Indicator match rules

Indicator match rules continuously compare field values in your security event indices against field values in threat indicator indices. When a match is found, an alert is generated, enriched with metadata from the matched indicator. This makes indicator match rules the primary mechanism for operationalizing threat intelligence feeds within Elastic Security.

Indicator match rules provide a powerful capability to search your security data; however, their queries can consume significant deployment resources. When creating an indicator match rule, limit the time range of the indicator index query to the minimum period necessary for the desired rule coverage. For example, the default indicator index query @timestamp > "now-30d/d" searches specified indicator indices for indicators ingested during the past 30 days and rounds the query start time down to the nearest day (resolves to UTC 00:00:00). Without this limitation, the rule includes all of the indicators in your indicator indices, which may extend the time it takes for the indicator index query to complete.

Indicator match rules are the right fit when:

• You maintain an index of known threat indicators (IP addresses, domains, file hashes, URLs) and want to detect when any of them appear in your event data.
• You need to compare fields across two separate indices (source events and threat intelligence).
• You want alerts automatically enriched with indicator metadata, such as threat type, confidence, and source feed.

Indicator match rules are not the best fit when:

• You need to join data from multiple sources with transformations, aggregations, or complex filtering. Use an ES|QL rule with LOOKUP JOIN for more flexible cross-index queries.
• You need to detect event sequences or ordering. Use an EQL rule instead.
• Your indicators are in a flat file rather than an Elasticsearch index. First upload them as a value list or import them through the Machine Learning Data Visualizer.

Indicator match rules require:

• Source event indices containing the security events you want to scan.
• Indicator indices containing threat intelligence data. Data in these indices must be ECS compatible and must contain a @timestamp field.

You can use value lists as the indicator index. This is useful when you have a flat list of indicators (IPs, domains, hashes) that you want to match against without creating a full indicator index:

1. Upload a value list of indicators.
2. In the Indicator index patterns field, enter .items-<{{kib}} space> (the hidden index where value lists are stored).
3. In the Indicator index query field, enter list_id : <your-list-name>.
4. In Indicator mapping, set the Indicator index field to the list type (keyword, text, or IP).

The following examples use the detections API request format to show how indicator match rules are defined. Each example is followed by a field-by-field breakdown.

This rule matches outbound network connections against a threat intelligence feed of known malicious IP addresses.

{
  "type": "threat_match",
  "language": "kuery",
  "name": "Network connection to known malicious IP",
  "description": "Matches outbound network events against a threat intelligence feed of malicious IPs.",
  "query": "event.category: \"network\" and network.direction: \"egress\"",
  "index": ["packetbeat-*", "filebeat-*", "logs-endpoint.events.*"],
  "threat_index": ["filebeat-threatintel-*"],
  "threat_query": "@timestamp >= \"now-30d\"",
  "threat_mapping": [
    {
      "entries": [
        {
          "field": "destination.ip",
          "type": "mapping",
          "value": "threat.indicator.ip"
        }
      ]
    }
  ],
  "threat_indicator_path": "threat.indicator",
  "severity": "critical",
  "risk_score": 99,
  "interval": "5m",
  "from": "now-6m"
}
		

This rule matches file creation events against threat intelligence by both SHA-256 hash and file name, requiring both fields to match. Performance tuning fields control parallelism and batch size.

{
  "type": "threat_match",
  "language": "kuery",
  "name": "Known malware file hash detected",
  "description": "Matches file creation events against threat intelligence by SHA-256 hash and file name.",
  "query": "event.category: \"file\" and event.type: \"creation\"",
  "index": ["logs-endpoint.events.*", "winlogbeat-*"],
  "threat_index": ["filebeat-threatintel-*"],
  "threat_query": "@timestamp >= \"now-30d\"",
  "threat_mapping": [
    {
      "entries": [
        {
          "field": "file.hash.sha256",
          "type": "mapping",
          "value": "threat.indicator.file.hash.sha256"
        },
        {
          "field": "file.name",
          "type": "mapping",
          "value": "threat.indicator.file.name"
        }
      ]
    }
  ],
  "concurrent_searches": 5,
  "items_per_search": 500,
  "severity": "critical",
  "risk_score": 99,
  "interval": "5m",
  "from": "now-6m"
}
		

The following settings are specific to indicator match rules. For settings shared across all rule types, refer to Rule settings reference.

Source

The index patterns or data view that store your source event documents. Prepopulated with indices from the default Elastic Security indices advanced setting.

Custom query

The query and filters used to retrieve source event documents. Field values in matching documents are compared against indicator values according to the threat mapping. Defaults to *:* (all documents).

Indicator index patterns

The index patterns that store threat indicator documents. Prepopulated with indices from the securitySolution:defaultThreatIndex advanced setting.

Indicator index query

The query used to retrieve indicator documents. Defaults to @timestamp > "now-30d/d", which searches for indicators ingested in the past 30 days.

Indicator mapping

Threat mapping conditions that compare values in source event fields with values in indicator fields. Configure:

• Field: A field from your source event indices.
• MATCHES / DOES NOT MATCH: Whether the values should match or not match. At least one MATCHES entry is required.

Note

Define matching (MATCHES) conditions first, then narrow down your results by adding DOES NOT MATCH conditions to exclude field values you want to ignore. Mapping entries that only use DOES NOT MATCH are not supported. At least one entry must have a MATCHES condition.

• Indicator index field: A field from your threat indicator index.

Multiple mapping entries can be combined with AND and OR clauses. Only single-value fields are supported.

Suppress alerts (optional)

Reduce repeated or duplicate alerts. For details, refer to Alert suppression.

Required fields (optional)

An informational list of fields the rule needs to function. This does not affect rule execution.

Related integrations (optional)

Associate the rule with one or more Elastic integrations to indicate data dependencies and allow users to verify each integration's installation status.