Files

T

Isai 07579f2bd7 [Rule Tunings] AWS remove target.entity.id and actor.entity.id fields (#5563 )

* [Rule Tunings] AWS removal of target.entity.id and actor.entity.id fields

Related Issue : - https://github.com/elastic/security-team/issues/14019

`target.entity.id` and `related.entity.id` fields will soon be fully removed from the AWS Integration. This rule tuning replaces rule queries that relied on `target.entity.id` with the equivalent field `entity.target.id` which was introduced with AWS version 4.7.0 along with several new entity classification fields. This tuning also removes references to these fields in highlighted fields and investigation guides for several rules.

* update data for defense_evasion_route53_dns_query_resolver_config_deletion.toml

update data for defense_evasion_route53_dns_query_resolver_config_deletion.toml

* updated_dates

2026-01-21 13:54:56 -05:00

_deprecated

[Rule Deprecations] AWS Rule Deprecations (#5568 )

2026-01-20 16:05:39 -05:00

apm

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

cross-platform

[New Rules] Ollama Detections (#5546 )

2026-01-12 11:05:15 -06:00

integrations

[Rule Tunings] AWS remove target.entity.id and actor.entity.id fields (#5563 )

2026-01-21 13:54:56 -05:00

linux

[Rule Tuning] Potential Disabling of AppArmor - Restore AppArmor service filters (#5574 )

2026-01-19 09:19:24 -03:00

macos

Update command_and_control_unusual_network_connection_to_suspicious_web_service.toml (#5008 )

2025-08-26 13:03:59 +01:00

add mitre attack rules for ML job rules, bump dates (#5333 )

2025-12-01 15:48:59 -06:00

network

Update discovery_potential_port_scan_detected.toml (#5571 )

2026-01-16 23:21:12 -03:00

promotions

[Rule Tuning] Remove New Wiz Defend Rule (Add Wiz Defend to External Alerts) (#5422 )

2025-12-08 22:24:22 +05:30

threat_intel

[Rule Tuning] Reduce Severity from Critical to High (#4637 )

2025-05-06 21:37:47 +05:30

windows

[Rule Tuning] Web Server Rules (#5581 )

2026-01-20 15:30:57 -03:00

README.md

[New Rule] Endpoint Security Behavior Protection (#1440 )

2021-08-25 09:56:59 -06:00

README.md

rules/

Rules within this folder are organized by solution or platform. The structure is flattened out, because nested file hierarchies are hard to navigate and find what you're looking for. Each directory contains several .toml files, and the primary ATT&CK tactic is included in the file name when it's relevant (i.e. windows/execution_via_compiled_html_file.toml)

folder	description
`.`	Root directory where rules are stored
`apm/`	Rules that use Application Performance Monitoring (APM) data sources
`cross-platform/`	Rules that apply to multiple platforms, such as Windows and Linux
`integrations/`	Rules organized by Fleet integration
`linux/`	Rules for Linux or other Unix based operating systems
`macos/`	Rules for macOS
`ml/`	Rules that use machine learning jobs (ML)
`network/`	Rules that use network data sources
`promotions/`	Rules that promote external alerts into detection engine alerts
`windows/`	Rules for the Microsoft Windows Operating System

Integration specific rules are stored in the integrations/ directory:

folder	integration
`aws/`	Amazon Web Services (AWS)
`azure/`	Microsoft Azure
`cyberarkpas/`	Cyber Ark Privileged Access Security
`endpoint/`	Elastic Endpoint Security
`gcp/`	Google Cloud Platform (GCP)
`google_workspace/`	Google Workspace (formerly GSuite)
`o365/`	Microsoft Office
`okta/`	Oka