This report summarizes scanner evidence for elastic/detection-rules, a Python project with 2,718 GitHub stars. SynthScan examined 575,287 lines of code across 3114 source files, recording 2394 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 15.9 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 625 finding(s).
Are imports declared and package/API names verified? 36 finding(s).
Are wrappers, guards, and repeated structures necessary? 2179 finding(s).
Which changes need focused human review? 2394 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2394 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_esql_parser.py | 0 | from logs-endpoint.events.process-* metadata _id, _version, _index | where kql( | STRING |
| HIGH | …form/command_and_control_wget_activity_llm_triage.toml | 0 | from logs-endpoint.events.process-* metadata _id, _version, _index | where kql( | STRING |
| HIGH | …form/command_and_control_curl_activity_llm_triage.toml | 0 | from logs-endpoint.events.process-* metadata _id, _version, _index | where kql( | STRING |
| HIGH | …ommand_and_control_curl_download_from_npm_install.toml | 0 | from logs-endpoint.events.process-* metadata _id, _version, _index | where kql( | STRING |
| HIGH | …/credential_access_entra_id_risk_detection_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ing_block/collection_microsoft_purview_dlp_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …initial_access_microsoft_air_investigation_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …vasion_microsoft_security_compliance_admin_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …cess_microsoft_purview_security_compliance_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …/collection_microsoft_purview_insider_risk_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …k/initial_access_microsoft_defender_alerts_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ess_microsoft_defender_threat_intelligence_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …nitial_access_microsoft_quarantine_hygiene_signal.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ge_escalation_endgame_process_injection_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ge_escalation_endgame_cred_manipulation_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | rules/promotions/endgame_ransomware_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …es/promotions/endgame_adversary_behavior_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | rules/promotions/endgame_malware_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …es/promotions/execution_endgame_exploit_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | rules/promotions/endgame_malware_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ege_escalation_endgame_permission_theft_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …lege_escalation_endgame_permission_theft_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ege_escalation_endgame_process_injection_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …ege_escalation_endgame_cred_manipulation_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | rules/promotions/endgame_ransomware_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …s/credential_access_endgame_cred_dumping_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …/credential_access_endgame_cred_dumping_prevented.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …les/promotions/execution_endgame_exploit_detected.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | rules/promotions/external_alerts.toml | 0 | ## setup ### additional notes for information on troubleshooting the maximum alerts warning please refer to this [guide] | STRING |
| HIGH | …k/command_and_control_certutil_network_connection.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …persistence_ml_windows_anomalous_process_creation.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …es/ml/persistence_ml_rare_process_by_host_windows.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …les/windows/defense_evasion_masquerading_werfault.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …startup_folder_file_written_by_suspicious_process.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …ege_escalation_service_control_spawned_script_int.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | rules/windows/execution_via_compiled_html_file.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …/windows/defense_evasion_execution_lolbas_wuauclt.