields backport: auto Domain: Endpoint OS: Linux OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5569 opened Jan 16, 2026 by Samirbous Loading…
@Samirbous
25
[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries backport: auto Hunt: Tuning Hunting
#5566 opened Jan 16, 2026 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
4
[Rule Tunings] AWS remove target.entity.id and actor.entity.id fields backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5563 opened Jan 15, 2026 by imays11 Loading…
@imays11
4
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset backport: auto container Integration: Cloud Defend Cloud Defend Integration OS: Linux Rule: New Proposal for new rule Team: TRADE
#5561 opened Jan 15, 2026 by Aegrah Loading…
@Aegrah
2
[New] Lateral Movement Alerts from a Newly Observed Entity backport: auto Rule: New Proposal for new rule
#5557 opened Jan 14, 2026 by Samirbous Loading…
@Samirbous
30
[Tuning] Rare Connection to WebDAV Target backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5556 opened Jan 13, 2026 by Samirbous Loading…
@Samirbous
9
[New Rule] Multiple High-Severity Alerts for Privileged AD User backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5555 opened Jan 13, 2026 by w0rk3r • Draft
@w0rk3r
2
[New Rule] Potential PowerShell Obfuscated Script via High Entropy backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5554 opened Jan 12, 2026 by w0rk3r Loading…
@w0rk3r
12
Disabling mutation of the rule body during the serialization process bug Something isn't working
#5551 opened Jan 12, 2026 by traut • Draft
1 of 5 tasks
@traut
1
[New Rule] PowerShell Script Block Entropy Outlier via MAD Z-Score backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#5539 opened Jan 8, 2026 by w0rk3r • Draft
@w0rk3r
6
Add investigation fields to beaconing rules
#5536 opened Jan 7, 2026 by susan-shu-c • Draft
5 tasks
Update actions/setup-python digest to 83679a8 backport: auto community
#5527 opened Jan 3, 2026 by elastic-renovate-prod bot Loading…
1 task
Added logic to main.py to use the created_at and updated_at values if they exist backport: auto enhancement New feature or request patch python Internal python for the repository
#5444 opened Dec 10, 2025 by aarju Loading…
2 tasks
13
Update actions/checkout action to v6 backport: auto community
#5349 opened Nov 20, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency marshmallow to v4 backport: auto community
#5330 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency elasticsearch to v9 backport: auto community
#5329 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/upload-artifact action to v6 backport: auto community
#5328 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/checkout digest backport: auto community stale 60 days of inactivity
#5327 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
1
Update actions/setup-python action to v6 backport: auto community
#5326 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
ProTip! Filter pull requests by the default branch with base:main.