Search results

[New Rule] M365 Azure Monitor Alert Email with Financial or Billing Theme

Domain: Email

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#5877 In elastic/detection-rules;

· terrancedejesus opened on Mar 24, 2026

[Rule Tuning] M365 SharePoint/OneDrive File Access via PowerShell - Convert to new_terms

Domain: SaaS

Domain: Storage

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5872 In elastic/detection-rules;

· terrancedejesus opened on Mar 23, 2026

[Rule Tuning] M365 Identity Login from Atypical Travel Location - Reduce FP Noise

Domain: Cloud

Domain: SaaS

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5865 In elastic/detection-rules;

· terrancedejesus opened on Mar 23, 2026

[Rule Tuning] Entra ID OAuth User Impersonation to Microsoft Graph

Domain: Cloud

Domain: Identity

Domain: Web

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5863 In elastic/detection-rules;

· terrancedejesus opened on Mar 23, 2026

[Rule Tuning] Kernel Module Load via Built-in Utility (2339f03c-f53f-40fa-834b-40c5983fc41f)

genai-tradecraft

Status: Open.

#5844 In elastic/detection-rules;

· tradebot-elastic opened on Mar 18, 2026

[DAC] [FR] Add Batch Import to DaC CLI

community

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#5829 In elastic/detection-rules;

· hhhharshil opened on Mar 12, 2026

[Rule Tuning] Network Traffic Capture via CAP_NET_RAW

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5826 In elastic/detection-rules;

· jvalente-salemstate opened on Mar 11, 2026

[Rule Tuning] Suspicious Child Execution via Web Server (f16fca20-4d6c-43f9-aec1-20b6de3b0aeb)

genai-tradecraft

Status: Open.

#5815 In elastic/detection-rules;

· tradebot-elastic opened on Mar 9, 2026

[Bug] DAC - Timeline rules that validate fine in Kibana fails validation in DAC

bugSomething isn't workingSomething isn't working

community

Team: TRADE

Status: Open.

#5814 In elastic/detection-rules;

· 0xBAADF0OD opened on Mar 6, 2026

[Rule Tuning] Unusual Instance Metadata Service (IMDS) API Request (ecc0cd54-608e-11ef-ab6d-f661ea17fbce)

genai-tradecraft

Status: Open.

#5801 In elastic/detection-rules;

· tradebot-elastic opened on Mar 1, 2026

[Rule Tuning] Potential Reverse Shell Activity via Terminal (a1a0375f-22c2-48c0-81a4-7c2d11cc6856)

genai-tradecraft

Status: Open.

#5798 In elastic/detection-rules;

· tradebot-elastic opened on Feb 28, 2026

[Rule Tuning] Machine Learning Detected DNS Request Predicted to be a DGA domain

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5787 In elastic/detection-rules;

· khalavak opened on Feb 26, 2026