Files

T

Susan 3e1c6f38e4 Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794 )

* Update euid job ids and min stack version

* Update euid job ids and min stack version

* Update job suffix from _euid to _ea

* Update pad okta rules

* Update min_stack_comments

* Update gcp audit rules

* Update rules based on new changes

* Add rule for v3_windows_rare_script_ea job

* Update updated_date for rule to pass test

* Remove integrations-only changes (moved to euid-rules-update-integrations branch)

DED, DGA, LMD, PAD, and ProblemChild ML rule changes have been moved to the
euid-rules-update-integrations branch which corresponds to integrations#17626.
This branch (euid-rules-update) now only contains Kibana-related ML rule changes.

Made-with: Cursor

* Update stale updated_date to 2026/04/01 across all modified ML rules

Made-with: Cursor

* Bump min_stack_version from 9.3.0 to 9.4.0 in azure/gcp city/country/user rules

Made-with: Cursor

* Add min_stack_comments to those missing

2026-04-02 09:25:14 -04:00

_deprecated

[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672 )

2026-02-05 13:24:21 +01:00

apm

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

cross-platform

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

integrations

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794 )

2026-04-02 09:25:14 -04:00

linux

[Rule Tuning] Potential snap-confine Privilege Escalation (#5889 )

2026-04-02 11:21:09 +02:00

macos

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794 )

2026-04-02 09:25:14 -04:00

network

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

promotions

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

threat_intel

[Rule Tuning] Reduce Severity from Critical to High (#4637 )

2025-05-06 21:37:47 +05:30

windows

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

README.md

[FR] Minor Typo Fixes (#5784 )

2026-03-06 16:12:45 -06:00

README.md

rules/

Rules within this folder are organized by solution or platform. The structure is flattened out, because nested file hierarchies are hard to navigate and find what you're looking for. Each directory contains several .toml files, and the primary ATT&CK tactic is included in the file name when it's relevant (i.e. windows/execution_via_compiled_html_file.toml)

folder	description
`.`	Root directory where rules are stored
`apm/`	Rules that use Application Performance Monitoring (APM) data sources
`cross-platform/`	Rules that apply to multiple platforms, such as Windows and Linux
`integrations/`	Rules organized by Fleet integration
`linux/`	Rules for Linux or other Unix based operating systems
`macos/`	Rules for macOS
`ml/`	Rules that use machine learning jobs (ML)
`network/`	Rules that use network data sources
`promotions/`	Rules that promote external alerts into detection engine alerts
`windows/`	Rules for the Microsoft Windows Operating System

Integration specific rules are stored in the integrations/ directory:

folder	integration
`aws/`	Amazon Web Services (AWS)
`azure/`	Microsoft Azure
`cyberarkpas/`	Cyber Ark Privileged Access Security
`endpoint/`	Elastic Endpoint Security
`gcp/`	Google Cloud Platform (GCP)
`google_workspace/`	Google Workspace (formerly GSuite)
`o365/`	Microsoft Office
`okta/`	Okta