How to Manage Elastic Security Detection Rules with Terraform
Summary
Elastic’s Terraform provider adds resources for managing detection rules and exception lists as code. The article demonstrates an ES|QL service-account logon rule and compares Terraform’s deployment workflow with the detection-rules repository.
Key points
- Elastic Stack Terraform provider versions v0.12.0 and v0.13.0 add resources for managing security detection rules and exception lists.
- The example ES|QL rule detects interactive Windows logons by service accounts using event code 4624 and the system.security data stream.
- Terraform exception-list resources can document approved exclusions, such as a legacy SQL backup service account.
- Terraform plan can surface changes made directly in Kibana before updates are applied.
- Elastic AI Agent can help translate ES|QL rules and exception logic into Terraform HCL.
- The article recommends the detection-rules repository for rule authoring and built-in testing; the Terraform provider is aimed at deployment and operations, and relies on Kibana to accept or reject rule definitions.
Article Details
- Topic
- Managing Elastic Security detection rules and exception lists as Terraform code
MITRE ATT&CK
T1078 · Valid AccountsThe example detection rule is mapped to Valid Accounts and detects interactive logons by service accounts that may indicate credential theft or misuse.T1078.002 · Domain AccountsThe example rule identifies domain and service accounts using naming patterns and detects interactive logons that may indicate credential theft or misuse.
Vendors
Products
Elastic SecurityAt the core of Elastic Security lie outstanding detection capabilities, allowing users to create, test, tune, manage, deploy detection rules, as code, in their environments.Elastic StackElastic Stack Terraform provider versions v0.12.0 and v0.13.0 add resources to manage security detection rules and exception lists as Terraform code.
Tools
detection-rulesThe article compares the Terraform provider with the detection-rules repository, demonstrates an ES|QL example for detecting interactive service-account logons, and highlights Elastic AI Agent assistance for generatingTerraformElastic’s Terraform provider now supports managing detection rules and exception lists as code, enabling teams to define, deploy, and track security detections alongside other infrastructure in HCL and to translate