Eric Forte 27e0333d62 Field not supported in integration (#6131) ...

(cherry picked from commit d03b8d28b0)

2026-05-13 12:22:01 +00:00

..

defense_evasion_github_protected_branch_settings_changed.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

defense_evasion_secret_scanning_disabled.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

execution_github_app_deleted.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

execution_github_high_number_of_cloned_repos_from_pat.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

execution_github_ueba_multiple_behavior_alerts_from_account.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

execution_new_github_app_installed.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

exfiltration_github_private_repository_turned_public.toml

Field not supported in integration (#6131)

2026-05-13 12:22:01 +00:00

exfiltration_high_number_of_cloning_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

impact_github_repository_activity_from_unusual_ip.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

impact_github_repository_deleted.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

impact_high_number_of_closed_pull_requests_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

impact_high_number_of_protected_branch_force_pushes_by_user.toml

8.19 manual commit/push. Ref: https://github.com/elastic/detection-rules/issues/5940

2026-04-10 12:56:10 -04:00

initial_access_github_actions_bot_first_push_to_repo.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

initial_access_github_actions_workflow_injection_blocked.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

initial_access_github_register_self_hosted_runner.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

persistence_github_org_owner_added.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

persistence_new_pat_created.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

persistence_organization_owner_role_granted.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00