opensearch-project/security-analytics

View on GitHub

Security Analytics enables users for detecting security threats on their security event log data. It will also allow them to modify/tailor the pre-packaged solution.

Stars: 111
Forks: 111
Open beginner issues: 1
Indexed issues: 153
Avg merge: 1d 17h
Merged PRs (30d): 13

Dominant language: Java
License: Apache-2.0
Last GitHub push: Sep 16, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

153 open issues indexed

Make auto_expand_replicas bounds configurable via cluster settings Open

enhancement untriaged

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security-analytics#1814 · 1 comment · Opened Sep 15, 2026
[BUG] Unable to create a Correlation Rule Open

bug untriaged

Difficulty 3/5 1-2 days Newbie friendliness 55/100

opensearch-project/security-analytics#1799 · Opened Aug 25, 2026
fix: NullPointerException in RuleIndices when log type has no field mappings, and UnsupportedOperationException risk in CustomLogType from immutable map deserialization Open

untriaged

Difficulty 3/5 1-2 days Newbie friendliness 68/100

opensearch-project/security-analytics#1796 · 2 comments · Opened Aug 21, 2026
[RELEASE] Release version 3.9.0 Open

untriaged

Difficulty 5/5 Over a week Newbie friendliness 20/100

opensearch-project/security-analytics#1787 · Opened Aug 8, 2026
[BUG] Findings history deleted by alert retention instead of finding retention Open

bug untriaged

Difficulty 3/5 1-2 days Newbie friendliness 74/100

opensearch-project/security-analytics#1759 · 1 comment · Opened Aug 4, 2026
[FEATURE] Add Sigma rule for AWS IAM privilege escalation — AdministratorAccess policy attachment detection Open

enhancement untriaged

Difficulty 3/5 1-2 days Newbie friendliness 78/100

opensearch-project/security-analytics#1752 · Opened Jul 30, 2026
[BUG] Cannot create a detector for a Sigma rule with an aggregation expression (500 NullPointerException) Open

bug untriaged

Difficulty 4/5 3-5 days Newbie friendliness 58/100

opensearch-project/security-analytics#1750 · 2 comments · Opened Jul 30, 2026
[BUG] Query Field Names missing from Finding Index Mapping Open

bug untriaged

Difficulty 1/5 Under an hour Newbie friendliness 88/100

opensearch-project/security-analytics#1745 · Opened Jul 2, 2026
[RELEASE] Release version 3.8.0 Open

release v3.8.0

Difficulty 5/5 Over a week Newbie friendliness 20/100

opensearch-project/security-analytics#1743 · 1 comment · Opened Jun 30, 2026
[BUG] OSMapping uses `timestamp` alias instead of ECS-standard `@timestamp`, breaking time-range filters for ECS-compliant indices Open

untriaged

Difficulty 4/5 3-5 days Newbie friendliness 56/100

opensearch-project/security-analytics#1731 · Opened Jun 10, 2026
[BUG] TransportIndexDetectorAction: chained_findings monitor created with deleteQueryIndexInEveryRun=true causing index churn Open

Difficulty 1/5 Under an hour Newbie friendliness 78/100

opensearch-project/security-analytics#1725 · 1 reaction · Opened May 21, 2026
[FEATURE] Preserve Sigma rule UUID or support non-ATT&CK namespaced metadata/tags Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security-analytics#1724 · 1 comment · Opened May 21, 2026
[BUG] [alerting_exception] kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security-analytics#1721 · Opened May 18, 2026
[BUG] Clearing a detector's rules causes the underlying workflow to be orphaned Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security-analytics#1720 · 1 comment · Opened May 15, 2026
[FEATURE] Correlation rule for cross-index field matching Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

opensearch-project/security-analytics#1690 · 1 comment · Opened Apr 7, 2026
[RELEASE] Release version 3.7.0 Open

v3.7.0

Difficulty 5/5 Over a week Newbie friendliness 25/100

opensearch-project/security-analytics#1683 · 2 comments · Opened Mar 31, 2026
[BUG] Doc-Level Monitor Produces False Negatives When Detector Has More Than 10 Rules Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

opensearch-project/security-analytics#1656 · 1 comment · Opened Mar 25, 2026
[FEATURE] Warning system when detector query becomes too large Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security-analytics#1655 · 1 comment · Opened Mar 11, 2026
[FEATURE] Exception Rule Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

opensearch-project/security-analytics#1647 · 1 comment · Opened Feb 11, 2026
[RELEASE] Release version 3.6.0 Open

v3.6.0

Difficulty 5/5 Over a week Newbie friendliness 20/100

opensearch-project/security-analytics#1645 · 2 comments · Opened Feb 6, 2026
[BUG] Rule query index template misses log types with empty mappings (e.g. apache_access) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security-analytics#1640 · 1 comment · Opened Feb 3, 2026
[Feature Request] Add INVESTIGATION in detection rule. Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1633 · 2 comments · Opened Jan 22, 2026
[BUG] Error Creating Security Detector "Request Timeout after 30000ms" Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

