Import Detection Rules

---

note

All converted rules are enabled by default and have an added SIGMA tag to make it easy to filter for Sigma rules

1. Expand the left-hand menu and navigate to the Security app

2. Click on the Rules button under the Security app

3. Click the Detection rules (SIEM) option from the Rules section

4. Click on the Import rules button in the top-right corner of the Rules page:

   1. Select the detection_rules.ndjson file from the local filesystem
   2. Check Overwrite existing detection rules with conflicting "rule_id"
   3. Click Import

   

5. After refreshing the page, the rules should be visible in the Rules page listing