Detection Rule Management
- 6 installs
- 20 repo stars
- Updated July 8, 2026
- elastic/example-mcp-app-security
detection-rule-management skill documents Create, tune, and manage Elastic Security detection rules.
About
detection-rule-management skill documents Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add e. name: detection-rule-management description: >
- Create, tune, and manage Elastic Security detection rules.
- Platform-specific setup patterns for detection-rule-management.
- Evidence-backed steps from upstream SKILL.md.
- When-to-use criteria for detection-rule-management versus alternatives.
Detection Rule Management by the numbers
- 6 all-time installs (skills.sh)
- Ranked #1,709 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Jul 24, 2026 (Skillselion catalog sync)
detection-rule-management capabilities & compatibility
- Capabilities
- detection rule management quick start · detection rule management when to use guidance · detection rule management integration patterns
- Works with
- elasticsearch
- Use cases
- security audit
What detection-rule-management says it does
Create, tune, and manage Elastic Security detection rules. Use for false positive
tuning, adding exceptions, creating new detection coverage, finding noisy rules,
npx skills add https://github.com/elastic/example-mcp-app-security --skill detection-rule-managementAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 6 |
|---|---|
| repo stars | ★ 20 |
| Last updated | July 8, 2026 |
| Repository | elastic/example-mcp-app-security ↗ |
How do I use detection-rule-management correctly?
Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any dete
Who is it for?
Teams implementing detection-rule-management workflows from the catalog.
Skip if: Skip when requirements clearly match a different specialized stack.
When should I use this skill?
User asks about detection-rule-management, create, tune, and manage elastic security detection rules. use for false positive tuning, .
What you get
Working detection-rule-management setup with validated configuration and next steps.
Files
Detection Rule Management
Manage detection rules using the elastic-security MCP connector. The manage-rules tool renders an interactive rule management dashboard.
Tools (via elastic-security MCP connector)
| Tool | Purpose |
|---|---|
manage-rules | Browse/search rules with interactive dashboard. Params: filter (KQL) |
threat-hunt | Test queries against live data before creating rules |
The dashboard supports searching rules, viewing details, enabling/disabling, validating queries, and viewing noisy rules.
Rule Types
| Type | Use case | Example |
|---|---|---|
query (KQL) | Simple field matching | process.name: "mimikatz.exe" |
eql | Behavioral sequences | Process A spawns B within 5 minutes |
esql | Analytics/aggregations | Complex joins or transformations |
threshold | Count/frequency | >10 failed logins in 5 minutes |
threat_match | IOC correlation | Match against malicious IP indicators |
new_terms | First-time activity | User logs into host for first time |
Tuning Strategy (in order of preference)
1. Add exception — Known-good process/user/host. Does not modify the rule query. 2. Tighten the query — Exclude FP pattern from the rule query itself. 3. Adjust threshold/suppression — Increase threshold or enable alert suppression. 4. Reduce risk score/severity — Downgrade priority if rule has some value but is noisy. 5. Disable the rule — Last resort. Only if rule provides no value.
Creating New Rules
1. Define the threat (MITRE technique, data sources, malicious vs legitimate behavior) 2. Test the query with threat-hunt against live data 3. Create via the dashboard or ask Claude to help construct the rule JSON 4. Monitor alert volume and tune false positives
Common Index Patterns
| Data type | Index pattern |
|---|---|
| Alerts | .alerts-security.alerts-* |
| Processes | logs-endpoint.events.process-* |
| Network | logs-endpoint.events.network-* |
| Windows | logs-windows.* |
| AWS | logs-aws.* |
| Okta | logs-okta.* |
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does detection-rule-management do?
detection-rule-management skill documents Create, tune, and manage Elastic Security detection rules.
When should I use detection-rule-management?
User asks about detection-rule-management, create, tune, and manage elastic security detection rules. use for false positive tuning, .
Is this skill safe to install?
Review the Security Audits panel on this page before installing in production.