[FR] Managing Multiple Rule Sets - #56
Open
eric-forte-elastic wants to merge 2 commits into
Open
Conversation
eric-forte-elastic
added
documentation
eric-forte-elastic
marked this pull request as ready for review
June 25, 2026 14:32
eric-forte-elastic
requested review from
shashank-elastic and
terrancedejesus
and
a lite review from Copilot
August 14, 2026 17:00
There was a problem hiding this comment.
Pull request overview
This PR updates the DaC reference documentation to explain how to manage multiple rule sets (e.g., custom rules, customized prebuilt rules, and unmodified prebuilt rules) and how to scope Kibana exports using kibana export-rules filters/queries.
Changes:
- Adds guidance on structuring multiple local rule sets (single config vs. independent configs) and how to export multiple compatible directories into one artifact.
- Documents recommended Kibana export scoping for custom vs. customized vs. unmodified prebuilt rules (including example
--export-queryfilters). - Adds governance-model diagrams and supporting narrative for “multiple rule sets” in VCS-authoritative and dual-sync workflows.
Reviewed changes
Copilot reviewed 5 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/internals_of_the_detection_rules_repo.md | Adds notes on structuring multiple local rule sets via rule_dirs vs separate custom rules directories. |
| docs/faq.md | Adds FAQ entry explaining how to distinguish/export custom, customized prebuilt, and unmodified prebuilt rules. |
| docs/dac_quick_start_guide.md | Introduces a new “Managing multiple rule sets” section with export scoping examples and guidance. |
| docs/core_components_and_governance_models_of_dac.md | Adds narrative + embedded diagrams illustrating multiple rule sets in VCS-authoritative and dual-sync models. |
| docs/core_component_syncing_rules_and_data_from_elastic_security_to_vcs.md | Adds guidance on running multiple intentionally-scoped exports from a single Kibana space. |
| docs/_static/multiple_rule_sets_vcs_authoritative.svg | Adds a new diagram for the VCS-authoritative multiple rule sets workflow. |
| docs/_static/multiple_rule_sets_dual_sync.svg | Adds a new diagram for the dual-sync multiple rule sets workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| Useful export categories are: | ||
|
|
||
| - Custom rules: use `python -m detection_rules kibana export-rules --custom-rules-only`, or filter for internal/non-immutable rules. |
| config: etc/test_config.yaml | ||
| ``` | ||
|
|
||
| For multiple local rule sets, choose whether they should be loaded by one custom rules config or by separate configs. If the rule sets share schema validation, tests, exceptions/actions directories, and versioning strategy, list multiple directories under `rule_dirs`: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Resolves #22
Summary
Some documentation updates to cover managing multiple rule sets using the
kibana export-rulesfilters.