Search results

[FR] Update Network Rules With Zeek Support

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

Enhancement

#6029 In elastic/detection-rules;

· eric-forte-elastic opened on May 2, 2026

[FR] Remove Endgame support after EOL

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#6021 In elastic/detection-rules;

· Mikaayenson opened on May 1, 2026

[Rule Tuning] First-Time FortiGate Administrator Login

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#6020 In elastic/detection-rules;

· JoeySec opened on Apr 30, 2026

[Rule Tuning] Privileges Elevation via Parent Process PID Spoofing (26b01043-4f04-4d2f-882a-5a1d2e95751b)

genai-tradecraft

Status: Open.

#6016 In elastic/detection-rules;

· tradebot-elastic opened on Apr 30, 2026

[Rule Tuning] Linux Restricted Shell Breakout via Linux Binary(s) (52376a86-ee86-4967-97ae-1a05f55816f0)

genai-tradecraft

Status: Open.

#5983 In elastic/detection-rules;

· tradebot-elastic opened on Apr 25, 2026

[Hunt Tuning] Entra ID Device Code Phishing / Update Drifted Docs

Domain: Cloud

Domain: Identity

Hunt: Tuning

Integration: AWSAWS related rulesAWS related rules

Integration: Azureazure related rulesazure related rules

Status: Open.

#5935 In elastic/detection-rules;

· terrancedejesus opened on Apr 8, 2026

[Rule Tuning] Suspicious macOS MS Office Child Process

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5886 In elastic/detection-rules;

· rkarimovs opened on Mar 26, 2026

[Rule Tuning] Kernel Module Load via Built-in Utility (2339f03c-f53f-40fa-834b-40c5983fc41f)

genai-tradecraft

Status: Open.

#5844 In elastic/detection-rules;

· tradebot-elastic opened on Mar 18, 2026

[DAC] [FR] Add Batch Import to DaC CLI

community

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#5829 In elastic/detection-rules;

· hhhharshil opened on Mar 12, 2026

[Rule Tuning] Network Traffic Capture via CAP_NET_RAW

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5826 In elastic/detection-rules;

· jvalente-salemstate opened on Mar 11, 2026

[Rule Tuning] Suspicious Child Execution via Web Server (f16fca20-4d6c-43f9-aec1-20b6de3b0aeb)

genai-tradecraft

Status: Open.

#5815 In elastic/detection-rules;

· tradebot-elastic opened on Mar 9, 2026

[Rule Tuning] Unusual Instance Metadata Service (IMDS) API Request (ecc0cd54-608e-11ef-ab6d-f661ea17fbce)

genai-tradecraft

Status: Open.

#5801 In elastic/detection-rules;

· tradebot-elastic opened on Mar 1, 2026