Install Elastic prebuilt rules

Elastic provides hundreds of prebuilt detection rules that cover common attack techniques across multiple platforms. This page explains how to install and enable prebuilt rules so they start generating alerts.

Your subscription determines which prebuilt rule features are available:

Most prebuilt rules don't start running by default. Use Install and enable to start rules immediately, or install first and enable later.

1. Find Detection rules (SIEM) in the navigation menu or by using the global search field, then go to the Rules table.

   The badge next to Add Elastic rules shows the number of prebuilt rules available for installation.

   
   ×

2. Select Add Elastic rules.

   Tip

   To examine the details of a rule before you install it, select the rule name. This opens the rule details flyout.

3. Do one of the following:

   • Install all available rules: Select Install all at the top of the page. (This doesn't enable the rules; you still need to do that manually.)
   • Install a single rule: In the rules table, either select Install to install a rule without enabling it, or select → Install and enable to start running the rule once it's installed.
   • Install multiple rules: Select the rules, and then at the top of the page either select Install x selected rule(s) to install without enabling the rules, or select → Install and enable to install and start running the rules.
   Tip

   Use the search bar and Tags filter to find the rules you want to install. For example, filter by OS: Windows if your environment only includes Windows endpoints. For more on tag categories, refer to Prebuilt rule tags.

   
   ×

4. For any rules you haven't already enabled, go back to the Rules page, search or filter for the rules you want to run, and do either of the following:

   • Enable a single rule: Turn on the rule's Enabled switch.
   • Enable multiple rules: Select the rules, then select Bulk actions → Enable.

Once you enable a rule, it starts running on its configured schedule. To confirm that it's running successfully, check its Last response status in the rules table, or open the rule's details page and check the Execution results tab.

After installing prebuilt rules:

• Keep rules current: Elastic regularly updates prebuilt rules to detect new threats. Refer to Update Elastic prebuilt rules to learn how to apply updates.
• Customize rules: Adapt prebuilt rules to your environment by editing them directly (Enterprise) or duplicating and modifying copies. Refer to Customize Elastic prebuilt rules.
• Build custom rules: Create detection logic tailored to your infrastructure. Refer to Author rules.