Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] Added Traefik Compatibility to Web Server Access Rules
backport: auto
bbr
Building Block Rules
Domain: Web
patch
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5837
opened Mar 16, 2026 by
Aegrah
Loading…
WIP - Add batch processing to Kibana import-rules
enhancement
New feature or request
patch
#5834
opened Mar 13, 2026 by
eric-forte-elastic
•
Draft
5 tasks
[New/Tuning] New DB Dump Rule & Tuning wget/curl DRs
backport: auto
Domain: Endpoint
OS: Linux
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5832
opened Mar 13, 2026 by
Aegrah
Loading…
[Tuning] Connection to Commonly Abused Web Services
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5831
opened Mar 12, 2026 by
Samirbous
Loading…
[New Rule] AWS CloudShell Environment Created
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
#5830
opened Mar 12, 2026 by
imays11
Loading…
[New Rule] Azure Arc Kubernetes Cluster Connect Abuse
backport: auto
Domain: Cloud
Domain: Containers
Domain: Identity
Integration: Azure
azure related rules
Integration: Kubernetes
Kubernetes Integration
Rule: New
Proposal for new rule
#5824
opened Mar 10, 2026 by
terrancedejesus
Loading…
5 tasks
WIP - [FR] [DAC] Initial Yaml Support
backport: auto
enhancement
New feature or request
patch
python
Internal python for the repository
#5821
opened Mar 10, 2026 by
eric-forte-elastic
•
Draft
5 tasks
[Tuning] Mis Rules Tuning
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5817
opened Mar 9, 2026 by
Samirbous
Loading…
[FR] Includes deprecated rule stubs to the package for upstream testing
backport: auto
enhancement
New feature or request
patch
python
Internal python for the repository
#5813
opened Mar 5, 2026 by
dplumlee
Loading…
1 of 5 tasks
[New Rule] M365 SharePoint Site Administrator Added
backport: auto
Domain: Cloud
Domain: Identity
Domain: SaaS
Integration: Microsoft 365
Rule: New
Proposal for new rule
#5806
opened Mar 2, 2026 by
terrancedejesus
Loading…
5 tasks
Update Entity related rules with new tweaking or tuning an existing rule
_ea ML job ID and update minimum stack versions
backport: auto
Rule: Tuning
#5794
opened Feb 27, 2026 by
susan-shu-c
Loading…
5 tasks
[New Rules] New Terms rules for malicious Python/Pickle model activity on macOS
backport: auto
Domain: Endpoint
OS: macOS
Rule: New
Proposal for new rule
#5780
opened Feb 25, 2026 by
DefSecSentinel
Loading…
[Bug] KQL Validation Add Wildcard w/ Space token value
backport: auto
bug
Something isn't working
patch
python
Internal python for the repository
Team: TRADE
#5753
opened Feb 20, 2026 by
imays11
Loading…
5 tasks done
[Rule Tuning & Deprecation] Tuning & Deprecating Promotion Rule
backport: auto
Integration: Cloud Defend
Cloud Defend Integration
Rule: Deprecation
removal of a rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[New Rule] AWS API Activity from Uncommon S3 Client by Rare User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
[FR] [DAC] Add Exception Duplication Checking
backport: auto
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
#5689
opened Feb 5, 2026 by
eric-forte-elastic
Loading…
5 tasks
[New Rule] Kubernetes Anonymous User Bound to ClusterRole
container
Integration: Kubernetes
Kubernetes Integration
Rule: New
Proposal for new rule
Team: TRADE
[New Rule] Potential Service Masquerading
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries
backport: auto
Hunt: Tuning
Hunting
#5566
opened Jan 16, 2026 by
terrancedejesus
•
Draft
5 tasks
ProTip!
no:milestone will show everything without a milestone.