90191e635d
[FR] [DAC] Add Exception Duplication Checking ( #5689 )
...
* Add Exception Duplication Checking
(cherry picked from commit f7387bb10d
2026-04-29 12:59:25 +00:00
08fd199f62
Lock versions for releases: 8.19,9.2,9.3,9.4 ( #5998 )
...
(cherry picked from commit cb3c342b31
2026-04-28 19:24:32 +00:00
8623934ee8
Fix value lists within exception lists ( #5963 )
...
* Fix value lists within exception lists
(cherry picked from commit 0f521a0848
2026-04-24 16:25:35 +00:00
bf11e3154b
[FR] Add enforcement for deprecated_reason ( #5953 )
...
(cherry picked from commit b6886f310c
2026-04-23 11:48:12 +00:00
d4ccf49ccd
Lock versions for releases: 8.19,9.2,9.3,9.4 ( #5972 )
...
* Locked versions for releases: 8.19,9.2,9.3,9.4
---------
Co-authored-by: shashank-elastic <shashank-elastic@users.noreply.github.com >
(cherry picked from commit 2dac152094
2026-04-23 00:17:39 +00:00
b554a0eb4f
ESQL validation support fix ( #5970 )
...
(cherry picked from commit 2029654e79
2026-04-22 20:54:57 +00:00
f349e4bfb6
Prep for Release 9.4 ( #5965 )
...
Removed changes from:
- detection_rules/etc/packages.yaml
(selectively cherry picked from commit 7a54f8be99
2026-04-22 18:45:36 +00:00
400cdd5e78
[Bug ]Fix Kibana version parsing for package version ( #5962 )
...
* [Bug ]Fix kibana version parsing for package version
---------
Co-authored-by: Shashank K S <Shashank.Suryanarayana@elastic.co >
(cherry picked from commit 876e4ed535
2026-04-22 15:28:19 +00:00
6f4691b284
Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0 ( #5909 )
...
Co-authored-by: Shashank K S <Shashank.Suryanarayana@elastic.co >
Removed changes from:
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml
- rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml
- rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml
- rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml
- rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml
- rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml
- rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml
- rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml
- rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml
- rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml
- rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml
- rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml
- rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml
- rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
- rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml
- rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml
- rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml
- rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml
- rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml
(selectively cherry picked from commit d8a39869c5
2026-04-22 12:09:49 +00:00
8ad4c1913e
[FR] [DAC] Initial Yaml Support ( #5821 )
...
* Initial Yaml Support
(cherry picked from commit 9736407ef3
2026-04-10 15:32:10 +00:00
2365bbb69c
[Bug] Small bugfix to address update navigator edge case ( #5942 )
...
* [Bug] Small bugfix to address update navigator edge case
(cherry picked from commit 984be4a1ac
2026-04-10 12:57:07 +00:00
d8fa320059
[FR] Load ECS mapping based on supplied stack version ( #5925 )
...
* Load ECS mapping based on supplied stack version
(cherry picked from commit 1503976d10
2026-04-09 16:43:24 +00:00
390f1a7e9e
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5930 )
...
(cherry picked from commit c601edfbb3
2026-04-08 14:17:24 +00:00
682c460048
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5926 )
...
(cherry picked from commit 88bc42265f
2026-04-07 12:18:04 +00:00
aef0567ee5
[Rule Tuning] Entra ID Illicit Consent Grant via Registered Application - Fix New Terms Field ( #5894 )
...
* [Rule Tuning] Entra ID Illicit Consent Grant via Registered Application - Fix New Terms Field
Fixes #5893
* adding non-admin consented filter
* converting to ESQL
* additional query adjustments
* adjusted query KEEP
* updating non-ecs
* Apply suggestion from @terrancedejesus
(cherry picked from commit 48128c1c66
2026-04-06 13:43:16 +00:00
e10aced1a1
Monthly Manifest and Schema Updation ( #5920 )
...
