Elastic Content Share

Get content for Kibana, Elasticsearch, Logstash and more

Elastic Content Share

Elastic Detection Rules Hunting Queries

Official Elastic threat hunting queries with TOML metadata and Markdown docs for proactive investigations across endpoint, cloud, network, Okta, and LLM telemetry.

Elastic Detection Rules Hunting Queries thumbnail image

Give threat hunters a curated bundle of official Elastic hunting queries for initial evidence gathering across Windows, macOS, Linux, cloud, network, Okta, and LLM security data sources.

What is included

  • TOML hunting query files with metadata, MITRE mappings, references, notes, and one or more KQL, EQL, ES|QL, SQL, or YARA queries.
  • Generated Markdown documentation for the hunts, suitable for review, copy-paste use, and analyst handoff.
  • The hunting package README plus Elastic License 2.0 and NOTICE files from the upstream repository.

Who it helps

This download is aimed at SOC teams that want proactive hunting starting points in Elastic Security, especially teams looking beyond prebuilt alert rules. The content helps analysts pivot from a hypothesis or ATT&CK technique into concrete queries and investigation notes.

Compatibility

The hunting folder mixes query languages and data-source requirements. Some individual queries mention Elastic Defend 8.6+ or ES|QL functions introduced in later 8.x versions, but the source does not declare a single package-wide tested version. Compatibility was checked and intentionally left unset.

Source and license

Source: elastic/detection-rules hunting queries. The upstream repository uses Elastic License 2.0, and the license and notice files are included in the ZIP.

Download Now
Tested versions
ECS compliant

You must log in to submit a review.