Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] Host File System Changes via Windows Subsystem for Linux
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6255
opened Jun 5, 2026 by
Aegrah
Contributor
Loading…
[New Rule] Systemd Service Override Configuration File Created
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#6254
opened Jun 5, 2026 by
Aegrah
Contributor
Loading…
[Rule Tuning] Multiple Alerts in Different ATT&CK Tactics on a Single Host
backport: auto
Rule: Tuning
tweaking or tuning an existing rule
#6252
opened Jun 4, 2026 by
Mikaayenson
Contributor
Loading…
1 of 5 tasks
[Rule Tuning] Misc. Linux DRs
backport: auto
Domain: Endpoint
OS: Linux
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6250
opened Jun 4, 2026 by
Aegrah
Contributor
Loading…
[Rule Tunings] Google Workspace minor rule updates
backport: auto
Domain: Cloud
Integration: Google Workspace
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6233
opened Jun 2, 2026 by
imays11
Contributor
Loading…
[New Rule] GenAI CLI Started with Unsafe Permission Bypass
backport: auto
Domain: GenAI
Rule: New
Proposal for new rule
#6232
opened Jun 2, 2026 by
Mikaayenson
Contributor
Loading…
[Rule Tuning] Misc GenAI Rule Tuning
backport: auto
Domain: GenAI
Rule: Tuning
tweaking or tuning an existing rule
#6231
opened Jun 2, 2026 by
Mikaayenson
Contributor
Loading…
[New Rule] M365 Identity Unusual Device Code Granting
backport: auto
Domain: Cloud
Domain: Identity
Domain: SaaS
Integration: Microsoft 365
Rule: New
Proposal for new rule
#6230
opened Jun 2, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[Tuning] Kubernetes Secret get or list from Node or Pod Service Account
backport: auto
Rule: Tuning
tweaking or tuning an existing rule
#6229
opened Jun 2, 2026 by
Samirbous
Contributor
Loading…
[Rule Tunings][Rule Deprecation] Google Workspace authentication policy modification rules
backport: auto
Domain: Cloud
Integration: Google Workspace
Rule: Deprecation
removal of a rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6226
opened Jun 1, 2026 by
imays11
Contributor
Loading…
[Rule Tunings] Google Workspace Admin Role lifecycle rules
backport: auto
Domain: Cloud
Integration: Google Workspace
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6214
opened May 29, 2026 by
imays11
Contributor
Loading…
[FR] [DaC] Add support for Kibana workflows
backport: auto
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
schema
#6211
opened May 29, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[Rule Tunings] GWS Rules w/ zero alerts
backport: auto
Domain: Cloud
Integration: Google Workspace
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#6210
opened May 28, 2026 by
imays11
Contributor
Loading…
WIP - Java Wrapper for Elasticsearch's ES|QL Parser
enhancement
New feature or request
minor
python
Internal python for the repository
#6207
opened May 27, 2026 by
eric-forte-elastic
Contributor
•
Draft
5 tasks
[Rule Tuning] Add Zeek Index Support
backport: auto
Domain: Network
enhancement
New feature or request
integration: Zeek
patch
Rule: Tuning
tweaking or tuning an existing rule
#6206
opened May 27, 2026 by
eric-forte-elastic
Contributor
Loading…
5 tasks
[Rule: Tuning] Rule triggers for false positive due to broad wildcard
backport: auto
community
Domain: Endpoint
OS: Linux
#6205
opened May 27, 2026 by
litemars
Contributor
Loading…
[Rule: Tuning] Increase coverage for the Remote SSH Login Enabled rule
backport: auto
community
Domain: Endpoint
OS: macOS
Rule: Tuning
tweaking or tuning an existing rule
#6202
opened May 27, 2026 by
litemars
Contributor
Loading…
1 task
[New Rule] Azure AD Graph Access with Unusual Client and User
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6182
opened May 22, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
[New Rule] Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
#6181
opened May 22, 2026 by
terrancedejesus
Contributor
Loading…
5 tasks
ProTip!
Follow long discussions with comments:>50.