[tradebot-elastic]

What does this PR do?

Update the Security Rules package to version 9.5.1.
Autogenerated from commit https://github.com/elastic/detection-rules/tree/5781a43aaca4182308a6cd600c6144f358523df3

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Author's Checklist

• Install the most recently release security rules in the Detection Engine
• Install the package
• Confirm the update is available in Kibana. Click "Update X rules" or "Install X rules"
• Look at the changes made after the install and confirm they are consistent

How to test this PR locally

• Perform the above checklist, and use package-storage to build EPR from source

Related issues

None

Screenshots

None

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 63f2d3d

Failed CI Steps

• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.6.0-SNAPSHOT ECH
• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.6.0-SNAPSHOT ECH
• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.6.0-SNAPSHOT ECH
• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.6.0-SNAPSHOT ECH
• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.6.0-SNAPSHOT ECH
• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.5.0-SNAPSHOT ECH

History

cc @shashank-elastic

[github-actions]

TL;DR

Both OOM-testing jobs failed during the shared EPR deployment phase, after the endpoint package was successfully built and uploaded. The EPR VM does not have a running package-registry container, so the cache-refresh restart command exhausted all five retries; this is an EPR infrastructure/deployment issue, not a failure introduced by the package version-only changes in this PR.

Remediation

• Restore or recreate the package-registry container on the EPR VM, then rerun the 9.5.0-SNAPSHOT and 9.6.0-SNAPSHOT OOM-testing jobs.
• If the container is intentionally renamed or no longer required, update deploy-epr.sh/the EPR deployment configuration to target the current service before retrying.
• Validate that the package registry is reachable and that the endpoint package cache refresh completes before rerunning the OOM tests.

Investigation details

Root Cause

The deployment script completed endpoint package build and upload, then failed while refreshing the EPR VM package cache because Docker reported No such container: package-registry. The retry wrapper repeated the same missing-container error five times and exited with status 1. Both reported failures use the same deployment step and log, matching a shared EPR environment problem.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/46422
• Jobs: https://buildkite.com/elastic/appex-qa-stateful-security-prebuilt-rules-ftr-oom-testing/builds/1924 and https://buildkite.com/elastic/appex-qa-stateful-security-prebuilt-rules-ftr-oom-testing/builds/1925
• Log: after === Upload endpoint package, the upload reaches 100%; at Restart docker at the EPR VM, Docker returns Error response from daemon: No such container: package-registry on retries 1/5 through 5/5, followed by user command error: exit status 1.
• PR diff: only updates packages/security_detection_engine/manifest.yml from 9.5.1-beta.1 to 9.5.1 and adds its changelog entry; it does not change deployment configuration.

Verification

• Reviewed the failed deployment log and PR diff; no tests were run because the failure occurred before OOM testing started.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

Package security_detection_engine - 9.5.1 containing this change is available at https://epr.elastic.co/package/security_detection_engine/9.5.1/