Merge branch 'main' into SAP-NV

Author: Mikaayenson

.github/CODEOWNERS

@@ -1,14 +1,19 @@
 # detection-rules code owners
-# POC: Elastic Security Intelligence and Analytics Team
-
-tests/**/*.py     @mikaayenson @eric-forte-elastic @terrancedejesus
-detection_rules/  @mikaayenson @eric-forte-elastic @terrancedejesus
-tests/            @mikaayenson @eric-forte-elastic @terrancedejesus
-lib/              @mikaayenson @eric-forte-elastic @terrancedejesus
-hunting/          @mikaayenson @eric-forte-elastic @terrancedejesus
-
-# skip rta-mapping to avoid the spam
-detection_rules/etc/packages.yaml @mikaayenson @eric-forte-elastic @terrancedejesus
-detection_rules/etc/*.json        @mikaayenson @eric-forte-elastic @terrancedejesus
-detection_rules/etc/*.json        @mikaayenson @eric-forte-elastic @terrancedejesus
-detection_rules/etc/*/*           @mikaayenson @eric-forte-elastic @terrancedejesus
+
+## POC: Elastic Threat Research & Detection Engineering
+
+tests/**/*.py     @mikaayenson @eric-forte-elastic @traut
+detection_rules/  @mikaayenson @eric-forte-elastic @traut
+tests/            @mikaayenson @eric-forte-elastic @traut
+lib/              @mikaayenson @eric-forte-elastic @traut
+hunting/**/*.py          @mikaayenson @eric-forte-elastic @traut
+
+## skip rta-mapping to avoid the spam
+
+detection_rules/etc/packages.yaml @mikaayenson @eric-forte-elastic @traut
+detection_rules/etc/*.json        @mikaayenson @eric-forte-elastic @traut
+detection_rules/etc/*/*           @mikaayenson @eric-forte-elastic @traut
+
+## exclude files from code owners
+
+detection_rules/etc/non-ecs-schema.json

.github/PULL_REQUEST_GUIDELINES/bug_guidelines.md

@@ -11,11 +11,7 @@ These guidelines serve as a reminder set of considerations when addressing a bug
 ### Code Standards and Practices
 
 - [ ] Code follows established design patterns within the repo and avoids duplication.
-- [ ] Code changes do not introduce new warnings or errors.
-- [ ] Variables and functions are well-named and descriptive.
-- [ ] Any unnecessary / commented-out code is removed.
 - [ ] Ensure that the code is modular and reusable where applicable.
-- [ ] Check for proper exception handling and messaging.
 
 ### Testing
 
@@ -25,11 +21,9 @@ These guidelines serve as a reminder set of considerations when addressing a bug
 - [ ] Validate that any rules affected by the bug are correctly updated.
 - [ ] Ensure that performance is not negatively impacted by the changes.
 - [ ] Verify that any release artifacts are properly generated and tested.
+- [ ] Conducted system testing, including fleet, import, and create APIs (e.g., run `make test-cli`, `make test-remote-cli`, `make test-hunting-cli`)
 
 ### Additional Checks
 
-- [ ] Ensure that the bug fix does not break existing functionality.
-- [ ] Review the bug fix with a peer or team member for additional insights.
 - [ ] Verify that the bug fix works across all relevant environments (e.g., different OS versions).
-- [ ] Confirm that all dependencies are up-to-date and compatible with the changes.
 - [ ] Confirm that the proper version label is applied to the PR `patch`, `minor`, `major`.

.github/PULL_REQUEST_GUIDELINES/enhancement_guidelines.md

@@ -11,11 +11,7 @@ These guidelines serve as a reminder set of considerations when addressing addin
 ### Code Standards and Practices
 
 - [ ] Code follows established design patterns within the repo and avoids duplication.
-- [ ] Code changes do not introduce new warnings or errors.
-- [ ] Variables and functions are well-named and descriptive.
-- [ ] Any unnecessary / commented-out code is removed.
 - [ ] Ensure that the code is modular and reusable where applicable.
-- [ ] Check for proper exception handling and messaging.
 
