Details
When editing the Alerts page KQL query bar filter or editing the KQL query bar filter on the rule edit page, you might encounter a UI bug requiring you to select a data view to proceed.

Workaround
Select the Edit the query filter using DSL option.

Details
Configuration options for rule action frequency are unavailable when creating and editing rules. Rules with action frequencies that are already configured still run correctly.

Workaround
Use the update rule API to change a rule’s action frequency settings. Alternatively, export a rule, update its action frequency settings, and then re-import the rule.

Details
The JSON comparison for updated prebuilt detection rules might display some properties used for internal processing, which doesn’t accurately indicate how the rule will change if you update it.

For example, if you added automated actions or an exception list to an installed rule, the comparison shows the JSON properties actions, response_actions, or exceptions_list in the Base version (your installed version) but not in the Update column (Elastic’s latest version). When you update the rule, it will still include your actions or exceptions — they will not be removed.

Similarly, the comparison might show a difference in the enabled property, but upgrading the rule will not change whether your installed rule is enabled or not. Other properties that might display in the comparison but don’t actually indicate rule configuration changes include execution_summary, timestamp_override_fallback_disabled, meta, filters, updated_at, and output_index.

Workaround
No workaround is needed. You can ignore these unrelated property differences in the JSON comparison.