Elastic Security Detection Engineering Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A detection in Elastic Security is a question of your logs

Elastic Security is where this detection will run. The language you write is the detection language your Elastic version documents, often KQL or ES|QL. Confirm the version you actually operate before you save a draft, because a query copied from a different product will not become correct by wishing. Elastic detection rules have changed language across versions. Confirm whether this cluster expects KQL, the Lucene query the rule UI shows, or ES|QL. Write that name in the ticket. Do not guess. This page is a planning guide. It is not a vendor manual, and it does not tell you how to try passwords, spoof a place, or flood a directory.

Three generators on this site draft stories you can explain: many failures against one account, failures spread across many accounts, and a sign-in your identity provider already recorded in two places that a person could not travel between. A draft is a starting text. You read it. A rule that matches every event is a rule you delete. The tools run in the browser. They do not log into Elastic Security and they do not scan a network.

The test is one wrong password typed by you against a lab account you own, or a replay of a log line you are already allowed to hold. You then look for that one event. You do not borrow a word list, you do not choose a spray count, and you do not pretend to be in another city. If the lab account does not exist yet, creating it is the identity guide's habit, and it is obviously a lab account.

The detection engineering guide owns thresholds, owners, and the promise that a single typo does not page a human. The SIEM migration guide owns the day you move this rule and keep the old one until the new one has fired. This page stops when one story fires once and stays quiet once inside Elastic Security.

One lab failure, read back in Elastic Security

Create the lab account if the identity guide has not already. Type the wrong password once. Find that event in the log Elastic Security is already receiving. If the event is not there, the work is the log pipeline, not a louder rule. A detection cannot see what you never collected.

Generate the single-account failure draft. Set the count above one so your own test typo, and everyone else's, does not page. Read every line. If the draft names a field your tenant does not have, replace it with the field you saw on the lab event. Do not add a second story in the same save.

Run the draft on the lab event and on a normal sign-in that should stay quiet. Write both results with the time. Then disable the rule once, so rollback is a switch you have used, and enable it again only for the lab scope. Production scope is a later window.

The many-account story and the impossible-travel story wait. When you do open them, they still use logs you already have. A company VPN that makes travel look impossible is a tuning note, not a reason to spoof a location so you can watch the rule fire.

# Elastic Security lab. Review before you save.
# Language: the detection language your Elastic version documents, often KQL or ES|QL.
# One failed password on a lab account you own. No word list. No spray. No spoofed place.
# Threshold above a single typo.
# prompt-for-this is not an API token.
# Disable the rule once so rollback is real.

A change you can finish

Production is the same story, aimed at the accounts the identity owner agreed, after the lab fire and the lab quiet. You do not enable all three generators on a Friday.

Rollback is disabling this rule in Elastic Security. You do not delete the text until the next review, and you do not turn off the log to silence it.

Confirm you administer this Elastic Security tenant and the log is already arriving.
Confirm the query language is the detection language your Elastic version documents, often KQL or ES|QL on the version you run.
Create one lab failure you are allowed to create.
Read the generated draft and delete any match-everything clause.
Set a threshold above one trivial failure.
See the rule fire once and stay quiet once.
Practise disable. Leave the other two stories for later windows.

Mistakes that outlive the command

Elastic Security detections fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Pasting a query from a product that does not speak the detection language your Elastic version documents, often KQL or ES|QL.
A threshold of one, so every typo pages someone.
Testing with a word list or a spray against accounts you do not own.
Spoofing a location to force an impossible-travel alert.
Saving a generator draft you did not read.
Enabling three stories in one change window.
Deleting the log because the rule was noisy.
Putting an API token in the ticket instead of prompt-for-this.
Declaring the rule done when it has never seen the lab event.
Treating Elastic Security as a licence to scan networks you do not administer.

Decisions to write down before the window

Decision 1 for Elastic Security detections. The tenant in the ticket is the Elastic Security tenant you administer. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 2 for Elastic Security detections. The language written down is the detection language your Elastic version documents, often KQL or ES|QL, and someone confirmed the version. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 3 for Elastic Security detections. The log for the story is already collected. If it is not, this window stops. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 4 for Elastic Security detections. The test event is one lab failure or a replay you may hold. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 5 for Elastic Security detections. No word list, spray count, or location spoof is part of the test. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 6 for Elastic Security detections. The threshold is above a single typo. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 7 for Elastic Security detections. The draft was read, and match-everything was removed. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 8 for Elastic Security detections. Fire and quiet were both recorded. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 9 for Elastic Security detections. Disable was practised. That is the rollback. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 10 for Elastic Security detections. An owner and a tuning date are on the rule. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 11 for Elastic Security detections. The other two stories are later tickets. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 12 for Elastic Security detections. A true page goes to the incident response guide, not to an improvised exploit note. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for Elastic Security detections. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. Elastic Security detections is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

Elastic Security checks before the rule covers real accounts

Check 1 in Elastic Security checks before the rule covers real accounts. You administer this Elastic Security tenant. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in Elastic Security checks before the rule covers real accounts. The language in the rule matches the detection language your Elastic version documents, often KQL or ES|QL on your version. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in Elastic Security checks before the rule covers real accounts. The lab event is one you created or a log you may hold. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in Elastic Security checks before the rule covers real accounts. The rule matched that event. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in Elastic Security checks before the rule covers real accounts. A normal event did not page. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in Elastic Security checks before the rule covers real accounts. The threshold is written on the rule. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in Elastic Security checks before the rule covers real accounts. No word list was used. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in Elastic Security checks before the rule covers real accounts. No location was spoofed. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in Elastic Security checks before the rule covers real accounts. The hostname in the prompt matches the hostname in the ticket for Elastic Security detections. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in Elastic Security checks before the rule covers real accounts. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in Elastic Security checks before the rule covers real accounts. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in Elastic Security checks before the rule covers real accounts. Done is a sentence a second person can repeat: the proof for Elastic Security detections happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.