 ### Testing
 
@@ -25,11 +21,9 @@ These guidelines serve as a reminder set of considerations when addressing addin
 - [ ] Validate that any rules affected by the enhancement are correctly updated.
 - [ ] Ensure that performance is not negatively impacted by the changes.
 - [ ] Verify that any release artifacts are properly generated and tested.
+- [ ] Conducted system testing, including fleet, import, and create APIs (e.g., run `make test-cli`, `make test-remote-cli`, `make test-hunting-cli`)
 
 ### Additional Checks
 
-- [ ] Ensure that the enhancement does not break existing functionality.
-- [ ] Review the enhancement with a peer or team member for additional insights.
 - [ ] Verify that the enhancement works across all relevant environments (e.g., different OS versions).
-- [ ] Confirm that all dependencies are up-to-date and compatible with the changes.
 - [ ] Confirm that the proper version label is applied to the PR `patch`, `minor`, `major`.

.github/PULL_REQUEST_GUIDELINES/schema_enhancement_guidelines.md

@@ -11,11 +11,7 @@ These guidelines serve as a reminder set of considerations when addressing addin
 ### Code Standards and Practices
 
 - [ ] Code follows established design patterns within the repo and avoids duplication.
-- [ ] Code changes do not introduce new warnings or errors.
-- [ ] Variables and functions are well-named and descriptive.
-- [ ] Any unnecessary / commented-out code is removed.
 - [ ] Ensure that the code is modular and reusable where applicable.
-- [ ] Check for proper exception handling and messaging.
 
 ### Testing
 
@@ -25,23 +21,21 @@ These guidelines serve as a reminder set of considerations when addressing addin
 - [ ] Validate that any rules affected by the enhancement are correctly updated.
 - [ ] Ensure that performance is not negatively impacted by the changes.
 - [ ] Verify that any release artifacts are properly generated and tested.
+- [ ] Conducted system testing, including fleet, import, and create APIs (e.g., run `make test-cli`, `make test-remote-cli`, `make test-hunting-cli`)
 
 ### Additional Schema Related Checks
 
-- [ ] Ensure that the enhancement does not break existing functionality. (e.g., run `make test-cli`)
-- [ ] Review the enhancement with a peer or team member for additional insights.
 - [ ] Verify that the enhancement works across all relevant environments (e.g., different OS versions).
-- [ ] Confirm that all dependencies are up-to-date and compatible with the changes.
 - [ ] Link to the relevant Kibana PR or issue provided
-- [ ] Exported detection rule(s) from Kibana to showcase the feature(s)
-- [ ] Converted the exported ndjson file(s) to toml in the detection-rules repo
-- [ ] Re-exported the toml rule(s) to ndjson and re-imported into Kibana
+- [ ] Test export/import flow:
+  - [ ] Exported detection rule(s) from Kibana to showcase the feature(s)
+  - [ ] Converted the exported ndjson file(s) to toml in the detection-rules repo
+  - [ ] Re-exported the toml rule(s) to ndjson and re-imported into Kibana
 - [ ] Updated necessary unit tests to accommodate the feature
+- [ ] Incorporated a comprehensive test rule in unit tests for full schema coverage
 - [ ] Applied min_compat restrictions to limit the feature to a specified minimum stack version
 - [ ] Executed all unit tests locally with a test toml rule to confirm passing
 - [ ] Included Kibana PR implementer as an optional reviewer for insights on the feature
 - [ ] Implemented requisite downgrade functionality
 - [ ] Cross-referenced the feature with product documentation for consistency
-- [ ] Incorporated a comprehensive test rule in unit tests for full schema coverage
-- [ ] Conducted system testing, including fleet, import, and create APIs (e.g., run `make test-remote-cli`)
 - [ ] Confirm that the proper version label is applied to the PR `patch`, `minor`, `major`.

.github/workflows/add-guidelines.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Set environment variable for early exit control
         id: check_label
@@ -47,14 +47,14 @@ jobs:
 
       - name: Fail if no relevant labels are found
         if: env.GUIDELINES_FILE == ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             core.setFailed('No appropriate GitHub label found in the PR. Failing the job.')
 
