Prebuilt rules

Prebuilt rules are detections a platform ships and updates for you, which you can enable, tune or clone. They give day-one coverage. The questions to ask are how many there are, how often they change, and whether you can edit them on your licence.

What Prebuilt rules means here

Elastic calls them prebuilt detection rules and has a section on handling deprecated ones. Updates arrive on the vendor's schedule.

Enable them in stages and replay each on your data first, so a large library does not turn into a large queue.

Example of Prebuilt rules in Elastic Security documentation

Elastic's prebuilt rules reference lists every prebuilt rule but states no total, and its docs say Elastic regularly updates prebuilt rules without naming a cadence. elastic.co read 2026-11-03

Terms related to Prebuilt rules

• Content library: A content library is a vendor- or community-maintained set of ready-made detections.
• Community rules: Community rules are detections written and shared by users, not by the product vendor.
• Deprecation: Deprecation is retiring a rule on purpose: marking it, warning its users and turning it off on a date.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.