security-detection-rule-management
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.
- Version
- 0.1.0
- Compatibility
- Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables: KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD; ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD.
Pinned to revision 4e8964e24a5a, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/detection-rule-management/SKILL.md
- skills/detection-rule-management/references/detection-api-reference.md
- skills/detection-rule-management/references/endpoint-behavior-tuning-workflow.md
- skills/detection-rule-management/references/endpoint-exceptions-guide.md
- skills/detection-rule-management/references/endpoint-rule-exclusion-best-practices.md
- skills/detection-rule-management/scripts/add-endpoint-exception.js
- skills/detection-rule-management/scripts/check-exclusion-best-practices.js
- skills/detection-rule-management/scripts/es-client.js
- skills/detection-rule-management/scripts/fetch-endpoint-rule-from-github.js
- skills/detection-rule-management/scripts/kibana-client.js
- skills/detection-rule-management/scripts/rule-manager.js
Every link opens the file at its source, pinned to the revision this page describes.