Removed changes from:
- rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml
(selectively cherry picked from commit 199a4d6160
2026-04-06 12:08:32 +00:00
42650a0973
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5888 )
...
* Locked versions for releases: 8.19,9.1,9.2,9.3
* Update pyproject.toml
---------
Co-authored-by: Mikaayenson <Mikaayenson@users.noreply.github.com >
(cherry picked from commit d9890db6ff
2026-03-26 17:34:51 +00:00
33d684f2e5
[New Rule] M365 Azure Monitor Alert Email with Financial or Billing Theme ( #5878 )
...
* [New Rule] M365 Azure Monitor Alert Email with Financial or Billing Theme
Fixes #5877
* adding microsoft_exchange_online_message_trace to manifests/schemas; bumping patch
* updated mitre
* Update rules/integrations/microsoft_exchange_online_message_trace/initial_access_azure_monitor_callback_phishing_email.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* bumping patch
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
(cherry picked from commit cd19b25485
2026-03-26 15:53:34 +00:00
50877dfcb0
[FR] [DaC] Add fine-grained bypass env var for ES|QL keep and metadata validation ( #5869 )
...
* Add fine grain 'keep' req bypass
* Add metadata bypass
(cherry picked from commit 75ffa5ec4e
2026-03-24 18:39:59 +00:00
994bce1040
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5875 )
...
(cherry picked from commit b14dec9efa
2026-03-23 18:18:36 +00:00
a01a461794
[New Rules] External Promotion Alert for IBM QRadar ( #5843 )
...
(cherry picked from commit ade7de7be4
2026-03-20 19:45:47 +00:00
06ea3edbc2
[FR] Includes deprecated rule stubs to the package for upstream testing ( #5813 )
...
* adds scripting to include deprecated rule stubs in package
* remove deprecated manifest from package
* adds 9.4 gate
* bump version
* fix merge conflict
* test
* revert commit hash
* adds deprecated_reason logic from comment
* fix lint error
* fix lint error
* fix formatting
* test
* revert commit hash
* Update detection_rules/packaging.py
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
(cherry picked from commit cb5b89f83e
2026-03-18 19:40:34 +00:00
2da74eca1f
[Rule Tuning] Added Traefik Compatibility to Web Server Access Rules ( #5837 )
...
* [Rule Tuning] Added Traefik Compatibility to Web Server Access Rules
* ++
* Bump pyproject.toml
* Bump pyproject.toml
(cherry picked from commit 8b140d5811
2026-03-17 16:33:22 +00:00
db2a92db5d
[New Rule] Azure Arc Kubernetes Cluster Connect Abuse ( #5824 )
...
* [New Rule] Azure Arc Kubernetes Cluster Connect Abuse
Fixes #5823
* rename, adjusted query
* adding KEEP *
* adjusting maturity
* added to non-ecs schema
* updating rule
* addressing unit test failures
* adjustments to logic, mitre mappings, unit test failures, etc.
* Update rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
(cherry picked from commit 937a7a35e6
2026-03-17 15:10:35 +00:00
9d9609286e
[FR] Reset deprecated lock to the latest state during lock ( #5827 )
...
(cherry picked from commit 49c9c283e6
2026-03-16 22:08:49 +00:00
9dfc1fdfed
[Bug] [DAC] Add filtering to export-rules-from-repo ( #5769 )
...
* Add filtering to export-rules-from-repo
(cherry picked from commit 57bf1546dd
2026-03-10 17:11:17 +00:00
c68a5f2c2c
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5820 )
...
(cherry picked from commit 61211a2670
2026-03-10 13:23:04 +00:00
99cf2ccfaf
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5818 )
...
(cherry picked from commit 87badac5a0
2026-03-10 10:06:21 +00:00
99f32f13b2
[Bug] Ignore Other Keep Wildcards ( #5792 )
...
