Create a detection rule using the UI

Once the Detections feature is turned on, follow these steps to create a detection rule. At any step, you can preview the rule before saving it to see what kind of results you can expect.

1. Define the rule type. The configuration for this step varies depending on the rule type. For field descriptions specific to each type, refer to the Rule types section.
2. Configure basic rule settings.
3. (Optional) Configure advanced rule settings.
4. Set the rule's schedule.
5. (Optional) Set up rule actions.
6. (Optional) Set up response actions.
7. Create and enable the rule, or create the rule without enabling it.

To create detection rules, you must have:

• At least Read access to data views, which requires the Data View Management Kibana privilege in Elastic Stack or the appropriate user role in Serverless.
• The required privileges to preview rules, manage rules, and manage alerts. Refer to Turn on detections for more details.

Each rule type has its own configuration and query requirements. Refer to the appropriate guide for type-specific instructions:

• Custom query
• Event correlation (EQL)
• Threshold
• Indicator match
• New terms
• ES|QL
• Machine learning

To understand which type to use, refer to Select the right rule type.

After creating the rule, you can change its settings, enable or disable it, and more. Refer to Manage detection rules for more information.