[Rule Tuning] Add Corelight support for existing rules

detection_rules/schemas/definitions.py

@@ -91,6 +91,7 @@ def validator_wrapper(value: Any) -> Any:
     "apm",
     "auditd_manager",
     "cloud_defend",
+    "corelight",
     "endpoint",
     "jamf_protect",
     "network_traffic",

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.7.1"
+version = "1.7.2"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"

rules/network/command_and_control_port_26_activity.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-integration = ["network_traffic", "panw", "pfsense", "zeek"]
+integration = ["network_traffic", "panw", "pfsense", "zeek", "corelight"]
 maturity = "production"
-updated_date = "2026/06/08"
+updated_date = "2026/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     """,
 ]
 from = "now-9m"
-index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*"]
+index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*", "logs-corelight.*"]
 language = "kuery"
 license = "Elastic License v2"
 name = "SMTP on Port 26/TCP"
@@ -33,6 +33,7 @@ tags = ["Tactic: Command and Control",
         "Tactic: Exfiltration",
         "Domain: Endpoint",
         "Use Case: Threat Detection",
+        "Data Source: Corelight",
         "Data Source: PAN-OS",
         "Data Source: Network Traffic",
         "Data Source: pfSense",

rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-integration = ["network_traffic", "panw", "pfsense", "zeek"]
+integration = ["network_traffic", "panw", "pfsense", "zeek", "corelight"]
 maturity = "production"
-updated_date = "2026/06/08"
+updated_date = "2026/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -23,7 +23,7 @@ false_positives = [
     """,
 ]
 from = "now-9m"
-index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*"]
+index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*", "logs-corelight.*"]
 language = "kuery"
 license = "Elastic License v2"
 name = "RDP (Remote Desktop Protocol) from the Internet"
@@ -36,6 +36,7 @@ tags = ["Tactic: Command and Control",
     "Tactic: Initial Access",
     "Domain: Endpoint",
     "Use Case: Threat Detection",
+    "Data Source: Corelight",
     "Data Source: PAN-OS",
     "Data Source: Network Traffic",
     "Data Source: pfSense",

rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-integration = ["network_traffic", "panw", "pfsense", "zeek"]
+integration = ["network_traffic", "panw", "pfsense", "zeek", "corelight"]
 maturity = "production"
-updated_date = "2026/06/08"
+updated_date = "2026/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ directly exposed to the Internet, as it is frequently targeted and exploited by
 backdoor vector.
 """
 from = "now-9m"
-index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*"]
+index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*", "logs-corelight.*"]
 language = "kuery"
 license = "Elastic License v2"
 name = "RPC (Remote Procedure Call) from the Internet"
@@ -24,6 +24,7 @@ severity = "high"
 tags = ["Tactic: Initial Access",
         "Domain: Endpoint",
         "Use Case: Threat Detection",
+        "Data Source: Corelight",
         "Data Source: Network Traffic",
         "Data Source: PAN-OS",
         "Data Source: pfSense",

rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-integration = ["network_traffic", "panw", "pfsense", "zeek"]
+integration = ["network_traffic", "panw", "pfsense", "zeek", "corelight"]
 maturity = "production"
-updated_date = "2026/06/08"
+updated_date = "2026/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ directly exposed to the Internet, as it is frequently targeted and exploited by
 backdoor vector.
 """
 from = "now-9m"
-index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*"]
+index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*", "logs-corelight.*"]
 language = "kuery"
 license = "Elastic License v2"
 name = "RPC (Remote Procedure Call) to the Internet"
@@ -25,6 +25,7 @@ tags = ["Tactic: Initial Access",
     "Tactic: Lateral Movement",
     "Domain: Endpoint",
     "Use Case: Threat Detection",
+    "Data Source: Corelight",
     "Data Source: PAN-OS",
     "Data Source: Network Traffic",
     "Data Source: pfSense",

rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-integration = ["network_traffic", "panw", "pfsense", "zeek"]
+integration = ["network_traffic", "panw", "pfsense", "zeek", "corelight"]
 maturity = "production"
-updated_date = "2026/06/08"
+updated_date = "2026/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ systems. It should almost never be directly exposed to the Internet, as it is fr
 threat actors as an initial access or backdoor vector or for data exfiltration.
 """
 from = "now-9m"
-index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*"]
+index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*", "logs-corelight.*"]
 language = "kuery"
 license = "Elastic License v2"
 name = "SMB (Windows File Sharing) Activity to the Internet"
@@ -25,6 +25,7 @@ tags = ["Tactic: Initial Access",
         "Tactic: Exfiltration",
         "Domain: Network",
         "Use Case: Threat Detection",
+        "Data Source: Corelight",
         "Data Source: PAN-OS",
         "Data Source: Network Traffic",
         "Data Source: pfSense",

rules/network/lateral_movement_dns_server_overflow.toml

@@ -1,16 +1,16 @@
 [metadata]
 creation_date = "2020/07/16"
-integration = ["network_traffic", "panw", "zeek"]
+integration = ["network_traffic", "panw", "zeek", "corelight"]
 maturity = "production"
-updated_date = "2026/05/28"
+updated_date = "2026/06/24"
 
 [rule]
 author = ["Elastic"]
 description = """
 Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in
 Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.
 """
-index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-zeek.*"]
+index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-zeek.*", "logs-corelight.*"]
 language = "kuery"
 license = "Elastic License v2"
 name = "Abnormally Large DNS Response"
@@ -32,7 +32,7 @@ Detection alerts from this rule indicate possible anomalous activity around larg
 
 - Based on this rule, which looks for a threshold of 65k bytes, activity below this value is expected to be legitimate. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses in observed attacks were all greater than 65k bytes.
 - This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to determine the source of the activity and potentially allowlist the source host.
-- Network security devices such as PAN-OS firewalls, Fortinet, and NetFlow exporters record `destination.bytes` as the total bytes across an entire session rather than a single DNS response. Long-lived flow records (`event.duration` > 60 seconds) with `event.action` of `flow_terminated` or `network_flow` are excluded to reduce this noise. Duration is used rather than packet count because a genuine SigRed TCP exchange completes in seconds and cannot be made to exceed 60 seconds by an attacker continuing to use the connection.
+- Network security devices such as PAN-OS firewalls, Fortinet, and NetFlow exporters, as well as Zeek/Corelight connection summary records, record `destination.bytes` as the total bytes across an entire session rather than a single DNS response. Long-lived flow or connection records (`event.duration` > 60 seconds) are excluded to reduce this noise. Duration is used rather than packet count because a genuine SigRed TCP exchange completes in seconds and cannot be made to exceed 60 seconds by an attacker continuing to use the connection.
 
 ### Related rules
 
@@ -62,6 +62,7 @@ tags = [
     "Tactic: Impact",
     "Resources: Investigation Guide",
     "Use Case: Vulnerability",
+    "Data Source: Corelight",
     "Data Source: PAN-OS",
     "Data Source: Network Traffic",
     "Data Source: Zeek",
@@ -72,12 +73,17 @@ type = "query"
 query = '''
 ((event.category:(network or network_traffic) and destination.port:53) 
       or network.protocol:"dns" 
-      or data_stream.dataset:(network_traffic.dns or zeek.dns))
+      or data_stream.dataset:(network_traffic.dns or zeek.dns)
+      or (event.module:corelight and event.dataset:dns))
     and destination.bytes >= 65000
     and event.type:("allowed" or "end" or "protocol" or "start")
 and not (
-  event.action:("flow_terminated" or "network_flow")
-  and event.duration > 60000000000
+  event.duration > 60000000000
+  and (
+    event.action:("flow_terminated" or "network_flow")
+    or data_stream.dataset:zeek.connection
+    or (event.module:corelight and event.dataset:conn)
+  )
 )
 '''