YourAI.tools
Elastic logo

Skill

detection-rule-management

manage Elastic Security detection rules

Published by Elastic Updated Jul 12
Covers Security Monitoring Elastic Triage

Description

Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

SKILL.md

Detection Rule Management

Manage detection rules using the elastic-security MCP connector. The manage-rules tool renders an interactive rule management dashboard.

Tools (via elastic-security MCP connector)

ToolPurpose
manage-rulesBrowse/search rules with interactive dashboard. Params: filter (KQL)
threat-huntTest queries against live data before creating rules

The dashboard supports searching rules, viewing details, enabling/disabling, validating queries, and viewing noisy rules.

Rule Types

TypeUse caseExample
query (KQL)Simple field matchingprocess.name: "mimikatz.exe"
eqlBehavioral sequencesProcess A spawns B within 5 minutes
esqlAnalytics/aggregationsComplex joins or transformations
thresholdCount/frequency>10 failed logins in 5 minutes
threat_matchIOC correlationMatch against malicious IP indicators
new_termsFirst-time activityUser logs into host for first time

Tuning Strategy (in order of preference)

  1. Add exception — Known-good process/user/host. Does not modify the rule query.
  2. Tighten the query — Exclude FP pattern from the rule query itself.
  3. Adjust threshold/suppression — Increase threshold or enable alert suppression.
  4. Reduce risk score/severity — Downgrade priority if rule has some value but is noisy.
  5. Disable the rule — Last resort. Only if rule provides no value.

Creating New Rules

  1. Define the threat (MITRE technique, data sources, malicious vs legitimate behavior)
  2. Test the query with threat-hunt against live data
  3. Create via the dashboard or ask Claude to help construct the rule JSON
  4. Monitor alert volume and tune false positives

Common Index Patterns

Data typeIndex pattern
Alerts.alerts-security.alerts-*
Processeslogs-endpoint.events.process-*
Networklogs-endpoint.events.network-*
Windowslogs-windows.*
AWSlogs-aws.*
Oktalogs-okta.*
AboutPrivacy PolicyTerms and Conditions

© 2026 YourAI.tools. Every skill from an identity-verified publisher.

Independent catalog. Not affiliated with, endorsed by, or sponsored by Anthropic or any listed publisher. All trademarks belong to their respective owners.