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …ilege_escalation_unusual_parentchild_relationship.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …nd_and_control_remote_file_copy_desktopimgdownldr.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …egister_server_program_connecting_to_the_internet.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …defense_evasion_execution_msbuild_started_renamed.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | rules/windows/lateral_movement_remote_services.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …ows/defense_evasion_suspicious_zoom_child_process.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …es/windows/persistence_system_shells_via_services.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | rules/windows/execution_from_unusual_path_cmdline.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | rules/windows/command_and_control_certreq_postdata.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …es/windows/command_and_control_common_webservices.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …teral_movement_execution_via_file_shares_sequence.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …ows/defense_evasion_suspicious_short_program_name.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …se_evasion_network_connection_from_windows_binary.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …es/windows/defense_evasion_from_unusual_directory.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …s_persistence_network_logon_provider_modification.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …s/credential_access_kerberoasting_unusual_process.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …ding_the_hidden_file_attribute_with_via_attribexe.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | rules/windows/persistence_time_provider_mod.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …elp_executable_program_connecting_to_the_internet.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …dows/defense_evasion_suspicious_certutil_commands.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …indows/discovery_privileged_localgroup_membership.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | …ows/credential_access_lsass_memdump_handle_access.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| HIGH | rules/windows/persistence_startup_folder_scripts.toml | 0 | select description, display_name, name, path, pid, service_type, start_type, status, user_account from services where no | STRING |
| 1618 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/misc.py | 198 | def load_current_package_version() -> str: | CODE |
| LOW | detection_rules/misc.py | 291 | def get_default_elasticsearch_client() -> Elasticsearch: | CODE |
| LOW | detection_rules/misc.py | 318 | def get_default_kibana_client() -> Kibana: | CODE |
| LOW | detection_rules/mixins.py | 42 | def get_dataclass_required_fields(cls: Any) -> list[str]: | CODE |
| LOW | detection_rules/mixins.py | 250 | def validate_field_compatibility(self, data: dict[str, Any], **_: dict[str, Any]) -> None: | CODE |
| LOW | detection_rules/cli_utils.py | 33 | def _get_rule_prompt_required_fields( | CODE |
| LOW | detection_rules/exception.py | 277 | def parse_exceptions_results_from_api( | CODE |
| LOW | detection_rules/action_connector.py | 60 | def from_action_connector_dict( | CODE |
| LOW | detection_rules/action_connector.py | 126 | def parse_action_connector_results_from_api( | CODE |
| LOW | detection_rules/action_connector.py | 141 | def build_action_connector_objects( # noqa: PLR0913, PLR0917 | CODE |
| LOW | detection_rules/index_mappings.py | 59 | def esql_indices_covered_by_packages( | CODE |
| LOW | detection_rules/index_mappings.py | 128 | def collect_known_esql_index_patterns(stream_keys: set[str], indices: list[str]) -> set[str]: | CODE |
| LOW | detection_rules/index_mappings.py | 147 | def assert_known_esql_indices(indices: list[str], stream_keys: set[str]) -> list[str]: | CODE |
| LOW | detection_rules/index_mappings.py | 173 | def validate_offline_esql_from_indices( | CODE |
| LOW | detection_rules/stack_emit.py | 114 | def _atlas_entries_from_mappings(context: EmitContext) -> list[dict[str, Any]]: | CODE |
| LOW | detection_rules/stack_emit.py | 124 | def _apply_related_integrations_gte(obj: dict[str, Any], stack: Version, context: EmitContext) -> None: | CODE |
