Skip to content

Actions: elastic/detection-rules

Actions

ES|QL Validation

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
esql-validation.yml
923 workflow runs
923 workflow runs

Filter by Event

Filter by Status

Filter by Branch

Filter by Actor

[New Rule] Okta Multiple OS Names Detected for a Single DT Hash ES|QL Validation #49: Pull request #5241 synchronize by terrancedejesus
21s terrancedejesus/issue5240
terrancedejesus/issue5240
21s
[New Rule] Okta Multiple OS Names Detected for a Single DT Hash ES|QL Validation #48: Pull request #5241 synchronize by terrancedejesus
20s terrancedejesus/issue5240
terrancedejesus/issue5240
20s
[New Rule] Okta Multiple OS Names Detected for a Single DT Hash ES|QL Validation #47: Pull request #5241 synchronize by terrancedejesus
24s terrancedejesus/issue5240
terrancedejesus/issue5240
24s
[New Rule] Okta Multiple OS Names Detected for a Single DT Hash ES|QL Validation #46: Pull request #5241 opened by terrancedejesus
26s terrancedejesus/issue5240
terrancedejesus/issue5240
26s
[Rule Tuning] File Transfer or Listener Established via Netcat ES|QL Validation #45: Pull request #5223 synchronize by eric-forte-elastic
22s rule-tuning-nc-listener
rule-tuning-nc-listener
22s
[Rule Tunings] AWS Multiple API Calls ESQL rules ES|QL Validation #44: Pull request #5238 opened by imays11
7m 45s tune_aws_multi_region_rules
tune_aws_multi_region_rules
7m 45s
[Tuning] Potential Ransomware Behavior - Note Files by System ES|QL Validation #43: Pull request #5235 synchronize by Samirbous
4m 10s Samirbous-patch-1
Samirbous-patch-1
4m 10s
[Tuning] Potential Ransomware Behavior - Note Files by System ES|QL Validation #42: Pull request #5235 synchronize by Samirbous
4m 59s Samirbous-patch-1
Samirbous-patch-1
4m 59s
[Tuning] Potential Ransomware Behavior - Note Files by System ES|QL Validation #41: Pull request #5235 opened by Samirbous
4m 46s Samirbous-patch-1
Samirbous-patch-1
4m 46s
Add rules for Azure Activity Logs/GCP Audit ML jobs ES|QL Validation #40: Pull request #5191 synchronize by shashank-elastic
18s adding_azure_and_gcp_ml_job_rules
adding_azure_and_gcp_ml_job_rules
18s
[Rule Tunings] AWS EC2 EBS Snapshot and Encryption Rules ES|QL Validation #39: Pull request #5229 synchronize by imays11
18s tune_aws_ebs_snapshot_rules
tune_aws_ebs_snapshot_rules
18s
[Rule Tunings] AWS EC2 EBS Snapshot and Encryption Rules ES|QL Validation #38: Pull request #5229 synchronize by imays11
23s tune_aws_ebs_snapshot_rules
tune_aws_ebs_snapshot_rules
23s
[Rule Tunings] AWS EC2 EBS Snapshot and Encryption Rules ES|QL Validation #37: Pull request #5229 synchronize by imays11
20s tune_aws_ebs_snapshot_rules
tune_aws_ebs_snapshot_rules
20s
Prep 9.2 ES|QL Validation #36: Pull request #5231 synchronize by shashank-elastic
23s prep_9.2
prep_9.2
23s
Prep 9.2 ES|QL Validation #35: Pull request #5231 synchronize by shashank-elastic
26s prep_9.2
prep_9.2
26s
[New Rule] Azure Compute Snapshot Deletion(s) ES|QL Validation #34: Pull request #5211 synchronize by terrancedejesus
21s terrancedejesus/issue5210
terrancedejesus/issue5210
21s
[New Rule] Azure Compute Restore Point Collection Deleted ES|QL Validation #33: Pull request #5217 synchronize by terrancedejesus
22s terrancedejesus/issue5216
terrancedejesus/issue5216
22s
[New Rule] Azure Storage Account Deletion ES|QL Validation #32: Pull request #5200 synchronize by terrancedejesus
14s terrancedejesus/issue5199
terrancedejesus/issue5199
14s
[New Rule] Azure Compute Snapshot Deletion(s) ES|QL Validation #31: Pull request #5211 synchronize by terrancedejesus
22s terrancedejesus/issue5210
terrancedejesus/issue5210
22s
[New Rule] Azure Compute Restore Point Collection Deleted ES|QL Validation #30: Pull request #5217 synchronize by terrancedejesus
31s terrancedejesus/issue5216
terrancedejesus/issue5216
31s
Prep 9.2 ES|QL Validation #29: Pull request #5231 synchronize by shashank-elastic
16s prep_9.2
prep_9.2
16s
[New Rule] Azure Compute Restore Point Collection Deleted ES|QL Validation #28: Pull request #5217 synchronize by terrancedejesus
24s terrancedejesus/issue5216
terrancedejesus/issue5216
24s
[New Rule] Azure Storage Account Deletion ES|QL Validation #27: Pull request #5200 synchronize by terrancedejesus
26s terrancedejesus/issue5199
terrancedejesus/issue5199
26s
[Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules ES|QL Validation #26: Pull request #5232 opened by Aegrah
16s crowdstrike-support-pr-eql
crowdstrike-support-pr-eql
16s
[Rule Tuning] Suspicious Entra ID OAuth User Impersonation Scope Detected ES|QL Validation #25: Pull request #5190 synchronize by terrancedejesus
20s terrancedejesus/issue5189
terrancedejesus/issue5189
20s
ProTip! You can narrow down the results and go further in time using created:<2025-10-17 or the other filters available.