elastic / elastic/detection-rules
[FR] CLI function to check a cluster for Deprecated Rules
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Repository Feature
Core Repo - (rule management, validation, testing, lib, cicd, etc.)
### Problem Description
Long-time customers might still be running deprecated rules without realizing that the logic is either not performant or flawed.
### Desired Solution
We could provide a CLI command to check the cluster for rules that are in https://github.com/elastic/detection-rules/blob/main/detection_rules/etc/deprecated_rules.json
Here is a quick (and dirty) check in python I did for a customer: https://gist.github.com/w0rk3r/01196baf3449d4f1605337aa497c0e7a
### Considered Alternatives
_No response_
### Additional Context
* [Slack thread](https://elasticstack.slack.com/archives/C016E72DWDS/p1741907369239299) for context
Contributor guide
Assessment
This issue has not been assessed yet.