| LOW | detection_rules/config.py | 410 | def load_current_package_version() -> str: | CODE |
| LOW | detection_rules/esql.py | 46 | def normalize_dataset_package(package: str) -> str: | CODE |
| LOW | detection_rules/esql.py | 73 | def get_esql_query_event_dataset_integrations(query: str, tree: Any | None = None) -> list[EventDataset]: | CODE |
| LOW | detection_rules/esql.py | 134 | def infer_packages_from_indices(indices: list[str]) -> list[str]: | CODE |
| LOW | detection_rules/esql.py | 154 | def collect_index_field_schemas(indices: list[str]) -> dict[str, Any]: | CODE |
| LOW | detection_rules/esql.py | 172 | def collect_lookup_index_field_schemas(indices: list[str]) -> dict[str, dict[str, Any]]: | CODE |
| LOW | detection_rules/esql.py | 219 | def collect_package_fields_for_indices( | CODE |
| LOW | detection_rules/esql.py | 273 | def get_esql_query_source_groups(query: str, tree: Any | None = None) -> list[EsqlSourceGroup]: | CODE |
| LOW | detection_rules/esql.py | 302 | def get_esql_query_source_patterns(query: str, tree: Any | None = None) -> list[tuple[str, str]]: | CODE |
| LOW | detection_rules/esql.py | 322 | def get_esql_lookup_join_targets(query: str, tree: Any | None = None) -> list[str]: | CODE |
| LOW | detection_rules/esql.py | 337 | def replace_esql_query_sources(query: str, replacements: dict[tuple[int, int], str]) -> str: | CODE |
| LOW | detection_rules/rule_loader.py | 142 | def update_metadata_from_file(rule_path: Path, fields_to_update: dict[str, Any]) -> dict[str, Any]: | CODE |
| LOW | detection_rules/docs.py | 731 | def convert_markdown_to_asciidoc(text: str) -> str: | CODE |
| LOW | detection_rules/docs.py | 922 | def generate_current_rule_summary(self) -> None: | CODE |
| LOW | detection_rules/docs.py | 1030 | def generate_downloadable_updates_summary(self) -> None: | STRING |
| LOW | detection_rules/remote_validation.py | 252 | def validate_machine_learning(_: Any, __: TOMLRuleContents) -> dict[str, str]: | CODE |
| LOW | detection_rules/eswrap.py | 47 | def parse_unique_field_results( | CODE |
| LOW | detection_rules/rule_validators.py | 108 | def deduplicate_validation_targets(targets: list[ValidationTarget]) -> list[ValidationTarget]: | CODE |
| LOW | detection_rules/rule_validators.py | 190 | def custom_base_parse_decorator(func: Callable[..., Any]) -> Callable[..., Any]: | CODE |
| LOW | detection_rules/rule_validators.py | 241 | def _prepare_integration_schema( | CODE |
| LOW | detection_rules/rule_validators.py | 378 | def validate_query_text_with_schema( | CODE |
| LOW | detection_rules/rule_validators.py | 458 | def _build_synthetic_sequence_from_subquery(self, subquery: "ast.SubqueryBy") -> str: | CODE |
| LOW | detection_rules/rule_validators.py | 485 | def add_accumulated_integration_targets(query_text: str, packaged: list[dict[str, Any]], context: str) -> None: | CODE |
| LOW | detection_rules/rule_validators.py | 720 | def validate_query_text_with_schema( # noqa: PLR0913, PLR0917 | CODE |
| LOW | detection_rules/rule_validators.py | 783 | def validate_rule_type_configurations(self, data: EQLRuleData, meta: RuleMeta) -> tuple[list[str], bool]: | CODE |
| LOW | detection_rules/rule_validators.py | 814 | def _warm_esql_offline_caches() -> None: | CODE |
| LOW | detection_rules/rule_validators.py | 823 | def _integration_fields_for_indices( # noqa: PLR0913 | CODE |
| LOW | detection_rules/rule_validators.py | 861 | def _lookup_join_schemas_for_stack( | CODE |
| LOW | detection_rules/rule_validators.py | 893 | def _schema_dict_for_from_indices( # noqa: PLR0913, PLR0917 | CODE |
| LOW | detection_rules/rule_validators.py | 1033 | def _validate_nested_queries_with_schema( # noqa: PLR0912, PLR0913, PLR0917 | CODE |
| LOW | detection_rules/rule_validators.py | 1236 | def validate_query_text_with_schema( # noqa: PLR0911, PLR0912, PLR0913, PLR0917 | CODE |
| LOW | detection_rules/rule_validators.py | 1320 | def _unknown_field_from_error(exc: Exception) -> str | None: | CODE |
| LOW | detection_rules/custom_schemas.py | 96 | def update_auto_generated_schema(index: str, field: str, field_type: str | None = None) -> None: | CODE |
| LOW | detection_rules/attack.py | 61 | def get_attack_file_path_for_version(version: str) -> Path: | CODE |
| LOW | detection_rules/attack.py | 197 | def build_attack_lookups_for_version(version: str) -> AttackLookups: | CODE |
| LOW | detection_rules/attack.py | 331 | def build_redirected_techniques_map(threads: int = 50) -> dict[str, Any]: | CODE |
