Skip to content

[Tuning] ESQL Dynamic unique value fields #5569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Samirbous wants to merge 15 commits into
base: main
Choose a base branch
from
Open

[Tuning] ESQL Dynamic unique value fields #5569

Samirbous wants to merge 15 commits into from
+112 −32

Conversation

@Samirbous
Copy link
Contributor

@Samirbous Samirbous commented Jan 16, 2026

Extract dynamic field with 1 value to ECS fields for alerts FP exclusion:

Esql.host_id_values -> host.is
Esql.agent_id_values -> agent.id
Esql.host_name_values -> host.name

@Samirbous
[Tuning] Extract dynamic field with 1 value to ECS fields for alerts …
f070cc2 
…exclusion

Extract dynamic field with 1 value to ECS fields for alerts exclusion:

Esql.host_id_values -> host.is
Esql.agent_id_values -> agent.id
Esql.host_name_values -> host.name
@Samirbous Samirbous self-assigned this Jan 16, 2026
@Samirbous Samirbous added the Rule: Tuning tweaking or tuning an existing rule label Jan 16, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 16, 2026

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 16, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson approved these changes Jan 16, 2026
View reviewed changes
Samirbous and others added 2 commits January 20, 2026 17:24
@Samirbous @Mikaayenson
Update rules/cross-platform/multiple_alerts_elastic_defend_netsecurit…
096ca49 
…y_by_host.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@Samirbous @Mikaayenson
Update rules/linux/impact_potential_bruteforce_malware_infection.toml
fc01c4e 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous @Mikaayenson
Update rules/linux/command_and_control_frequent_egress_netcon_from_su…
9f97143 
…s_executable.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous @Mikaayenson
Apply suggestions from code review
7b6fef4 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Samirbous and others added 3 commits January 20, 2026 17:51
@Samirbous @Mikaayenson
Update rules/cross-platform/multiple_alerts_elastic_defend_netsecurit…
dc21880 
…y_by_host.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@Samirbous @Mikaayenson
Update rules/cross-platform/newly_observed_elastic_defend_alert.toml
2e7941c 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@Samirbous @Mikaayenson
Update rules/cross-platform/newly_observed_elastic_detection_rule.toml
2e97a9f 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous @Mikaayenson
Update rules/windows/credential_access_rare_webdav_destination.toml
8d66283 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 20, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Elastic Defend and Network Security Alerts Correlation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspected Lateral Movement from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed High Severity Detection Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Rare Connection to WebDAV Target (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Port Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Newly Observed Elastic Defend Behavior Alert (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Malware-Driven SSH Brute Force Attempt (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Subnet Scanning Activity from Compromised Host (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Command Execution from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Transfer Utility Launched from Unusual Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Process Spawned from Web Server Parent (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ LSASS Process Access via Windows API (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

eric-forte-elastic
eric-forte-elastic approved these changes Jan 20, 2026
View reviewed changes
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Manual review, looks good to me! 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@eric-forte-elastic eric-forte-elastic eric-forte-elastic approved these changes

Assignees

@Samirbous Samirbous

Labels

backport: auto Domain: Endpoint OS: Linux OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Samirbous @tradebot-elastic @Mikaayenson @eric-forte-elastic