DaC Reference

================================ Detections as Code


Elastic Reference
_______________
Managing Elastic Security Security Detection Rules Using DaC

⚠️ Note: The alpha detection-rules DAC-feature branch, content within these slides, and this reference guide are subject to change. Once we finally migrate the changes to the main branch, we will update the content accordingly.

Documentation

• DaC Concept and Workflows
  • Overview
  • Applying DaC Principles to Rules in Elastic
  • Managing Detection Rules beyond Elastic Security with VCS
  • How to use this reference
  • Overall Elastic DaC Diagram
  • Core Components of DaC Delineation
  • Governance Models of Dac Delineation
• Core components and Governance Models of DaC
  • Core components of Detections as Code
  • Governance Models Dictating the Core Components of DaC
  • Sub-Components and Options
  • Detailed Considerations of the Different Governance Models
• Internals of the detection-rules Repo and How it is Used Internally
  • Overview of Elastic Detection Rules Repo and Usage
  • Getting Started with the Repo
  • CLI
  • Unit tests
  • Schemas and Data Structures
  • Incorporating Custom Rules
  • Creating Detection Rules
  • Rule Versioning
  • Exceptions and Actions
  • Unit testing
  • Rule Schema Validation
  • Detection Logic Validation
• Core Component: Managing Detection Rules in a VCS
  • Overview
  • Considerations
  • Sub-Component 1: Elastic Detection Rules Repo and Usage
  • Sub-Component 2: Incorporating Custom Rules
  • Sub-Component 3: Creating Detection Rules
  • Sub-Component 4: Rule Versioning
  • Sub-Component 5: Exceptions and Actions
  • Sub-Component 6: Unit testing
  • Sub-Component 7: Rule Schema Validation
  • Sub-Component 8: Detection Logic Validation
• Core Component: Syncing Rules and Data from VCS to Elastic Security
  • Overview
  • Considerations
  • Sub-Component 1: Deploying via Direct HTTP Request API Calls
  • Sub-Component 2: Deploying via CI/CD
  • Sub-Component 3: Pre-Production Testing
• Core Component: Managing Detection Rules in Elastic Security
  • Overview
  • Considerations
  • Sub-Component 1: Source of Truth
• Core Component: Syncing Rules and Data from Elastic Security to VCS
  • Overview
  • Considerations
  • Sub-Component 1: Exporting Rules via Direct HTTP Request API Calls
  • Sub-Component 2: Exporting Rules via CI/CD
• E2E Reference
  • Quick Start Slides
• Feedback and Resources
  • Feedback
  • Updates and Next Steps
  • Resources
• Known Limitations Using Elastic’s detection-rules DAC Approach
  • No Direct Support
  • Potential Upcoming Enhancements
• About this guide and project
  • Licensing and Use
• Frequently Asked Questions