Ruben Groenewoud 3cba3d7982 [Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672) ...

* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword

* [Rule Tuning] Dormant & Deprecated Rule Clean-Up

* [Rule Tuning] Dormant & Deprecated Rule Clean-Up

* Few more deprecations

* ++

* Update unit test syntax fix

* Update bad bytes

* ++

2026-02-05 13:24:21 +01:00

..

defense_evasion_github_protected_branch_settings_changed.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

defense_evasion_secret_scanning_disabled.toml

[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)

2026-02-05 13:24:21 +01:00

execution_github_app_deleted.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

execution_github_high_number_of_cloned_repos_from_pat.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

execution_github_ueba_multiple_behavior_alerts_from_account.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

execution_new_github_app_installed.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

exfiltration_github_private_repository_turned_public.toml

[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)

2026-02-05 13:24:21 +01:00

exfiltration_high_number_of_cloning_by_user.toml

Prep for Release 9.3 (#5548)

2026-01-12 21:07:07 +05:30

impact_github_repository_activity_from_unusual_ip.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 17:19:12 +01:00

impact_github_repository_deleted.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

impact_high_number_of_closed_pull_requests_by_user.toml

Prep for Release 9.3 (#5548)

2026-01-12 21:07:07 +05:30

impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml

Prep for Release 9.3 (#5548)

2026-01-12 21:07:07 +05:30

impact_high_number_of_protected_branch_force_pushes_by_user.toml

chore: Fix lock version for 9.3.2 Release (#5634)

2026-01-27 22:38:39 -05:00

initial_access_github_actions_bot_first_push_to_repo.toml

[New Rule] GitHub Actions Bot Pushed to Repository for First Time (#5438)

2025-12-18 09:58:57 -05:00

initial_access_github_actions_workflow_injection_blocked.toml

[New Rule] GitHub Actions Workflow Injection Blocked (#5433)

2025-12-17 14:29:33 -05:00

initial_access_github_register_self_hosted_runner.toml

[Rule Tuning] New GitHub Self Hosted Action Runner (#5436)

2025-12-10 10:55:47 -05:00

persistence_github_org_owner_added.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

persistence_new_pat_created.toml

Prep for Release 9.3 (#5548)

2026-01-12 21:07:07 +05:30

persistence_organization_owner_role_granted.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30