All pull requests

Pull requests

• Update dependency elasticsearch to v9

  backport: autocommunity
  #7042·elastic-renovate-prod[bot] opened Oct 20, 2026Bot·1 task·

  ·

• [New Rule] Linux NFS Export Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7040·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule, Rule Tuning] Linux Mount Configuration and Discovery

  Domain: EndpointOS: LinuxRule: NewRule: TuningTeam: TRADE
  #7039·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [Rule Tuning] Add Systemd Environment Generator Coverage

  Domain: EndpointOS: LinuxRule: TuningTeam: TRADE
  #7038·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule] Linux User Provisioning Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7037·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule] Linux Interactive Tool Startup Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7036·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule, Rule Tuning] Sysctl Configuration and kernel.modprobe Activity

  Domain: EndpointOS: LinuxRule: NewRule: TuningTeam: TRADE
  #7035·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule] Linux Mail Delivery Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7034·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rules] Linux Logging and SELinux Policy Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7033·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule] TCP Wrappers Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7032·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [New Rule] SSH Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7031·Aegrah opened Oct 20, 2026Contributor·6 tasks done·

  ·
  1

  

• [Rule Tuning] Add AppArmor Policy Coverage to FIM Rule

  Domain: EndpointOS: LinuxRule: TuningTeam: TRADE
  #7030·Aegrah opened Oct 20, 2026Contributor·4 tasks done·

  ·
  

• [New Rule] AppArmor Profile Added or Replaced

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7029·Aegrah opened Oct 20, 2026Contributor·5 tasks done·

  ·
  1

  

• [New Rule] AppArmor Configuration File Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7028·Aegrah opened Oct 20, 2026Contributor·5 tasks done·

  ·
  2

  

• [New Rule] Linux Package Lifecycle Hook Activity

  Domain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7027·Aegrah opened Oct 20, 2026Contributor·3 of 4 tasks·

  ·
  1

  

• [New Rule] Sudo Configuration or Plugin Activity

  backport: autoDomain: EndpointOS: LinuxRule: NewTeam: TRADE
  #7025·Aegrah opened Oct 20, 2026Contributor·3 of 4 tasks·

  ·
  7

  

• [Rule Tuning] M365 Exchange MFA Notification Email Deleted or Moved

  backport: autocurrentreleaseDomain: Cloudgenai-tradecraftIntegration: Microsoft 365Rule: Tuning
  #7024·tradebot-elastic opened Oct 20, 2026Contributor·

  ·
  

• Update dependency setuptools to v84.2.0

  backport: autocommunity
  #7023·elastic-renovate-prod[bot] opened Oct 19, 2026Bot·1 task·

  ·

• [Bug] Register MITRE ATLAS as a 9.6 stack_emit epoch

  backport: autobugmeta:rapid-mergepatchpythonTeam: TRADE
  #7022·Mikaayenson opened Oct 19, 2026Contributor·5 of 9 tasks·

  ·
  5

  

• [New Rule] Composer Install Script Execution

  backport: autocommunity
  #7021·clivoa opened Oct 19, 2026Contributor·

  ·

• [New Rule] Shai-Hulud Exfiltration Artifact File Creation

  backport: autocommunity
  #7020·clivoa opened Oct 19, 2026Contributor·

  ·

• [New Rule] Package Registry Credential File Referenced on a Command Line

  backport: autocommunityDomain: EndpointOS: Linux
  #7019·clivoa opened Oct 19, 2026Contributor·

  ·

• [Rule Tuning] Minor Alert Suppression and Exclusion Updates

  Domain: NetworkRule: Tuning
  #7018·eric-forte-elastic opened Oct 19, 2026Contributor·5 tasks·

  ·
  1

  

• [Rule Tuning] Update problemchild rules

  Rule: Tuning
  #7016·sodhikirti07 opened Oct 19, 2026Contributor·5 tasks·

  ·

• [Bug] Never reuse a version shipped through a stack_emit channel

  backport: autopatchpython
  #7013·shashank-elastic opened Oct 19, 2026Contributor·5 tasks·

  ·
  1

  23