elastic / elastic/detection-rules
[DaC] TOML data only contains date instead of datatime
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Command or doc area
- [x] `kibana export-rules` / `kibana import-rules`
- [ ] `import-rules-to-repo`
- [ ] `export-rules-from-repo`
- [ ] Other DaC CLI command (name it in the field below)
- [ ] Documentation in this repo only (link the page/section below)
### Other command name or doc link
_No response_
### Summary
Exported TOML files contain only date instead of datetime strings within the metadata path for creation_date and updated_date.
This leads to the issue that you are not able to update exceptions (for one rule) two times a day if you use DAC and GIT for rule management.
We use DAC and pipelines within GIT to transport rules and exceptions from one elastic instance to another.
If you only edit exceptions (nothing on the rule itself) and export the rule (including exceptions), the rule file will only change once a day (date). The next step which fetches changed rules to be deployed, will therefore only work once per day.
The Metadata is in general not used for import or anything else, it is just for documentation purposes. More than one modification per day can not be reflected. I would suggest to use the ISO datetime string like it is used within the API as well.
### Expected vs actual
Expected:
```
[metadata]
creation_date = "2026-07-01T09:20:18.855Z"
maturity = "production"
promotion = true
updated_date = "2026-07-01T09:45:39.239Z"
[rule]
author = ["Elastic"]
description = """
Some rule.
"""
...
```
As is:
```
[metadata]
creation_date = "2020/02/18"
maturity = "production"
promotion = true
updated_date = "2025/03/21"
[rule]
author = ["Elastic"]
description = """
Some rule.
"""
...
```
### Environment (if relevant)
_No response_
### Reproduction (if applicable)
_No response_
### Related issues (optional)
_No response_
Contributor guide
Research direction
Start with the `kibana export-rules` and `kibana import-rules` entry points and trace how the TOML metadata fields `creation_date` and `updated_date` are serialized. Check the existing tests around rule export and metadata formatting. Done means exported TOML preserves ISO datetime strings with time and subsecond precision, including when exceptions change more than once per day.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100