Skip to content

docs: add preface for deprecated prebuilt detection rules page #5968

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Mpdreamz wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: add preface for deprecated prebuilt detection rules page #5968

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions docs/deprecated-rules.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# Deprecated prebuilt detection rules

Elastic periodically retires prebuilt detection rules that have been superseded by improved coverage, renamed, or are no longer relevant to current threat landscapes. Deprecated rules are moved to a separate category rather than deleted so that users who have customized or enabled them retain a reference.
Copy link
Copy Markdown

@approksiu approksiu Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove renamed, this is not the reason for deprecation

Copy link
Copy Markdown
Member

@nastasha-solomon nastasha-solomon Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor tweaks so users don't wonder if "retired" rules are different from "deprecated" ones. Also removed the part about rules being moved to a separate category because it could be interpreted as them being physically moved to a separate folder or location in the EPR package.

Suggested change
Elastic periodically retires prebuilt detection rules that have been superseded by improved coverage, renamed, or are no longer relevant to current threat landscapes. Deprecated rules are moved to a separate category rather than deleted so that users who have customized or enabled them retain a reference.
Elastic periodically deprecates prebuilt detection rules that have been superseded by improved coverage, renamed, or are no longer relevant to current threat landscapes. Rather than deleting deprecated rules, Elastic keeps them available so that users who have customized or enabled them can refer back to them.


## What happens to deprecated rules

Deprecated rules continue to function normally if you have enabled them. Elastic no longer maintains them, which means:
Copy link
Copy Markdown
Member

@nastasha-solomon nastasha-solomon Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small tweak to the first sentence because the following limitations slightly contradict the statement of deprecated rules running "normally".

Suggested change
Deprecated rules continue to function normally if you have enabled them. Elastic no longer maintains them, which means:
Deprecated rules continue to run if you have enabled them. Elastic no longer maintains them, which means:


- They do not receive threat intelligence updates or query improvements.
- They may not reflect current data source field names or index patterns.
- They are not tested against new Elastic Stack releases.

## Recommended actions

When a rule is deprecated, Elastic typically provides a replacement rule with improved detection logic. To transition:

1. Identify the replacement rule using the rule name or description references in the deprecated rule's documentation.
Copy link
Copy Markdown
Member

@nastasha-solomon nastasha-solomon Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A bit more specific.

Suggested change
1. Identify the replacement rule using the rule name or description references in the deprecated rule's documentation.
1. Find the replacement rule name in the deprecation notice displayed on the rule's detail page. Alternatively, find the deprecated rule in the Prebuilt rules reference to find the recommended replacement.

2. Enable the replacement rule and tune it to your environment.
3. Once satisfied with the replacement, you can disable or delete the deprecated rule.

If no replacement is listed, the threat the rule addressed may no longer be relevant, or coverage may have been incorporated into a broader rule.
Copy link
Copy Markdown
Member

@nastasha-solomon nastasha-solomon Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If no replacement is listed, the threat the rule addressed may no longer be relevant, or coverage may have been incorporated into a broader rule.
If a replacement isn't listed in the deprecation notice on the rule's detail page or in the Prebuilt rules reference, the threat the rule addressed is no longer relevant, or its coverage has been incorporated into a broader rule.


## Managing deprecated rules in Kibana

To view and manage deprecated rules in Kibana, go to **Security → Rules → Detection Rules** and filter by the **Deprecated** tag. See [manage detection rules](docs-content://solutions/security/detect-and-alert/manage-detection-rules.md) for full instructions.
Copy link
Copy Markdown

@approksiu approksiu Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For 9.4+ version, visit Security → Rules → Detection Rules. The deprecated rules notification will appear if you have deprecated rules installed.

1 change: 1 addition & 0 deletions docs/docset.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ extensions:
toc:
- file: index.md
detection_rules: ['../rules', '../rules_building_block']
deprecated_file: deprecated-rules.md
- folder: audit_policies/windows
children:
- file: readme.md
Expand Down
Loading