Search results

[Rule Tuning] Entra ID Suspicious Cloud Device Registration

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5682 In elastic/detection-rules;

· terrancedejesus opened on Feb 5, 2026

[Rule Tuning] Transform Dormant SharePoint Rule to Detect OAuth Phishing

Domain: Cloud

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5680 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] Deprecate Individual MSFT Defender Rules / Create BBR MSFT Defender Rule

Domain: Identity

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5678 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported

Domain: Identity

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5676 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] Okta User Assigned Administrator Role

Domain: Identity

Integration: Oktaokta related rulesokta related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5670 In elastic/detection-rules;

· terrancedejesus opened on Feb 3, 2026

[New Rule] Okta Admin Console Login Failure

Domain: Identity

Integration: Oktaokta related rulesokta related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#5668 In elastic/detection-rules;

· terrancedejesus opened on Feb 3, 2026

[DAC] [FR] Addressing Duplicate Exceptions

Status: Open.

#5664 In elastic/detection-rules;

· hhhharshil opened on Feb 2, 2026

[New Rule] Kernel Module Loading form Suspicious Location

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5646 In elastic/detection-rules;

· litemars opened on Jan 29, 2026

[New Rule] Lateral Movement SSH tunnel

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5645 In elastic/detection-rules;

· litemars opened on Jan 29, 2026

[New Rule] Defense evasion eBPF program laod

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5644 In elastic/detection-rules;

· litemars opened on Jan 29, 2026

[Rule Tuning] M365 Exchange Inbox Phishing Evasion Rule Created

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5643 In elastic/detection-rules;

· marcopedrinazzi opened on Jan 29, 2026

[Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5622 In elastic/detection-rules;

· GabiHausmann opened on Jan 26, 2026