Manage detection rulesedit

The Rules page allows you to view and manage all prebuilt and custom detection rules.

The Rules page

You can sort the rules by clicking the Rule, Last updated, or Enabled column header.

To sort by any other column, switch on the Technical preview toggle above the table. This experimental table view allows advanced sorting capabilities. If you experience performance issues when working with the table, you can turn this setting off.

On the Rules page, you can:

Load and activate prebuilt Elastic rulesedit

To load the Elastic Security app’s prebuilt rules, go to Detect → Rules → Load Elastic prebuilt rules and Timeline templates).

You can then activate whichever rules you want. If you delete any prebuilt rules, a button appears that enables you to reload all of the deleted ones.

Apart from the Elastic Endpoint rule, prebuilt rules are not activated by default. If you want to modify a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. All Elastic prebuilt rules are tagged with the word Elastic.

To learn how to enable detection rules in Elastic Security, watch the tutorial at the end of this topic.

Select and duplicate all prebuilt rulesedit

  1. Go to Detect → Rules.
  2. In the All rules table, click Select all (number) rules.
  3. Click Bulk actionsDuplicate selected.
  4. Select the Custom rules tab.

You can then modify the duplicated rules and, if required, delete the prebuilt ones.

Download latest prebuilt Elastic rulesedit

As of Elastic Stack >=7.13.0, you can download the latest version of Elastic prebuilt rules outside of a regular release cycle. This feature ensures you have the latest detection capabilities before upgrading to the latest Elastic Stack.

To download the latest version of prebuilt rules:

  1. In Kibana, go to ManagementIntegrations.
  2. Search for "Prebuilt Security Detection Rules."
  3. Select the integration, then select the Settings tab. The integration settings page is displayed.

    install prebuilt settings
  4. Click Install Prebuilt Security Detection Rules assets.
  5. Click Install Prebuilt Security Detection Rules to confirm the installation.

    install prebuilt rules

Modify existing rulesedit

You can clone, edit, activate, deactivate, and delete rules:

  1. Go to DetectRules.
  2. Do one of the following:

    • Click the All actions icon (…​) on the appropriate row, then select the required action.
    • In the Rule column, select all the rules you want to modify, then select the required action from the Bulk actions menu.
  3. To activate or deactivate a rule, click the Activated toggle button.

For prebuilt rules, you can only activate, deactivate, delete, edit rule actions, and add exceptions.

Export and import rulesedit

You can export detection rules to an .ndjson file, which you can then import into another Elastic Security environment. The following configuration items are also included in the .ndjson file:

  • Actions
  • Exception lists

Although detection rule actions are included in the exported file, the connectors used by the actions are not included. Use the Saved Objects UI in Kibana (Stack ManagementKibanaSaved Objects) to export and import any necessary connectors before you export and import the detection rules.

Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the Upload value lists UI (DetectRulesUpload value lists) to export and import value lists separately.

To export and import detection rules:

  1. Go to DetectRules.
  2. To export rules:

    1. In the All rules table, select the rules you want to export.
    2. Select Bulk actionsExport selected, then save the exported file.

      You cannot export Elastic prebuilt rules.

  3. To import rules:

    You need at least Read privileges for the Action and Connectors feature to import rules with actions. If you’re importing rules without actions, Action and Connectors feature privileges are not required. Refer to Enable and access detections for more information.

    1. Click Import rules.
    2. Drag and drop the file that contains the detection rules.

      Imported rules must be in an .ndjson file.

    3. (Optional) Select Overwrite existing detection rules with conflicting "rule_id" to update existing rules if they match the rule_id value of any rules in the import file. Configuration data included with the rules, such as actions, is also overwritten.
    4. (Optional) Select Overwrite existing exception lists with conflicting "list_id" to replace existing exception lists with exception lists from the import file if they have a matching list_id value.
    5. Click Import rule.

Tutorial: Enable detection rulesedit

To learn how to enable detection rules in Elastic Security, watch the following tutorial.