| LOW | detection_rules/attack.py | 350 | def refresh_redirected_techniques_map(threads: int = 50) -> None: | CODE |
| LOW | detection_rules/attack.py | 521 | def build_identity_version_map(framework: str, source_version: str, target_version: str) -> dict[str, Any]: | CODE |
| LOW | detection_rules/attack.py | 597 | def convert_threat_to_version( # noqa: PLR0912, PLR0913, PLR0915 | CODE |
| LOW | detection_rules/attack.py | 783 | def resolve_output_threat_version(stack: Version | str | None = None) -> tuple[str, str]: | CODE |
| LOW | detection_rules/ml.py | 176 | def get_all_existing_model_files(self) -> list[dict[str, Any]]: | CODE |
| LOW | detection_rules/ml.py | 228 | def remove_ml_scripts_pipelines(cls, es_client: Elasticsearch, ml_type: list[str]) -> dict[str, Any]: | CODE |
| LOW | detection_rules/ml.py | 272 | def get_ml_model_manifests_by_model_id(repo_name: str = "elastic/detection-rules") -> dict[str, ReleaseManifest]: | CODE |
| LOW | detection_rules/beats.py | 23 | def _decompress_and_save_schema(url: str, release_name: str) -> None: | CODE |
| 383 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/misc.py | 363 | CODE | |
| LOW | detection_rules/misc.py | 366 | CODE | |
| LOW | detection_rules/misc.py | 382 | CODE | |
| LOW | detection_rules/cli_utils.py | 47 | CODE | |
| LOW | detection_rules/cli_utils.py | 257 | CODE | |
| LOW | detection_rules/exception.py | 277 | CODE | |
| LOW | detection_rules/exception.py | 309 | CODE | |
| LOW | detection_rules/kbwrap.py | 273 | CODE | |
| LOW | detection_rules/kbwrap.py | 556 | CODE | |
| LOW | detection_rules/action_connector.py | 141 | CODE | |
| LOW | detection_rules/config.py | 250 | CODE | |
| LOW | detection_rules/config.py | 157 | CODE | |
| LOW | detection_rules/docs.py | 63 | CODE | |
| LOW | detection_rules/docs.py | 882 | CODE | |
| LOW | detection_rules/eswrap.py | 47 | CODE | |
| LOW | detection_rules/eswrap.py | 184 | CODE | |
| LOW | detection_rules/eswrap.py | 251 | CODE | |
| LOW | detection_rules/rule_validators.py | 108 | CODE | |
| LOW | detection_rules/rule_validators.py | 152 | CODE | |
| LOW | detection_rules/rule_validators.py | 465 | CODE | |
| LOW | detection_rules/rule_validators.py | 720 | CODE | |
| LOW | detection_rules/rule_validators.py | 992 | CODE | |
| LOW | detection_rules/rule_validators.py | 1011 | CODE | |
| LOW | detection_rules/rule_validators.py | 1033 | CODE | |
| LOW | detection_rules/rule_validators.py | 1093 | CODE | |
| LOW | detection_rules/rule_validators.py | 1352 | CODE | |
| LOW | detection_rules/rule_validators.py | 485 | CODE | |
| LOW | detection_rules/version_lock.py | 236 | CODE | |
| LOW | detection_rules/custom_schemas.py | 24 | CODE | |
| LOW | detection_rules/attack.py | 145 | CODE | |
| LOW | detection_rules/attack.py | 597 | CODE | |
| LOW | detection_rules/ml.py | 272 | CODE | |
| LOW | detection_rules/ml.py | 228 | CODE | |
| LOW | detection_rules/beats.py | 23 | CODE | |
| LOW | detection_rules/beats.py | 104 | CODE | |
| LOW | detection_rules/beats.py | 261 | CODE | |
| LOW | detection_rules/navigator.py | 251 | CODE | |
| LOW | detection_rules/devtools.py | 502 | CODE | |
| LOW | detection_rules/devtools.py | 1121 | CODE | |
| LOW | detection_rules/devtools.py | 1667 | CODE | |
| LOW | detection_rules/devtools.py | 1763 | CODE | |
| LOW | detection_rules/rule.py | 657 | CODE | |
| LOW | detection_rules/rule.py | 711 | CODE | |
| LOW | detection_rules/rule.py | 1065 | CODE | |
| LOW | detection_rules/rule.py | 1589 | CODE | |
| LOW | detection_rules/rule.py | 1630 | CODE | |
| LOW | detection_rules/rule.py | 1730 | CODE | |
| LOW | detection_rules/rule.py | 1777 | CODE | |
| LOW | detection_rules/utils.py | 73 | CODE | |
| LOW | detection_rules/rule_formatter.py | 60 | CODE | |
| LOW | detection_rules/rule_formatter.py | 109 | CODE | |
| LOW | detection_rules/rule_formatter.py | 221 | CODE | |
| LOW | detection_rules/rule_formatter.py | 112 | CODE | |
| LOW | detection_rules/rule_formatter.py | 242 | CODE | |
| LOW | detection_rules/generic_loader.py | 139 | CODE | |
| LOW | detection_rules/main.py | 184 | CODE | |
| LOW | detection_rules/main.py | 509 | CODE | |
| LOW | detection_rules/main.py | 563 | CODE | |
| LOW | detection_rules/integrations.py | 149 | CODE | |
| LOW | detection_rules/integrations.py | 229 | CODE | |
| 30 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/cli_utils.py | 419 | except Exception as e: | CODE |
