Promote Experimental rules to Stable

[alessandrarizzo]

Background

Changes

Testing

[cursor]

PR Summary

Medium Risk
Primarily configuration changes that enable/promote multiple new detections, which could increase alert volume and change severities for RDS/Kubernetes/OpenAI monitoring.

Overview
Expands managed detection coverage and promotes rules out of Experimental. The AWS core pack now includes additional RDS CloudTrail detections (activity stream stopped, automated backup deletion, failover, deletion protection disabled, IAM role added, made public, rebooted, SG ingress authorized, cross-region snapshot copy) and adds AWS.STS.GetCallerIdentity.TruffleHog.

The unified Kubernetes pack now includes two RBAC detections for risky role creation (Kubernetes.Role.NodeProxyPermissions, Kubernetes.Role.PodExec), and the OpenAI pack adds OpenAI.CredentialStuffing. Several rule metadata files drop the Status: Experimental marker to reflect stable promotion.

^{Reviewed by Cursor Bugbot for commit f0af158. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a44c25b. Configure here.}