elastic / detection-rules

Intro

For duplication, we look at places in code where there are 6 or more lines of code that are exactly the same.
Before duplication is calculated, the code is cleaned to remove empty lines, comments, and frequently duplicated constructs such as imports.
You should aim at having as little as possible (<5%) of duplicated code as high-level of duplication can lead to maintenance difficulties, poor factoring, and logical contradictions.

Learn more...

Duplication Overall

53% duplication:

169,299 cleaned lines of cleaned code (without empty lines, comments, and frequently duplicated constructs such as imports)
90,503 duplicated lines

223,804 duplicates

dependency graphs: 2D graph | 3D graph | 3D graph (with duplicates)...

Duplication per Extension

Duplication per Component (primary)

Duplication Between Components (50+ lines)

Download: SVG DOT (open online Graphviz editor)

From Component --> To Component	Duplicated Lines	File Pairs	Details
rules (11%) --> rules_building_block (218%)	34464	9944 file pairs	details...
hunting (<1%) --> rules (<1%)	102	7 file pairs	details...

Open 2D force graph... Open 3D force graph...

Show more details on duplication between components...

Longest Duplicates

The list of 50 longest duplicates.

See data for all 223,804 duplicates...

Size	#	Folders	Files	Lines	Code
76	x 2	rules/_deprecated rules/_deprecated	threat_intel_filebeat8x.toml threat_intel_fleet_integrations.toml	97:190 (49%) 97:190 (49%)	view
68	x 2	rules/windows rules/windows	command_and_control_new_terms_commonl... command_and_control_new_terms_commonl...	136:203 (24%) 206:273 (24%)	view
61	x 2	rules/ml rules/ml	credential_access_ml_windows_anomalou... credential_access_ml_windows_anomalou...	61:132 (54%) 63:134 (53%)	view
61	x 2	rules/ml rules/ml	persistence_ml_rare_process_by_host_w... persistence_ml_windows_anomalous_serv...	116:187 (38%) 64:135 (53%)	view
56	x 2	rules/windows rules/windows	command_and_control_remote_file_copy_... command_and_control_remote_file_copy_...	1:65 (35%) 1:65 (35%)	view
55	x 2	rules/ml rules/ml	credential_access_ml_suspicious_login... initial_access_ml_auth_rare_source_ip...	22:87 (45%) 22:87 (45%)	view
55	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_source_ip...	25:90 (44%) 22:87 (45%)	view
55	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... credential_access_ml_suspicious_login...	25:90 (44%) 22:87 (45%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_hour_for_...	25:89 (40%) 21:85 (49%)	view
54	x 2	rules/ml rules/ml	persistence_ml_windows_anomalous_path... persistence_ml_windows_anomalous_proc...	66:127 (41%) 116:177 (31%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... credential_access_ml_auth_spike_in_lo...	26:90 (43%) 25:89 (40%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_user_logo...	25:89 (40%) 28:92 (43%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... initial_access_ml_auth_rare_hour_for_...	26:90 (43%) 21:85 (49%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... initial_access_ml_auth_rare_user_logo...	26:90 (43%) 28:92 (43%)	view
54	x 2	rules/ml rules/ml	initial_access_ml_auth_rare_hour_for_... initial_access_ml_auth_rare_user_logo...	21:85 (49%) 28:92 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_source_ip...	25:88 (39%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	persistence_ml_windows_anomalous_proc... persistence_ml_windows_anomalous_serv...	119:179 (33%) 64:124 (46%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... credential_access_ml_auth_spike_in_lo...	25:88 (42%) 25:88 (39%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... credential_access_ml_suspicious_login...	25:88 (39%) 22:85 (43%)	view
53	x 2	rules/windows rules_building_block	command_and_control_remote_file_copy_... command_and_control_certutil_network_...	4:65 (33%) 5:66 (35%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_hour_for_...	25:88 (42%) 21:84 (48%)	view