opensearch-project/security-analytics#1632 · 2 comments · Opened Jan 12, 2026
[BUG]Security Analytics: Query index alias deleted on detector removal, causing rollover and IndexNotFoundException Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

opensearch-project/security-analytics#1630 · 3 comments · Opened Dec 23, 2025
[BUG] Correlation Rule does not persist Notification Channel in Alert Trigger (OpenSearch 3.3.0 / SA 3.3.2) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

opensearch-project/security-analytics#1617 · 1 comment · Opened Nov 20, 2025
[FEATURE] Request: Adopt Proper Elastic Common Schema (ECS) Field Mappings Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1615 · 2 comments · 2 reactions · Opened Nov 4, 2025
[BUG] Remove dependency on opaque JAR Open

bug v3.4.0

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security-analytics#1599 · 2 comments · 2 reactions · Opened Oct 23, 2025
[FEATURE] Sigma rule - exists modifier Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security-analytics#1576 · 1 comment · Opened Sep 15, 2025
[FEATURE] Need Custom Cron Schedule feature in Security Analytics detectors Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security-analytics#1575 · 3 comments · Opened Sep 10, 2025
[Action Required] Enable required status checks Open

enhancement v3.3.0

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1573 · 3 comments · Opened Sep 2, 2025
[OFFICE HOURS] Plugin status Open

office hours

Difficulty 1/5 Under an hour Newbie friendliness 15/100

opensearch-project/security-analytics#1570 · 2 comments · Opened Aug 20, 2025
[BUG] Hardcoded auto_expand_replicas 0-20 causes yellow cluster state when same_shard.host setting is enabled Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1559 · 1 comment · 1 reaction · Opened Jul 17, 2025
[FEATURE] Support for multiple fields In the correlation rule Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

opensearch-project/security-analytics#1558 · Opened Jul 14, 2025
[BUG] Attempt to disable an active rule under a threat detector causes an error Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1553 · 3 comments · Opened Jun 20, 2025
[BUG] Updating Security Analytics rule UUID does not work Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

opensearch-project/security-analytics#1540 · 1 comment · Opened Jun 13, 2025
Subscribe findings API should accept a list of findings instead Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security-analytics#1537 · 1 comment · Opened Jun 9, 2025
Auto-merge version increment PRs Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 25/100

opensearch-project/security-analytics#1531 · 1 comment · Opened May 16, 2025
[FEATURE] Add API endpoints to retrieve data from existing objects using their IDs Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

opensearch-project/security-analytics#1529 · 1 comment · Opened May 9, 2025
[BUG] Security Analytics/Threat Intelligence is not generating findings for custom IOC source feeds, and also stops generating findings for Alienvault after a period of time Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1528 · 2 comments · 1 reaction · Opened May 8, 2025
[BUG] New detection rules created by Security Analytics generates a fixed rule uuid Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

opensearch-project/security-analytics#1527 · 1 comment · Opened May 7, 2025
[RELEASE] Release version 3.1.0 Open

v3.1.0

Difficulty 5/5 Over a week Newbie friendliness 15/100

opensearch-project/security-analytics#1518 · 1 comment · Opened Apr 29, 2025
[FEATURE] Implement WithFieldName interface for QueryBuilder implementations in plugins Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 42/100

opensearch-project/security-analytics#1509 · 1 comment · Opened Apr 23, 2025
[BUG] The provided expression matches an alias, specify the corresponding concrete indices instead. Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security-analytics#1477 · 4 comments · Opened Feb 13, 2025
[BUG] Alerts created from "NoOp trigger" with "Error" status Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

opensearch-project/security-analytics#1476 · 4 comments · Opened Feb 13, 2025
[BUG] Detector for System Activity: Microsoft Windows times out, then gets created twice Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

opensearch-project/security-analytics#1475 · 2 comments · 1 reaction · Opened Feb 13, 2025
Onboard OpenSearch plugins to Smoke tests framework Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

opensearch-project/security-analytics#1474 · 3 comments · Opened Feb 13, 2025
[Release 3.0] Planned Breaking Changes for 3.0 in Plugin Open

release v3.0.0

Difficulty 5/5 Over a week Newbie friendliness 20/100

opensearch-project/security-analytics#1453 · 3 comments · Opened Jan 16, 2025
[AUTOCUT] Distribution Build Failed for security-analytics-2.18.1 Open

autocut v2.18.1

Difficulty 4/5 3-5 days Newbie friendliness 25/100

opensearch-project/security-analytics#1452 · 1 comment · Opened Jan 15, 2025
[BUG] getting ActionRequestValidationException in correlate API in findings page and unable to create graph Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

opensearch-project/security-analytics#1441 · 1 comment · Opened Dec 31, 2024
[BUG] Failed to deploy OS with 2.19.0 version Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

opensearch-project/security-analytics#1440 · 2 comments · Opened Dec 30, 2024

opensearch-project/security-analytics

Get new issues in your inbox