elastic / elastic/roadmap

AI-assisted ES|QL detection rule creation

Open
#249 0 comments 0 reactions 1 assignee Claimed by @approksiu View on GitHub
product-area:security v9.4.0
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**What the feature is (as Title)**
AI-assisted ES|QL detection rule creation

**Value proposition**
Elastic Security AI-Assisted Rule Creation empowers security teams to build detection rules faster and with greater confidence — no deep platform expertise required. By intelligently suggesting queries, auto-populating fields, and recommending optimal rule settings, it eliminates the manual guesswork that slows analysts down. New users get up and running immediately, while experienced users move faster than ever.

**Expected outcome**
Security analysts can create and refine ES|QL detection rules through natural language — no manual field editing required. By the end of the workflow, users have a fully formed rule attachment with accurate queries, severity levels, risk scores, MITRE ATT&CK mappings, and schedule settings, all updated interactively within the conversation. This reduces rule authoring time and lowers the barrier for analysts unfamiliar with Elastic's rule schema.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.