---
name: New rule
about: Suggestions and ideas for new rules
title: "[New Rule] Name of rule"
labels: "Rule: New"
assignees: ''

---

<!-- Before submitting an issue to tune a rule, be sure to reference CONTRIBUTING.md --->

## Description
<!-- Provide a detailed description of the activity to be detected -->


## Required Info

### Target indexes
<!-- filebeat-*, logs-windows.*, etc. -->

### Additional requirements
<!-- sysmon, beats config modification, etc. -->

### Target Operating Systems
<!-- windows, linux, macOS, etc -->

### Platforms
<!-- okta, cloudtrail, etc -->

### Tested ECS Version
x.x.x


## Optional Info

### Query

### New fields required in ECS/data sources for this rule?

### Related issues or PRs

### References



## Example Data
<!-- Example JSON data from the actual detonated activity makes this process much quicker -->
