Introduction
Revision History
| Date | Author | Summary |
|---|---|---|
| 06-NOV-2022 | TSgt. Bernadotte | Initial draft |
| 25-SEP-2023 | TSgt. Bernadotte | Included features added in Elastic 8.10.2 |
| 21-MAR-2026 | CW2 Bernadotte | Merged indicator match rule content from SOP-003 into indicator match section; expanded with IOC field mapping table, naming conventions, and full rule creation workflow |
Purpose
The purpose of this SOP is to provide step-by-step instructions for creating Elastic Detection rules within Kibana. This SOP focuses on the creation of Custom query, Indicator Match, and Threshold rules as they cover most detection use-cases. New Terms, Event Correlation, and Machine Learning rules are more advanced and are not covered within this SOP.
Considerations
This SOP is intended to be used with Kibana 8.x+, as previous versions of Kibana may lack some features called out within the procedures.