elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous 40b3c427e3 [New] AWS EKS Control Plane Logging Disabled (#6100 )

* [New] EKS Control Plane Logging Disabled

Detects successful Amazon EKS UpdateClusterConfig requests that disable control plane logging. Disabling EKS API server and control plane logs can reduce visibility into cluster activity and may indicate defense evasion following compromised AWS credentials or unauthorized administrative access.

* Update defense_evasion_eks_control_plane_logging_disabled.toml

* Update rules/integrations/aws/defense_evasion_eks_control_plane_logging_disabled.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/defense_evasion_eks_control_plane_logging_disabled.toml

* Update defense_evasion_eks_control_plane_logging_disabled.toml

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit 0218d2cddb)

2026-05-18 13:14:27 +00:00

aws

[New] AWS EKS Control Plane Logging Disabled (#6100 )

2026-05-18 13:14:27 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 02:11:34 +00:00

azure

[New] Entra ID Register Device with Unusual User Agent (#6151 )

2026-05-18 10:56:07 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )