You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit elastic.co/guide.

Prebuilt Security Detection Rules

Prebuilt detection rules for Elastic Security

What is an Elastic integration?
Version
8.13.7 (View all)
Compatible Kibana version(s)
8.13.0 or higher
Supported Serverless project types

What's this?
Security
Observability
Subscription level
What's this?
Basic
Level of support
What's this?
Elastic

The detection rules package stores the prebuilt security rules for the Elastic Security detection engine.

To download or update the rules, click Settings > Install Prebuilt Security Detection Rules assets. Then import the rules into the Detection engine.

License Notice

Changelog

VersionDetailsKibana version(s)

8.13.7

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.7-beta.1

Enhancement View pull request
Release security rules update

—

8.13.6

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.6-beta.1

Enhancement View pull request
Release security rules update

—

8.13.5

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.5-beta.1

Enhancement View pull request
Release security rules update

—

8.13.4

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.4-beta.1

Enhancement View pull request
Release security rules update

—

8.13.3

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.3-beta.1

Enhancement View pull request
Release security rules update

—

8.13.2

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.2-beta.1

Enhancement View pull request
Release security rules update

—

8.13.1

Enhancement View pull request
Release security rules update

8.13.0 or higher

8.13.1-beta.1

Enhancement View pull request
Release security rules update

—

8.12.5

Enhancement View pull request
Release security rules update

8.12.0 or higher

8.12.5-beta.1

Enhancement View pull request
Release security rules update

—

8.12.4

Enhancement View pull request
Release security rules update

8.12.0 or higher

8.12.4-beta.1

Enhancement View pull request
Release security rules update

—

8.12.3

Enhancement View pull request
Release security rules update

8.12.0 or higher

8.12.3-beta.1

Enhancement View pull request
Release security rules update

—

8.12.2

Enhancement View pull request
Release security rules update

8.12.0 or higher

8.12.2-beta.1

Enhancement View pull request
Release security rules update

—

8.12.1

Enhancement View pull request
Release security rules update

8.12.0 or higher

8.12.1-beta.1

Enhancement View pull request
Release security rules update

—

8.11.4

Enhancement View pull request
Release security rules update

8.11.0 or higher

8.11.4-beta.1

Enhancement View pull request
Release security rules update

—

8.11.3

Enhancement View pull request
Release security rules update

8.11.0 or higher

8.11.3-beta.1

Enhancement View pull request
Release security rules update

—

8.11.2

Enhancement View pull request
Release security rules update

8.11.0 or higher

8.11.2-beta.1

Enhancement View pull request
Release security rules update

—

8.11.1

Enhancement View pull request
Release security rules update

8.11.0 or higher

8.11.1-beta.1

Enhancement View pull request
Release security rules update

—

8.10.4-beta.1

Enhancement View pull request
Release security rules update

—

8.10.3

Enhancement View pull request
Release security rules update

8.10.1 or higher

8.10.3-beta.1

Enhancement View pull request
Release security rules update

—

8.10.2

Enhancement View pull request
Release security rules update

8.10.0 or higher

8.10.2-beta.1

Enhancement View pull request
Release security rules update

—

8.10.1

Enhancement View pull request
Release security rules update

8.10.0 or higher

8.10.1-beta.1

Enhancement View pull request
Release security rules update

—

8.9.3

Enhancement View pull request
Release security rules update

8.9.0 or higher

8.9.3-beta.1

Enhancement View pull request
Release security rules update

—

8.9.2

Enhancement View pull request
Release security rules update

8.9.0 or higher

8.9.2-beta.1

Enhancement View pull request
Release security rules update

—

8.8.7

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.8.7-beta.1

Enhancement View pull request
Release security rules update

—

8.7.9

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.9-beta.1

Enhancement View pull request
Release security rules update

—

8.6.9

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.9.1

Enhancement View pull request
Release security rules update

8.9.0 or higher

8.8.6

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.7.8

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.6.8

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.5.8

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.8.5

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.8.5-beta.1

Enhancement View pull request
Release security rules update

—

8.7.7

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.7-beta.1

Enhancement View pull request
Release security rules update

—

8.6.7

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.7-beta.1

Enhancement View pull request
Release security rules update

—

8.5.7

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.7-beta.1

Enhancement View pull request
Release security rules update

—

8.8.4

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.8.4-beta.1

Enhancement View pull request
Release security rules update

—

8.7.6

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.6-beta.1

Enhancement View pull request
Release security rules update

—

8.6.6

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.6-beta.1

Enhancement View pull request
Release security rules update

—

8.5.6

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.6-beta.1

Enhancement View pull request
Release security rules update

—

8.8.3

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.8.3-beta.1

Enhancement View pull request
Release security rules update

—

8.7.5

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.5-beta.1

Enhancement View pull request
Release security rules update

—

8.6.5

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.5-beta.1

Enhancement View pull request
Release security rules update

—

8.5.5

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.5-beta.1

Enhancement View pull request
Release security rules update

—

8.8.2

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.8.2-beta.1

Enhancement View pull request
Release security rules update

—

8.7.4

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.4-beta.1

Enhancement View pull request
Release security rules update

—

8.6.4

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.4-beta.1

Enhancement View pull request
Release security rules update

—

8.5.4

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.4-beta.1

Enhancement View pull request
Release security rules update

—

8.8.1

Enhancement View pull request
Release security rules update

8.8.0 or higher

8.8.1-beta.1

Enhancement View pull request
Release security rules update

—

8.7.3

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.3-beta.1

Enhancement View pull request
Release security rules update

—

8.6.3

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.3-beta.1

Enhancement View pull request
Release security rules update

—

8.5.3

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.3-beta.1

Enhancement View pull request
Release security rules update

—

8.4.5

Enhancement View pull request
Release security rules update

8.4.0 or higher

8.4.5-beta.1

Enhancement View pull request
Release security rules update

—

8.7.3-beta.0

Enhancement View pull request
Release security rules update

—

8.7.2

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.2-beta.1

Enhancement View pull request
Release security rules update

—

8.6.2

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.2-beta.1

Enhancement View pull request
Release security rules update

—

8.5.2

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.2-beta.1

Enhancement View pull request
Release security rules update

—

8.4.4

Enhancement View pull request
Release security rules update

8.4.0 or higher

8.4.4-beta.1

Enhancement View pull request
Release security rules update

—

8.7.1

Enhancement View pull request
Release security rules update

8.7.0 or higher

8.7.1-beta.1

Enhancement View pull request
Release security rules update

—

8.6.1

Enhancement View pull request
Release security rules update

8.6.0 or higher

8.6.1-beta.1

Enhancement View pull request
Release security rules update

—

8.5.1

Enhancement View pull request
Release security rules update

8.5.0 or higher

8.5.1-beta.1

Enhancement View pull request
Release security rules update

—

8.4.3

Enhancement View pull request
Release security rules update

8.4.0 or higher

8.4.3-beta.1

Enhancement View pull request
Release security rules update

—

8.4.2

Enhancement View pull request
Release security rules update

8.4.0 or higher

8.4.2-beta.1

Enhancement View pull request
Release security rules update

—

8.3.4

Enhancement View pull request
Release security rules update

8.3.0 or higher

8.3.4-beta.1

Enhancement View pull request
Release security rules update

—

8.3.3

Enhancement View pull request
Release security rules update

8.3.0 or higher

8.4.1

Enhancement View pull request
Release security rules update

8.4.0 or higher

8.3.1

Enhancement View pull request
Release security rules update

8.3.0 or higher

8.2.1

Enhancement View pull request
Release security rules update

8.2.0 or higher

7.16.4

Enhancement View pull request
Release security rules update

7.16.0 or higher

8.1.1

Enhancement View pull request
Release security rules update

8.1.0 or higher

7.16.3

Enhancement View pull request
Release security rules update

7.16.0 or higher

1.0.2

Enhancement View pull request
Release security rules update

8.0.0 or higher

0.16.2

Enhancement View pull request
Release security rules update

—

0.16.1

Enhancement View pull request
Release security rules update

—

1.0.1

Enhancement View pull request
Release security rules update

8.0.0 or higher

0.14.3

Enhancement View pull request
Release security rules update

—

0.14.2

Enhancement View pull request
Release security rules update

—

0.14.1

Enhancement View pull request
Release security rules update

—

0.13.3

Enhancement View pull request
Release security rules update

—

0.13.2

Enhancement View pull request
Release security rules update

—

0.13.1

Enhancement View pull request
Release security rules update

—

0.13.1-dev.0

Bug fix View pull request
Pre-release for 0.13.1 security rules

—

0.13.0

Bug fix View pull request
Fix package for 7.13.0 from detection-rules

—

0.13.0-dev.0

Enhancement View pull request
Publish package for 7.13.0 from detection-rules

—

0.0.3

Bug fix View pull request
Fix security rules naming

—

0.0.2

Enhancement View pull request
Change the rules to match Kibana 7.13 prepackaged

—

0.0.1-dev.3

Enhancement View pull request
Change the integration title

—

0.0.1-dev.2

Enhancement View pull request
Change the saved object type to security-rule

—

0.0.1-dev.1

Enhancement View pull request
Create package for security's detection engine

—

On this page