elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Susan 6f4691b284 Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0 (#5909 )

Co-authored-by: Shashank K S <Shashank.Suryanarayana@elastic.co>

Removed changes from:
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml
- rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml
- rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml
- rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml
- rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml
- rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml
- rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml
- rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml
- rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml
- rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml
- rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml
- rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml
- rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml
- rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml
- rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml
- rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml
- rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml
- rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml
- rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
- rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml
- rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml
- rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml
- rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml
- rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

(selectively cherry picked from commit d8a39869c5)

2026-04-22 12:09:49 +00:00

api_schemas

Prep for Release 9.3 (#5548 )

2026-01-12 15:40:35 +00:00

beats_schemas

Monthly Manifest and Schema Updation (#5920 )

2026-04-06 12:08:32 +00:00

ecs_schemas

Monthly Manifest and Schema Updation (#5920 )

2026-04-06 12:08:32 +00:00

endgame_schemas

Updated ECS mappings from keyword to wildcard (#2518 )