Skip to content

Pull requests: elastic/detection-rules

New pull request New
35 Open 3,540 Closed
35 Open 3,540 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Tunings] AWS Lambda Rules backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5451 opened Dec 11, 2025 by imays11 Loading…
@imays11
1
[Rule Tuning] Unusual Web Server Command Execution backport: auto Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5450 opened Dec 11, 2025 by Aegrah Loading…
@Aegrah
3
[Tuning] Top Noisy Rules backport: auto Domain: Endpoint eql-to-esql noise-reduction OS: Linux OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#5449 opened Dec 11, 2025 by Samirbous Loading…
@Samirbous
13
[Rule Tunings] AWS Route 53 Rules backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5448 opened Dec 10, 2025 by imays11 Loading…
@imays11
1
[Tuning] Suspicious React Server Child Process backport: auto Rule: Tuning tweaking or tuning an existing rule
#5447 opened Dec 10, 2025 by Samirbous Loading…
@Samirbous
3
[Tuning] Agent Spoofing - Multiple Hosts Using Same Agent backport: auto Rule: Tuning tweaking or tuning an existing rule
#5446 opened Dec 10, 2025 by Samirbous Loading…
@Samirbous
3
[New] React2Shell Network Security Alert backport: auto Domain: Network emerging-threat Rule: New Proposal for new rule
#5445 opened Dec 10, 2025 by Samirbous Loading…
@Samirbous
7
Added logic to main.py to use the created_at and updated_at values if they exist backport: auto python Internal python for the repository
#5444 opened Dec 10, 2025 by aarju Loading…
2 tasks
4
[New] Suricata and Elastic Defend Network Correlation backport: auto Domain: Endpoint Domain: Network Rule: New Proposal for new rule
#5443 opened Dec 10, 2025 by Samirbous Loading…
@Samirbous
28
[FR] Add keep metadata check to esql schema test backport: auto patch python Internal python for the repository schema test-suite unit and other testing components
#5441 opened Dec 9, 2025 by eric-forte-elastic Loading…
5 tasks
1
@eric-forte-elastic
1
[New Rule] GitHub Actions Bot Pushed to Repository for First Time backport: auto Domain: Cloud Rule: New Proposal for new rule
#5438 opened Dec 9, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
1
[New Rule] GitHub Actions Workflow Injection Blocked backport: auto Domain: Cloud Domain: SaaS patch Rule: New Proposal for new rule
#5433 opened Dec 9, 2025 by terrancedejesus Loading…
5 tasks
1
@terrancedejesus
3
[Rule Tuning] Suspicious Network Connection via systemd backport: auto community Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5432 opened Dec 9, 2025 by Aegrah Loading…
1
@Aegrah
2
[Rule Tunings] AWS WAF Rules backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#5429 opened Dec 8, 2025 by imays11 Loading…
@imays11
1
[Bug] Importing rules from directory uses wrong type backport: auto bug Something isn't working detections-as-code patch python Internal python for the repository
#5428 opened Dec 8, 2025 by eric-forte-elastic Loading…
5 tasks
1
@eric-forte-elastic
1
Update actions/checkout action to v6 backport: auto community
#5349 opened Nov 20, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency marshmallow to v4 backport: auto community
#5330 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency elasticsearch to v9 backport: auto community
#5329 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/upload-artifact action to v5 backport: auto community
#5328 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/checkout digest backport: auto community
#5327 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/setup-python action to v6 backport: auto community
#5326 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/setup-go action to v6 backport: auto community
#5325 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update actions/github-script action to v8 backport: auto community
#5322 opened Nov 17, 2025 by elastic-renovate-prod bot Loading…
1 task
Update dependency requests to ~=2.32.5 backport: auto community
#5257 opened Oct 28, 2025 by elastic-renovate-prod bot Loading…
1 task
[New Rule] File Creation with Curly Braces or Command Substitution backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#5219 opened Oct 14, 2025 by Aegrah • Draft
@Aegrah
5
ProTip! Updated in the last three days: updated:>2025-12-08.