Elastic Endpoint Behavioral Rules
Open-source detection logic (rules, YARA, EQL) for Elastic Security's endpoint protection against malware, ransomware, and advanced threats.
What is Elastic Endpoint Behavioral Rules?
Protections Artifacts is the open-source repository containing detection logic for Elastic Security's endpoint protection platform. It includes behavioral rules, YARA signatures, and ransomware protection artifacts that help security teams detect and prevent malware, ransomware, and advanced threats. The project provides the underlying rules that power Elastic's endpoint security capabilities.
Security engineers, threat hunters, and SOC analysts using or evaluating Elastic Security for endpoint protection who want transparency into detection logic or need to customize rules.
It offers fully open and transparent detection rules from a major security vendor, allowing teams to audit, understand, and provide feedback on the logic protecting their endpoints without vendor black boxes.
Overview
Elastic Security detection content for Endpoint
Use Cases
Best For
- Auditing detection logic used in Elastic endpoint security
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
