Pull requests: elastic/detection-rules
Pull requests list
[Tuning] Rare Connection to WebDAV Target
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5604
opened Jan 23, 2026 by
Samirbous
Loading…
[doc fix] Adjust wording in the docs for Kibana import/export commands
backport: auto
enhancement
New feature or request
patch
python
Internal python for the repository
#5600
opened Jan 22, 2026 by
traut
Loading…
5 tasks
[New] Multiple Vulnerabilities by Asset via Wiz
backport: auto
patch
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
#5598
opened Jan 22, 2026 by
Samirbous
Loading…
[fix] Preserve Something isn't working
maintenance
Internal changes
patch
python
Internal python for the repository
actions[].params.message field formatting during rule export from the repo
backport: auto
bug
#5597
opened Jan 22, 2026 by
traut
Loading…
1 of 5 tasks
[New Rule] Curl SOCKS Proxy Detected via Defend for Containers
backport: auto
container
Integration: Cloud Defend
Cloud Defend Integration
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5596
opened Jan 22, 2026 by
Aegrah
Loading…
[Tuning] Potential Ransomware Behavior - Note Files by System
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5595
opened Jan 21, 2026 by
Samirbous
Loading…
[New/Tuning] General API Abuse D4C/K8s Rules
backport: auto
container
Integration: Cloud Defend
Cloud Defend Integration
Integration: Kubernetes
Kubernetes Integration
OS: Linux
Rule: New
Proposal for new rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5591
opened Jan 21, 2026 by
Aegrah
Loading…
[Rule Tuning] Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5589
opened Jan 20, 2026 by
terrancedejesus
Loading…
5 tasks
[Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules
backport: auto
bbr
Building Block Rules
container
Domain: Endpoint
OS: Linux
patch
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5578
opened Jan 19, 2026 by
Aegrah
Loading…
[Tuning] ESQL Dynamic unique value fields
backport: auto
Domain: Endpoint
OS: Linux
OS: Windows
windows related rules
Rule: Tuning
tweaking or tuning an existing rule
#5569
opened Jan 16, 2026 by
Samirbous
Loading…
[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries
backport: auto
Hunt: Tuning
Hunting
#5566
opened Jan 16, 2026 by
terrancedejesus
Loading…
5 tasks
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset
backport: auto
container
Integration: Cloud Defend
Cloud Defend Integration
OS: Linux
Rule: Deprecation
removal of a rule
Rule: New
Proposal for new rule
Team: TRADE
#5561
opened Jan 15, 2026 by
Aegrah
Loading…
[New] Lateral Movement Alerts from a Newly Observed Entity
backport: auto
Rule: New
Proposal for new rule
#5557
opened Jan 14, 2026 by
Samirbous
Loading…
[New Rule] Multiple High-Severity Alerts for Privileged AD User
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
[New Rule] Potential PowerShell Obfuscated Script via High Entropy
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#5554
opened Jan 12, 2026 by
w0rk3r
Loading…
[New Rule] PowerShell Script Block Entropy Outlier via MAD Z-Score
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
ProTip!
Follow long discussions with comments:>50.