Elastic Detection Rules TOML Pack
Official Elastic prebuilt detection rules in TOML format with rich rule metadata for teams that want version-controlled detection content.
Use this collection
What you can do with TOML downloads
TOML downloads collect reusable Elastic Stack examples that can help you build dashboards, rules, pipelines, visualizations, and operational workflows faster.
How should I use these examples?
Download the content, import it into your Elastic environment, review the saved objects or rules, and adapt the fields, filters, and visualizations to your own data.
Where should I go next?
Use the related collections below to move between dashboards, security content, observability examples, pipelines, Elasticsearch resources, and AI-assisted Elastic workflows.
Explore Elastic content
Start from a use case, solution area, or content type to find useful Elastic resources.
End-to-End Observability
Business Critical Service health across UX, CDN, origin, network, and platform—including async hops without a single shared trace.
Kubernetes Observability
Kubernetes monitoring, OpenTelemetry, SLO, EKS, and ECK resources for Elastic users.
Network Observability
Packetbeat, DNS analytics, network signals, and observability patterns for Elastic.
Telco industry
Telco-focused paths for network visibility, service reliability, Kubernetes, and security monitoring.
Kibana dashboards
Ready-to-use dashboard examples for visualizing Elasticsearch data.
TOML examples
Elastic Detection Building Block Rules
Official Elastic building-block detection rules in TOML format for composing richer detections and investigation workflows.