---
title: View rule changes history
description: View a chronological history of changes made to a detection rule, compare revisions, and restore a rule to a previous state.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7376/solutions/security/detect-and-alert/view-rule-changes-history
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# View rule changes history
Rule changes history keeps a chronological record of changes made to a detection rule, so you can see what changed, when, and who made the change. This is useful for troubleshooting unexpected rule behavior, auditing rule changes for compliance purposes, and recovering from unwanted or accidental edits.
This page explains how to open a rule's changes history, review its version history, compare revisions, and restore the rule to a previous state. Rule changes history is available for custom rules and for installed or modified Elastic prebuilt rules.

## Open the changes history page

1. Find **Detection rules (SIEM)** in the navigation menu or by using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7376/explore-analyze/find-and-organize/find-apps-and-objects).
2. Click the rule's name to open its details page.
3. Select **All actions** > **History**.

The changes history page opens in a split-panel layout, with the **Version history** panel on the right and a diff view on the left.

## Review the version history

The **Version history** panel lists every recorded change for the rule, most recent first. Each entry shows:
- Rule's revision number at that point in time (for example, `R2`), and its Elastic version number if it's a prebuilt rule (for example, `V3`)
- Action taken (for example, created, edited, enabled, disabled, deleted, imported, or restored)
- Date and time of the change
- User who made the change
- Number of changes included in that revision

Scroll to the bottom to load older entries.

## View a diff between revisions

Select any entry in the **Version history** panel to view a diff of that revision against the revision immediately before it. Added content is highlighted in green, and removed content is highlighted in red. If a revision didn't change any visible rule fields, the diff view indicates that there are no changes to display.

## Restore a rule to a previous revision

If a rule was changed unexpectedly or you want to undo a set of changes, you can restore the rule to any revision in its history.
1. In the **Version history** panel, find the revision you want to restore.
2. Select the actions menu on that entry, then select **Restore this revision**.
3. Confirm the restore.

The rule is updated to match the selected revision, and a new entry is added to the version history to record the restore.
<note>
  You can also restore a deleted rule. This re-creates the rule, but it remains disabled. You must [enable it](/elastic/docs-content/pull/7376/solutions/security/detect-and-alert/manage-detection-rules#enable-disable-rules) manually.
</note>

<warning>
  If someone else changes or deletes the rule after the revision you're restoring was captured, a conflict dialog warns you before you continue. You can review the conflicting changes, or restore anyway and permanently overwrite them.
</warning>


## Rule changes history limitations

- You can't view or restore changes made before this feature was introduced, or while it was turned off.
- Rule changes history is read-only. You can't edit or delete version history entries.


## Turn off rule changes history

Rule changes history is turned on by default. If you want to turn it off, disable the `securitySolution:enableRuleChangesHistory` [advanced setting](/elastic/docs-content/pull/7376/solutions/security/get-started/configure-advanced-settings#enable-rule-changes-history).