[Security Rules] Update security rules package to v9.4.3-beta.1

[tradebot-elastic]

What does this PR do?

Update the Security Rules package to version 9.4.3-beta.1.
Autogenerated from commit https://github.com/elastic/detection-rules/tree/ccaf094d0ff5f61a53150f9cb0aa7fe07fa7ecff

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Author's Checklist

• Install the most recently release security rules in the Detection Engine
• Install the package
• Confirm the update is available in Kibana. Click "Update X rules" or "Install X rules"
• Look at the changes made after the install and confirm they are consistent

How to test this PR locally

• Perform the above checklist, and use package-storage to build EPR from source

Related issues

None

Screenshots

None

[macroscopeapp]

🟢 Low security_detection_engine/changelog.yml:7

The changelog entry uses the placeholder URL https://github.com/elastic/integrations/pulls/0000 instead of the actual PR number, so the link will not resolve correctly. It also incorrectly uses pulls (plural) instead of pull (singular) in the path. Replace 0000 with the actual PR number and change pulls to pull to match the format of other entries.

Suggested change

	link: https://github.com/elastic/integrations/pull/18793
	link: https://github.com/elastic/integrations/pull/0000

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file packages/security_detection_engine/changelog.yml around line 7:

The changelog entry uses the placeholder URL `https://github.com/elastic/integrations/pulls/0000` instead of the actual PR number, so the link will not resolve correctly. It also incorrectly uses `pulls` (plural) instead of `pull` (singular) in the path. Replace `0000` with the actual PR number and change `pulls` to `pull` to match the format of other entries.

[macroscopeapp]

🟡 Medium security_rule/35ab3cfa-6c67-11ef-ab4d-f661ea17fbcc_111.json:16

The rlike pattern "(.*)365|SharePoint|Exchange|Teams|Office(.*)" is parsed as five separate full-string alternatives due to regex precedence: (.*)365 OR SharePoint OR Exchange OR Teams OR Office(.*). Resources like "SharePoint Online" or "Microsoft Teams" fail to match because SharePoint, Exchange, Teams lack wildcards on both sides. This causes the rule to miss brute-force attacks against major M365 services. Consider using (.*(365|SharePoint|Exchange|Teams|Office).*) to match substrings in all resource display names.

    and azure.signinlogs.properties.resource_display_name rlike "(.*(365|SharePoint|Exchange|Teams|Office).*)"

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file packages/security_detection_engine/kibana/security_rule/35ab3cfa-6c67-11ef-ab4d-f661ea17fbcc_111.json around line 16:

The `rlike` pattern `"(.*)365|SharePoint|Exchange|Teams|Office(.*)"` is parsed as five separate full-string alternatives due to regex precedence: `(.*)365` OR `SharePoint` OR `Exchange` OR `Teams` OR `Office(.*)`. Resources like "SharePoint Online" or "Microsoft Teams" fail to match because `SharePoint`, `Exchange`, `Teams` lack wildcards on both sides. This causes the rule to miss brute-force attacks against major M365 services. Consider using `(.*(365|SharePoint|Exchange|Teams|Office).*)` to match substrings in all resource display names.

[macroscopeapp]

🟢 Low security_rule/6fa3abe3-9cd8-41de-951b-51ed8f710523_5.json:13

The stats command defines Esql.http_response_status_code_values twice with the same values(http.response.status_code) aggregation. ES|QL does not permit duplicate column names in a single stats command, so this query will fail to parse or execute. Remove the redundant duplicate line.

-    Esql.http_response_status_code_values = values(http.response.status_code),
     Esql.agent_name_values = values(agent.name),
     Esql.agent_id_values = values(agent.id),
     Esql.http_request_method_values = values(http.request.method),
-    Esql.http_response_status_code_values = values(http.response.status_code),
     Esql.url_path_values = values(Esql.url_original_to_lower),

Also found in 1 other location(s)

packages/security_detection_engine/kibana/security_rule/35ab3cfa-6c67-11ef-ab4d-f661ea17fbcc_111.json:16

The stats block in the ES|QL query defines Esql.azure_signinlogs_result_description_values = values(azure.signinlogs.result_description) twice — once in the first group of aggregations and again later alongside count_distinct. Depending on how ES|QL handles duplicate output column names in stats, this could either cause a parse error (breaking the rule entirely) or silently shadow the first definition. If it causes a parse error, the rule will never fire, completely defeating its purpose of detecting brute-force attacks.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file packages/security_detection_engine/kibana/security_rule/6fa3abe3-9cd8-41de-951b-51ed8f710523_5.json around line 13:

The `stats` command defines `Esql.http_response_status_code_values` twice with the same `values(http.response.status_code)` aggregation. ES|QL does not permit duplicate column names in a single `stats` command, so this query will fail to parse or execute. Remove the redundant duplicate line.

Also found in 1 other location(s):
- packages/security_detection_engine/kibana/security_rule/35ab3cfa-6c67-11ef-ab4d-f661ea17fbcc_111.json:16 -- The `stats` block in the ES|QL query defines `Esql.azure_signinlogs_result_description_values = values(azure.signinlogs.result_description)` twice — once in the first group of aggregations and again later alongside `count_distinct`. Depending on how ES|QL handles duplicate output column names in `stats`, this could either cause a parse error (breaking the rule entirely) or silently shadow the first definition. If it causes a parse error, the rule will never fire, completely defeating its purpose of detecting brute-force attacks.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: ad5a6c8

Failed CI Steps

• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.4.0-SNAPSHOT ECH

History

cc @shashank-elastic

[elastic-vault-github-plugin-prod]

Package security_detection_engine - 9.4.3-beta.1 containing this change is available at https://epr.elastic.co/package/security_detection_engine/9.4.3-beta.1/