Susan 3e1c6f38e4 Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794) ...

* Update euid job ids and min stack version

* Update euid job ids and min stack version

* Update job suffix from _euid to _ea

* Update pad okta rules

* Update min_stack_comments

* Update gcp audit rules

* Update rules based on new changes

* Add rule for v3_windows_rare_script_ea job

* Update updated_date for rule to pass test

* Remove integrations-only changes (moved to euid-rules-update-integrations branch)

DED, DGA, LMD, PAD, and ProblemChild ML rule changes have been moved to the
euid-rules-update-integrations branch which corresponds to integrations#17626.
This branch (euid-rules-update) now only contains Kibana-related ML rule changes.

Made-with: Cursor

* Update stale updated_date to 2026/04/01 across all modified ML rules

Made-with: Cursor

* Bump min_stack_version from 9.3.0 to 9.4.0 in azure/gcp city/country/user rules

Made-with: Cursor

* Add min_stack_comments to those missing

2026-04-02 09:25:14 -04:00

..

command_and_control_ml_packetbeat_dns_tunneling.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

command_and_control_ml_packetbeat_rare_dns_question.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

command_and_control_ml_packetbeat_rare_urls.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

command_and_control_ml_packetbeat_rare_user_agent.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_auth_spike_in_failed_logon_events.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_auth_spike_in_logon_events.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_linux_anomalous_metadata_process.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_linux_anomalous_metadata_user.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_suspicious_login_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_windows_anomalous_metadata_process.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

credential_access_ml_windows_anomalous_metadata_user.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

discovery_ml_linux_system_information_discovery.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

discovery_ml_linux_system_network_configuration_discovery.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

discovery_ml_linux_system_network_connection_discovery.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

discovery_ml_linux_system_process_discovery.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

discovery_ml_linux_system_user_discovery.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

execution_ml_windows_anomalous_script.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

execution_ml_windows_rare_script.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

initial_access_ml_auth_rare_source_ip_for_a_user.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

initial_access_ml_auth_rare_user_logon.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

initial_access_ml_linux_anomalous_user_name.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

initial_access_ml_windows_anomalous_user_name.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

initial_access_ml_windows_rare_user_type10_remote_login.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

ml_high_count_events_for_a_host_name.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

ml_high_count_network_denies.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 09:12:42 -05:00

ml_high_count_network_events.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_linux_anomalous_network_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

ml_linux_anomalous_network_port_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

ml_low_count_events_for_a_host_name.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

ml_packetbeat_rare_server_domain.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

ml_rare_destination_country.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 09:12:42 -05:00

ml_spike_in_traffic_to_a_country.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 09:12:42 -05:00

ml_windows_anomalous_network_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_linux_anomalous_process_all_hosts.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_rare_process_by_host_linux.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_rare_process_by_host_windows.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_windows_anomalous_path_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_windows_anomalous_process_all_hosts.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_windows_anomalous_process_creation.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

persistence_ml_windows_anomalous_service.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

privilege_escalation_ml_linux_anomalous_sudo_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

privilege_escalation_ml_windows_rare_user_runas_event.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00

resource_development_ml_linux_anomalous_compiler_activity.toml

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)

2026-04-02 09:25:14 -04:00