Pull requests: elastic/detection-rules
Pull requests list
Push failed backport changes to 8.19
backport: skip
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5954
opened Apr 20, 2026 by
w0rk3r
Contributor
Loading…
[FR] Add enforcement for deprecated_reason
backport: auto
enhancement
New feature or request
patch
#5953
opened Apr 20, 2026 by
Mikaayenson
Contributor
Loading…
1 of 5 tasks
[Rule Tuning] GenAI or MCP Server Child Process Execution
backport: auto
bbr
Building Block Rules
Domain: GenAI
Rule: Tuning
tweaking or tuning an existing rule
#5951
opened Apr 15, 2026 by
Mikaayenson
Contributor
Loading…
1 of 5 tasks
[Rule Tuning] Multiple Device Token Hashes for Single Okta Session
backport: auto
Domain: Cloud
Domain: Identity
Domain: SaaS
Integration: Okta
okta related rules
Rule: Tuning
tweaking or tuning an existing rule
#5948
opened Apr 13, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[FR] Workflow Updates for Automatically Bumping Stack Version
backport: auto
ci/cd
enhancement
New feature or request
#5941
opened Apr 9, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[New Rules] False Negatives for New BPFDoor Variants
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5939
opened Apr 9, 2026 by
Aegrah
Contributor
Loading…
[New Rule] DNS to Commonly Abused Web Services
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5938
opened Apr 9, 2026 by
Aegrah
Contributor
Loading…
[Hunt Tuning] Entra ID Device Code Phishing / Update Drifted Docs
backport: auto
Domain: Cloud
Domain: Identity
Hunt: Tuning
Hunting
Integration: AWS
AWS related rules
Integration: Azure
azure related rules
#5936
opened Apr 8, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet
backport: auto
Domain: Network
Integration: Network Traffic
integration: PANW
integration: Zeek
patch
Rule: Tuning
tweaking or tuning an existing rule
#5932
opened Apr 8, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
Fix TOML transform sections for Tomlet / docs-builder
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
#5931
opened Apr 8, 2026 by
Mpdreamz
Member
Loading…
5 tasks
[New] Diverse AWS rules
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#5913
opened Apr 3, 2026 by
Samirbous
Contributor
Loading…
Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0
backport: auto
Integration: DED
Integration: DGA
Integration: LMD
Integration: LotL
integration: ProblemChild
ML
machine learning related rule
patch
Rule: Tuning
tweaking or tuning an existing rule
#5909
opened Apr 1, 2026 by
susan-shu-c
Member
Loading…
5 tasks
[Tuning] Execution via GitHub Actions Runner
backport: auto
Domain: Endpoint
Rule: Tuning
tweaking or tuning an existing rule
#5892
opened Mar 27, 2026 by
Samirbous
Contributor
Loading…
[New] Long Base64 Encoded Command via Scripting Interpreter
backport: auto
Domain: Endpoint
Rule: New
Proposal for new rule
#5891
opened Mar 27, 2026 by
Samirbous
Contributor
Loading…
[New Rule] Kubernetes Pod Creation Using Common Debug or Base Images
backport: auto
container
Integration: Kubernetes
Kubernetes Integration
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5890
opened Mar 27, 2026 by
Aegrah
Contributor
Loading…
[New Rules] macOS Unified Logs Login Window and XProtect Detections
backport: auto
dev
rule meant to be non-prod / non-shipping
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5874
opened Mar 23, 2026 by
DefSecSentinel
Contributor
Loading…
4 tasks
[New Rules] macOS Unified Logs TCC Detection Rules
backport: auto
dev
rule meant to be non-prod / non-shipping
integration: Unified_Logs
OS: macOS
patch
Rule: New
Proposal for new rule
#5870
opened Mar 23, 2026 by
DefSecSentinel
Contributor
Loading…
6 tasks
ProTip!
Follow long discussions with comments:>50.