Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] Potential Timestomp in Executable Files
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5727
opened Feb 12, 2026 by
w0rk3r
Loading…
[New] Correlated Alerts on Similar User Identities
backport: auto
Domain: GenAI
Rule: New
Proposal for new rule
#5726
opened Feb 12, 2026 by
Samirbous
Loading…
[New Rule] AWS SSM Inventory Reconnaissance by Rare User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
#5724
opened Feb 11, 2026 by
imays11
Loading…
[Rule Tuning] Okta Credential Stuffing, Password Spraying, and Brute Force Detection Improvements
Domain: Identity
Integration: Okta
okta related rules
Rule: Tuning
tweaking or tuning an existing rule
#5723
opened Feb 11, 2026 by
terrancedejesus
•
Draft
5 tasks
[Rule Deprecation] M365 Teams Guest & External Access Rules
backport: auto
Domain: Cloud
Domain: SaaS
Domain: Web
Integration: Microsoft 365
Rule: Deprecation
removal of a rule
#5721
opened Feb 11, 2026 by
terrancedejesus
Loading…
5 tasks
[Tuning] Adds host metadata to the setup requirements
backport: auto
Rule: Tuning
tweaking or tuning an existing rule
#5719
opened Feb 11, 2026 by
Samirbous
Loading…
[New Rule] AWS Sensitive IAM Operations Performed via CloudShell
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
#5718
opened Feb 10, 2026 by
imays11
Loading…
[Rule Tuning & Deprecation] Tuning & Deprecating Promotion Rule
backport: auto
Integration: Cloud Defend
Cloud Defend Integration
Rule: Deprecation
removal of a rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5712
opened Feb 10, 2026 by
Aegrah
Loading…
[tuning] LLM DNS queries
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5709
opened Feb 10, 2026 by
Samirbous
Loading…
[Rule Tuning] PowerShell Rules Revamp - 9
backport: auto
bbr
Building Block Rules
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5706
opened Feb 10, 2026 by
w0rk3r
Loading…
[Rule Tuning] Entra ID Federated Identity Credential Persistence Detection
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#5702
opened Feb 9, 2026 by
terrancedejesus
Loading…
5 tasks
[New Rule] AWS API Activity from Uncommon S3 Client by Rare User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
#5694
opened Feb 6, 2026 by
imays11
Loading…
[New Rules] AWS IAM new identity federation provider rules
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
#5691
opened Feb 6, 2026 by
imays11
Loading…
[New Rule] AWS GuardDuty Member Account Manipulation
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
#5688
opened Feb 5, 2026 by
imays11
Loading…
[Rule Tuning] Entra ID Suspicious Cloud Device Registration
backport: auto
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5683
opened Feb 5, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Entra ID SharePoint Accessed by Unusual User and Microsoft Authentication Broker Client
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5681
opened Feb 4, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Deprecate Individual MSFT Compliance Rules / Create BBR MSFT Purview Compliance Rule
backport: auto
bbr
Building Block Rules
Domain: Cloud
Domain: Identity
Domain: SaaS
Integration: Microsoft 365
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#5679
opened Feb 4, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported
backport: auto
Domain: Identity
Integration: Microsoft 365
Rule: Tuning
tweaking or tuning an existing rule
#5677
opened Feb 4, 2026 by
terrancedejesus
Loading…
5 tasks
[New Rule] Kubernetes Anonymous User Bound to ClusterRole
container
Integration: Kubernetes
Kubernetes Integration
Rule: New
Proposal for new rule
Team: TRADE
[New Rule] Okta Admin Console Login Failure
backport: auto
bbr
Building Block Rules
Domain: Identity
Integration: Okta
okta related rules
Rule: New
Proposal for new rule
#5669
opened Feb 3, 2026 by
terrancedejesus
Loading…
5 tasks
[New Rule] Potential Service Masquerading
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5650
opened Jan 29, 2026 by
Aegrah
Loading…
ProTip!
What’s not been updated in a month: updated:<2026-01-13.