Skip to content

Commit 60f45ed

Browse files
[9.0 & Serverless] Add a docs page about Detection-as-code rules management (elastic#891)
### Description Provides 9.0 and Serverless changes for elastic#667. Twin PR for 8.18 is at: http://github.com/elastic/security-docs/pull/6656 ### Preview [Manage rules as code](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/891/solutions/security/detect-and-alert#manage-rule-dac)
1 parent 6f7a1d0 commit 60f45ed

File tree

2 files changed

+15
-0
lines changed

2 files changed

+15
-0
lines changed

solutions/security/detect-and-alert.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,3 +102,10 @@ Depending on your privileges and whether detection system indices have already b
102102

103103
To learn how your rules and alerts are affected by using the [logsdb index mode](/manage-data/data-store/data-streams/logs-data-stream.md), refer to [Using logsdb index mode with {{elastic-sec}}](/solutions/security/detect-and-alert/using-logsdb-index-mode-with-elastic-security.md).
104104

105+
## Manage rules as code [manage-rule-dac]
106+
107+
Utilize the [Detection-as-Code](https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html) (DaC) principles to externally manage your detection rules.
108+
109+
The {{elastic-sec}} Labs team uses the [detection-rules](https://github.com/elastic/detection-rules) repo to develop, test, and release {{elastic-sec}}'s[ prebuilt rules](https://github.com/elastic/detection-rules/tree/main/rules). The repo provides DaC features and allows you to customize settings to simplify the setup for managing user rules with the DaCe pipeline.
110+
111+
To get started, refer to the [DaC documentation](https://github.com/elastic/detection-rules/blob/main/README.md#detections-as-code-dac).

solutions/security/detect-and-alert/manage-detection-rules.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,3 +253,11 @@ You can also check rules' related integrations in the **Installed Rules** and **
253253
::::{tip}
254254
You can hide the **integrations** badge in the Rules tables by turning off the `securitySolution:showRelatedIntegrations` [advanced setting](/solutions/security/get-started/configure-advanced-settings.md#show-related-integrations).
255255
::::
256+
257+
## Manage rules as code [manage-rule-dac]
258+
259+
Utilize the [Detection-as-Code](https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html) (DaC) principles to externally manage your detection rules.
260+
261+
The {{elastic-sec}} Labs team uses the [detection-rules](https://github.com/elastic/detection-rules) repo to develop, test, and release {{elastic-sec}}'s[ prebuilt rules](https://github.com/elastic/detection-rules/tree/main/rules). The repo provides DaC features and allows you to customize settings to simplify the setup for managing user rules with the DaCe pipeline.
262+
263+
To get started, refer to the [DaC documentation](https://github.com/elastic/detection-rules/blob/main/README.md#detections-as-code-dac).

0 commit comments

Comments
 (0)