diff --git a/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml b/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml similarity index 98% rename from rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml rename to rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml index 9d6962883..c1e11f5a0 100644 --- a/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml +++ b/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2021/07/19" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/18" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml b/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml similarity index 98% rename from rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml rename to rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml index 2fafeb324..131df9a70 100644 --- a/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml +++ b/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2021/07/19" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/18" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml b/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml similarity index 98% rename from rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml rename to rules/_deprecated/exfiltration_ec2_vm_export_failure.toml index e11d2137f..3f12c0eba 100644 --- a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml +++ b/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2021/04/22" integration = ["aws"] -maturity = "production" -updated_date = "2025/10/23" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/impact_rds_group_deletion.toml b/rules/_deprecated/impact_rds_group_deletion.toml similarity index 98% rename from rules/integrations/aws/impact_rds_group_deletion.toml rename to rules/_deprecated/impact_rds_group_deletion.toml index e32c3721b..d922bec30 100644 --- a/rules/integrations/aws/impact_rds_group_deletion.toml +++ b/rules/_deprecated/impact_rds_group_deletion.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2021/06/05" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/21" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml b/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml similarity index 98% rename from rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml rename to rules/_deprecated/impact_rds_instance_cluster_stoppage.toml index 912b8d40b..43efe381a 100644 --- a/rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml +++ b/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2020/05/20" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/21" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/persistence_rds_cluster_creation.toml b/rules/_deprecated/persistence_rds_cluster_creation.toml similarity index 98% rename from rules/integrations/aws/persistence_rds_cluster_creation.toml rename to rules/_deprecated/persistence_rds_cluster_creation.toml index d9c4f287d..fe66d72ba 100644 --- a/rules/integrations/aws/persistence_rds_cluster_creation.toml +++ b/rules/_deprecated/persistence_rds_cluster_creation.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2020/05/20" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/21" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/persistence_rds_group_creation.toml b/rules/_deprecated/persistence_rds_group_creation.toml similarity index 98% rename from rules/integrations/aws/persistence_rds_group_creation.toml rename to rules/_deprecated/persistence_rds_group_creation.toml index a0c4e0017..3cacb22e3 100644 --- a/rules/integrations/aws/persistence_rds_group_creation.toml +++ b/rules/_deprecated/persistence_rds_group_creation.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2021/06/05" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/21" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_rds_instance_creation.toml b/rules/_deprecated/persistence_rds_instance_creation.toml similarity index 98% rename from rules/integrations/aws/persistence_rds_instance_creation.toml rename to rules/_deprecated/persistence_rds_instance_creation.toml index e16598f30..825141393 100644 --- a/rules/integrations/aws/persistence_rds_instance_creation.toml +++ b/rules/_deprecated/persistence_rds_instance_creation.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2021/06/06" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/21" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_redshift_instance_creation.toml b/rules/_deprecated/persistence_redshift_instance_creation.toml similarity index 98% rename from rules/integrations/aws/persistence_redshift_instance_creation.toml rename to rules/_deprecated/persistence_redshift_instance_creation.toml index 091a00a62..5454bf865 100644 --- a/rules/integrations/aws/persistence_redshift_instance_creation.toml +++ b/rules/_deprecated/persistence_redshift_instance_creation.toml @@ -1,8 +1,9 @@ [metadata] creation_date = "2022/04/12" integration = ["aws"] -maturity = "production" -updated_date = "2025/11/25" +maturity = "deprecated" +updated_date = "2026/01/16" +deprecation_date = "2026/01/16" [rule] author = ["Elastic"]