Commits

Branch selector

 main

User selector

All users

Datepicker

All time

Commit History

Commits on Jan 2, 2026

• Update persistence_webshell_detection.toml (#5524)

  Show description for 08663de
  

  Samirbous

  and

  w0rk3r

  authored
  08663de

  Copy full SHA for 08663de

• [New] Multiple Elastic Defend Alerts from Single Process Tree (#5522)

  Show description for 74d6fe9
  

  Samirbous

  and

  w0rk3r

  authored
  74d6fe9

  Copy full SHA for 74d6fe9

• [Tuning] Elastic Defend and Network Security Alerts Correlation (#5518)

  Show description for c7adfd8
  Samirbous

  authored
  c7adfd8

  Copy full SHA for c7adfd8

Commits on Jan 1, 2026

• Update initial_access_execution_susp_react_serv_child.toml (#5503)

  Show description for f337926
  

  Samirbous

  and

  w0rk3r

  authored
  f337926

  Copy full SHA for f337926

Commits on Dec 21, 2025

• [Rule Tuning] Entra ID OAuth PRT Issuance to Non-Managed Device Detected (#5464)

  Show description for b0d3d7d
  terrancedejesus

  authored
  b0d3d7d

  Copy full SHA for b0d3d7d

• [Rule Tuning] Entra ID User Sign-in with Unusual Registered Device (#5466)

  Show description for 0fd3df6
  terrancedejesus

  authored
  0fd3df6

  Copy full SHA for 0fd3df6

Commits on Dec 19, 2025

• [Rule Tuning] AWS Service Quotas Multi-Region GetServiceQuota Requests (#5468)

  Show description for a14a1fd
  

  imays11

  and

  Mikaayenson

  authored
  a14a1fd

  Copy full SHA for a14a1fd

• [Rule Tuning] AWS SQS Queue Purge (#5457)

  Show description for 284d7d5
  imays11

  authored
  284d7d5

  Copy full SHA for 284d7d5

• [Rule Tunings] AWS Config Rule Tunings (#5456)

  Show description for e8f3178
  imays11

  authored
  e8f3178

  Copy full SHA for e8f3178

• [Rule Tunings] AWS Lambda Rules (#5451)

  Show description for 97b0bd8
  

  imays11

  and

  Mikaayenson

  authored
  97b0bd8

  Copy full SHA for 97b0bd8

• [Rule Tuning] AWS EC2 EBS Snapshot Access Removed (#5499)

  Show description for 12d257e
  imays11

  authored
  12d257e

  Copy full SHA for 12d257e

• [Bug] Importing rules from directory uses wrong type (#5428)

  Show description for dd707b3
  eric-forte-elastic

  authored
  dd707b3

  Copy full SHA for dd707b3

• [Rule Tuning] Multiple Alerts Involving a User (#5498)

  Show description for b956a43
  w0rk3r

  authored
  b956a43

  Copy full SHA for b956a43

• [Rule Tuning] Potential Network Scan Detected (#5495)

  Show description for 1d64bf0
  w0rk3r

  authored
  1d64bf0

  Copy full SHA for 1d64bf0

• [Rule Tuning] Shared Object Created or Changed by Previously Unknown … (#5469)

  Show description for 5bc834b
  

  Aegrah

  and

  Samirbous

  authored
  5bc834b

  Copy full SHA for 5bc834b

• [New] React2Shell Network Security Alert (#5445)

  Show description for 30883ab
  

  Samirbous

  and

  Mikaayenson

  authored
  30883ab

  Copy full SHA for 30883ab

• [New] Suricata and Elastic Defend Network Correlation (#5443)

  Show description for 95cf506
  

  3 peopleauthored
  95cf506

  Copy full SHA for 95cf506

• [Rule Tuning] Entra ID User Sign-in with Unusual Client (#5473)

  Show description for 4c9317b
  

  3 peopleauthored
  4c9317b

  Copy full SHA for 4c9317b

• [Rule Tuning] Entra ID OAuth user_impersonation Scope for Unusual User and Client (#5462)

  Show description for 1bd7dea
  terrancedejesus

  authored
  1bd7dea

  Copy full SHA for 1bd7dea

Commits on Dec 18, 2025

• [Rule Tuning] AWS EventBridge Rule Disabled or Deleted (#5458)

  Show description for bc6ad03
  imays11

  authored
  bc6ad03

  Copy full SHA for bc6ad03

• [Rule Tuning] AWS CLI with Kali Linux Fingerprint Identified (#5467)

  Show description for ed42a9e
  imays11

  authored
  ed42a9e

  Copy full SHA for ed42a9e

• [Rule Tunings] AWS Route53 Rules (#5448)

  Show description for c35a580
  imays11

  authored
  c35a580

  Copy full SHA for c35a580

• [New] Alerts From Multiple Integrations by Entity (#5460)

  Show description for a1e40de
  

  3 peopleauthored
  a1e40de

  Copy full SHA for a1e40de

• [Rule Tunings] AWS New Terms History Window Reduction (#5479)

  Show description for 25545b5
  imays11

  authored
  25545b5

  Copy full SHA for 25545b5

• [Rule Tunings] AWS WAF Rules (#5429)

  Show description for d1f9ebb
  imays11

  authored
  d1f9ebb

  Copy full SHA for d1f9ebb

• [Tuning] Top Noisy Windows BBR (#5480)

  Show description for f9ba8a8
  

  Samirbous

  and

  w0rk3r

  authored
  f9ba8a8

  Copy full SHA for f9ba8a8

• [Tuning] Diverse Rules Tuning (#5482)

  Show description for b996a29
  

  3 peopleauthored
  b996a29

  Copy full SHA for b996a29

• [New Rule] GitHub Actions Bot Pushed to Repository for First Time (#5438)

  Show description for 57f18a1
  

  terrancedejesus

  and

  Aegrah

  authored
  57f18a1

  Copy full SHA for 57f18a1

• [Docs] Fix Docs Unit Test (#5496)

  Show description for 1119c3f
  w0rk3r

  authored
  1119c3f

  Copy full SHA for 1119c3f

• [Rule Tuning] PowerShell Rules - Misc Tuning/Severity Bumps (#5486)

  Show description for a9bdfaa
  w0rk3r

  authored
  a9bdfaa

  Copy full SHA for a9bdfaa

• [Rule Tuning] Communication App Rules (#5487)

  Show description for 5ec8e3e
  

  w0rk3r

  and

  Samirbous

  authored
  5ec8e3e

  Copy full SHA for 5ec8e3e

Commits on Dec 17, 2025

• [New Rule] GitHub Actions Workflow Injection Blocked (#5433)

  Show description for f43bf99
  

  3 peopleauthored
  f43bf99

  Copy full SHA for f43bf99

Commits on Dec 15, 2025

• [Tuning] Elastic Defend and Email Alerts Correlation (#5459)

  Show description for 6ac69db
  Samirbous

  authored
  6ac69db

  Copy full SHA for 6ac69db

• [New/Tuning] Linux Tunneling Rules (#5452)

  Aegrah

  authored
  a16307e

  Copy full SHA for a16307e

• [Rule Tuning] Security File Access via Common Utilities (#5453)

  Show description for 294e829
  

  Aegrah

  and

  Samirbous

  authored
  294e829

  Copy full SHA for 294e829

Pagination

Previous

Next