Search results

[DaC] export-rules fails on KQL rules with empty query (filters only)

community

detections-as-code

pythonInternal python for the repositoryInternal python for the repository

Team: TRADE

Status: Open.

#6167 In elastic/detection-rules;

· florianges opened on May 20, 2026

[New Rule] AWS Bedrock Model Invocation Logging Deleted Configuration

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#6160 In elastic/detection-rules;

· marcopedrinazzi opened on May 17, 2026

[New Rule] AWS Bedrock Guardrail Configuration Changed

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#6159 In elastic/detection-rules;

· marcopedrinazzi opened on May 17, 2026

[New Rule] AWS security agent detection

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#6155 In elastic/detection-rules;

· marcopedrinazzi opened on May 15, 2026

[New Rule] New LLM Jacking Rules

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#6154 In elastic/detection-rules;

· marcopedrinazzi opened on May 15, 2026

[Rule Tuning] Suspicious AWS S3 Connection via Script Interpreter

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#6140 In elastic/detection-rules;

· litemars opened on May 13, 2026

[New Rule] Expand LLM and MCP agent detection coverage under rules/integrations/llm/

community

Status: Open.

#6126 In elastic/detection-rules;

· eeee2345 opened on May 10, 2026

[DaC] additional line break added to query after export/import

community

detections-as-code

pythonInternal python for the repositoryInternal python for the repository

Team: TRADE

Status: Open.

#6081 In elastic/detection-rules;

· wingiti opened on May 5, 2026

[FR] Migrate rules from retired Defense Evasion tactic (Stealth TA0005 / Defense Impairment TA0112)

maintenanceInternal changesInternal changes

Status: Open.

Enhancement

#6035 In elastic/detection-rules;

· shashank-elastic opened on May 4, 2026

[FR] Update Network Rules With Zeek Support

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

Enhancement

#6029 In elastic/detection-rules;

· eric-forte-elastic opened on May 2, 2026

[FR] Remove Endgame support after EOL

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#6021 In elastic/detection-rules;

· Mikaayenson opened on May 1, 2026

[Rule Tuning] Privileges Elevation via Parent Process PID Spoofing (26b01043-4f04-4d2f-882a-5a1d2e95751b)

genai-tradecraft

Status: Open.

#6016 In elastic/detection-rules;

· tradebot-elastic opened on Apr 30, 2026