Skip to content

Issues: elastic/detection-rules

Beta
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

132 Open 1,508 Closed
132 Open 1,508 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

[Meta] Evaluate Metadata for Linux Ruleset Meta OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4754 opened May 30, 2025 by Aegrah
@Aegrah
[Rule Tuning] Potential Antimalware Scan Interface Bypass via PowerShell community Integration: Windows Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4752 opened May 29, 2025 by drummbelbummel
@Samirbous
4
[Bug] Makefile Test Remote CLI defined Twice bug Something isn't working Team: TRADE
#4750 opened May 28, 2025 by eric-forte-elastic
1
@eric-forte-elastic
[Rule Tuning] Suspicious Endpoint Security Parent Process - Wrong or missing SecurityHealthHost path community Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4746 opened May 25, 2025 by willemdh
[Security Solution] "Modification of Safari Settings via Defaults Command" rule seems to be broken after update bug Something isn't working community Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4741 opened May 21, 2025 by saernz
@DefSecSentinel
5
[Bug] Base requirements not sufficient to run detection_rules module bug Something isn't working community Team: TRADE
#4724 opened May 16, 2025 by willbrownecs
1
[Rule Tuning] Windows Registry File Creation in SMB Share community Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4722 opened May 14, 2025 by tschaegge-b
[Rule Tuning] attrib.exe usage by draw.io community Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4721 opened May 13, 2025 by richlv
[Bug] Help Flag Returns Errors bug Something isn't working community Team: TRADE
#4718 opened May 10, 2025 by sleepless-swan
[FR] Pre-Built Elastic Auditd Ruleset enhancement New feature or request OS: Linux Security Content Team: TRADE
#4713 opened May 9, 2025 by Aegrah
@Aegrah
1
[FR] Support Visualization of Previous Rule Versions enhancement New feature or request Team: TRADE
#4709 opened May 8, 2025 by w0rk3r
[FR] Unit Test for elastic_endpoint_security Rule ID Change enhancement New feature or request Team: TRADE
#4707 opened May 7, 2025 by Mikaayenson
[FR] Reduce Built-in Git Operations enhancement New feature or request Team: TRADE
#4701 opened May 6, 2025 by eric-forte-elastic
[Rule Tuning] Suspicious Access to LDAP Attributes - Ignored Fields Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4698 opened May 5, 2025 by w0rk3r
@w0rk3r
[New Rule] ADExplorer collecting Active Directory information backlog community Rule: New Proposal for new rule Team: TRADE
#4697 opened May 5, 2025 by pl853
@w0rk3r
[Bug] EQL Sequence Multi-Data Source Schema Validation bug Something isn't working Team: TRADE
#4693 opened May 1, 2025 by terrancedejesus
[Rule Tuning] Potential Ransomware Behavior - High count of Readme files by System Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4653 opened Apr 24, 2025 by w0rk3r
@w0rk3r
[Rule Tuning] Google Workspace Admin Role Assigned to a User community Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4651 opened Apr 24, 2025 by buzzdeee
[Rule Tuning] Suspicious Execution from a Mounted Device community Rule: Tuning tweaking or tuning an existing rule Team: TRADE
#4603 opened Apr 10, 2025 by kenza-ab
@w0rk3r
1
[FR] Include Timeline Templates export/import in the CLI such that they can be imported and exported together with rules like exceptions and action connectors community enhancement New feature or request Team: TRADE
#4588 opened Apr 1, 2025 by frederikb96
2
[FR] Handle Cases Where Kibana Duplicates Action Connectors community enhancement New feature or request stale 60 days of inactivity Team: TRADE
#4576 opened Mar 28, 2025 by eric-forte-elastic
1
[Bug] Using the CLI to export esql (ES|QL) rules from Kibana results in ValidationError if using metadata according to documentation bug Something isn't working community Team: TRADE
#4575 opened Mar 27, 2025 by frederikb96
2
[Bug] CLI detection_rules kibana import-rules imports all exceptions and connectors if --rule-file or --rule-id is set bug Something isn't working community Team: TRADE
#4574 opened Mar 27, 2025 by frederikb96
2
[FR] GitHub URL inside rule description that points to GitHub location community enhancement New feature or request stale 60 days of inactivity Team: TRADE
#4560 opened Mar 25, 2025 by CyberneticNomad-v808
3
[FR] CLI function to check a cluster for Deprecated Rules enhancement New feature or request Team: TRADE
#4553 opened Mar 20, 2025 by w0rk3r
1
ProTip! Type g p on any issue or pull request to go back to the pull request listing page.