| LOW | detection_rules/exception.py | 348 | except Exception as e: | CODE |
| LOW | detection_rules/kbwrap.py | 414 | except Exception as e: | CODE |
| LOW | detection_rules/kbwrap.py | 489 | except Exception as e: | CODE |
| LOW | detection_rules/kbwrap.py | 509 | except Exception as e: | CODE |
| LOW | detection_rules/kbwrap.py | 525 | except Exception as e: | CODE |
| LOW | detection_rules/action_connector.py | 183 | except Exception as e: | CODE |
| LOW | detection_rules/esql.py | 281 | except Exception: # noqa: BLE001 — incomplete fragments have no FROM groups | CODE |
| LOW | detection_rules/esql.py | 310 | except Exception: # noqa: BLE001 — incomplete fragments yield no sources | CODE |
| LOW | detection_rules/esql.py | 326 | except Exception: # noqa: BLE001 — incomplete fragments yield no lookup targets | CODE |
| LOW | detection_rules/rule_loader.py | 352 | except Exception: | CODE |
| MEDIUM | detection_rules/rule_loader.py | 353 | print(f"Error loading rule in {path}") | CODE |
| LOW | detection_rules/rule_loader.py | 550 | except Exception: | CODE |
| MEDIUM | detection_rules/rule_loader.py | 551 | print(f"Error loading rule in {path}") | CODE |
| LOW | detection_rules/rule_loader.py | 735 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | detection_rules/remote_validation.py | 201 | except Exception as exc: | CODE |
| LOW | detection_rules/remote_validation.py | 224 | except Exception as exc: | CODE |
| LOW | detection_rules/rule_validators.py | 778 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | detection_rules/rule_validators.py | 1029 | except Exception: # noqa: BLE001, S112 — field merge best-effort; schema path raises | CODE |
| LOW | detection_rules/rule_validators.py | 1074 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | detection_rules/rule_validators.py | 1089 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | detection_rules/rule_validators.py | 1285 | except Exception as exc: # noqa: BLE001 | CODE |
| MEDIUM | detection_rules/beats.py | 53 | print(f"Error loading {name}, not a valid YAML") | CODE |
| LOW⚡ | detection_rules/devtools.py | 1554 | except Exception as e: # noqa: BLE001 | CODE |
| LOW⚡ | detection_rules/devtools.py | 1563 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | detection_rules/rule.py | 626 | except Exception as e: | CODE |
| LOW | detection_rules/rule.py | 637 | except Exception as e: | CODE |
| LOW | detection_rules/rule.py | 684 | except Exception as e: | CODE |
| LOW⚡ | detection_rules/generic_loader.py | 174 | except Exception: | CODE |
| MEDIUM⚡ | detection_rules/generic_loader.py | 175 | print(f"Error loading item in {path}") | CODE |
| LOW⚡ | tests/test_esql_parser.py | 560 | except Exception as exc: # noqa: BLE001 — collect all failures | STRING |
| LOW | tests/test_all_rules.py | 1861 | except Exception: # noqa: BLE001, S112 | CODE |
| LOW | tests/base.py | 61 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | hunting/run.py | 54 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | lib/kibana/kibana/resources.py | 220 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | detection_rules/kbwrap.py | 132 | action_connector_type_error = "expected value of type [string] but got [undefined]" | CODE |
| HIGH | detection_rules/attack.py | 370 | # config (or mapped to null) are dropped, so generation is accuracy-first and never invents a mapping. | COMMENT |
| HIGH | detection_rules/ghwrap.py | 125 | # GitHub deletes a gist file when its PATCH value is JSON null, not an empty object. | COMMENT |
| HIGH | tests/test_python_library.py | 295 | [any where azure.identityprotection.properties.user_principal_name != null] by azure.identityprotection.proper | CODE |
| HIGH | tests/test_transform_fields.py | 27 | """!{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, dis | STRING |
| HIGH | tests/test_transform_fields.py | 107 | query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM | STRING |
| HIGH | lib/kql/kql/dsl.py | 174 | # Bare unquoted terms can parse as numbers/booleans/null, but `multi_match.query` | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …nse_evasion_bedrock_guardrail_deleted_or_weakened.toml | 68 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html", | STRING |
| MEDIUM | …drock_knowledge_base_or_rag_data_source_poisoning.toml | 34 | ### Investigating AWS Bedrock Knowledge Base or RAG Data Source Tampering | COMMENT |
