You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/detections/prebuilt-rules-management.asciidoc
+17-13Lines changed: 17 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -17,9 +17,7 @@ Follow these guidelines to start using the {security-app}'s <<prebuilt-rules, pr
17
17
[NOTE]
18
18
====
19
19
* Most prebuilt rules don't start running by default. You can use the **Install and enable** option to start running rules as you install them, or first install the rules, then enable them manually. After installation, only a few prebuilt rules will be enabled by default, such as the Endpoint Security rule.
20
-
21
-
* You can't modify most settings on Elastic prebuilt rules. You can only edit <<rule-notifications, rule actions>> and <<add-exceptions, add exceptions>>. If you want to modify other settings on a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. However, your customized rule is entirely separate from the original prebuilt rule, and will not get updates from Elastic if the prebuilt rule is updated.
22
-
20
+
* Without an https://www.elastic.co/subscriptions/cloud[Enterprise] subscription, you can't modify most settings on Elastic prebuilt rules. You must first duplicate them, then make your changes to the duplicated rules. Refer to <<select-all-prebuilt-rules>> to learn more.
23
21
* Automatic updates of Elastic prebuilt rules are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re on {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.
* Enable a single rule: Turn on the rule's *Enabled* switch.
57
55
* Enable multiple rules: Select the rules, then click *Bulk actions* -> *Enable*.
58
56
59
-
Once you enable a rule, it starts running on its configured schedule. To confirm that it's running successfully, check its *Last response* status in the rules table, or open the rule's details page and check the <<rule-execution-logs, *Execution results*>> tab.
57
+
Once you enable a rule, it starts running on its configured schedule. To confirm that it's running successfully, check its *Last response* status in the Rules table, or open the rule's details page and check the <<rule-execution-logs, *Execution results*>> tab.
58
+
59
+
If you have an https://www.elastic.co/subscriptions/cloud[Enterprise] subscription, you can also <<edit-rules-settings,edit the prebuilt rules>> that you've installed.
60
60
61
61
[float]
62
62
[[prebuilt-rule-tags]]
@@ -84,22 +84,26 @@ Each prebuilt rule includes several tags identifying the rule's purpose, detecti
84
84
85
85
[float]
86
86
[[select-all-prebuilt-rules]]
87
-
=== Select and duplicate all prebuilt rules
87
+
=== Select and duplicate prebuilt rules
88
+
89
+
Without an https://www.elastic.co/subscriptions/cloud[Enterprise] subscription, you can't modify most settings on Elastic prebuilt rules. You can only edit <<rule-notifications, rule actions>> and <<add-exceptions, add exceptions>>. If you want to modify other settings on a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. Note that your customized rule is entirely separate from the original prebuilt rule, and will not get updates from Elastic if the prebuilt rule is updated.
88
90
89
91
. Find *Detection rules (SIEM)* in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
90
92
. In the *Rules* table, select the *Elastic rules* filter.
91
-
. Click *Select all _x_ rules* above the rules table.
93
+
. Select one or more rules, or click *Select all _x_ rules* above the rules table.
92
94
. Click *Bulk actions* -> *Duplicate*.
93
-
. Select whether to duplicate the rules' exceptions, then click *Duplicate*.
95
+
. (Optional) Select whether to duplicate the rules' exceptions, then click *Duplicate*.
94
96
95
-
You can then modify the duplicated rules and, if required, delete the prebuilt ones. However, your customized rules are entirely separate from the original prebuilt rules, and will not get updates from Elastic if the prebuilt rules are updated.
97
+
You can then modify the duplicated rules and, if required, delete the prebuilt ones.
96
98
97
99
[float]
98
100
[[update-prebuilt-rules]]
99
101
=== Update Elastic prebuilt rules
100
102
101
103
Elastic regularly updates prebuilt rules to optimize their performance and ensure they detect the latest threats and techniques. When updated versions are available for your installed prebuilt rules, the *Rule Updates* tab appears on the *Rules* page, allowing you to update your installed rules with the latest versions.
102
104
105
+
IMPORTANT: The following steps are only applicable if you have a https://www.elastic.co/subscriptions/cloud[Platinum] subscription or lower. If you have an Enterprise subscription, follow the guidelines in <<prebuilt-rules-update-modified-unmodified>> instead.
