Detections as Code (DaC) for Security Rules

3 posts · May 2024 – Nov 2024

What this trail covers

Elastic Security enhances its Detections as Code (DaC) capabilities by making the detection-rules repository more accessible and user-friendly for custom rule management. This includes features to minimize merge conflicts when forking the repository, allowing users to specify custom rule directories, configure which Elastic-provided unit tests to run or skip, and manage additional rule settings like exceptions and actions alongside detections. The goal is to provide an end-to-end experience for detection engineers.

All Elastic trails

Nov 2024Know your tools: The full range of Elastic Security’s detection engineering capabilitiesThis post details the full range of Elastic Security's detection engineering capabilities, focusing on features that enable detection engineers to build, manage, and optimize detection rules. It highlights prebuilt rule customization, alert suppression, manual rule runs for testing, and automated case creation. It also elaborates on different detection rule types (ES|QL, custom query, event correlation, ML, threshold) and their use cases, including the use of building block rules for threat hunting. The post emphasizes the ongoing research and updates to prebuilt rules and encourages community contributions to the public detection rules repository.
May 2024Reducing false positives with automated SIEM investigations from Elastic and TinesThis post details how the Elastic InfoSec team uses Tines to automate the initial investigation of SIEM alerts, specifically focusing on reducing false positives by querying Elasticsearch for contextual information. It describes the process of sending alerts from Elastic Security to Tines via Alert Actions (Tines connector or Webhook), using custom tags (e.g., 'Triage:Asset', 'Triage:PMFA') to route alerts to specific automated triage paths, and leveraging Elasticsearch's _search API and Signals API to close or escalate alerts. The post quantifies the impact of this automation, highlighting the reduction in manual triage effort and the potential need for additional headcount without it. It provides configuration details for sending alerts to Tines using both the Tines and Webhook connectors, and explains the logic behind different triage tags.
May 2024Transform security with Elastic's Detections as Code — Adopting DaC made easyThis post introduces enhancements to the detection-rules repository to facilitate custom rule management for users adopting Detections as Code (DaC). Key contributions include: 1. Support for specifying a custom rules directory within the repository for users to load their own rules. 2. The ability to configure which Elastic-provided unit tests run on custom rules, allowing users to skip tests not relevant to their environment. 3. Added support for managing additional rule settings like exceptions and actions alongside detections within the repository.
Advertisement