Search results

[Rule Tuning] Okta Sign-In Events via Third-Party IdP - Convert to New Terms

Domain: Identity

Integration: Oktaokta related rulesokta related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5543 In elastic/detection-rules;

· terrancedejesus opened on Jan 9, 2026

[Rule Tuning] New Okta Authentication Behavior Detected

Domain: Identity

Integration: Oktaokta related rulesokta related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5541 In elastic/detection-rules;

· terrancedejesus opened on Jan 9, 2026

[Rule Tuning] Svchost spawning Cmd

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5538 In elastic/detection-rules;

· rkarimovs opened on Jan 8, 2026

[Bug] [DAC] Rule Action Email Strings Incorrectly Handled

bugSomething isn't workingSomething isn't working

community

detections-as-code

Team: TRADE

Status: Open.

Bug

#5529 In elastic/detection-rules;

· eric-forte-elastic opened on Jan 6, 2026

[Rule Tuning] Component Object Model Hijacking

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5526 In elastic/detection-rules;

· b3at1 opened on Jan 2, 2026

[Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (994e40aa-8c85-43de-825e-15f665375ee8)

genai-tradecraft

Status: Open.

#5523 In elastic/detection-rules;

· tradebot-elastic opened on Jan 2, 2026

[Rule Tuning] RPC (Remote Procedure Call) from the Internet (143cb236-0956-4f42-a706-814bcaa0cf5a)

genai-tradecraft

Status: Open.

#5519 In elastic/detection-rules;

· tradebot-elastic opened on Dec 31, 2025

[Rule Tuning] Abnormally Large DNS Response (11013227-0301-4a8c-b150-4db924484475)

genai-tradecraft

Status: Open.

#5509 In elastic/detection-rules;

· tradebot-elastic opened on Dec 23, 2025

[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet (8c1bdde8-4204-45c0-9e0c-c85ca3902488)

genai-tradecraft

Status: Open.

#5507 In elastic/detection-rules;

· tradebot-elastic opened on Dec 21, 2025

[Rule Tunings] AWS Investigation Guides Normalization

Domain: Cloud

Integration: AWSAWS related rulesAWS related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Security Content

Team: TRADE

Status: Open.

Task

#5500 In elastic/detection-rules;

· imays11 opened on Dec 18, 2025

[FR] Global Tag Inheritance for Detection Rule Custom Tags

community

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#5493 In elastic/detection-rules;

· veritasr3x opened on Dec 18, 2025

[Rule Tuning] RPC (Remote Procedure Call) to the Internet (32923416-763a-4531-bb35-f33b9232ecdb)

genai-tradecraft

Status: Open.

#5491 In elastic/detection-rules;

· tradebot-elastic opened on Dec 18, 2025