All pull requests

Pull requests

• Fix checkout v7 credential collision in release workflows

  backport: auto
  #6927·shashank-elastic opened Sep 29, 2026Contributor·

  ·
  6

  

• [FR] Cache ES|QL parses and memoize the offline ES|QL schema helpers

  esqlpatchpython
  #6926·eric-forte-elastic opened Sep 28, 2026Contributor·

  ·
  

• [Bug] Fix updated date unit tests on PRs not to main

  bugpatchtest-suite
  #6925·eric-forte-elastic opened Sep 28, 2026Contributor·

  ·
  

• [FR] Validate patterns with Lucene's regex syntax

  enhancementpatchpythontest-suite
  #6924·eric-forte-elastic opened Sep 28, 2026Contributor·

  ·
  

• [Rule Tuning] Add Composer, RubyGems, Go, and Gradle to Elastic Defend Package Manager Ancestry (#6605)

  backport: autocommunityRule: Tuning
  #6923·SecByShresth opened Sep 28, 2026·

  ·
  1

  1

• [Rule Tuning] Azure VM Extension Deployment by User

  Domain: CloudIntegration: AzureRule: Tuning
  #6921·terrancedejesus opened Sep 28, 2026Contributor·

  ·

• [Rule Tuning] Access to a Sensitive LDAP Attribute

  backport: autoDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #6918·tradebot-elastic opened Sep 28, 2026Contributor·

  ·
  1

  

• Update dependency nodeenv to v1.11.0

  backport: autocommunitypatch
  #6911·elastic-renovate-prod[bot] opened Sep 26, 2026Bot·

  ·

• [Bug] Naive split causing value error in attack.py

  backport: autopatchpython
  #6908·eric-forte-elastic opened Sep 25, 2026Contributor·

  ·
  1

  4

  

• [FR] [DaC] Update Cross Cluster Search support

  backport: autodetections-as-codepatchpythonschema
  #6904·eric-forte-elastic opened Sep 24, 2026Contributor·

  ·
  2

  

• [New Rule] Lure-Themed Internet-Delivered RMM Executable

  backport: autoDomain: EndpointOS: WindowsRule: New
  #6900·w0rk3r opened Sep 24, 2026Contributor·

  ·
  17

  

• [New Rule] GitHub Webhook Created or Configuration Changed

  backport: autoIntegration: GitHubRule: New
  #6899·bryans3c opened Sep 24, 2026Contributor·

  ·
  6

  

• [New Rule] GitHub User SSH Key Added

  backport: autoIntegration: GitHubRule: New
  #6898·bryans3c opened Sep 24, 2026Contributor·

  ·
  3

  

• [New Rule] GitHub Outside Collaborator Added to Repository

  backport: autoIntegration: GitHubRule: New
  #6897·bryans3c opened Sep 24, 2026Contributor·

  ·
  6

  

• [New Rule] GitHub OAuth Application Authorized

  backport: autoIntegration: GitHubRule: New
  #6896·bryans3c opened Sep 24, 2026Contributor·

  ·
  6

  

• [New Rule] GitHub Actions or Integration Secret Created

  backport: autoIntegration: GitHubRule: New
  #6895·bryans3c opened Sep 24, 2026Contributor·

  ·
  2

  

• [New Rule] GitHub Sign-in from Unrecognized Device

  backport: autoIntegration: GitHubRule: New
  #6894·bryans3c opened Sep 24, 2026Contributor·

  ·
  3

  

• [New Rule] GitHub PAT or SSH Key Added from Unusual User Agent

  backport: autoIntegration: GitHubpatchRule: Newschema
  #6893·bryans3c opened Sep 24, 2026Contributor·

  ·
  1

  

• [New Rule] GitHub PAT or SSH Key Added from Unusual IP

  backport: autoIntegration: GitHubpatchRule: Newschema
  #6892·bryans3c opened Sep 24, 2026Contributor·

  ·
  2

  

• [New Rule] GitHub Payment Method Removed

  backport: autoIntegration: GitHubRule: New
  #6891·bryans3c opened Sep 24, 2026Contributor·

  ·
  3

  

• [New Rule] GitHub Organization Removed or Transferred from Enterprise

  backport: autoIntegration: GitHubRule: New
  #6890·bryans3c opened Sep 24, 2026Contributor·

  ·
  2

  

• [New Rule] GitHub Token Clone Push or ZIP from Unusual IP

  backport: autoIntegration: GitHubpatchRule: Newschema
  #6889·bryans3c opened Sep 24, 2026Contributor·

  ·
  7

  

• [New Rule] GitHub Repository Transferred Out of Organization

  backport: autoIntegration: GitHubRule: New
  #6888·bryans3c opened Sep 24, 2026Contributor·

  ·
  2

  

• [New Rule] GitHub Exfiltration via High Number of Repository ZIP Downloads

  backport: autoIntegration: GitHubpatchRule: Newschema
  #6887·bryans3c opened Sep 24, 2026Contributor·

  ·
  6

  

• [New Rule] GitHub Token Activity from Unusual User Agent

  backport: autoIntegration: GitHubpatchRule: Newschema
  #6886·bryans3c opened Sep 24, 2026Contributor·

  ·
  3