Elastic Security Beta: Detection-as-Code Enhancements for Rule Lifecycle Automation

What Happened

Elastic Security has released beta support for Detection-as-Code (DaC) in the detection-rules repository. The update adds CLI commands that let users move, test, and validate rules directly from the repo into Kibana or back, and to convert between TOML and ndjson formats.

Impact

Security teams that rely on the detection-rules repo for rule development now have a streamlined workflow. The new commands enable bulk import/export of custom rules, automated unit testing, and integration into CI/CD pipelines, reducing manual effort and the risk of stale or mis‑configured detections.

Key Features

• kibana import-rules

  /

  kibana export-rules

  – move rules in bulk between the repo and Kibana.

• import-rules-to-repo

  /

  export-rules-from-repo

  – convert rules between TOML and ndjson for version control.
• Single‑command unit testing and validation of rule logic.
• Designed for integration with existing VCS and CI/CD workflows.

What to Do

To adopt DaC, check out the detection-rules repo on the main branch and run the new CLI commands. Add the commands to your build scripts, run unit tests before merging, and use the bulk import/export to keep Kibana in sync with your version‑controlled rule set. Refer to the DaC Reference Guide for detailed usage.