Apr 10, 2020 · Hi Team, Can we write an elastic query in condition while defining Detection Rule. I was generating alert using WATCHERS.

Sep 17, 2020 · I have installed stack on AWS, all three(Elastic, Logstash, Kibana) components are on different instance. Stack is running all good and ...

Jul 29, 2022 · Hi, We are using elasticsearch detection engine to run detections through logs data. Most of our detection rules are executed against logs-* ...

Apr 9, 2020 · Hello, i have a problem with setup detections in SIEM. I always get a message with Let's set up your detection engine.

Use the detection engine to create and manage rules and view the alerts these rules create. Rules periodically search indices (such as logs-* and filebeat-* ) ...

About detection rules · Create a detection rule · Manage detection alerts

Specify what data to search by entering individual Elasticsearch index patterns or selecting an existing data view. Use the filter and query fields to create ...

This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security's Detection Engine. This repository was ...

CLI.md · Issues 171 · Pull requests 46 · CONTRIBUTING.md