Use official Elastic building-block rules as lower-level detection components for composed alerts, investigations, and rule engineering.
What is included
- TOML building-block rules from elastic/detection-rules.
- Rule metadata such as severity, risk score, MITRE mappings, query language, and references where present.
- Elastic License 2.0 and NOTICE files.
Who it helps
Detection engineers can use these rules as composable primitives for higher-level alerting strategies and tuning workflows.
Compatibility
The source folder does not declare a single package-wide Elastic Stack version. Compatibility was checked and intentionally left unset.
Source and license
Source: elastic/detection-rules rules_building_block. The upstream repository uses Elastic License 2.0.
The ZIP attached to this draft contains the reusable upstream files plus the available license or notice files.
| Tested versions | |
| ECS compliant |
You must log in to submit a review.