Search results

[Bug] ESQL validation keep Clause Reported Missing Metadata Fields

bugSomething isn't workingSomething isn't working

Team: TRADE

Status: Open.

Bug

#5715 In elastic/detection-rules;

· eric-forte-elastic opened on Feb 10, 2026

[FR] D4C Rules are Erroneously Added to deprecated_rules.json

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

Enhancement

#5714 In elastic/detection-rules;

· eric-forte-elastic opened on Feb 10, 2026

[Rule Tuning] Suspicious Windows Powershell Arguments - Tenable/Nessus agent

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5713 In elastic/detection-rules;

· richlv opened on Feb 10, 2026

[Rule Tuning] Sensitive Audit Policy Sub-Category Disabled

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5703 In elastic/detection-rules;

· CherrabiNesrine opened on Feb 9, 2026

[Rule Tuning] Entra ID Federated Identity Credential Persistence Detection

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: NewProposal for new ruleProposal for new rule

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5701 In elastic/detection-rules;

· terrancedejesus opened on Feb 9, 2026

[Rule Tuning] Command and Scripting Interpreter via Windows Scripts (2d62889e-e758-4c5e-b57e-c735914ee32a)

genai-tradecraft

Status: Open.

#5695 In elastic/detection-rules;

· tradebot-elastic opened on Feb 8, 2026

[Rule Tuning] Entra ID Suspicious Cloud Device Registration

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5682 In elastic/detection-rules;

· terrancedejesus opened on Feb 5, 2026

[Rule Tuning] Transform Dormant SharePoint Rule to Detect OAuth Phishing

Domain: Cloud

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5680 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] Deprecate Individual MSFT Defender Rules / Create BBR MSFT Defender Rule

Domain: Identity

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5678 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported

Domain: Identity

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5676 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] Okta User Assigned Administrator Role

Domain: Identity

Integration: Oktaokta related rulesokta related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5670 In elastic/detection-rules;

· terrancedejesus opened on Feb 3, 2026

[New Rule] Okta Admin Console Login Failure

Domain: Identity

Integration: Oktaokta related rulesokta related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#5668 In elastic/detection-rules;

· terrancedejesus opened on Feb 3, 2026