* Ignore other Keep Wildcards
* Added a unit test for multiple keeps
* Add keep star unit tests
(cherry picked from commit 26d37dd62e
2026-03-09 23:36:50 +00:00
93e03ab8ee
Monthly Manifest and Schema Updation ( #5816 )
...
* Monthly Manifest and Schema Updation
* Update Patch Version
(cherry picked from commit e08f234b1c
2026-03-09 13:18:07 +00:00
4b09ca83e1
[New Rule] Microsoft 365 SharePoint/OneDrive Sensitive Search and File Access ( #5777 )
...
* [New Rule] Microsoft 365 SharePoint/OneDrive Sensitive Search and File Access
Fixes #5776
* adjusting UUIDs
* added additional strings
* adjusted investigation guide
* fixed mitre mappings
* fixed mitre mappings
* Apply suggestion from @terrancedejesus
(cherry picked from commit 5ecbc0f0b9
2026-02-26 19:32:16 +00:00
a21246f086
[New Rule] M365 MFA Notification Email Deleted or Moved ( #5779 )
...
* [New Rule] M365 MFA Notification Email Deleted or Moved
Fixes #5778
* updated non-ecs
* adjusted rule name
* Apply suggestion from @terrancedejesus
(cherry picked from commit 71c461d867
2026-02-26 18:24:17 +00:00
8f5a0a829a
[New Rule] Okta User Authentication via Proxy Followed by Security Alert ( #5752 )
...
* [New Rule] Okta User Authentication via Proxy Followed by Security Alert
Fixes #5751
* adjusted to EQL
* fixed syntax
* Update rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* removed defense evasion; adjusted maxspan to 30m
* removed Okta tag
* adding Okta back as integration tag
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
(cherry picked from commit 8593116f58
2026-02-26 16:35:28 +00:00
a6eca1b83b
[Rule Tuning] M365 OneDrive/SharePoint Excessive File Downloads ( #5767 )
...
* [Rule Tuning] M365 OneDrive/SharePoint Excessive File Downloads
Fixes #5766
* updated non-ecs
* fixing keep command
(cherry picked from commit 04ad018f27
2026-02-26 15:42:16 +00:00
48641bdf30
[Bug] Adding Deprecated Rules to Rules Package Breaks Current Package Build ( #5773 )
...
* applying patch fix for historical rules and deprecated JSON object
---------
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co >
(cherry picked from commit 201660af36
2026-02-24 18:58:26 +00:00
3710f6adf4
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5765 )
...
(cherry picked from commit 92a379e034
2026-02-24 13:22:51 +00:00
b808532bc3
[Bug] ES|QL Validation Add Reverse Lookup Check Against Kibana Value ( #5747 )
...
* Add reverse lookup check against Kibana value
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
(cherry picked from commit 5adc118f92
2026-02-20 20:32:41 +00:00
a6627e42d9
[FR] Add deprecated file to release for upstream testing ( #5749 )
...
(cherry picked from commit a1c3267529
2026-02-20 20:19:45 +00:00
098e9cdcee
[Rule Tuning] Entra ID Federated Identity Credential Persistence Detection ( #5702 )
...
* [Rule Tuning] Entra ID Federated Identity Credential Persistence Detection
Fixes #5701
* updated mitre mapping ID
* adjusted mitre mappings; non-ecs schema file
* fixed trailing comma in non-ecs; adjusted file name
* adjusted file name; fixed non-ecs schema for upstream ESQL validation
* Apply suggestion from @terrancedejesus
* Apply suggestion from @terrancedejesus
* changed lookback to 9 minutes; adjusted keep values
* added setup; added tag
(cherry picked from commit f773103519
2026-02-19 21:01:27 +00:00
857b804275
[Rule Tuning] Entra ID SharePoint Accessed by Unusual User and Microsoft Authentication Broker Client ( #5681 )
...
