Search results

[FR] ES|QL remote validation support newline split indices

enhancementNew feature or requestNew feature or request

pythonInternal python for the repositoryInternal python for the repository

Team: TRADE

Status: Open.

Enhancement

#5355 In elastic/detection-rules;

· eric-forte-elastic opened on Nov 24, 2025

[New Rule] AWS EC2 LOLBin Execution via SSM

Domain: Cloud

Domain: Endpoint

Integration: AWSAWS related rulesAWS related rules

Integration: EndpointElastic Endpoint SecurityElastic Endpoint Security

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#5353 In elastic/detection-rules;

· terrancedejesus opened on Nov 24, 2025

[Tuning][Unit Test]<code>Microsoft Defender XDR</code> vs <code>Microsoft Defender for Endpoint</code> Data Source Tag Update and Compatibility Check

enhancementNew feature or requestNew feature or request

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

test-suiteunit and other testing componentsunit and other testing components

Status: Open.

Initiative

#5346 In elastic/detection-rules;

· imays11 opened on Nov 19, 2025

[Rule Tuning] Remove Exception List from Endpoint Promotion Rules Post 9.3

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5320 In elastic/detection-rules;

· Mikaayenson opened on Nov 17, 2025

[Bug] Trying to export rules from kibana but validationError

bugSomething isn't workingSomething isn't working

community

Team: TRADE

Status: Open.

#5319 In elastic/detection-rules;

· OzzyKampha opened on Nov 17, 2025

[Rule Tuning] Connection to Commonly Abused Web Services

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5302 In elastic/detection-rules;

· girtsLv opened on Nov 12, 2025

[Rule Tuning] Logic Overlap between Execution from Unusual Path - Command Line and Process Execution from an Usual Directory

backlog

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5290 In elastic/detection-rules;

· veritasr3x opened on Nov 7, 2025

[Rule Tuning] Connection to Commonly Abused Web Services

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5279 In elastic/detection-rules;

· veritasr3x opened on Nov 4, 2025

[New Rule] Name of rule: Linux Fileless Execution via memfd_create

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5276 In elastic/detection-rules;

· litemars opened on Nov 3, 2025

[Rule Tuning] Suspicious Network Connection via systemd - unified-monitoring-agent

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5273 In elastic/detection-rules;

· richlv opened on Nov 3, 2025

[Rule Tuning] Google Workspace ruleset audit and tuning.

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5270 In elastic/detection-rules;

· shashank-elastic opened on Oct 31, 2025

[Rule Tuning] Potential PowerShell Obfuscation via High Special Character Proportion

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5263 In elastic/detection-rules;

· khalavak opened on Oct 29, 2025