106
+
103
107
. Find *Detection rules (SIEM)* in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
104
108
. In the *Rules* table, select the *Rule Updates* tab.
105
109
+
@@ -110,16 +114,16 @@ image::images/prebuilt-rules-update.png[The Rule Updates tab on the Rules page]
110
114
111
115
. (Optional) To examine the details of a rule's latest version before you update it, select the rule name. This opens the rule details flyout.
112
116
+
113
-
Select the *Updates* tab to view rule changes field by field, or the *JSON view* tab to view changes for the entire rule in JSON format. Both tabs display side-by-side comparisons of the *Current rule* (what you currently have installed) and the *Elastic update* version (what you can choose to install). Deleted characters are highlighted in red; added characters are highlighted in green.
117
+
Select the *Elastic update overview* tab to view rule changes field by field, or the *JSON view* tab to view changes for the entire rule in JSON format. Both tabs display side-by-side comparisons of the *Current rule* (what you currently have installed) and the *Elastic update* version (what you can choose to install). Deleted characters are highlighted in red; added characters are highlighted in green.
114
118
+
115
-
To accept the changes and install the updated version, select *Update*.
119
+
To accept the changes and install the updated version, select *Update rule*.
. Do one of the following to update prebuilt rules on the *Rules* page:
124
+
. Do one of the following to update prebuilt rules on the *Rule Updates* tab:
121
125
* Update all available rules: Click *Update all*.
122
126
* Update a single rule: Click *Update rule* for that rule.
123
127
* Update multiple rules: Select the rules and click *Update _x_ selected rule(s)*.
124
128
+
125
-
TIP: Use the search bar and *Tags* filter to find the rules you want to update. For example, filter by `OS: Windows` if your environment only includes Windows endpoints. For more on tag categories, refer to <<prebuilt-rule-tags>>.
129
+
TIP: Use the search bar and *Tags* filter to find the rules you want to update. For example, filter by `OS: Windows` if your environment only includes Windows endpoints. For more on tag categories, refer to <<prebuilt-rule-tags>>.
== Update modified and unmodified Elastic prebuilt rules
3
+
4
+
.Requirements
5
+
[sidebar]
6
+
--
7
+
You must have an https://www.elastic.co/subscriptions/cloud[Enterprise] subscription to access this feature. If you have a Platinum subscription or lower, follow the guidelines in <<update-prebuilt-rules>> instead.
8
+
--
9
+
10
+
This page provides instructions for updating modified and unmodified prebuilt rules. You can also find information about <<rule-field-update-statuses,statuses>> or <<resolve-reduce-rule-conflicts,conflicts>> that you might encounter when updating rules.
11
+
12
+
To update rules:
13
+
14
+
. Find *Detection rules (SIEM)* in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
15
+
. In the *Rules* table, select the *Rule Updates* tab.
16
+
+
17
+
NOTE: The *Rule Updates* tab doesn't appear if all your installed prebuilt rules are up to date.
18
+
+
19
+
[role="screenshot"]
20
+
image::images/prebuilt-rules-update-advanced.png[The Rule Updates tab on the Rules page]
21
+
22
+
. (Optional) To examine the details of a rule's latest version before you update it, select the rule name. This opens the rule update flyout, where you can:
23
+
24
+
** Preview incoming updates: Select the *Elastic update overview* tab to view rule changes field by field, or the *JSON view* tab to view changes for the entire rule in JSON format.
25
+
26
+
** Compare different versions of a rule field: Use the **Diff view** drop-down menu to compare different versions of a rule field. For example, compare the changes that you made to the current version of the field with changes that will be applied from the incoming Elastic update.
27
+
+
28
+
NOTE: If you haven't updated the rule in a while, its original version might be unavailable for comparison. Instead, you will only have access to the rule's current version and the incoming Elastic update. You can avoid this by updating prebuilt rules more often.
29
+
30
+
** Check the update status: View the status of the entire rule update and for <<rule-field-update-statuses,each field that's being changed>>.
31
+
32
+
** Address update conflicts: Find and address conflicts that <<resolve-reduce-rule-conflicts, need additional attention>>.
33
+
34
+
** Edit the final update: Change the update that will be applied to the field when you update the rule. To change the update, go to the *Final update* section, make your changes, and then save them.
35
+
+
36
+
IMPORTANT: Elastic updates containing a rule type change cannot be edited. Before updating the rule, duplicate it if you need to record changes that you made to the rule fields.
. From the *Rule Updates* tab, do one of the following to update prebuilt rules:
43
+
+
44
+
* Update all available rules: Click *Update all*. If any rules have conflicts, you will be prompted to take <<resolve-reduce-rule-conflicts,additional action>>.
45
+
* Update a single rule without conflicts: Click *Update rule* for that rule.
46
+
* Update multiple rules: Select the rules and click *Update _x_ selected rule(s)*. If any rules have conflicts, you will be prompted to take additional action.
47
+
+
48
+
[TIP]
49
+
====
50
+
51
+
To find specific rules to update:
52
+
53
+
* Use the **Modified/Unmodified** drop-down menu to only display modified or unmodified prebuilt rules.
54
+
* Use the search bar and *Tags* filter to find the rules you want to update. For example, filter by `OS: Windows` if your environment only includes Windows endpoints. For more on tag categories, refer to <<prebuilt-rule-tags>>.
55
+
56
+
====
57
+
58
+
[float]
59
+
[[rule-field-update-statuses]]
60
+
=== Understand rule field update statuses
61
+
62
+
This table describes statuses that might appear for rule fields being updated.
63
+
64
+
[width="100%",cols="2",options="header"]
65
+
|==============================================
66
+
|Status |Description
67
+
68
+
|*Ready for update* a|Displays when there are no conflicts to resolve.
69
+
70
+
Further action is not required for the field. It is ready to be updated.
71
+
72
+
|*No update* a|Displays when the field is not being updated by Elastic, but the current field value differs from the original one. This typically happens when the field's value was changed after the prebuilt rule was initially installed.
73
+
74
+
Further action is not required for the field. It is ready to be updated.
75
+
76
+
TIP: You can still change the final field update, if needed. To do so, make your changes in the *Final update* section and save them.
77
+
78
+
|*Review required* a|Displays when Elastic auto-resolves a conflict between the current field value and the value from the incoming Elastic update.
79
+
80
+
You must accept or edit the field's final update and save the changes. Refer to <<resolve-reduce-rule-conflicts>> to learn more about auto-resolved conflicts and how to reduce future conflicts.
81
+
82
+
|*Action required* a|Displays when Elastic could not auto-resolve the conflict between the current field value and the value from the incoming Elastic update.
83
+
84
+
You must manually set and save the field's final update. Refer to <<resolve-reduce-rule-conflicts>> to learn more about conflicts that need manual fixes and how to reduce future conflicts.
85
+
86
+
|==============================================
87
+
88
+
89
+
[float]
90
+
[[resolve-reduce-rule-conflicts]]
91
+
=== Resolve and reduce update conflicts
92
+
93
+
Keeping prebuilt rules up to date might help you minimize the frequency and complexity of conflicts that occur during rule updates.
94
+
95
+
When a conflict does happen, Elastic attempts to resolve it and will suggest a fix for your review. This is called an _auto-resolved conflict_. You can still update rules with auto-resolved conflicts, but we advise against bulk-updating multiple rules as it's risky and can sometimes lead to lost rule modifications and other issues. Instead, we recommend carefully reviewing each rule with auto-resolved conflicts from the rule update flyout.
96
+
97
+
If Elastic can't resolve a conflict, you must manually fix it before updating the rule. This is called an _unresolved conflict_. To fix unresolved conflicts in a rule, do the following:
98
+
99
+
. From the **Rule update** tab, click on the rule name or click **Review**. This opens the rule update flyout, where you can find rule fields with unresolved conflicts.
100
+
+
101
+
TIP: Fields with unresolved conflicts have the `Action required` status.
102
+
103
+
. Go to the *Final update* section and do any of the following:
104
+
** Keep the current value instead of accepting the Elastic update.
105
+
** Accept the Elastic update and overwrite the current value.
106
+
** Edit the final field value by combining the current value with the Elastic update or making the appropriate changes.
107
+
. Click **Save and accept** to apply your changes. The field's status changes to `Ready for update`.
108
+
109
+
After you've resolved the remaining conflicts, click *Update rule* to accept the changes and install the updated version.
0 commit comments