Issues · elastic/detection-rules · GitHub

Labels Milestones New issue

[FR] Amend ESQL Rules with VIEWS (virtual index) instead of hardcoded index patterns

#6219

· getkub opened

on May 31, 2026

[New Rules] Megalodon GitHub Actions supply chain backdoor campaign (May 2026)

#6217

· StuLast opened

on May 30, 2026

[New Rule] Container Escape via Kernel core_pattern Modification

#6216

· Aryu-RU opened

on May 30, 2026

[DaC] [FR] Add support for Kibana Workflows in rule actions

detections-as-code

#6212

· eric-forte-elastic opened

on May 29, 2026

[Rule Tuning] Web Application Suspicious Activity: POST Request Declined (a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e)

genai-tradecraft

#6186

· tradebot-elastic opened

on May 25, 2026

[DaC] export-rules fails on KQL rules with empty query (filters only)

detections-as-code

#6167

· florianges opened

on May 20, 2026

[New Rule] AWS Bedrock Model Invocation Logging Deleted Configuration

#6160

· marcopedrinazzi opened

on May 17, 2026

[New Rule] AWS Bedrock Guardrail Configuration Changed

#6159

· marcopedrinazzi opened

on May 17, 2026

[New Rule] AWS security agent detection

#6155

· marcopedrinazzi opened

on May 15, 2026

[New Rule] New LLM Jacking Rules

#6154

· marcopedrinazzi opened

on May 15, 2026

[New Rule] Expand LLM and MCP agent detection coverage under rules/integrations/llm/

#6126

· eeee2345 opened

on May 10, 2026

[DaC] additional line break added to query after export/import

detections-as-code

#6081

· wingiti opened

on May 5, 2026