53	x 2	rules/_deprecated rules/threat_intel	threat_intel_filebeat8x.toml threat_intel_indicator_match_hash.toml	97:159 (34%) 133:195 (27%)	view
53	x 2	rules/ml rules/ml	initial_access_ml_auth_rare_hour_for_... initial_access_ml_auth_rare_source_ip...	21:84 (48%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	initial_access_ml_windows_anomalous_u... initial_access_ml_windows_rare_user_t...	42:102 (50%) 35:95 (59%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_suspicious_login... initial_access_ml_auth_rare_user_logo...	22:85 (43%) 28:91 (42%)	view
53	x 2	rules/ml rules/ml	persistence_ml_rare_process_by_host_w... persistence_ml_windows_anomalous_proc...	116:176 (33%) 119:179 (33%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... credential_access_ml_auth_spike_in_lo...	26:89 (43%) 25:88 (42%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... credential_access_ml_suspicious_login...	26:89 (43%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... initial_access_ml_auth_rare_source_ip...	26:89 (43%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	initial_access_ml_auth_rare_source_ip... initial_access_ml_auth_rare_user_logo...	22:85 (43%) 28:91 (42%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_suspicious_login... initial_access_ml_auth_rare_hour_for_...	22:85 (43%) 21:84 (48%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_user_logo...	25:88 (42%) 28:91 (42%)	view
53	x 2	rules/windows rules_building_block	command_and_control_remote_file_copy_... command_and_control_certutil_network_...	4:65 (33%) 5:66 (35%)	view
53	x 2	rules/_deprecated rules/threat_intel	threat_intel_fleet_integrations.toml threat_intel_indicator_match_hash.toml	97:159 (34%) 133:195 (27%)	view
52	x 2	rules/windows rules/windows	command_and_control_common_webservice... command_and_control_remote_file_copy_...	7:66 (16%) 7:66 (32%)	view
51	x 2	rules/windows rules_building_block	command_and_control_common_webservice... command_and_control_certutil_network_...	7:65 (16%) 8:66 (33%)	view
51	x 2	rules/windows rules/windows	command_and_control_common_webservice... command_and_control_remote_file_copy_...	7:65 (16%) 7:65 (32%)	view
49	x 2	rules/linux rules/linux	discovery_linux_hping_activity.toml discovery_linux_nping_activity.toml	69:124 (41%) 69:124 (41%)	view
48	x 2	rules/_deprecated rules/linux	discovery_suspicious_network_tool_lau... discovery_suspicious_network_tool_lau...	69:128 (44%) 87:147 (39%)	view
48	x 2	rules/integrations/okta rules/integrations/okta	credential_access_okta_authentication... credential_access_okta_multiple_devic...	30:79 (41%) 30:79 (41%)	view
47	x 2	rules/ml rules/ml	persistence_ml_rare_process_by_host_w... persistence_ml_windows_anomalous_proc...	60:114 (29%) 60:114 (27%)	view
47	x 2	rules/linux rules/linux	defense_evasion_hidden_shared_object.... defense_evasion_log_files_deleted.toml	56:110 (43%) 59:113 (37%)	view
47	x 2	rules/linux rules/linux	defense_evasion_chattr_immutable_file... defense_evasion_hidden_shared_object....	57:111 (40%) 56:110 (43%)	view
47	x 2	rules/ml rules/ml	persistence_ml_rare_process_by_host_w... persistence_ml_windows_anomalous_proc...	60:114 (29%) 63:117 (29%)	view
47	x 2	rules/ml rules/ml	persistence_ml_windows_anomalous_proc... persistence_ml_windows_anomalous_proc...	60:114 (27%) 63:117 (29%)	view
47	x 2	rules/linux rules/linux	defense_evasion_chattr_immutable_file... defense_evasion_log_files_deleted.toml	57:111 (40%) 59:113 (37%)	view
47	x 2	rules/linux rules/linux	execution_process_backgrounded_by_unu... execution_unusual_pkexec_execution.toml	60:113 (37%) 61:114 (37%)	view
45	x 2	rules/linux rules/linux	lateral_movement_telnet_network_activ... lateral_movement_telnet_network_activ...	63:114 (38%) 64:115 (38%)	view
45	x 2	rules/_deprecated rules/linux	credential_access_collection_sensitiv... credential_access_collection_sensitiv...	87:143 (37%) 79:135 (40%)	view
44	x 2	rules/integrations/endpoint rules/integrations/endpoint	defense_evasion_elastic_memory_threat... defense_evasion_elastic_memory_threat...	115:169 (31%) 114:168 (31%)	view