Search results

[DaC] Rule response actions are missing in the export/import

community

detections-as-code

pythonInternal python for the repositoryInternal python for the repository

Team: TRADE

Status: Open.

#6040 In elastic/detection-rules;

· wingiti opened on May 4, 2026

[FR] Update requirements for newer requests version

community

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#6039 In elastic/detection-rules;

· wingiti opened on May 4, 2026

[FR] Migrate rules from retired Defense Evasion tactic (Stealth TA0005 / Defense Impairment TA0112)

maintenanceInternal changesInternal changes

Status: Open.

Enhancement

#6035 In elastic/detection-rules;

· shashank-elastic opened on May 4, 2026

[FR] Update Network Rules With Zeek Support

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

Enhancement

#6029 In elastic/detection-rules;

· eric-forte-elastic opened on May 2, 2026

[FR] Remove Endgame support after EOL

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#6021 In elastic/detection-rules;

· Mikaayenson opened on May 1, 2026

[Rule Tuning] First-Time FortiGate Administrator Login

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#6020 In elastic/detection-rules;

· JoeySec opened on Apr 30, 2026

[Rule Tuning] Privileges Elevation via Parent Process PID Spoofing (26b01043-4f04-4d2f-882a-5a1d2e95751b)

genai-tradecraft

Status: Open.

#6016 In elastic/detection-rules;

· tradebot-elastic opened on Apr 30, 2026

[Rule Tuning] Linux Restricted Shell Breakout via Linux Binary(s) (52376a86-ee86-4967-97ae-1a05f55816f0)

genai-tradecraft

Status: Open.

#5983 In elastic/detection-rules;

· tradebot-elastic opened on Apr 25, 2026

[Hunt Tuning] Entra ID Device Code Phishing / Update Drifted Docs

Domain: Cloud

Domain: Identity

Hunt: Tuning

Integration: AWSAWS related rulesAWS related rules

Integration: Azureazure related rulesazure related rules

Status: Open.

#5935 In elastic/detection-rules;

· terrancedejesus opened on Apr 8, 2026

[Rule Tuning] Suspicious macOS MS Office Child Process

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5886 In elastic/detection-rules;

· rkarimovs opened on Mar 26, 2026

[Rule Tuning] Kernel Module Load via Built-in Utility (2339f03c-f53f-40fa-834b-40c5983fc41f)

genai-tradecraft

Status: Open.

#5844 In elastic/detection-rules;

· tradebot-elastic opened on Mar 18, 2026

[DAC] [FR] Add Batch Import to DaC CLI

community

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#5829 In elastic/detection-rules;

· hhhharshil opened on Mar 12, 2026