Skip to content

Pull requests: elastic/detection-rules

New pull request New
94 Open 4,346 Closed
94 Open 4,346 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Add Data Source tags to the ML detection rules backport: auto ML machine learning related rule Rule: Tuning tweaking or tuning an existing rule
#6511 opened Jul 27, 2026 by sodhikirti07 Contributor Loading…
1 of 5 tasks
@sodhikirti07
8
[New Rule] AWS Bedrock High Risk Filesystem or Execution Tool Invocation backport: auto Domain: Cloud Integration: AWS-Bedrock Rule: New Proposal for new rule
#6510 opened Jul 27, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS Batch Job Submitted with Container Override by New Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6509 opened Jul 27, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[New Rule] AWS IAM Permission Boundary or Guardrail Policy Deleted by New Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6508 opened Jul 27, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
3
[New Rule] AWS S3 Bucket ACL Modified to Allow Public Access by New Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6507 opened Jul 27, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
4
[Rule Tuning] Add Resources: LLM tag for ES|QL COMPLETION rules backport: auto python Internal python for the repository schema
#6506 opened Jul 27, 2026 by Mikaayenson Contributor Loading…
2 of 3 tasks
@Mikaayenson
5
[New Rule] AWS EC2 NACL Entry Created Allowing All Ports by New Identity backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: New Proposal for new rule
#6505 opened Jul 27, 2026 by bryans3c Contributor Loading…
4 tasks
@bryans3c
3
[Bug] Fix import-rules error handling: KeyError on errors without rule_id; unread exceptions/connector error arrays community
#6504 opened Jul 27, 2026 by runicdefnd3r • Draft
1 task
1
Validate the field against the schema in KQL range expressions backport: auto community Domain: Endpoint OS: Windows windows related rules
#6502 opened Jul 27, 2026 by munzzyy Loading…
3
Fix KQL to EQL conversion treating an escaped/quoted asterisk as a wildcard backport: auto bug Something isn't working community patch
#6501 opened Jul 27, 2026 by munzzyy Loading…
8
WIP - [FR] Local Python Parsing for ES|QL minor python Internal python for the repository
#6500 opened Jul 26, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
[FR] Offline ES|QL validation via python-esql enhancement New feature or request
#6499 opened Jul 26, 2026 by Mikaayenson Contributor • Draft
3 of 5 tasks
@Mikaayenson
4
[New Rule] Unusual File Creation via Web Server backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#6496 opened Jul 24, 2026 by Aegrah Contributor Loading…
@Aegrah
10
Bump setuptools from 78.1.1 to 83.0.0 backport: auto community dependencies Pull requests that update a dependency file major python Internal python for the repository
#6495 opened Jul 23, 2026 by dependabot Bot Loading…
[FR] Add Safeguard for Kibana Rule Exception Race Condition backport: auto community detections-as-code enhancement New feature or request patch python Internal python for the repository
#6493 opened Jul 23, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[FR] Add nested KQL query support in lib/kql backport: auto enhancement New feature or request kql related to the kql module patch python Internal python for the repository Team: TRADE
#6492 opened Jul 23, 2026 by imays11 Contributor Loading…
3 tasks done
1
@imays11
4
[Bug] ECS Checks Overly Broad in Certain Integrations backport: auto bug Something isn't working patch python Internal python for the repository schema
#6491 opened Jul 23, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
6
[Rule Tuning] Potential Lateral Tool Transfer via SMB Share backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6490 opened Jul 23, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
3
[FR] Add free text support to KQL backport: auto enhancement New feature or request kql related to the kql module patch python Internal python for the repository
#6487 opened Jul 22, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[Rule Tuning] Unusual Discovery Signal Alert with Unusual Process Command Line backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6484 opened Jul 22, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[New Rules] GCP GKE Rule Conversions Part 6 backport: auto Domain: Cloud Workloads Domain: Cloud Integration: GCP GCP related rules Rule: New Proposal for new rule Team: TRADE
#6482 opened Jul 22, 2026 by imays11 Contributor Loading…
@imays11
6
[Rule Tuning] Higher-Order Multi Att&ck Tactics rules backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6480 opened Jul 21, 2026 by w0rk3r Contributor Loading…
@w0rk3r
9
[FR] Add completion ES|QL validation exceptions for container runs backport: auto detections-as-code enhancement New feature or request patch python Internal python for the repository schema
#6475 opened Jul 20, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
12
[Rule Tuning] Exclude Kea DHCP from CAP_NET_RAW building block community
#6468 opened Jul 19, 2026 by archit15singh • Draft
5 of 7 tasks
1
2
[New Hunt] AKS Kubelet nodes/proxy Command Execution from an External Source IP backport: auto Domain: Cloud Domain: Containers Hunt: New Hunting Integration: Azure azure related rules
#6460 opened Jul 16, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
10
ProTip! Follow long discussions with comments:>50.