| MEDIUM | …ck_multiple_attempts_to_use_denied_models_by_user.toml | 53 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …ck_multiple_attempts_to_use_denied_models_by_user.toml | 64 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …_guardrails_multiple_violations_in_single_request.toml | 57 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …_guardrails_multiple_violations_in_single_request.toml | 68 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …_bedrock/aws_bedrock_execution_without_guardrails.toml | 56 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …_bedrock/aws_bedrock_execution_without_guardrails.toml | 67 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …_bedrock/aws_bedrock_execution_without_guardrails.toml | 97 | // Filter for invocations without guardrails | STRING |
| MEDIUM | …k/aws_bedrock_high_resource_consumption_detection.toml | 66 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …edrock_high_confidence_misconduct_blocks_detected.toml | 56 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …edrock_high_confidence_misconduct_blocks_detected.toml | 67 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …iple_sensitive_information_policy_blocks_detected.toml | 55 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …iple_sensitive_information_policy_blocks_detected.toml | 66 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …drock/execution_bedrock_high_risk_tool_invocation.toml | 55 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html", | STRING |
| MEDIUM | …aws_bedrock_multiple_topic_policy_blocks_detected.toml | 55 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …aws_bedrock_multiple_topic_policy_blocks_detected.toml | 66 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …ock_guardrails_multiple_violations_by_single_user.toml | 57 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …ock_guardrails_multiple_violations_by_single_user.toml | 68 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| MEDIUM | …/aws_bedrock_multiple_word_policy_blocks_detected.toml | 55 | "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html", | STRING |
| MEDIUM | …/aws_bedrock_multiple_word_policy_blocks_detected.toml | 66 | https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/kbwrap.py | 31 | CODE | |
| LOW | detection_rules/stack_emit.py | 25 | CODE | |
| LOW | detection_rules/esql.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/__init__.py | 8 | CODE | |
| LOW | detection_rules/atlas.py | 8 | CODE | |
| LOW | detection_rules/schemas/__init__.py | 18 | CODE | |
| LOW | tests/test_esql_parser.py | 8 | CODE | |
| LOW | tests/test_esql_multi_value.py | 18 | CODE | |
| LOW | lib/kibana/kibana/__init__.py | 8 | CODE | |
| LOW | lib/kibana/kibana/__init__.py | 9 | CODE | |
| LOW | lib/kibana/kibana/__init__.py | 9 | CODE | |
| LOW | lib/kql/kql/__init__.py | 11 | CODE | |
| LOW | lib/kql/kql/__init__.py | 11 | CODE | |
| LOW | lib/kql/kql/parser.py | 18 | CODE | |
| LOW | lib/kql/kql/evaluator.py | 10 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | detection_rules/attack.py | 808 | except ValueError: | CODE |
| HIGH | detection_rules/utils.py | 83 | except json.JSONDecodeError: | CODE |
| HIGH | lib/kibana/kibana/connector.py | 214 | except requests.exceptions.ConnectionError: | CODE |
| HIGH | lib/kql/kql/parser.py | 307 | except ValueError: | CODE |
| HIGH | lib/kql/kql/parser.py | 334 | except ValueError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/cli_utils.py | 234 | # Check if flag or config is set to not include tactic in the filename | COMMENT |
| LOW | detection_rules/exception.py | 232 | # Check if self.path has a .toml extension | COMMENT |
| LOW | detection_rules/kbwrap.py | 356 | # Assign counts to variables | COMMENT |
| LOW | detection_rules/kbwrap.py | 390 | # Check if flag or config is set to not include tactic in the filename | COMMENT |
| LOW | detection_rules/kbwrap.py | 392 | # Check if the flag is set to not include tactic in the filename | COMMENT |
| LOW | detection_rules/action_connector.py | 104 | # Check if self.path has a .toml extension | COMMENT |
| LOW | detection_rules/config.py | 344 | # Check if the file exists | COMMENT |
| LOW | detection_rules/utils.py | 76 | # Check if the string looks like a JSON list | COMMENT |
| LOW | detection_rules/integrations.py | 155 | # Check if the file is a match | COMMENT |
| LOW | detection_rules/integrations.py | 184 | # Check if the file already exists and handle accordingly | COMMENT |
