admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,714 Commits 407 Branches 706 Tags
8.19
Commit Graph

36 Commits

Author SHA1 Message Date
github-actions[bot] e250829c64 Lock versions for releases: 8.19,9.2,9.3,9.4 (#6225) 
(cherry picked from commit e6622325ad)
 2026-06-01 18:16:19 +00:00
github-actions[bot] 7ddc16922a Lock versions for releases: 8.19,9.2,9.3,9.4 (#6163) 
(cherry picked from commit 8f28676d62)
 2026-05-18 14:26:55 +00:00
github-actions[bot] 9d773652e1 Lock versions for releases: 8.19,9.2,9.3,9.4 (#6044) 
(cherry picked from commit 0b15511ef5)
 2026-05-04 16:01:04 +00:00
Mika Ayenson, PhD 524bb0b8f3 [FR] Add enforcement for deprecated_reason (#5953) 
(cherry picked from commit b6886f310c)
 2026-04-23 11:47:18 +00:00
github-actions[bot] f8a08a45e5 Lock versions for releases: 8.19,9.2,9.3,9.4 (#5972) 
* Locked versions for releases: 8.19,9.2,9.3,9.4

---------

Co-authored-by: shashank-elastic <shashank-elastic@users.noreply.github.com>

(cherry picked from commit 2dac152094)
 2026-04-23 00:16:50 +00:00
shashank-elastic 3865814c93 Prep for Release 9.4 (#5965) 
Removed changes from:
- detection_rules/etc/packages.yaml
- rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml
- rules/windows/defense_evasion_masquerading_as_svchost.toml
- rules/windows/execution_windows_script_from_internet.toml

(selectively cherry picked from commit 7a54f8be99)
 2026-04-22 18:44:44 +00:00
github-actions[bot] d42b784cd4 Lock versions for releases: 8.19,9.1,9.2,9.3 (#5926) 
(cherry picked from commit 88bc42265f)
 2026-04-07 12:16:29 +00:00
github-actions[bot] ed407be48d Lock versions for releases: 8.19,9.1,9.2,9.3 (#5888) 
* Locked versions for releases: 8.19,9.1,9.2,9.3

* Update pyproject.toml

---------

Co-authored-by: Mikaayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit d9890db6ff)
 2026-03-26 17:33:22 +00:00
Eric Forte 98f536d58b [FR] [DaC] Add fine-grained bypass env var for ES|QL keep and metadata validation (#5869) 
* Add fine grain 'keep' req bypass

* Add metadata bypass

(cherry picked from commit 75ffa5ec4e)
 2026-03-24 18:38:18 +00:00
github-actions[bot] 0fdb87749f Lock versions for releases: 8.19,9.1,9.2,9.3 (#5875) 
(cherry picked from commit b14dec9efa)
 2026-03-23 18:16:59 +00:00
github-actions[bot] a9e4da6586 Lock versions for releases: 8.19,9.1,9.2,9.3 (#5818) 
(cherry picked from commit 87badac5a0)
 2026-03-10 10:04:59 +00:00
github-actions[bot] 66fc95dc64 Lock versions for releases: 8.19,9.1,9.2,9.3 (#5708) 
(cherry picked from commit df9c27d82e)
 2026-02-10 05:45:46 +00:00
github-actions[bot] 7138225e30 Lock versions for releases: 8.19,9.1,9.2,9.3 (#5639) 
(cherry picked from commit 8b8c0beec7)
 2026-01-28 13:09:16 +00:00
github-actions[bot] 9811190eb9 Lock versions for releases: 8.19,9.1,9.2,9.3 (#5553) 
(cherry picked from commit e5291f455c)
 2026-01-12 18:23:38 +00:00
shashank-elastic 349d228ef0 Prep for Release 9.3 (#5548) 
Removed changes from:
- detection_rules/etc/packages.yaml
- rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml
- rules/windows/execution_windows_script_from_internet.toml

