elastic · eric-forte-elastic · Mar 20, 2025 · Mar 20, 2025
diff --git a/.github/workflows/react-tests-dispatcher.yml b/.github/workflows/react-tests-dispatcher.yml
@@ -22,7 +22,6 @@ on:
       - '!rules/integrations/o365/*.toml'
       - '!rules/integrations/okta/*.toml'
       - '!rules/integrations/problemchild/*.toml'
-      - '!rules/integrations/pad/*.toml'
 
 jobs:
   dispatch:

@@ -178,7 +178,7 @@ def validator(value):
     'Use Case: Vulnerability'
 ]
 NonEmptyStr = NewType('NonEmptyStr', str, validate=validate.Length(min=1))
-MACHINE_LEARNING_PACKAGES = ['LMD', 'DGA', 'DED', 'ProblemChild', 'Beaconing', 'PAD']
+MACHINE_LEARNING_PACKAGES = ['LMD', 'DGA', 'DED', 'ProblemChild', 'Beaconing']
 AlertSuppressionGroupBy = NewType('AlertSuppressionGroupBy', List[NonEmptyStr], validate=validate.Length(min=1, max=3))
 AlertSuppressionMissing = NewType('AlertSuppressionMissing', str,
                                   validate=validate.OneOf(['suppress', 'doNotSuppress']))

diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "0.4.24"
+version = "0.4.23"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"

diff --git a/...grations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml b/...grations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml
diff --git a/...ions/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml b/...ions/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml