elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Isai c090cca2f7 [Rule Tuning] AWS RDS DB Snapshot Shared with Another Account (#5418 )

This rule is performing well in telemetry and producing alerts as expected for both explicit external account sharing and making snapshots public. Both scenarios tested.
- updated description, FP and IG
- added highlighted fields
- added `event.type` as `event_category_override` field because `event.category` is not populated for these events.

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit 8c5231ec4e)

2025-12-08 16:15:52 +00:00

aws

[Rule Tuning] AWS RDS DB Snapshot Shared with Another Account (#5418 )

2025-12-08 16:15:52 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 02:11:34 +00:00

azure

[New] Suspicious Microsoft Entra ID Concurrent Sign-Ins via DeviceCode (#5396 )

2025-12-03 19:37:14 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )