Commits

Branch selector

 main

User selector

All users

Datepicker

All time

Commit History

Commits on Oct 10, 2024

• Refresh to fetch latest ECS & Beats schemas, Integration manifests & schemas. (elastic#4140)

  shashank-elastic

  authored
  acb01cf

  Copy full SHA for acb01cf

• Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (elastic#4147)

  github-actions[bot]

  authored
  afbca3e

  Copy full SHA for afbca3e

• [Rule Tuning] Add KEEP Command to all ES|QL Rules (elastic#4146)

  Show description for 06319b7
  terrancedejesus

  authored
  06319b7

  Copy full SHA for 06319b7

Commits on Oct 9, 2024

• [FR][DAC] Import Rules Verbose Message (elastic#4093)

  Show description for 4edef2e
  eric-forte-elastic

  authored
  4edef2e

  Copy full SHA for 4edef2e

• [Rule Tuning] Add METADATA checks for non-aggregate ES|QL queries and fix existing (elastic#4126)

  Show description for 2819260
  

  terrancedejesus

  and

  imays11

  authored
  2819260

  Copy full SHA for 2819260

Commits on Oct 7, 2024

• [New Rule] Successful Application SSO from Rare Unknown Client Device (elastic#4141)

  Show description for 7674229
  terrancedejesus

  authored
  7674229

  Copy full SHA for 7674229

Commits on Oct 3, 2024

• [Hunting] Re-factor Hunting Library Code (elastic#4085)

  Show description for 50e23ba
  

  3 peopleauthored
  50e23ba

  Copy full SHA for 50e23ba

Commits on Oct 2, 2024

• [Rule Tuning] Fixing Incorrect ES|QL Operator Use - AWS Service Quotas Multi-Region GetServiceQuota Request (elastic#4118)

  Show description for 45a3475
  

  terrancedejesus

  and

  imays11

  authored
  45a3475

  Copy full SHA for 45a3475

Commits on Oct 1, 2024

• Sync RTA Base64 or Xxd Decode Argument Evasion (elastic#4113)

  Show description for 51859e5
  

  protectionsmachine

  and

  shashank-elastic

  authored
  51859e5

  Copy full SHA for 51859e5

• Sync RTA Suspicious Echo Execution (elastic#4110)

  Show description for e664679
  

  protectionsmachine

  and

  shashank-elastic

  authored
  e664679

  Copy full SHA for e664679

• Sync RTA Hexadecimal Payload Execution (elastic#4109)

  Show description for 2649382
  

  protectionsmachine

  and

  shashank-elastic

  authored
  2649382

  Copy full SHA for 2649382

• Sync RTA Potential Process Injection via dd (elastic#4108)

  Show description for 9e539e8
  

  protectionsmachine

  and

  shashank-elastic

  authored
  9e539e8

  Copy full SHA for 9e539e8

• Sync RTA Linux Telegram API Request (elastic#4107)

  protectionsmachine

  authored
  37ba89b

  Copy full SHA for 37ba89b

• Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (elastic#4116)

  github-actions[bot]

  authored
  80143b2

  Copy full SHA for 80143b2

• Update defense_evasion_posh_assembly_load.toml (elastic#4112)

  Samirbous

  authored
  a68a404

  Copy full SHA for a68a404

• [Tuning] Updated references (elastic#4114)

  Aegrah

  authored
  5b41bbd

  Copy full SHA for 5b41bbd

Commits on Sep 28, 2024

• [Rule Tuning] Ignore "Not Available" in o365.audit.UserId for Microsoft 365 Rules (elastic#4105)

  Show description for ef4e433
  terrancedejesus

  authored
  ef4e433

  Copy full SHA for ef4e433

• Update command_and_control_tunnel_vscode.toml (elastic#4104)

  Samirbous

  authored
  1d1b2eb

  Copy full SHA for 1d1b2eb

Commits on Sep 27, 2024

• Fix GenAI Request Model ID Field (elastic#4111)

  shashank-elastic

  authored
  ef95a54

  Copy full SHA for ef95a54

• [New Rules] CVE-2024-x.x.x.x.x (CUPS/Foomatic-RIP RCE) (elastic#4106)

  Show description for a3e89a7
  Aegrah

  authored
  a3e89a7

  Copy full SHA for a3e89a7

Commits on Sep 25, 2024

• [Docs | Rule Tuning] Add blog references to rules (elastic#4097)

  Show description for b80d834
  

  Mikaayenson

  and

  Samirbous

  authored
  b80d834

  Copy full SHA for b80d834

Commits on Sep 24, 2024

• [Rule Tuning] AWS STS GetCallerIdentity API Called for the First Time (elastic#4094)

  Show description for 0ed6b3f
  imays11

  authored
  0ed6b3f

  Copy full SHA for 0ed6b3f

Commits on Sep 19, 2024

• Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md (elastic#4091)

  Show description for fab842b
  

  github-actions[bot]

  and

  shashank-elastic

  authored
  fab842b

  Copy full SHA for fab842b

• Add flag to update the docs/ATT&CK-coverage.md with markdown URL(s) (elastic#4077)

  shashank-elastic

  authored
  e2f1fce

  Copy full SHA for e2f1fce

• [Tuning] Add logs-panw.panos index to Network rules (elastic#4089)

  Show description for 5e0fb4a
  

  Samirbous

  and

  shashank-elastic

  authored
  5e0fb4a

  Copy full SHA for 5e0fb4a

Commits on Sep 17, 2024

• [Bug] Handle formatting empty list (elastic#4086)

  Mikaayenson

  authored
  df31c00

  Copy full SHA for df31c00

• [New] ROT encoded Python Script Execution (elastic#4084)

  Show description for def2a9e
  

  Samirbous

  and

  DefSecSentinel

  authored
  def2a9e

  Copy full SHA for def2a9e

Commits on Sep 16, 2024

• [New Hunt] Add Initial Okta Hunting Queries (elastic#4064)

  Show description for 9181c00
  terrancedejesus

  authored
  9181c00

  Copy full SHA for 9181c00

• Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (elastic#4082)

  github-actions[bot]

  authored
  5740642

  Copy full SHA for 5740642

• min_stack New Rules that use the S1 Integration (elastic#4081)

  shashank-elastic

  authored
  814130b

  Copy full SHA for 814130b

• [Rule Tuning] min_stack New Rules that use the S1 Integration (elastic#4079)

  Show description for 7c78e40
  w0rk3r

  authored
  7c78e40

  Copy full SHA for 7c78e40

• [New] Potential Foxmail Exploitation (elastic#4044)

  Show description for 31ca246
  

  Samirbous

  and

  DefSecSentinel

  authored
  31ca246

  Copy full SHA for 31ca246

• [New] Execution via Windows Command Debugging Utility (elastic#3918)

  Show description for 41a7a5f
  Samirbous

  authored
  41a7a5f

  Copy full SHA for 41a7a5f

• [New] Persistence via a Windows Installer (elastic#4055)

  Show description for f26d7fc
  

  Samirbous

  and

  DefSecSentinel

  authored
  f26d7fc

  Copy full SHA for f26d7fc

• [New] Attempt to establish VScode Remote Tunnel (elastic#4061)

  Show description for b60b6e2
  

  3 peopleauthored
  b60b6e2

  Copy full SHA for b60b6e2

Pagination

Previous

Next