admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,732 Commits 407 Branches 706 Tags
9.2
Commit Graph

3 Commits

Author SHA1 Message Date
Terrance DeJesus 906c43891c [Rule Tuning] Change event.dataset to data_stream.dataset (#5943) 
* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names

Removed changes from:
- rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml
- rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml
- rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml
- rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml
- rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml
- rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml

(selectively cherry picked from commit deab1c0161)
 2026-04-10 16:31:06 +00:00
shashank-elastic 49e6970d22 Prep for Release 9.3 (#5548) 
Removed changes from:
- detection_rules/etc/packages.yaml

(selectively cherry picked from commit 1ce072a4e5)
 2026-01-12 15:40:35 +00:00
Ruben Groenewoud ca9415d7c5 [New Rule] Potential Password Spraying Attack via SSH (#5515) 
* [New Rule] Potential Password Spraying Attack via SSH

* ++

* Update rules/linux/credential_access_potential_password_spraying_attack.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update credential_access_potential_password_spraying_attack.toml

* Update credential_access_potential_password_spraying_attack.toml

* Change time bucket duration from 1 to 5 minutes

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit ee936cb154)
 2026-01-08 12:47:53 +00:00