All pull requests

Pull requests

• [New Rule] GCP Compute Snapshot Created by Rare User

  backport: autoDomain: CloudIntegration: GCPRule: New
  #7175·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] Entra ID App Consent or Permission Grant by Rare User

  backport: autoDomain: CloudIntegration: AzureRule: New
  #7174·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] Entra ID User Created or Deleted by Rare Identity

  backport: autoDomain: CloudIntegration: AzureRule: New
  #7173·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] Entra ID Password Reset of Another User

  backport: autoDomain: CloudIntegration: AzureRule: New
  #7172·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] Azure Event Hub Namespace Deleted

  backport: autoDomain: CloudIntegration: AzureRule: New
  #7171·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] Azure Compute Snapshot Created by Unusual Identity

  backport: autoDomain: CloudIntegration: AzureRule: New
  #7170·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] AWS EC2 Instance Launched With User Data by Rare User

  backport: autoDomain: CloudIntegration: AWSRule: New
  #7169·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [New Rule] AWS EC2 EBS Snapshot Created by Rare User

  backport: autoDomain: CloudIntegration: AWSRule: New
  #7168·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  3

  

• [New Rule] AWS IAM Password Policy Recon by Rare User

  backport: autoDomain: CloudIntegration: AWSRule: New
  #7167·bryans3c opened Nov 12, 2026Contributor·5 tasks·

  ·
  1

  

• [Rule Tuning] ELF Payload Staged in a Suspicious Directory

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: LinuxRule: Tuning
  #7166·tradebot-elastic opened Nov 12, 2026Contributor·

  ·
  5

  

• [New Rule] Potential Process Self-Deletion

  backport: autocurrentreleaseDomain: EndpointOS: LinuxRule: New
  #7163·Aegrah opened Nov 10, 2026Contributor·5 tasks done·

  ·
  9

  

• [New Rule] macOS System Log Deletion or Truncation

  backport: autoDomain: EndpointOS: macOSRule: NewTeam: TRADE
  #7162·litemars opened Nov 10, 2026Contributor·

  ·
  3

  

• [New Rule] Third-Party Security Software Unload or Tamper via Launchctl

  backport: autoDomain: EndpointOS: macOSRule: NewTeam: TRADE
  #7161·litemars opened Nov 10, 2026Contributor·

  ·
  3

  

• [Rule Tuning] PKINIT Followed by Same-Principal U2U Service Ticket

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7160·tradebot-elastic opened Nov 9, 2026Contributor·

  ·
  3

  

• [New Rule] Shell Evaluated Curl Downloaded Content

  backport: autocurrentreleaseDomain: EndpointOS: macOSRule: NewTeam: TRADE
  #7159·litemars opened Nov 9, 2026Contributor·

  ·
  19

  

• Update actions/setup-python digest to 6d4fd22

  backport: autocommunity
  #7158·elastic-renovate-prod[bot] opened Nov 9, 2026Bot·1 task·

  ·
  1

• [Rule Tuning] Multiple Detection Rules

  backport: autocurrentreleaseDomain: EndpointOS: macOSRule: TuningTeam: TRADE
  #7157·litemars opened Nov 9, 2026Contributor·

  ·
  11

  

• Update dependency flake8 to v7.5.0

  backport: autocommunity
  #7156·elastic-renovate-prod[bot] opened Nov 9, 2026Bot·1 task·

  ·
  2

• Update dependency marko to v2.2.5

  backport: autocommunity
  #7155·elastic-renovate-prod[bot] opened Nov 9, 2026Bot·1 task·

  ·
  1

• [Rule Tuning] Timestomping using Touch or SetFile Command

  backport: autoDomain: EndpointOS: macOSRule: TuningTeam: TRADE
  #7153·litemars opened Nov 9, 2026Contributor·

  ·
  6

  

• [Rule Tuning] Potential Computer Account NTLM Relay Activity

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7151·tradebot-elastic opened Nov 9, 2026Contributor·

  ·
  4

  

• [Rule Tuning] Multiple Logon Failure from the same Source Address

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7149·tradebot-elastic opened Nov 8, 2026Contributor·

  ·
  2

  

• [Rule Tuning] Sensitive Audit Policy Sub-Category Disabled

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7148·tradebot-elastic opened Nov 7, 2026Contributor·

  ·
  4

  

• docs: improve Kerberos port 88 investigation guidance

  backport: autocommunityDomain: EndpointOS: Windows
  #7146·hack-ita opened Nov 7, 2026·

  ·
  2

• [Docs] Map prebuilt rules landing page to legacy 8.x pages

  backport: autodocumentationenhancementpatch
  #7138·nastasha-solomon opened Nov 4, 2026Member·2 tasks done·

  ·
  2