elastic/protections-artifacts

These are the artifacts that ship inside Elastic Defend, Elastic's endpoint agent — the protections that run on the host itself. They are not the hunting content in elastic-detection-rules, which runs as queries in Elasticsearch. Different execution model, different repository, easy to confuse.

This is the one source in this index carrying two formats, and they work differently:

• YARA (2,087 rules) — pattern matching against files and process memory on the endpoint.
• Elastic TOML behavior rules (1,249) — EQL-style conditions evaluated against endpoint event streams in real time.

The format facet on this page separates them, and you should use it: a YARA rule and a behavior rule answer different questions.

The YARA rules follow Elastic's naming convention — Windows_Trojan_AgentTesla, Linux_Backdoor_AutoColor, ByteCode_MSIL_Ransomware_... — encoding platform, category and family in the rule name itself. That convention is worth knowing because it makes the rule name a usable search key.

The behavior rules under behavior/rules/ are TOML with an EQL-like query field describing a sequence or condition over endpoint events (process, file, network, registry), plus metadata for severity and ATT&CK.

For YARA, a scan match on the endpoint. For behavior rules, the condition matching live event telemetry — which means they can express sequence and temporal relationships that the YARA half cannot.

Both formats land in the same schema, so filter by format before comparing rules from this source with each other.

ATT&CK coverage comes almost entirely from the behavior half — YARA carries no technique field. So the technique count on this page describes roughly a third of the rules, not all of them.

• This is protection content, not hunting content. These rules are tuned to run inside an agent with the agent's context and its own precedence rules. Lifting a behavior rule out and running it as a standalone query will not reproduce what Elastic Defend does with it.
• The two formats are mixed in every unfiltered view of this source. A count of "rules in elastic-protections-artifacts" is a count of two unrelated things unless you split it.