elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Terrance DeJesus 3e417410ed [Rule Tuning] Entra ID User Sign-in with Unusual Client (#5473 )

* [Rule Tuning] Entra ID User Sign-in with Unusual Client
Fixes #5472

* linting

* Update rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* removed duplicate client ID

* fixed investigation guide

* Update rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit 4c9317b9cc)

2025-12-19 01:07:58 +00:00

aws

[Rule Tuning] AWS EventBridge Rule Disabled or Deleted (#5458 )

2025-12-18 21:59:54 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 02:11:34 +00:00

azure

[Rule Tuning] Entra ID User Sign-in with Unusual Client (#5473 )

2025-12-19 01:07:58 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )