elastic/detection-rules

16.6

Adjusted Score

16.6

Raw Score

100%

Time Factor

2026-07-14

Last Push

2.7K

Stars

Python

Language

502.8K

Lines of Code

2.8K

Files

2.1K

Pattern Hits

2026-07-14

Scan Date

0.55

HC Hit Rate

What These Metrics Mean

Adjusted Score: Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score: The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor: The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits: Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate: High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files: Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 1564MEDIUM 33LOW 458

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 2055 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Cross-File Repetition1560 hits · 7800 pts

Severity	File	Line	Snippet	Context
HIGH	…/credential_access_entra_id_risk_detection_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ing_block/collection_microsoft_purview_dlp_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…initial_access_microsoft_air_investigation_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…vasion_microsoft_security_compliance_admin_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…cess_microsoft_purview_security_compliance_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…/collection_microsoft_purview_insider_risk_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…k/initial_access_microsoft_defender_alerts_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ess_microsoft_defender_threat_intelligence_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…nitial_access_microsoft_quarantine_hygiene_signal.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ge_escalation_endgame_process_injection_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ge_escalation_endgame_cred_manipulation_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	rules/promotions/endgame_ransomware_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…es/promotions/endgame_adversary_behavior_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	rules/promotions/endgame_malware_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…es/promotions/execution_endgame_exploit_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	rules/promotions/endgame_malware_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ege_escalation_endgame_permission_theft_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…lege_escalation_endgame_permission_theft_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ege_escalation_endgame_process_injection_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…ege_escalation_endgame_cred_manipulation_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	rules/promotions/endgame_ransomware_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…s/credential_access_endgame_cred_dumping_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…/credential_access_endgame_cred_dumping_prevented.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…les/promotions/execution_endgame_exploit_detected.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	rules/promotions/external_alerts.toml	0	## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide]	STRING
HIGH	…k/command_and_control_certutil_network_connection.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…persistence_ml_windows_anomalous_process_creation.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…es/ml/persistence_ml_rare_process_by_host_windows.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…les/windows/defense_evasion_masquerading_werfault.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…startup_folder_file_written_by_suspicious_process.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…ege_escalation_service_control_spawned_script_int.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/execution_via_compiled_html_file.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…/windows/defense_evasion_execution_lolbas_wuauclt.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…ilege_escalation_unusual_parentchild_relationship.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…nd_and_control_remote_file_copy_desktopimgdownldr.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…egister_server_program_connecting_to_the_internet.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…defense_evasion_execution_msbuild_started_renamed.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/lateral_movement_remote_services.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…ows/defense_evasion_suspicious_zoom_child_process.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…es/windows/persistence_system_shells_via_services.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/execution_from_unusual_path_cmdline.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/command_and_control_certreq_postdata.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…es/windows/command_and_control_common_webservices.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…teral_movement_execution_via_file_shares_sequence.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…ows/defense_evasion_suspicious_short_program_name.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…se_evasion_network_connection_from_windows_binary.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…es/windows/defense_evasion_from_unusual_directory.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…s_persistence_network_logon_provider_modification.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…s/credential_access_kerberoasting_unusual_process.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…ding_the_hidden_file_attribute_with_via_attribexe.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/persistence_time_provider_mod.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…elp_executable_program_connecting_to_the_internet.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…dows/defense_evasion_suspicious_certutil_commands.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…indows/discovery_privileged_localgroup_membership.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…ows/credential_access_lsass_memdump_handle_access.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/persistence_startup_folder_scripts.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…eforce_multiple_logon_failure_followed_by_success.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…windows/command_and_control_ingress_transfer_bits.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	…indows/credential_access_bruteforce_admin_account.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
HIGH	rules/windows/persistence_adobe_hijack_persistence.toml	0	select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no	STRING
1500 more matches not shown…

Hyper-Verbose Identifiers255 hits · 242 pts

Severity	File	Line	Snippet	Context
LOW	detection_rules/misc.py	198	def load_current_package_version() -> str:	CODE
LOW	detection_rules/misc.py	291	def get_default_elasticsearch_client() -> Elasticsearch:	CODE
LOW	detection_rules/misc.py	318	def get_default_kibana_client() -> Kibana:	CODE
LOW	detection_rules/mixins.py	42	def get_dataclass_required_fields(cls: Any) -> list[str]:	CODE
LOW	detection_rules/mixins.py	250	def validate_field_compatibility(self, data: dict[str, Any], **_: dict[str, Any]) -> None:	CODE
LOW	detection_rules/exception.py	277	def parse_exceptions_results_from_api(	CODE
LOW	detection_rules/action_connector.py	60	def from_action_connector_dict(	CODE
LOW	detection_rules/action_connector.py	126	def parse_action_connector_results_from_api(	CODE
LOW	detection_rules/action_connector.py	141	def build_action_connector_objects( # noqa: PLR0913	CODE
LOW	detection_rules/index_mappings.py	41	def delete_nested_key_from_dict(d: dict[str, Any], compound_key: str) -> None:	CODE
LOW	detection_rules/index_mappings.py	52	def flat_schema_to_index_mapping(flat_schema: dict[str, str]) -> dict[str, Any]:	CODE
LOW	detection_rules/index_mappings.py	101	def create_index_with_index_mapping(	CODE
LOW	detection_rules/index_mappings.py	149	def get_simulated_index_template_mappings(elastic_client: Elasticsearch, name: str) -> dict[str, Any]:	CODE
LOW	detection_rules/index_mappings.py	162	def prune_mappings_of_unsupported_types(	CODE
LOW	detection_rules/index_mappings.py	193	def prepare_integration_mappings( # noqa: PLR0913	CODE
LOW	detection_rules/index_mappings.py	240	def get_index_to_package_lookup(indices: list[str], index_lookup: dict[str, Any]) -> dict[str, Any]:	CODE
LOW	detection_rules/index_mappings.py	257	def get_filtered_index_schema( # noqa: PLR0913	CODE
LOW	detection_rules/index_mappings.py	356	def execute_query_against_indices(	CODE
LOW⚡	detection_rules/index_mappings.py	414	def find_flattened_fields_with_subfields(mapping: dict[str, Any], path: str = "") -> list[str]:	CODE
LOW	detection_rules/config.py	368	def load_current_package_version() -> str:	CODE
LOW	detection_rules/esql.py	23	def get_esql_query_event_dataset_integrations(query: str) -> list[EventDataset]:	CODE
LOW	detection_rules/rule_loader.py	142	def update_metadata_from_file(rule_path: Path, fields_to_update: dict[str, Any]) -> dict[str, Any]:	CODE
LOW	detection_rules/docs.py	731	def convert_markdown_to_asciidoc(text: str) -> str:	CODE
LOW	detection_rules/docs.py	922	def generate_current_rule_summary(self) -> None:	CODE
LOW	detection_rules/docs.py	1030	def generate_downloadable_updates_summary(self) -> None:	STRING
LOW	detection_rules/remote_validation.py	262	def validate_machine_learning(_: Any, __: TOMLRuleContents) -> dict[str, str]:	CODE
LOW	detection_rules/eswrap.py	47	def parse_unique_field_results(	CODE
LOW	detection_rules/rule_validators.py	132	def custom_base_parse_decorator(func: Callable[..., Any]) -> Callable[..., Any]:	CODE
LOW	detection_rules/rule_validators.py	173	def _prepare_integration_schema(	CODE
LOW	detection_rules/rule_validators.py	309	def validate_query_text_with_schema(	CODE
LOW	detection_rules/rule_validators.py	389	def _build_synthetic_sequence_from_subquery(self, subquery: "ast.SubqueryBy") -> str:	CODE
LOW	detection_rules/rule_validators.py	416	def add_accumulated_integration_targets(query_text: str, packaged: list[dict[str, Any]], context: str) -> None:	CODE
LOW	detection_rules/rule_validators.py	647	def validate_query_text_with_schema( # noqa: PLR0913	CODE
LOW	detection_rules/rule_validators.py	710	def validate_rule_type_configurations(self, data: EQLRuleData, meta: RuleMeta) -> tuple[list[str], bool]:	CODE
LOW	detection_rules/rule_validators.py	787	def validate_columns_index_mapping(	CODE
LOW	detection_rules/rule_validators.py	868	def remote_validate_rule_contents(	CODE
LOW	detection_rules/custom_schemas.py	89	def update_auto_generated_schema(index: str, field: str, field_type: str \| None = None) -> None:	CODE
LOW	detection_rules/attack.py	216	def build_redirected_techniques_map(threads: int = 50) -> dict[str, Any]:	CODE
LOW	detection_rules/attack.py	235	def refresh_redirected_techniques_map(threads: int = 50) -> None:	CODE
LOW	detection_rules/ml.py	176	def get_all_existing_model_files(self) -> list[dict[str, Any]]:	CODE
LOW	detection_rules/ml.py	228	def remove_ml_scripts_pipelines(cls, es_client: Elasticsearch, ml_type: list[str]) -> dict[str, Any]:	CODE
LOW	detection_rules/ml.py	272	def get_ml_model_manifests_by_model_id(repo_name: str = "elastic/detection-rules") -> dict[str, ReleaseManifest]:	CODE
LOW	detection_rules/beats.py	23	def _decompress_and_save_schema(url: str, release_name: str) -> None:	CODE
LOW	detection_rules/beats.py	90	def download_latest_beats_schema() -> None:	CODE
LOW	detection_rules/devtools.py	413	def save_double_bumps_to_file(double_bumps: list[tuple[str, str, int, int]], save_path: Path) -> None:	CODE
LOW	detection_rules/devtools.py	1592	def build_integration_manifests(overwrite: bool, integration: str, prerelease: bool = False) -> None:	CODE
LOW	detection_rules/devtools.py	1614	def build_integration_schemas(overwrite: bool, integration: str) -> None:	CODE
LOW⚡	detection_rules/devtools.py	1630	def show_latest_compatible_version(package: str, stack_version: str) -> None:	CODE
LOW	detection_rules/rule.py	135	def get_validation_stack_versions(self) -> dict[str, dict[str, Any]]:	CODE
LOW	detection_rules/rule.py	177	def render_investigate_osquery_to_string(self) -> dict[definitions.TransformTypes, list[str]]:	CODE
LOW	detection_rules/rule.py	803	def validates_index_and_data_view_id(self, data: dict[str, Any], **_: Any) -> None:	CODE
LOW	detection_rules/rule.py	809	def validates_query_or_filters(self, data: dict[str, Any], **_: Any) -> None:	CODE
LOW	detection_rules/rule.py	1283	def convert_supported_version(cls, stack_version: str \| None) -> Version:	CODE
LOW	detection_rules/rule.py	1452	def _convert_add_related_integrations(self, obj: dict[str, Any]) -> None:	CODE
LOW	detection_rules/rule.py	1507	def _convert_add_required_fields(self, obj: dict[str, Any]) -> None:	CODE
LOW	detection_rules/rule.py	1552	def _convert_get_setup_content(self, note_tree: list[Any]) -> str:	CODE
LOW	detection_rules/rule.py	1575	def check_explicit_restricted_field_version(self, field_name: str) -> bool:	CODE
LOW	detection_rules/rule.py	1582	def check_restricted_field_version(self, field_name: str) -> bool:	CODE
LOW	detection_rules/rule.py	1599	def get_packaged_integrations(	CODE
LOW	detection_rules/rule.py	1635	def post_conversion_validation(self, value: dict[str, Any], **_: Any) -> None:	CODE
195 more matches not shown…

Deep Nesting78 hits · 69 pts

Severity	File	Line	Context
LOW	detection_rules/misc.py	351	CODE
LOW	detection_rules/misc.py	354	CODE
LOW	detection_rules/misc.py	370	CODE
LOW	detection_rules/cli_utils.py	33	CODE
LOW	detection_rules/cli_utils.py	237	CODE
LOW	detection_rules/exception.py	277	CODE
LOW	detection_rules/exception.py	309	CODE
LOW	detection_rules/kbwrap.py	273	CODE
LOW	detection_rules/kbwrap.py	556	CODE
LOW	detection_rules/action_connector.py	141	CODE
LOW	detection_rules/index_mappings.py	390	CODE
LOW	detection_rules/config.py	235	CODE
LOW	detection_rules/config.py	147	CODE
LOW	detection_rules/esql.py	23	CODE
LOW	detection_rules/docs.py	63	CODE
LOW	detection_rules/docs.py	882	CODE
LOW	detection_rules/eswrap.py	47	CODE
LOW	detection_rules/eswrap.py	184	CODE
LOW	detection_rules/eswrap.py	251	CODE
LOW	detection_rules/rule_validators.py	94	CODE
LOW	detection_rules/rule_validators.py	396	CODE
LOW	detection_rules/rule_validators.py	647	CODE
LOW	detection_rules/rule_validators.py	416	CODE
LOW	detection_rules/version_lock.py	192	CODE
LOW	detection_rules/custom_schemas.py	23	CODE
LOW	detection_rules/ml.py	272	CODE
LOW	detection_rules/ml.py	228	CODE
LOW	detection_rules/beats.py	23	CODE
LOW	detection_rules/beats.py	104	CODE
LOW	detection_rules/beats.py	261	CODE
LOW	detection_rules/navigator.py	214	CODE
LOW	detection_rules/devtools.py	503	CODE
LOW	detection_rules/devtools.py	1137	CODE
LOW	detection_rules/devtools.py	1424	CODE
LOW	detection_rules/devtools.py	1749	CODE
LOW	detection_rules/rule.py	603	CODE
LOW	detection_rules/rule.py	657	CODE
LOW	detection_rules/rule.py	995	CODE
LOW	detection_rules/rule.py	1415	CODE
LOW	detection_rules/rule.py	1452	CODE
LOW	detection_rules/rule.py	1552	CODE
LOW	detection_rules/rule.py	1599	CODE
LOW	detection_rules/utils.py	73	CODE
LOW	detection_rules/rule_formatter.py	60	CODE
LOW	detection_rules/rule_formatter.py	109	CODE
LOW	detection_rules/rule_formatter.py	221	CODE
LOW	detection_rules/rule_formatter.py	112	CODE
LOW	detection_rules/rule_formatter.py	242	CODE
LOW	detection_rules/generic_loader.py	139	CODE
LOW	detection_rules/main.py	186	CODE
LOW	detection_rules/main.py	522	CODE
LOW	detection_rules/main.py	576	CODE
LOW	detection_rules/integrations.py	114	CODE
LOW	detection_rules/integrations.py	186	CODE
LOW	detection_rules/ecs.py	157	CODE
LOW	detection_rules/ecs.py	280	CODE
LOW	tests/test_specific_rules.py	88	CODE
LOW	tests/test_all_rules.py	208	CODE
LOW	tests/test_all_rules.py	326	CODE
LOW	tests/test_all_rules.py	405	CODE
18 more matches not shown…

Redundant / Tautological Comments22 hits · 36 pts

Severity	File	Line	Snippet	Context
LOW	detection_rules/cli_utils.py	220	# Check if flag or config is set to not include tactic in the filename	COMMENT
LOW	detection_rules/exception.py	232	# Check if self.path has a .toml extension	COMMENT
LOW	detection_rules/kbwrap.py	356	# Assign counts to variables	COMMENT
LOW	detection_rules/kbwrap.py	390	# Check if flag or config is set to not include tactic in the filename	COMMENT
LOW	detection_rules/kbwrap.py	392	# Check if the flag is set to not include tactic in the filename	COMMENT
LOW	detection_rules/action_connector.py	104	# Check if self.path has a .toml extension	COMMENT
LOW	detection_rules/index_mappings.py	398	# Check if the field has a `fields` key	COMMENT
LOW	detection_rules/index_mappings.py	400	# Check if any subfield in `fields` also has a `fields` key	COMMENT
LOW⚡	detection_rules/index_mappings.py	422	# Check if the field is of type 'flattened' and has a 'fields' key	COMMENT
LOW⚡	detection_rules/index_mappings.py	425	# Check if the field is of type 'flattened' and has a 'properties' key	COMMENT
LOW	detection_rules/config.py	329	# Check if the file exists	COMMENT
LOW	detection_rules/rule_validators.py	806	# Check if the column exists in combined_mappings or a valid field generated from a function or operator	COMMENT
LOW	detection_rules/utils.py	76	# Check if the string looks like a JSON list	COMMENT
LOW	detection_rules/integrations.py	117	# Check if the file already exists and handle accordingly	COMMENT
LOW	detection_rules/integrations.py	156	# Check if the file is a match	COMMENT
LOW⚡	tests/test_all_rules.py	1445	# Check if note field contains ## Triage and analysis	COMMENT
LOW⚡	tests/test_all_rules.py	1458	# Check if `### Investigating` is present and if so, check if it is followed by the rule name.	COMMENT
LOW	tests/test_all_rules.py	1415	# Check if the risk_score falls within the range for the severity level	COMMENT
LOW	hunting/definitions.py	59	# Check if either "stats by" or "\| keep" exists in the query	COMMENT
LOW	hunting/utils.py	115	# Check if the folder_name exists and if it's a list, convert it to a dictionary	COMMENT
LOW	hunting/__main__.py	99	# Output results using tabulate	COMMENT
LOW	.github/workflows/esql-validation.yml	25	# Check if the event is a push	COMMENT

Excessive Try-Catch Wrapping28 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	detection_rules/cli_utils.py	394	except Exception as e:	CODE
LOW	detection_rules/exception.py	348	except Exception as e:	CODE
LOW	detection_rules/kbwrap.py	414	except Exception as e:	CODE
LOW	detection_rules/kbwrap.py	489	except Exception as e:	CODE
LOW	detection_rules/kbwrap.py	509	except Exception as e:	CODE
LOW	detection_rules/kbwrap.py	525	except Exception as e:	CODE
LOW	detection_rules/action_connector.py	183	except Exception as e:	CODE
LOW	detection_rules/rule_loader.py	352	except Exception:	CODE
MEDIUM	detection_rules/rule_loader.py	353	print(f"Error loading rule in {path}")	CODE
LOW	detection_rules/rule_loader.py	550	except Exception:	CODE
MEDIUM	detection_rules/rule_loader.py	551	print(f"Error loading rule in {path}")	CODE
LOW	detection_rules/rule_loader.py	735	except Exception as e: # noqa: BLE001	CODE
LOW	detection_rules/remote_validation.py	194	except Exception as exc:	CODE
LOW	detection_rules/remote_validation.py	211	except Exception as exc:	CODE
LOW	detection_rules/remote_validation.py	234	except Exception as exc:	CODE
LOW	detection_rules/rule_validators.py	705	except Exception as exc: # noqa: BLE001	CODE
MEDIUM	detection_rules/beats.py	53	print(f"Error loading {name}, not a valid YAML")	CODE
LOW⚡	detection_rules/devtools.py	1636	except Exception as e: # noqa: BLE001	CODE
LOW⚡	detection_rules/devtools.py	1645	except Exception as e: # noqa: BLE001	CODE
LOW	detection_rules/rule.py	572	except Exception as e:	CODE
LOW	detection_rules/rule.py	583	except Exception as e:	CODE
LOW	detection_rules/rule.py	630	except Exception as e:	CODE
LOW⚡	detection_rules/generic_loader.py	174	except Exception:	CODE
MEDIUM⚡	detection_rules/generic_loader.py	175	print(f"Error loading item in {path}")	CODE
LOW	tests/test_all_rules.py	1642	except Exception: # noqa: BLE001, S112	CODE
LOW	tests/base.py	61	except Exception as e: # noqa: BLE001	CODE
LOW	hunting/run.py	54	except Exception as e: # noqa: BLE001	CODE
LOW	lib/kibana/kibana/resources.py	220	except Exception:	CODE

Modern AI Meta-Vocabulary20 hits · 31 pts

Severity	File	Line	Snippet	Context
MEDIUM	…nse_evasion_bedrock_guardrail_deleted_or_weakened.toml	69	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html"	STRING
MEDIUM	…drock_knowledge_base_or_rag_data_source_poisoning.toml	34	### Investigating AWS Bedrock Knowledge Base or RAG Data Source Tampering	COMMENT
MEDIUM	…ck_multiple_attempts_to_use_denied_models_by_user.toml	53	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…ck_multiple_attempts_to_use_denied_models_by_user.toml	64	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…_guardrails_multiple_violations_in_single_request.toml	57	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…_guardrails_multiple_violations_in_single_request.toml	68	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…_bedrock/aws_bedrock_execution_without_guardrails.toml	56	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…_bedrock/aws_bedrock_execution_without_guardrails.toml	67	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…_bedrock/aws_bedrock_execution_without_guardrails.toml	88	// Filter for invocations without guardrails	STRING
MEDIUM	…k/aws_bedrock_high_resource_consumption_detection.toml	66	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…edrock_high_confidence_misconduct_blocks_detected.toml	56	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…edrock_high_confidence_misconduct_blocks_detected.toml	67	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…iple_sensitive_information_policy_blocks_detected.toml	55	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…iple_sensitive_information_policy_blocks_detected.toml	66	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…aws_bedrock_multiple_topic_policy_blocks_detected.toml	55	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…aws_bedrock_multiple_topic_policy_blocks_detected.toml	66	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…ock_guardrails_multiple_violations_by_single_user.toml	57	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…ock_guardrails_multiple_violations_by_single_user.toml	68	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE
MEDIUM	…/aws_bedrock_multiple_word_policy_blocks_detected.toml	55	"https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html",	STRING
MEDIUM	…/aws_bedrock_multiple_word_policy_blocks_detected.toml	66	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html	CODE

Unused Imports25 hits · 24 pts

Severity	File	Line	Context
LOW	detection_rules/kbwrap.py	31	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/__init__.py	8	CODE
LOW	detection_rules/rule.py	58	CODE
LOW	detection_rules/schemas/__init__.py	18	CODE
LOW	lib/kibana/kibana/__init__.py	8	CODE
LOW	lib/kibana/kibana/__init__.py	9	CODE
LOW	lib/kibana/kibana/__init__.py	9	CODE
LOW	lib/kql/kql/__init__.py	11	CODE
LOW	lib/kql/kql/__init__.py	11	CODE
LOW	lib/kql/kql/parser.py	18	CODE
LOW	lib/kql/kql/evaluator.py	10	CODE

Over-Commented Block18 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	.pre-commit-config.yaml	21	# language: system	COMMENT
LOW	detection_rules/etc/_config.yaml	21	# exception_dir: exceptions	COMMENT
LOW	detection_rules/etc/_config.yaml	41	## ├── exception_1.toml	COMMENT
LOW	detection_rules/etc/_config.yaml	61	# stack-schema-map.yaml file when using a custom rules directory and config.	COMMENT
LOW	detection_rules/etc/_config.yaml	81	# going to the environment variable if both are set. Having both these options allows for configuring testing on	COMMENT
LOW	detection_rules/etc/__init__.py	1	# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one	COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	1	# Purpose: Alignment of stack with beats and ecs versions	COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	21		COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	41	# "8.2.0":	COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	61	# beats: "8.6.1"	COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	81	# beats: "8.10.3"	COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	101	# beats: "8.14.3"	COMMENT
LOW	detection_rules/etc/stack-schema-map.yaml	121	# beats: "8.18.0"	COMMENT
LOW	detection_rules/etc/example_test_config.yaml	1		COMMENT
LOW	tests/kuery/__init__.py	1	# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one	COMMENT
LOW	tests/data/__init__.py	1	# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one	COMMENT
LOW	hunting/__init__.py	1	# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one	COMMENT
LOW	.github/stale.yml	41	closeComment: >	COMMENT

Modern Structural Boilerplate14 hits · 17 pts

Severity	File	Line	Snippet	Context
LOW	detection_rules/custom_schemas.py	89	def update_auto_generated_schema(index: str, field: str, field_type: str \| None = None) -> None:	CODE
LOW	detection_rules/attack.py	185	def update_threat_map(rule_threat_map: list[dict[str, Any]]) -> None:	CODE
LOW⚡	detection_rules/navigator.py	171	def _update_all(self, rule: TOMLRule, tactic: str, technique_id: str) -> None:	CODE
LOW⚡	detection_rules/navigator.py	175	def _update_platforms(self, rule: TOMLRule, tactic: str, technique_id: str) -> None:	CODE
LOW⚡	detection_rules/navigator.py	181	def _update_indexes(self, rule: TOMLRule, tactic: str, technique_id: str) -> None:	CODE
LOW⚡	detection_rules/navigator.py	186	def _update_tags(self, rule: TOMLRule, tactic: str, technique_id: str) -> None:	CODE
LOW	detection_rules/devtools.py	1656	def update_rule_data_schemas() -> None:	CODE
LOW	detection_rules/rule.py	1374	def set_version_lock(self, value: VersionLock) -> None:	CODE
LOW	detection_rules/rule.py	1802	def set_version_lock(self, value: VersionLock \| None) -> None:	CODE
LOW⚡	detection_rules/utils.py	168	def set_all_validation_bypass(env_value: bool = False) -> None:	CODE
LOW⚡	detection_rules/utils.py	174	def set_nested_value(obj: dict[str, Any], compound_key: str, value: Any) -> None:	CODE
LOW	hunting/utils.py	95	def update_index_yml(base_path: Path) -> None:	CODE
LOW	hunting/markdown.py	92	def update_or_add_entry(self, hunt_config: Hunt, toml_path: Path) -> None:	CODE
LOW	hunting/markdown.py	130	def update_index_md(self) -> None:	CODE

