Elastic Detection Rules Hunting Queries
Official Elastic threat hunting queries with TOML metadata and Markdown docs for proactive investigations across endpoint, cloud, network, Okta, and LLM telemetry.
Use this collection
What you can do with KQL downloads
KQL downloads collect reusable Elastic Stack examples that can help you build dashboards, rules, pipelines, visualizations, and operational workflows faster.
How should I use these examples?
Download the content, import it into your Elastic environment, review the saved objects or rules, and adapt the fields, filters, and visualizations to your own data.
Where should I go next?
Use the related collections below to move between dashboards, security content, observability examples, pipelines, Elasticsearch resources, and AI-assisted Elastic workflows.
Explore Elastic content
Start from a use case, solution area, or content type to find useful Elastic resources.
End-to-End Observability
Business Critical Service health across UX, CDN, origin, network, and platform—including async hops without a single shared trace.
Kubernetes Observability
Kubernetes monitoring, OpenTelemetry, SLO, EKS, and ECK resources for Elastic users.
Network Observability
Packetbeat, DNS analytics, network signals, and observability patterns for Elastic.
Telco industry
Telco-focused paths for network visibility, service reliability, Kubernetes, and security monitoring.
Kibana dashboards
Ready-to-use dashboard examples for visualizing Elasticsearch data.
KQL examples