All pull requests

Pull requests

• [Rule Tuning] Add antigravity support for genai rules

  backport: autoDomain: GenAI
  #7110·Mikaayenson opened Oct 29, 2026Contributor·

  ·
  3

  

• [Rule Tuning] AWS STS Role Assumption by Service

  backport: autocurrentreleaseDomain: Cloudgenai-tradecraftIntegration: AWSRule: Tuning
  #7109·tradebot-elastic opened Oct 29, 2026Contributor·

  ·
  2

  

• [New] Shell or Suspicious Process Spawned by Ray Worker

  backport: autoOS: LinuxOS: macOSOS: WindowsRule: New
  #7107·Samirbous opened Oct 29, 2026Contributor·

  ·
  13

  

• [New Rules/Tuning] ESXi Atomic coverage

  backport: autoDomain: EndpointIntegration: vsphereRule: NewRule: Tuning
  #7106·django-88 opened Oct 29, 2026Contributor·

  ·
  6

  

• [New Rule] Shell or Scripting Interpreter Spawned via Node.js or Bun

  backport: autocommunity
  #7105·CyberThreatNet opened Oct 29, 2026·

  ·
  1

  6

• [New Hunt] Unusual Distributed Fan-In Relative to Historical Baseline

  Domain: NetworkHunt: NewIntegration: Network Traffic
  #7102·eric-forte-elastic opened Oct 28, 2026Contributor·5 tasks·

  ·
  

• [Rule Tuning] Linux Group Creation

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: LinuxRule: Tuning
  #7101·tradebot-elastic opened Oct 28, 2026Contributor·

  ·
  5

  

• [Rule Tuning] Suspicious React Server Child Process

  backport: autoRule: Tuning
  #7100·bryans3c opened Oct 28, 2026Contributor·

  ·
  3

  

• [Rule Tuning] System Public IP Discovery via DNS Query

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7099·tradebot-elastic opened Oct 27, 2026Contributor·

  ·
  4

  

• [New Rule] Suspicious behavior related to NetScaler appliances

  Domain: NetworkRule: New
  #7098·eric-forte-elastic opened Oct 27, 2026Contributor·5 tasks·

  ·
  4

  

• [New Rule] Many to one flow based rules

  Domain: NetworkRule: New
  #7097·eric-forte-elastic opened Oct 27, 2026Contributor·5 tasks·

  ·
  1

  

• [Rule Tuning] Port Scan Rule Tunings

  backport: autoDomain: NetworkIntegration: Network Trafficintegration: PANWRule: Tuning
  #7096·eric-forte-elastic opened Oct 27, 2026Contributor·Queued·5 tasks
  5

  

• [Rule Tuning] Potential Network Sweep Detected

  backport: autoDomain: NetworkIntegration: Network Trafficintegration: PANWRule: Tuning
  #7095·eric-forte-elastic opened Oct 27, 2026Contributor·Queued·5 tasks
  4

  

• [Rule Tuning] Google Workspace User Login with Unusual ASN

  backport: autocurrentreleaseDomain: Cloudgenai-tradecraftIntegration: Google WorkspaceRule: Tuning
  #7094·tradebot-elastic opened Oct 27, 2026Contributor·

  ·
  3

  

• [New] GenAI Agent Instruction File Written to Downloads

  backport: autoDomain: GenAIRule: New
  #7093·Samirbous opened Oct 27, 2026Contributor·

  ·
  13

  

• [Tuning] ESXi rules tuning

  backport: autoIntegration: vsphereRule: Tuning
  #7092·Samirbous opened Oct 27, 2026Contributor·

  ·
  7

  

• [New Rule] First-Seen Brotli-Compressed Chunked HTTP POST to Destination

  backport: autoDomain: Web
  #7091·Aegrah opened Oct 27, 2026Contributor·

  ·
  6

  

• [New Rule] Potential HTTP/1.1 Request Smuggling: Conflicting Framing Headers

  backport: autoDomain: Web
  #7090·Aegrah opened Oct 27, 2026Contributor·

  ·
  4

  

• [New Rule] [Rule Tuning] Entra ID device registration: default hostname BBR and unusual user agent

  backport: autobbrDomain: CloudDomain: IdentityIntegration: AzureRule: NewRule: Tuning
  #7087·terrancedejesus opened Oct 26, 2026Contributor·2 tasks done·

  ·
  2

  

• [Rule Tuning] Unusual Parent-Child Relationship

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7086·tradebot-elastic opened Oct 26, 2026Contributor·

  ·
  8

  

• [Bug] Fixing metadata across macOS detection rules

  backport: autobugDomain: CloudDomain: EndpointIntegration: AzureOS: macOSTeam: TRADE
  #7085·litemars opened Oct 26, 2026Contributor·

  ·
  9

  

• [New Rule] Memory Fault Crash in Web Server Process

  backport: autoDomain: EndpointOS: WindowsRule: New
  #7081·w0rk3r opened Oct 23, 2026Contributor·

  ·
  4

  

• [Rule Tuning] Git Repository or File Download to Suspicious Directory

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: LinuxRule: Tuning
  #7079·tradebot-elastic opened Oct 23, 2026Contributor·

  ·
  4

  

• [New Rule] Discovery Commands Followed by Instance Metadata Service Access

  backport: autoDomain: EndpointOS: LinuxOS: macOSOS: WindowsRule: NewTeam: TRADE
  #7075·litemars opened Oct 23, 2026Contributor·

  ·
  28

  

• [New Rule, Rule Tuning] Linux Session Environment Configuration Coverage

  #7072·Aegrah opened Oct 23, 2026Contributor·6 of 7 tasks·

  ·
  5