Unusual Traffic to Elastic Deployment

Daniel Koifman@Koifsec

•updated Mar 31, 2026•1•0•53

This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.