Self-Referential Comments6 hits · 17 pts

Severity	File	Line	Snippet	Context
MEDIUM	detection_rules/devtools.py	769	# Create a pull request (not done yet, but we need the PR number)	COMMENT
MEDIUM	detection_rules/custom_rules.py	139	# Create the stack-schema-map.yaml file	COMMENT
MEDIUM	hunting/definitions.py	10	# Define the hunting directory path	COMMENT
MEDIUM	hunting/__main__.py	78	# Create an instance of the QueryIndex class	COMMENT
MEDIUM	hunting/__main__.py	225	# Create a QueryRunner instance	COMMENT
MEDIUM	.github/workflows/kibana-mitre-update.yml	18	KIBANA_ISSUE_NUMBER: 166152 # Define the Kibana issue number as a variable	CODE

Cross-Language Confusion4 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	detection_rules/kbwrap.py	132	action_connector_type_error = "expected value of type [string] but got [undefined]"	CODE
HIGH	tests/test_python_library.py	295	[any where azure.identityprotection.properties.user_principal_name != null] by azure.identityprotection.proper	CODE
HIGH	tests/test_transform_fields.py	27	"""!{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, dis	STRING
HIGH	tests/test_transform_fields.py	107	query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM	STRING

Verbosity Indicators8 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW⚡	hunting/search.py	58	# Step 1: If data source is provided, filter by data source first	COMMENT
LOW⚡	hunting/search.py	67	# Step 2: If MITRE filter is provided, process the filter	COMMENT
LOW	hunting/search.py	80	# Step 3: If keyword is provided, search for it in name, description, and notes	COMMENT
LOW	hunting/search.py	145	# Step 1: Check files first by their 'integration' field	COMMENT
LOW	hunting/search.py	157	# Step 2: Check the index for generic data sources (e.g., 'aws', 'linux')	COMMENT
LOW⚡	…uditd_sensitive_cloud_and_host_identity_file_open.toml	76	### Step 1: Add Auditd Manager in Fleet	COMMENT
LOW⚡	…uditd_sensitive_cloud_and_host_identity_file_open.toml	84	### Step 2: Paste audit rules into Auditd Manager	COMMENT
LOW	…uditd_sensitive_cloud_and_host_identity_file_open.toml	125	### Step 3: Reload and verify	COMMENT

Structural Annotation Overuse8 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW⚡	hunting/search.py	58	# Step 1: If data source is provided, filter by data source first	COMMENT
LOW⚡	hunting/search.py	67	# Step 2: If MITRE filter is provided, process the filter	COMMENT
LOW	hunting/search.py	80	# Step 3: If keyword is provided, search for it in name, description, and notes	COMMENT
LOW	hunting/search.py	145	# Step 1: Check files first by their 'integration' field	COMMENT
LOW	hunting/search.py	157	# Step 2: Check the index for generic data sources (e.g., 'aws', 'linux')	COMMENT
LOW⚡	…uditd_sensitive_cloud_and_host_identity_file_open.toml	76	### Step 1: Add Auditd Manager in Fleet	COMMENT
LOW⚡	…uditd_sensitive_cloud_and_host_identity_file_open.toml	84	### Step 2: Paste audit rules into Auditd Manager	COMMENT
LOW	…uditd_sensitive_cloud_and_host_identity_file_open.toml	125	### Step 3: Reload and verify	COMMENT

AI Slop Vocabulary4 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	detection_rules/rule_loader.py	340	# if it already loaded the rule, then we can just use it from that	COMMENT
LOW	detection_rules/rule_loader.py	537	# if it already loaded the rule, then we can just use it from that	COMMENT
LOW⚡	detection_rules/generic_loader.py	166	# if it already loaded the item, then we can just use it from that	COMMENT
MEDIUM	tests/test_all_rules.py	1239	# skip rules that do not leverage queries (i.e. machine learning)	COMMENT

AI Structural Patterns3 hits · 3 pts

Severity	File	Line	Context
LOW	detection_rules/cli_utils.py	237	CODE
LOW	detection_rules/kbwrap.py	273	CODE
LOW	tests/test_python_library.py	28	CODE

Slop Phrases2 hits · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	…s/aws_bedrock_sensitive_content_refusal_detection.toml	14	gen_ai.completion LIKE "I cannot provide any information about"	STRING
MEDIUM	…e_administrator_privileges_assigned_to_okta_group.toml	47	- Training or onboarding sessions where temporary admin access is granted to groups for demonstration purposes can cause	CODE

Analysis Overview

What These Metrics Mean

Score History

Severity Breakdown

Directory Score Breakdown

Pattern Findings