| LOW⚡ | tests/test_all_rules.py | 1649 | # Check if note field contains ## Triage and analysis | COMMENT |
| LOW⚡ | tests/test_all_rules.py | 1662 | # Check if `### Investigating` is present and if so, check if it is followed by the rule name. | COMMENT |
| LOW | tests/test_all_rules.py | 1619 | # Check if the risk_score falls within the range for the severity level | COMMENT |
| LOW | hunting/utils.py | 115 | # Check if the folder_name exists and if it's a list, convert it to a dictionary | COMMENT |
| LOW | hunting/__main__.py | 99 | # Output results using tabulate | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 21 | # language: system | COMMENT |
| LOW | detection_rules/etc/_config.yaml | 21 | # exception_dir: exceptions | COMMENT |
| LOW | detection_rules/etc/_config.yaml | 41 | ## ├── exception_1.toml | COMMENT |
| LOW | detection_rules/etc/_config.yaml | 61 | # stack-schema-map.yaml file when using a custom rules directory and config. | COMMENT |
| LOW | detection_rules/etc/_config.yaml | 81 | # going to the environment variable if both are set. Having both these options allows for configuring testing on | COMMENT |
| LOW | detection_rules/etc/_config.yaml | 101 | # Tactic tags are rewritten to match the emitted threat mapping. | COMMENT |
| LOW | detection_rules/etc/__init__.py | 1 | # Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | COMMENT |
| LOW | detection_rules/etc/stack-schema-map.yaml | 1 | # Purpose: Alignment of stack with beats and ecs versions | COMMENT |
| LOW | detection_rules/etc/stack-schema-map.yaml | 21 | COMMENT | |
| LOW | detection_rules/etc/stack-schema-map.yaml | 41 | # "8.2.0": | COMMENT |
| LOW | detection_rules/etc/stack-schema-map.yaml | 61 | # beats: "8.6.1" | COMMENT |
| LOW | detection_rules/etc/stack-schema-map.yaml | 81 | # beats: "8.10.3" | COMMENT |
| LOW | detection_rules/etc/stack-schema-map.yaml | 101 | # beats: "8.14.3" | COMMENT |
| LOW | detection_rules/etc/stack-schema-map.yaml | 121 | # beats: "8.18.0" | COMMENT |
| LOW | detection_rules/etc/example_test_config.yaml | 1 | COMMENT | |
| LOW | …n_rules/etc/attack-version-maps/attack_v18_to_v19.yaml | 1 | # MITRE ATT&CK v18 -> v19 version mapping. | COMMENT |
| LOW | tests/kuery/__init__.py | 1 | # Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | COMMENT |
| LOW | tests/data/__init__.py | 1 | # Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | COMMENT |
| LOW | hunting/__init__.py | 1 | # Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | COMMENT |
| LOW | .github/stale.yml | 41 | closeComment: > | COMMENT |
| LOW | .github/workflows/release-line-caught-up.yml | 1 | # Gate main merges (and the merge queue) until origin/main's latest merge is | COMMENT |
| LOW | .github/workflows/release-line-caught-up.yml | 21 | # Producer-live detection: if main's backport.yml contains the post-pending job | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | detection_rules/devtools.py | 768 | # Create a pull request (not done yet, but we need the PR number) | COMMENT |
| MEDIUM | detection_rules/custom_rules.py | 139 | # Create the stack-schema-map.yaml file | COMMENT |
| MEDIUM | hunting/definitions.py | 9 | # Define the hunting directory path | COMMENT |
| MEDIUM | hunting/__main__.py | 78 | # Create an instance of the QueryIndex class | COMMENT |
| MEDIUM | hunting/__main__.py | 225 | # Create a QueryRunner instance | COMMENT |
| MEDIUM | .github/workflows/kibana-mitre-update.yml | 19 | KIBANA_ISSUE_NUMBER: 166152 # Define the Kibana issue number as a variable | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/custom_schemas.py | 96 | def update_auto_generated_schema(index: str, field: str, field_type: str | None = None) -> None: | CODE |
| LOW | detection_rules/attack.py | 300 | def update_threat_map(rule_threat_map: list[dict[str, Any]]) -> None: | CODE |
| LOW⚡ | detection_rules/navigator.py | 210 | def _update_all(self, rule: TOMLRule, tactic: str, technique_id: str) -> None: | CODE |
| LOW⚡ | detection_rules/navigator.py | 214 | def _update_platforms(self, rule: TOMLRule, tactic: str, technique_id: str) -> None: | CODE |
| LOW⚡ | detection_rules/navigator.py | 220 | def _update_indexes(self, rule: TOMLRule, tactic: str, technique_id: str) -> None: | CODE |
| LOW⚡ | detection_rules/navigator.py | 225 | def _update_tags(self, rule: TOMLRule, tactic: str, technique_id: str) -> None: | CODE |
