elastic / elastic/detection-rules

[FR] CLI function to check a cluster for Deprecated Rules

Open
#4,553 3 comments 1 reaction 1 assignee Claimed by @eric-forte-elastic View on GitHub
backlog enhancement Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Repository Feature

Core Repo - (rule management, validation, testing, lib, cicd, etc.)

### Problem Description

Long-time customers might still be running deprecated rules without realizing that the logic is either not performant or flawed.

### Desired Solution

We could provide a CLI command to check the cluster for rules that are in https://github.com/elastic/detection-rules/blob/main/detection_rules/etc/deprecated_rules.json

Here is a quick (and dirty) check in python I did for a customer: https://gist.github.com/w0rk3r/01196baf3449d4f1605337aa497c0e7a

### Considered Alternatives

_No response_

### Additional Context

* [Slack thread](https://elasticstack.slack.com/archives/C016E72DWDS/p1741907369239299) for context

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.