       - name: Add Guidelines Comment
         if: env.CONTINUE_JOB == 'true' && (github.event.action == 'opened' || github.event.action == 'labeled')
-        uses: mshick/add-pr-comment@v2
+        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
         with:
           message-path: ${{ env.GUIDELINES_FILE }}
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/attack-coverage-update.yml

@@ -21,7 +21,7 @@ jobs:
       github.event.pull_request.state == 'open' && !github.event.pull_request.draft
     steps:
       - name: 'Apply default "backport: auto" label'
-        uses: actions/github-script@v4
+        uses: actions/github-script@10b53a9ec6c222bb4ce97aa6bd2b5f739696b536 # v4
         if: |
           !contains(github.event.pull_request.labels.*.name, 'backport: auto') &&
           !contains(github.event.pull_request.labels.*.name, 'backport: skip')
@@ -34,7 +34,7 @@ jobs:
               labels: ['backport: auto']
             })
       - name: 'Remove "backport: auto" if "backport: skip" is set'
-        uses: actions/github-script@v4
+        uses: actions/github-script@10b53a9ec6c222bb4ce97aa6bd2b5f739696b536 # v4
         if: |
           contains(github.event.pull_request.labels.*.name, 'backport: auto') &&
           contains(github.event.pull_request.labels.*.name, 'backport: skip')
@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           token: ${{ secrets.WRITE_TRADEBOT_DETECTION_RULES_TOKEN }}
           ref: main
@@ -91,7 +91,7 @@ jobs:
           git reset --soft HEAD^
 
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
 
@@ -159,7 +159,7 @@ jobs:
           git push
 
       - name: "Notify slack on failure"
-        uses: craftech-io/slack-action@v1
+        uses: craftech-io/slack-action@fb1d4e50375d7758efb90fa0564734bae931f84f # v1
         with:
           slack_webhook_url: ${{ secrets.EXTERNAL_SLACK_DETECTION_RULES_URL }}
           status: failure

.github/workflows/backport.yml

@@ -18,14 +18,14 @@ jobs:
     steps:
     - name: Get Backport Status
       id: get_backport_status
-      uses: fjogeleit/http-request-action@v1
+      uses: fjogeleit/http-request-action@bf78da14118941f7e940279dd58f67e863cbeff6 # v1
       with:
         url: "https://api.github.com/repos/elastic/detection-rules/actions/workflows/pythonpackage.yml/runs?per_page=1&branch=${{matrix.target_branch}}"
         method: 'GET'
         bearerToken: ${{ secrets.READ_ELASTIC_DETECTION_RULES_ORG_TOKEN }}
 
     - name: Check Backport Status
-      uses: actions/github-script@v6
+      uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
       with:
         script: |
           const workflow_status = ${{ toJSON(fromJSON(steps.get_backport_status.outputs.response).workflow_runs[0].status) }}

.github/workflows/branch-status-checks.yml

@@ -0,0 +1,49 @@
+name: Code checks
+
+on:
+  push:
+    branches: [ "main", "7.*", "8.*", "9.*" ]
+  pull_request:
+    branches: [ "*" ]
+    paths:
+      - 'detection_rules/**/*.py'
+      - 'hunting/**/*.py'
+      - 'tests/**/*.py'
+      - 'lib/**/*.py'
+
+jobs:
+  code-checks:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      with:
+        fetch-depth: 1
+
+    - name: Set up Python 3.13
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      with:
+        python-version: '3.13'
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip cache purge
+        pip install .[dev]
+
+    - name: Linting check
+      run: |
+        ruff check --exit-non-zero-on-fix
+
+    - name: Formatting check
+      run: |
+        ruff format --check
+
+    - name: Pyright check
+      run: |
+        pyright
+
+    - name: Python License Check
+      run: |
+        python -m detection_rules dev license-check

.github/workflows/code-checks.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check if member of elastic org
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         id: membership
         with:
           github-token: ${{ secrets.READ_ELASTIC_DETECTION_RULES_ORG_TOKEN }}
@@ -40,7 +40,7 @@ jobs:
 
 
       - name: Add label for community members
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         if: ${{ steps.membership.outputs.result == 'notMember' }}
         with:
           script: |