| LOW | detection_rules/devtools.py | 1574 | def update_rule_data_schemas() -> None: | CODE |
| LOW | detection_rules/rule.py | 1548 | def set_version_lock(self, value: VersionLock) -> None: | CODE |
| LOW | detection_rules/rule.py | 1991 | def set_version_lock(self, value: VersionLock | None) -> None: | CODE |
| LOW⚡ | detection_rules/utils.py | 168 | def set_all_validation_bypass(env_value: bool = False) -> None: | CODE |
| LOW⚡ | detection_rules/utils.py | 174 | def set_nested_value(obj: dict[str, Any], compound_key: str, value: Any) -> None: | CODE |
| LOW | hunting/utils.py | 95 | def update_index_yml(base_path: Path) -> None: | CODE |
| LOW | hunting/markdown.py | 92 | def update_or_add_entry(self, hunt_config: Hunt, toml_path: Path) -> None: | CODE |
| LOW | hunting/markdown.py | 130 | def update_index_md(self) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | hunting/search.py | 58 | # Step 1: If data source is provided, filter by data source first | COMMENT |
| LOW⚡ | hunting/search.py | 67 | # Step 2: If MITRE filter is provided, process the filter | COMMENT |
| LOW | hunting/search.py | 80 | # Step 3: If keyword is provided, search for it in name, description, and notes | COMMENT |
| LOW | hunting/search.py | 145 | # Step 1: Check files first by their 'integration' field | COMMENT |
| LOW | hunting/search.py | 157 | # Step 2: Check the index for generic data sources (e.g., 'aws', 'linux') | COMMENT |
| LOW⚡ | …uditd_sensitive_cloud_and_host_identity_file_open.toml | 76 | ### Step 1: Add Auditd Manager in Fleet | COMMENT |
| LOW⚡ | …uditd_sensitive_cloud_and_host_identity_file_open.toml | 84 | ### Step 2: Paste audit rules into Auditd Manager | COMMENT |
| LOW | …uditd_sensitive_cloud_and_host_identity_file_open.toml | 125 | ### Step 3: Reload and verify | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | hunting/search.py | 58 | # Step 1: If data source is provided, filter by data source first | COMMENT |
| LOW⚡ | hunting/search.py | 67 | # Step 2: If MITRE filter is provided, process the filter | COMMENT |
| LOW | hunting/search.py | 80 | # Step 3: If keyword is provided, search for it in name, description, and notes | COMMENT |
| LOW | hunting/search.py | 145 | # Step 1: Check files first by their 'integration' field | COMMENT |
| LOW | hunting/search.py | 157 | # Step 2: Check the index for generic data sources (e.g., 'aws', 'linux') | COMMENT |
| LOW⚡ | …uditd_sensitive_cloud_and_host_identity_file_open.toml | 76 | ### Step 1: Add Auditd Manager in Fleet | COMMENT |
| LOW⚡ | …uditd_sensitive_cloud_and_host_identity_file_open.toml | 84 | ### Step 2: Paste audit rules into Auditd Manager | COMMENT |
| LOW | …uditd_sensitive_cloud_and_host_identity_file_open.toml | 125 | ### Step 3: Reload and verify | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/rule_loader.py | 340 | # if it already loaded the rule, then we can just use it from that | COMMENT |
| LOW | detection_rules/rule_loader.py | 537 | # if it already loaded the rule, then we can just use it from that | COMMENT |
| LOW⚡ | detection_rules/generic_loader.py | 166 | # if it already loaded the item, then we can just use it from that | COMMENT |
| MEDIUM | tests/test_all_rules.py | 1443 | # skip rules that do not leverage queries (i.e. machine learning) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …s/aws_bedrock_sensitive_content_refusal_detection.toml | 14 | gen_ai.completion LIKE "*I cannot provide any information about*" | STRING |
| MEDIUM | …_evasion_gcp_vertexai_repeated_assistant_refusals.toml | 32 | (assistant text such as "I cannot fulfill…", "I cannot provide…", "unable to assist…", or | CODE |
| MEDIUM | …_evasion_gcp_vertexai_repeated_assistant_refusals.toml | 101 | response_text like "*i cannot provide*" or | STRING |
| MEDIUM | …e_administrator_privileges_assigned_to_okta_group.toml | 47 | - Training or onboarding sessions where temporary admin access is granted to groups for demonstration purposes can cause | CODE |
| MEDIUM | …sion_azure_ai_foundry_repeated_assistant_refusals.toml | 110 | Esql.reply_text like "*I cannot provide*" or | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | detection_rules/cli_utils.py | 257 | CODE | |
| LOW | detection_rules/kbwrap.py | 273 | CODE | |
| LOW | tests/test_python_library.py | 28 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | detection_rules/etc/_config.yaml | 94 | # --------------------------------------------------------- | COMMENT |