elastic / elastic/detection-rules

[DaC] TOML data only contains date instead of datatime

Open
#6,672 3 comments 0 reactions 0 assignees View on GitHub
community detections-as-code python Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Command or doc area

- [x] `kibana export-rules` / `kibana import-rules`
- [ ] `import-rules-to-repo`
- [ ] `export-rules-from-repo`
- [ ] Other DaC CLI command (name it in the field below)
- [ ] Documentation in this repo only (link the page/section below)

### Other command name or doc link

_No response_

### Summary

Exported TOML files contain only date instead of datetime strings within the metadata path for creation_date and updated_date.

This leads to the issue that you are not able to update exceptions (for one rule) two times a day if you use DAC and GIT for rule management.
We use DAC and pipelines within GIT to transport rules and exceptions from one elastic instance to another.
If you only edit exceptions (nothing on the rule itself) and export the rule (including exceptions), the rule file will only change once a day (date). The next step which fetches changed rules to be deployed, will therefore only work once per day.

The Metadata is in general not used for import or anything else, it is just for documentation purposes. More than one modification per day can not be reflected. I would suggest to use the ISO datetime string like it is used within the API as well.

### Expected vs actual

Expected:
```
[metadata]
creation_date = "2026-07-01T09:20:18.855Z"
maturity = "production"
promotion = true
updated_date = "2026-07-01T09:45:39.239Z"

[rule]
author = ["Elastic"]
description = """
Some rule.
"""
...
```

As is:
```
[metadata]
creation_date = "2020/02/18"
maturity = "production"
promotion = true
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
description = """
Some rule.
"""
...
```

### Environment (if relevant)

_No response_

### Reproduction (if applicable)

_No response_

### Related issues (optional)

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the `kibana export-rules` and `kibana import-rules` entry points and trace how the TOML metadata fields `creation_date` and `updated_date` are serialized. Check the existing tests around rule export and metadata formatting. Done means exported TOML preserves ISO datetime strings with time and subsecond precision, including when exceptions change more than once per day.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.