Skip to content

Actions: elastic/detection-rules

Actions

ES|QL Validation

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
esql-validation.yml
976 workflow runs
976 workflow runs

Filter by Event

Filter by Status

Filter by Branch

Filter by Actor

[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #281: Pull request #5311 synchronize by Samirbous
19s obfusc_args_unicde
obfusc_args_unicde
19s
[Tuning] Agent Spoofing - Multiple Hosts Using Same Agent ES|QL Validation #280: Pull request #5313 synchronize by Samirbous
4m 25s Samirbous-patch-1
Samirbous-patch-1
4m 25s
[New] Potential Masquerading as Svchost ES|QL Validation #279: Pull request #5305 synchronize by eric-forte-elastic
4m 20s qstr_test
qstr_test
4m 20s
[Bug] Add synthetic properties check to remote ESQL validation ES|QL Validation #278: Pull request #5308 synchronize by eric-forte-elastic
19s 5306-bug-esql-schema-field-pruning
5306-bug-esql-schema-field-pruning
19s
[Bug] Add synthetic properties check to remote ESQL validation ES|QL Validation #277: Pull request #5308 synchronize by eric-forte-elastic
19s 5306-bug-esql-schema-field-pruning
5306-bug-esql-schema-field-pruning
19s
[Tuning] Agent Spoofing - Multiple Hosts Using Same Agent ES|QL Validation #276: Pull request #5313 synchronize by Samirbous
4m 15s Samirbous-patch-1
Samirbous-patch-1
4m 15s
[Rule Tuning] Azure Diagnostic Settings Deletion ES|QL Validation #275: Pull request #5253 synchronize by terrancedejesus
16s terrancedejesus/issue5252
terrancedejesus/issue5252
16s
[Rule Tuning] Microsoft Entra ID Exccessive Account Lockouts ES|QL Validation #274: Pull request #5315 synchronize by terrancedejesus
15s terrancedejesus/issue5314
terrancedejesus/issue5314
15s
[Rule Tuning] Microsoft Entra ID Exccessive Account Lockouts ES|QL Validation #273: Pull request #5315 synchronize by terrancedejesus
17s terrancedejesus/issue5314
terrancedejesus/issue5314
17s
[Rule Tuning] Microsoft Entra ID Exccessive Account Lockouts ES|QL Validation #272: Pull request #5315 opened by terrancedejesus
18s terrancedejesus/issue5314
terrancedejesus/issue5314
18s
[Rule Tuning] AWS IAM API Calls via Temporary Session Tokens ES|QL Validation #271: Pull request #5310 synchronize by imays11
16s tune_aws_iam_calls_via_temp_creds
tune_aws_iam_calls_via_temp_creds
16s
[Tuning] Agent Spoofing - Multiple Hosts Using Same Agent ES|QL Validation #270: Pull request #5313 synchronize by Samirbous
54s Samirbous-patch-1
Samirbous-patch-1
54s
[Tuning] Agent Spoofing - Multiple Hosts Using Same Agent ES|QL Validation #269: Pull request #5313 opened by Samirbous
52s Samirbous-patch-1
Samirbous-patch-1
52s
[Tuning] Agent Spoofing - Mismatched Agent ID ES|QL Validation #268: Pull request #5312 opened by Samirbous
26s Samirbous-patch-1
Samirbous-patch-1
26s
[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #267: Pull request #5311 synchronize by Samirbous
1m 35s obfusc_args_unicde
obfusc_args_unicde
1m 35s
[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #266: Pull request #5311 synchronize by Samirbous
19s obfusc_args_unicde
obfusc_args_unicde
19s
[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #265: Pull request #5311 synchronize by Samirbous
4m 18s obfusc_args_unicde
obfusc_args_unicde
4m 18s
[New] Potential Masquerading as Svchost ES|QL Validation #264: Pull request #5305 synchronize by Samirbous
5m 10s qstr_test
qstr_test
5m 10s
[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #263: Pull request #5311 synchronize by Samirbous
5m 13s obfusc_args_unicde
obfusc_args_unicde
5m 13s
[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #262: Pull request #5311 synchronize by Samirbous
5m 49s obfusc_args_unicde
obfusc_args_unicde
5m 49s
[New] Command Obfuscation via Unicode Modifier Letters ES|QL Validation #261: Pull request #5311 opened by Samirbous
4m 7s obfusc_args_unicde
obfusc_args_unicde
4m 7s
[New] Potential Masquerading as Svchost ES|QL Validation #260: Pull request #5305 synchronize by Samirbous
4m 54s qstr_test
qstr_test
4m 54s
[Bug] Add synthetic properties check to remote ESQL validation ES|QL Validation #259: Pull request #5308 synchronize by eric-forte-elastic
16s 5306-bug-esql-schema-field-pruning
5306-bug-esql-schema-field-pruning
16s
[Bug] Add synthetic properties check to remote ESQL validation ES|QL Validation #258: Pull request #5308 synchronize by eric-forte-elastic
16s 5306-bug-esql-schema-field-pruning
5306-bug-esql-schema-field-pruning
16s
[Rule Tuning] AWS IAM API Calls via Temporary Session Tokens ES|QL Validation #257: Pull request #5310 opened by imays11
16s tune_aws_iam_calls_via_temp_creds
tune_aws_iam_calls_via_temp_creds
16s
ProTip! You can narrow down the results and go further in time using created:<2025-11-12 or the other filters available.