Elastic Content Share

Get content for Kibana, Elasticsearch, Logstash and more

Elastic Content Share

Elastic Detection Rules TOML Pack

Official Elastic prebuilt detection rules in TOML format with rich rule metadata for teams that want version-controlled detection content.

Elastic Detection Rules TOML Pack thumbnail image



Give detection engineers direct access to Elastic’s TOML-format prebuilt rules, including metadata that is not available in generic Sigma bundles.

What is included

  • Official TOML rules from the elastic/detection-rules rules folder.
  • Rule metadata including author, severity, risk score, ATT&CK mappings, investigation guidance, and false-positive notes where present.
  • Elastic License 2.0 and NOTICE files.

Who it helps

SOC and detection-engineering teams can use this pack to study, customize, and version-control Elastic detection logic.

Compatibility

The rules folder contains many individual rules with their own metadata, but the package does not declare one universal tested version. Compatibility was checked and intentionally left unset.

Source and license

Source: elastic/detection-rules rules. The upstream repository uses Elastic License 2.0.

The ZIP attached to this draft contains the reusable upstream files plus the available license or notice files.

Download Now
Tested versions
ECS compliant

You must log in to submit a review.