mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous 4fed99a667 [New] Suspicious FortiGate and Fortinet Logon rules (#5640 )

* [New] Suspicious FortiGate Admin Logon rules

- First-Time FortiGate Administrator Login
- FortiGate Administrator Login from Multiple IP Addresses

* Update initial_access_fortigate_admin_login_multi_srcip.toml

* ++

* ++

* Create initial_access_newly_observed_frotinet_logon.toml

* Update initial_access_newly_observed_frotinet_logon.toml

* build schema and manifest for fortinet

* Update pyproject.toml

* Update initial_access_newly_observed_frotinet_logon.toml

* Revert "Update initial_access_newly_observed_frotinet_logon.toml"

This reverts commit 7b99828b9a.

* Revert "Update pyproject.toml"

This reverts commit 025daf566f.

* Revert "build schema and manifest for fortinet"

This reverts commit a6234164f8.

* ++

(cherry picked from commit a2c1dd8575)

2026-01-28 18:00:25 +00:00

_deprecated

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561 )

2026-01-26 15:41:09 +00:00

apm

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

cross-platform

[New] Newly Observed Process Exhibiting CPU Spike (#5635 )

2026-01-28 17:41:33 +00:00

integrations

chore: Fix lock version for 9.3.2 Release (#5634 )

2026-01-28 03:41:37 +00:00

linux

[Tuning] ESQL Dynamic unique value fields (#5569 )

2026-01-26 16:37:21 +00:00

macos

Update command_and_control_unusual_network_connection_to_suspicious_web_service.toml (#5008 )

2025-08-26 13:03:59 +01:00

add mitre attack rules for ML job rules, bump dates (#5333 )

2025-12-01 21:52:51 +00:00

network

[New] Suspicious FortiGate and Fortinet Logon rules (#5640 )

2026-01-28 18:00:25 +00:00

promotions

[New] Multiple Vulnerabilities by Asset via Wiz (#5598 )

2026-01-26 17:29:29 +00:00

threat_intel

[Rule Tuning] Reduce Severity from Critical to High (#4637 )

2025-05-06 21:37:47 +05:30

windows

[Rule Tuning] PowerShell Rules Revamp - 2 (#5623 )

2026-01-26 22:38:14 +00:00

README.md

[New Rule] Endpoint Security Behavior Protection (#1440 )

2021-08-25 09:56:59 -06:00

README.md

rules/

Rules within this folder are organized by solution or platform. The structure is flattened out, because nested file hierarchies are hard to navigate and find what you're looking for. Each directory contains several .toml files, and the primary ATT&CK tactic is included in the file name when it's relevant (i.e. windows/execution_via_compiled_html_file.toml)

folder	description
`.`	Root directory where rules are stored
`apm/`	Rules that use Application Performance Monitoring (APM) data sources
`cross-platform/`	Rules that apply to multiple platforms, such as Windows and Linux
`integrations/`	Rules organized by Fleet integration
`linux/`	Rules for Linux or other Unix based operating systems
`macos/`	Rules for macOS
`ml/`	Rules that use machine learning jobs (ML)
`network/`	Rules that use network data sources
`promotions/`	Rules that promote external alerts into detection engine alerts
`windows/`	Rules for the Microsoft Windows Operating System

Integration specific rules are stored in the integrations/ directory:

folder	integration
`aws/`	Amazon Web Services (AWS)
`azure/`	Microsoft Azure
`cyberarkpas/`	Cyber Ark Privileged Access Security
`endpoint/`	Elastic Endpoint Security
`gcp/`	Google Cloud Platform (GCP)
`google_workspace/`	Google Workspace (formerly GSuite)
`o365/`	Microsoft Office
`okta/`	Oka