(selectively cherry picked from commit 1ce072a4e5)
 2026-01-12 15:38:59 +00:00
github-actions[bot] 89e499a67b Lock versions for releases: 8.19,9.0,9.1,9.2 (#5426) 
(cherry picked from commit 793ecfe34a)
 2025-12-08 19:00:52 +00:00
github-actions[bot] d21c21a566 Lock versions for releases: 8.19,9.0,9.1,9.2 (#5360) 
(cherry picked from commit 18d249aae6)
 2025-11-24 20:58:36 +00:00
github-actions[bot] 2bbfbbb4e3 Lock versions for releases: 8.19,9.0,9.1,9.2 (#5300) 
(cherry picked from commit 32fb003781)
 2025-11-11 13:29:33 +00:00
github-actions[bot] 8032a34e81 Lock versions for releases: 8.19,9.0,9.1,9.2 (#5234) 
(cherry picked from commit b9b8e24514)
 2025-10-17 16:41:51 +00:00
github-actions[bot] 4d14b1a7dd Lock versions for releases: 8.18,8.19,9.0,9.1 (#5188) 
(cherry picked from commit 49637fbfc7)
 2025-10-06 16:46:29 +00:00
github-actions[bot] 077688d082 Lock versions for releases: 8.18,8.19,9.0,9.1 (#5123) 
(cherry picked from commit 8f79d58f3f)
 2025-09-16 14:29:35 +00:00
github-actions[bot] 0a1af01152 Lock versions for releases: 8.18,8.19,9.0,9.1 (#5049) 
(cherry picked from commit f2291e0261)
 2025-09-01 17:51:17 +00:00
github-actions[bot] 4336bc7d85 Lock versions for releases: 8.18,8.19,9.0,9.1 (#4991) 
(cherry picked from commit fb76ec1b2d)
 2025-08-18 17:09:04 +00:00
github-actions[bot] c98a2413c1 Lock versions for releases: 8.18,8.19,9.0,9.1 (#4922) 
(cherry picked from commit b3c681e475)
 2025-07-22 07:22:34 +00:00
github-actions[bot] 7b7679e4bb Lock versions for releases: 8.14,8.15,8.16,8.17,8.18,9.0 (#4820) 
(cherry picked from commit fcad19fa18)
 2025-06-18 12:45:00 +00:00
github-actions[bot] 42acd83068 Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md (#4756) 
(cherry picked from commit 8a829d1503)
 2025-06-02 15:18:22 +00:00
github-actions[bot] 77c713a0ea Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md (#4731) 
(cherry picked from commit 5832aec32b)
 2025-05-20 02:18:56 +00:00
github-actions[bot] 1e419fc7ae Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md (#4702) 
(cherry picked from commit 69498a97ac)
 2025-05-06 17:47:44 +00:00
shashank-elastic 8f880c00a8 Deprecate Experimental ML command (#4669) 
(cherry picked from commit b3adc6d3ea)
 2025-05-02 15:36:09 +00:00
github-actions[bot] 48e9b20967 Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md (#4649) 
(cherry picked from commit 70062c3991)
 2025-04-24 01:46:57 +00:00
Frederik Berg 9c831fb217 Feature exclude tactic name (#4593) 
* Added new cli flag to exclude tactic name in rule file name

* added a shortcut for the flag and adjusted CLI readme

* Add no tactic flag also to import to prevent warnings

* Added info about unit test

* version bump

* Added no_tactic_filename as config option + fixed linting

* pyproject version bump

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>

(cherry picked from commit 9b682b752c)
 2025-04-16 20:06:57 +00:00
github-actions[bot] 9f0f5091ec Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md (#4571) 
(cherry picked from commit 51826ed32f)
 2025-03-27 04:16:39 +00:00
Eric Forte bb14889560 [Bug] Update Custom Rules Markdown Location (#4565) 
* Update to custom-rules markdown location

* bump version

* Update link reference

(cherry picked from commit 2d2c5b4d88)
 2025-03-26 14:06:22 +00:00
github-actions[bot] 02be7cac0a Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md (#4530) 2025-03-12 12:49:43 +05:30
Eric Forte eadcd9d3e0 [FR] Add Env Var DR_CLI_MAX_WIDTH and DaC Docs Updates (#4518) 
* Add Env Var DR_CLI_MAX_WIDTH

* Version Bump

* Update limit from 120 to 240

* Clean references to reference main

* Update Readme with DaC Info

* Add DaC to Table of Contents

* Bump Patch Version

* Updated naming and add dac md

* Organize Imports

* Deprecate upload-rule

* Update docs/detections-as-code.md

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* move docs to docs-dev

* Sort custom rules imports

* Remove duplicate

* Fix typo

* Bump Patch Version

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
 2025-03-10 12:59:12 -04:00
Sergey Polzunov 3bdda091e1 chore: use docs-dev instead of docs dir for docs (#4522) 
* chore: use `docs-dev` instead of `docs` folder

* patch version bump

* Rollback an incorrect rename

* Use exact docs dir in the helper comment

* Revert some overeager renamings

* Moving `docs` to `docs-dev`

* Update Docs Paths

---------

Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
 2025-03-07 14:34:51 +01:00