---
name: New rule
about: Suggestions and ideas for new rules
title: "[New Rule] "
labels: "Rule: New"
assignees: ''

---
## Description
<!-- Provide a detailed description of the activity to be detected -->


## Required Info

- **Eventing Sources:**
<!-- filebeat, sysmon, etc. -->

- **Target Operating Systems:**
<!-- windows, linux, macOS, etc -->

- **Platforms**
<!-- okta, cloudtrail, etc -->

- **Target ECS Version:** x.x.x
- **New fields required in ECS for this?**
- **Related issues or PRs**

## Optional Info
- **References:**



## Example Data
<!-- Example JSON data from the actual detonated activity makes this process much quicker -->
