Manage detection rules at scale

Teams that run large sets of detection rules (prebuilt, custom, or both) have recurring operational work. Rules need to be audited for health, errors need to be surfaced quickly, coverage needs to be tracked against a framework, and status often needs to flow back to an external tracker.

Use workflows to automate these rule-operations tasks. Workflows can query detection engine APIs on a schedule, post summaries to a chat channel, index results for dashboarding, or open a ticket when something is wrong, all using existing workflow building blocks.

Stack 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. To enable or disable rules from a workflow, prefer the named security.enableRule and security.disableRule steps over a generic kibana.request call to the detection engine _bulk_action API.

The following patterns combine scheduled triggers with named Detection rules action steps and Kibana request actions to drive rule-operations work:

• Audit rule health on a schedule. A scheduled workflow queries the detection engine API for rule status, filters for rules in an error or disabled state, and publishes a daily summary.
• Stack 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Enable or disable rules by ID or query. Use security.enableRule / security.disableRule to change rule state with schema-validated inputs and partial-failure reporting, instead of hand-writing a bulk-action request.
• Surface rule errors. Use if steps to branch on rule status and send a targeted notification when the failing rule is business-critical.
• Report on coverage. Use foreach steps to iterate over rules, group by tag or framework mapping, and index the result to an Elasticsearch index for dashboard visualization.
• Sync rule status to external systems. Use HTTP actions to mirror rule status into an external tracker, or post to Slack or PagerDuty when a rule crosses a threshold.

Step-by-step guides for rule-operations workflows:

• Run detection rules on demand: Manually re-run one or more detection rules over a configurable time range. Useful for gap-filling, post-incident review, and scheduled rule-health checks.

• Detection rules action steps: Enable or disable detection rules with security.enableRule and security.disableRule.
• Scheduled triggers: Run workflows on a cron-like schedule.
• Kibana action steps: Reference for generic Kibana API requests.
• Foreach step: Iterate over arrays returned by API calls.
• Detection rule concepts: Background on how detection rules work.