* [Rule Tuning] Transform Dormant SharePoint Rule to Detect OAuth Phishing
Fixes #5680
* adjusted query format for unit test; added additional domain tag for storage
* Apply suggestion from @terrancedejesus
* Fix formatting in non-ecs-schema.json
* adjusted description
* re-order mappings
(cherry picked from commit 63f76cf004
2026-02-19 15:12:48 +00:00
c32c80bc86
[Rule Tuning] Okta User Assigned Administrator Role ( #5671 )
...
Fixes #5670
(cherry picked from commit 62cc9f105d
2026-02-12 14:36:43 +00:00
2be9b0698e
[Bug] CLI adds frequency field to system actions (.cases), causing import failure ( #5690 )
...
* No frequency field to cases
(cherry picked from commit f306404fe5
2026-02-11 20:21:48 +00:00
e20e993c2f
[Bug] ESQL validation keep Clause Reported Missing Metadata Fields ( #5717 )
...
* Update Keep Field to Handle Comments
* Update for handling inline comments
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit f74c04d11a
2026-02-11 20:05:36 +00:00
3d524f96e5
Lock versions for releases: 8.19,9.1,9.2,9.3 ( #5708 )
...
(cherry picked from commit df9c27d82e
2026-02-10 05:47:31 +00:00
b3929c6656
Monthly Manifest and Schema Updation ( #5697 )
...
Removed changes from:
- rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml
- rules/integrations/cloud_defend/execution_kubeletctl_execution.toml
- rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml
(selectively cherry picked from commit 70d7f2b6b1
2026-02-10 03:50:26 +00:00
27c83c7fe7
[New Rules] Misc. K8s RBAC Abuse Rules ( #5673 )
...
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword
* [New Rules] Misc. K8s RBAC Abuse Rules
* --
* Update non-ecs-schema
* Update to make unit tests happy
* Mitre mapping updates
* Fix query logic for service account role bindings
* Fix formatting in persistence_service_account_bound_to_clusterrole rule
(cherry picked from commit 64a08cd6af
2026-02-05 16:45:12 +00:00
a01ba32e63
[Bug] Fix UTF-8 Encoding for Rule File Operations ( #5684 )
...
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword
* [Bug] Fix UTF-8 Encoding for Rule File Operations
(cherry picked from commit 694376bd7a
2026-02-05 13:24:36 +00:00
6cf5040f37
[New] Multiple Machine Learning Alerts by Influencer Field ( #5660 )
...
* [New] Multiple Machine Learning Alerts by Influencer Field
This rule uses alerts data to determine when multiple different machine learning alerts involving the same influencer field are triggered. Analysts can use this to prioritize triage and response, as these entities are more likely to be more suspicious.
* Update multiple_machine_learning_jobs_by_entity.toml
* Update multiple_machine_learning_jobs_by_entity.toml
* Update non-ecs-schema.json
* Update multiple_machine_learning_jobs_by_entity.toml
* Update non-ecs-schema.json
(cherry picked from commit 362c459094
2026-02-04 12:29:14 +00:00
1ae23033ba
[doc fix] Adjust wording in the docs for Kibana import/export commands ( #5600 )
...
* Wording fix
* Version bump
* Style fixes
* Style fix for tests
(cherry picked from commit 59e394f36b
2026-02-04 10:21:05 +00:00
0ac91c3001
[Rule Tuning] Full Kubernetes Ruleset ( #5659 )
...
* [Rule Tuning] Full Kubernetes Ruleset
* ++
* Update manifests & schemas
* Update pyproject.toml
* Added "kubernetes.audit.userAgent" to non_ecs
* Updated kubernetes.audit.requestObject.spec.containers.image of type text to Keyword
* Apply suggestion from @Aegrah
* Apply suggestion from @Aegrah
* Update privilege_escalation_pod_created_with_hostnetwork.toml
* Apply suggestion from @Aegrah
* Update privilege_escalation_pod_created_with_hostipc.toml
* Apply suggestion from @Mikaayenson
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
* ++
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
(cherry picked from commit c455d3d98a
2026-02-04 09:45:46 +00:00
Eric Forte