Skip to content

Pull requests: elastic/detection-rules

New pull request New
64 Open 4,418 Closed
64 Open 4,418 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Update actions/checkout digest backport: auto community
#6551 opened Jul 31, 2026 by elastic-renovate-prod Bot Loading…
1 task
[Rule Tuning] Rewriting execution through perl rule due to impossible condition backport: auto community Domain: Endpoint OS: Linux
#6549 opened Jul 31, 2026 by litemars Contributor Loading…
@Aegrah
[Rule Tuning] Adding co-author in multiple rules backport: auto community Domain: Endpoint OS: Linux OS: macOS
#6547 opened Jul 30, 2026 by litemars Contributor Loading…
[New Rule] Certighost ADCS Detections
#6537 opened Jul 30, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
7
[Bug] Edge case rule loading bugs backport: auto bug Something isn't working patch python Internal python for the repository
#6532 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
2
[New Rule] First Time Seen RMM Signer Across the Environment backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6522 opened Jul 29, 2026 by w0rk3r Contributor Loading…
@w0rk3r
8
[Rule Tuning] Potential Timestomp in Executable Files backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6521 opened Jul 29, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
7
[Bug] Fix import-rules error handling: KeyError on errors without rule_id; unread exceptions/connector error arrays community
#6504 opened Jul 27, 2026 by runicdefnd3r • Draft
1 task
1
Validate the field against the schema in KQL range expressions backport: auto community Domain: Endpoint OS: Windows windows related rules
#6502 opened Jul 27, 2026 by munzzyy Loading…
3
Fix KQL to EQL conversion treating an escaped/quoted asterisk as a wildcard backport: auto bug Something isn't working community patch
#6501 opened Jul 27, 2026 by munzzyy Loading…
8
WIP - [FR] Local Python Parsing for ES|QL minor python Internal python for the repository
#6500 opened Jul 26, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
[FR] Offline ES|QL validation via python-esql enhancement New feature or request
#6499 opened Jul 26, 2026 by Mikaayenson Contributor • Draft
3 of 5 tasks
@Mikaayenson
4
[FR] Add Safeguard for Kibana Rule Exception Race Condition backport: auto community detections-as-code enhancement New feature or request patch python Internal python for the repository
#6493 opened Jul 23, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[FR] Add nested KQL query support in lib/kql backport: auto enhancement New feature or request kql related to the kql module patch python Internal python for the repository Team: TRADE
#6492 opened Jul 23, 2026 by imays11 Contributor Loading…
3 tasks done
1
@imays11
5
[Bug] ECS Checks Overly Broad in Certain Integrations backport: auto bug Something isn't working patch python Internal python for the repository schema
#6491 opened Jul 23, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
6
[Rule Tuning] Potential Lateral Tool Transfer via SMB Share backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6490 opened Jul 23, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
4
[FR] Add free text support to KQL backport: auto enhancement New feature or request kql related to the kql module patch python Internal python for the repository
#6487 opened Jul 22, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[Rule Tuning] Unusual Discovery Signal Alert with Unusual Process Command Line backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6484 opened Jul 22, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
[FR] Add completion ES|QL validation exceptions for container runs backport: auto detections-as-code enhancement New feature or request patch python Internal python for the repository schema
#6475 opened Jul 20, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
12
[Rule Tuning] Exclude Kea DHCP from CAP_NET_RAW building block community
#6468 opened Jul 19, 2026 by archit15singh • Draft
5 of 7 tasks
1
2
[New Hunt] AKS Kubelet nodes/proxy Command Execution from an External Source IP backport: auto Domain: Cloud Domain: Containers Hunt: New Hunting Integration: Azure azure related rules
#6460 opened Jul 16, 2026 by terrancedejesus Contributor Loading…
5 tasks
@terrancedejesus
10
[Bug] KQL non-quoted spaces parsing support backport: auto bug Something isn't working kql related to the kql module patch python Internal python for the repository
#6388 opened Jul 6, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
5
Fix KQL wildcard literal failing to lex escaped specials with spaces backport: auto community
#6383 opened Jul 5, 2026 by munzzyy Loading…
4 of 5 tasks
1
3
Update actions/setup-go digest to 924ae3a backport: auto community
#6382 opened Jul 4, 2026 by elastic-renovate-prod Bot Loading…
1 task
[New Rule] AWS Bedrock AgentCore Gateway Repeated Tool Invocation Failures backport: auto community
#6368 opened Jul 1, 2026 by eeee2345 Loading…
@bryans3c
ProTip! Exclude everything labeled bug with -label:bug.