elastic/detection-rules resource

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2693 stars · 692 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The official open-source repository of detection rules used by Elastic Security's Detection Engine, containing thousands of prebuilt threat detection and threat hunting rules. It also ships Python tooling for parsing, validating, testing, and packaging rules, plus a Kibana API client for Detections-as-Code pipelines.

Use cases

• find prebuilt detection rules for elastic security
• manage detections as code pipelines
• validate and test custom detection rules before deployment
• parse and validate kibana query language (kql) queries
• run red team attack simulations (rtas) to test detection coverage
• map detection rule coverage to mitre att&ck techniques
• contribute new threat detection rules to elastic security

When to choose

• you run elastic security and want the latest community-maintained detection rules
• you want to automate deployment of detection rules via ci/cd (detections as code)
• you need python tooling to lint, test, and package detection rules
• you want to validate kql queries programmatically
• you are building threat hunting queries and want a shared library of hunting content

When to avoid

• you use a siem other than elastic (rules are written for the elastic detection engine and kql)
• you need a general-purpose ids/ips rule format like suricata or sigma without conversion
• you just want to consume rules without engaging with python tooling or kibana apis
• you need managed detection content with vendor support outside the elastic ecosystem

Facets

dataset · maturity active

security monitoring testing parser developer-tools security python detection-rules detections-as-code siem-rules threat-detection-rules kql rule-validation security-analytics elastic-stack rule-packaging adversary-emulation threat-detection threat-hunting siem detection-engineering elastic-security mitre-attack kibana

Member repositories

For agents

markdown · JSON · MCP: product_card(name="elastic/detection-rules")