elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Terrance DeJesus f09b006cf7 [New Rule] Okta Multiple OS Names Detected for a Single DT Hash (#5241 )

* [New Rule] Okta Multiple OS Names Detected for a Single DT Hash
Fixes #5240

* updated query logic

* Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

* fixed verbiage

* updated query logic

* Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* added investigation guide tag

* Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* added license field

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit 22a94c6e0b)

2025-11-24 19:28:29 +00:00

aws

[Rule Tunings] AWS IAM Roles Anywhere Rules (#5307 )

2025-11-24 16:11:26 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 02:09:11 +00:00

azure

[New Rule] Azure Compute Snapshot Deletion(s) (#5211 )

2025-11-15 13:37:38 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )