DaC Reference

================================ Detections as Code


Elastic Reference
_______________
Managing Elastic Security Security Detection Rules Using DaC

⚠️ Note: The Detection Rules DaC feature is still in Beta. This phase includes continued testing to include edge cases and feedback from the community. This reference guide, content within these slides, and associated content are subject to change.

Documentation

• DaC Concept and Workflows
  • Overview
  • Applying DaC Principles to Rules in Elastic
  • Managing Detection Rules beyond Elastic Security with VCS
  • How to use this reference
  • Overall Elastic DaC Diagram
  • Core Components of DaC Delineation
  • Governance Models of Dac Delineation
• Core components and Governance Models of DaC
  • Core components of Detections as Code
  • Governance Models Dictating the Core Components of DaC
  • Sub-Components and Options
  • Detailed Considerations of the Different Governance Models
• Internals of the detection-rules Repo and How it is Used Internally
  • Overview of Elastic Detection Rules Repo and Usage
  • Getting Started with the Repo
  • CLI
  • Unit tests
  • Schemas and Data Structures
  • Incorporating Custom Rules
  • Creating Detection Rules
  • Rule Versioning
  • Exceptions and Actions
  • Unit testing
  • Rule Schema Validation
  • Detection Logic Validation
• Core Component: Managing Detection Rules in a VCS
  • Overview
  • Considerations
  • Sub-Component 1: Elastic Detection Rules Repo and Usage
  • Sub-Component 2: Incorporating Custom Rules
  • Sub-Component 3: Creating Detection Rules
  • Sub-Component 4: Rule Versioning
  • Sub-Component 5: Exceptions and Actions
  • Sub-Component 6: Unit testing
  • Sub-Component 7: Rule Schema Validation
  • Sub-Component 8: Detection Logic Validation
• Core Component: Syncing Rules and Data from VCS to Elastic Security
  • Overview
  • Considerations
  • Sub-Component 1: Deploying via Direct HTTP Request API Calls
  • Sub-Component 2: Deploying via CI/CD
  • Sub-Component 3: Pre-Production Testing
• Core Component: Managing Detection Rules in Elastic Security
  • Overview
  • Considerations
  • Sub-Component 1: Source of Truth
• Core Component: Syncing Rules and Data from Elastic Security to VCS
  • Overview
  • Considerations
  • Sub-Component 1: Exporting Rules via Direct HTTP Request API Calls
  • Sub-Component 2: Exporting Rules via CI/CD
  • Sub-Component 3 (optional): Unit Testing Rules via CI/CD
• E2E Reference
  • Quick Start Slides
  • Demo Video
  • Quick Start Example Detection Rules CLI Commands
• Feedback and Resources
  • Feedback
  • Updates and Next Steps
  • Resources
• Known Issues and Limitations Using Elastic’s detection-rules DAC Approach
  • Intermittent Exception List Kibana Import Issue
  • Schema Validation Support
  • No Direct Support
  • Potential Upcoming Enhancements
• About this guide and project
  • Licensing and Use
• Frequently Asked Questions