# Detection Rule Management

> Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

- Skill: `elastic/detection-rule-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add elastic/detection-rule-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/elastic/detection-rule-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: elastic (https://skillmd.com/u/elastic)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/elastic/detection-rule-management

---


# Detection Rule Management

Manage detection rules using the `elastic-security` MCP connector. The `manage-rules` tool renders an interactive
rule management dashboard.

## Tools (via elastic-security MCP connector)

| Tool | Purpose |
|------|---------|
| `manage-rules` | Browse/search rules with interactive dashboard. Params: `filter` (KQL) |
| `threat-hunt` | Test queries against live data before creating rules |

The dashboard supports searching rules, viewing details, enabling/disabling, validating queries, and viewing noisy rules.

## Rule Types

| Type | Use case | Example |
|------|----------|---------|
| `query` (KQL) | Simple field matching | `process.name: "mimikatz.exe"` |
| `eql` | Behavioral sequences | Process A spawns B within 5 minutes |
| `esql` | Analytics/aggregations | Complex joins or transformations |
| `threshold` | Count/frequency | >10 failed logins in 5 minutes |
| `threat_match` | IOC correlation | Match against malicious IP indicators |
| `new_terms` | First-time activity | User logs into host for first time |

## Tuning Strategy (in order of preference)

1. **Add exception** — Known-good process/user/host. Does not modify the rule query.
2. **Tighten the query** — Exclude FP pattern from the rule query itself.
3. **Adjust threshold/suppression** — Increase threshold or enable alert suppression.
4. **Reduce risk score/severity** — Downgrade priority if rule has some value but is noisy.
5. **Disable the rule** — Last resort. Only if rule provides no value.

## Creating New Rules

1. Define the threat (MITRE technique, data sources, malicious vs legitimate behavior)
2. Test the query with `threat-hunt` against live data
3. Create via the dashboard or ask Claude to help construct the rule JSON
4. Monitor alert volume and tune false positives

## Common Index Patterns

| Data type | Index pattern |
|-----------|--------------|
| Alerts | `.alerts-security.alerts-*` |
| Processes | `logs-endpoint.events.process-*` |
| Network | `logs-endpoint.events.network-*` |
| Windows | `logs-windows.*` |
| AWS | `logs-aws.*` |
| Okta | `logs-okta.*` |