Issues

• Bucket-level monitor filter silently returns 0 hits for wildcard-typed fields

  untriaged
  opensearch-project/security-analytics#1826 · Filter by author thecodingshrimp opened on Sep 23, 2026

• [AUTOCUT] Integration Test Failed for security-analytics-3.9.0

  autocutuntriagedv3.9.0
  opensearch-project/security-analytics#1825 · Filter by author opensearch-ci-bot opened on Sep 23, 2026

• [RELEASE] Release version 3.10.0

  untriaged
  opensearch-project/security-analytics#1824 · Filter by author opensearch-ci-bot opened on Sep 22, 2026

• Make auto_expand_replicas bounds configurable via cluster settings

  enhancementuntriaged
  opensearch-project/security-analytics#1814 · Filter by author ns-akariya opened on Sep 15, 2026
  1

• [FEATURE] [RFC] FAIR-Aligned Cyber Risk Quantification (CRQ) & Financial Loss Attribution for Security Analytics Findings

  untriaged
  opensearch-project/security-analytics#1806 · Filter by author AAH20 opened on Sep 4, 2026

• [BUG] Unable to create a Correlation Rule

  buguntriaged
  opensearch-project/security-analytics#1799 · Filter by author sbhiens25 opened on Aug 25, 2026

• fix: NullPointerException in RuleIndices when log type has no field mappings, and UnsupportedOperationException risk in CustomLogType from immutable map deserialization

  untriaged
  opensearch-project/security-analytics#1796 · Filter by author thecodingshrimp opened on Aug 21, 2026
  2

• [RELEASE] Release version 3.9.0

  untriaged
  opensearch-project/security-analytics#1787 · Filter by author opensearch-ci-bot opened on Aug 8, 2026

• [BUG] Findings history deleted by alert retention instead of finding retention

  buguntriaged
  opensearch-project/security-analytics#1759 · Filter by author Aravinth31 opened on Aug 4, 2026
  1

• [FEATURE] Add Sigma rule for AWS IAM privilege escalation — AdministratorAccess policy attachment detection

  enhancementuntriaged
  opensearch-project/security-analytics#1752 · Filter by author mmnur opened on Jul 30, 2026

• [BUG] Cannot create a detector for a Sigma rule with an aggregation expression (500 NullPointerException)

  buguntriaged
  opensearch-project/security-analytics#1750 · Filter by author Noam-Alum opened on Jul 30, 2026
  2

• [BUG] Query Field Names missing from Finding Index Mapping

  buguntriaged
  opensearch-project/security-analytics#1745 · Filter by author engechas opened on Jul 2, 2026

• [RELEASE] Release version 3.8.0

  releasev3.8.0
  opensearch-project/security-analytics#1743 · Filter by author opensearch-ci-bot opened on Jun 30, 2026
  1

• [BUG] OSMapping uses timestamp alias instead of ECS-standard @timestamp, breaking time-range filters for ECS-compliant indices

  untriaged
  opensearch-project/security-analytics#1731 · Filter by author thecodingshrimp opened on Jun 10, 2026

• [BUG] TransportIndexDetectorAction: chained_findings monitor created with deleteQueryIndexInEveryRun=true causing index churn

  opensearch-project/security-analytics#1725 · Filter by author thecodingshrimp opened on May 21, 2026

• [FEATURE] Preserve Sigma rule UUID or support non-ATT&CK namespaced metadata/tags

  enhancement
  opensearch-project/security-analytics#1724 · Filter by author cmklem opened on May 21, 2026
  2

• [BUG] [alerting_exception] kotlin.collections.EmptyMap cannot be cast to kotlin.collections.MutableMap

  bug
  opensearch-project/security-analytics#1721 · Filter by author NLoi7 opened on May 18, 2026

• [BUG] Clearing a detector's rules causes the underlying workflow to be orphaned

  bug
  opensearch-project/security-analytics#1720 · Filter by author engechas opened on May 15, 2026
  1

• [FEATURE] Correlation rule for cross-index field matching

  enhancement
  opensearch-project/security-analytics#1690 · Filter by author vikhy-aws opened on Apr 7, 2026
  1

• [RELEASE] Release version 3.7.0

  v3.7.0
  opensearch-project/security-analytics#1683 · Filter by author opensearch-trigger-bot opened on Mar 31, 2026
  2

• [BUG] Doc-Level Monitor Produces False Negatives When Detector Has More Than 10 Rules

  bug
  opensearch-project/security-analytics#1656 · Filter by author joshikunal94 opened on Mar 25, 2026
  1

• [FEATURE] Warning system when detector query becomes too large

  enhancement
  opensearch-project/security-analytics#1655 · Filter by author AWSHurneyt opened on Mar 11, 2026
  1

• [FEATURE] Exception Rule

  enhancement
  opensearch-project/security-analytics#1647 · Filter by author wang-scw opened on Feb 11, 2026
  1

• [RELEASE] Release version 3.6.0

  v3.6.0
  opensearch-project/security-analytics#1645 · Filter by author opensearch-trigger-bot opened on Feb 6, 2026
  2

• [BUG] Rule query index template misses log types with empty mappings (e.g. apache_access)

  bug
  opensearch-project/security-analytics#1640 · Filter by author hyanggeun opened on Feb 3, 2026
  1