detection-rule-management

name	detection-rule-management
description	Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

Detection Rule Management

Manage detection rules using the elastic-security MCP connector. The manage-rules tool renders an interactive rule management dashboard.

Tools (via elastic-security MCP connector)

Tool	Purpose
manage-rules	Browse/search rules with interactive dashboard. Params: filter (KQL)
threat-hunt	Test queries against live data before creating rules

The dashboard supports searching rules, viewing details, enabling/disabling, validating queries, and viewing noisy rules.

Rule Types

Type	Use case	Example
query (KQL)	Simple field matching	process.name: "mimikatz.exe"
eql	Behavioral sequences	Process A spawns B within 5 minutes
esql	Analytics/aggregations	Complex joins or transformations
threshold	Count/frequency	>10 failed logins in 5 minutes