elastic / detection-rules

# Detection Rules
Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine.
This repository was first announced on Elastic's blog post, Elastic Security opens public detection rules repo. For additional content, see the accompanying webinar, Elastic Security: Introducing the public repository for detection rules.
## Table of Contents
- Detection Rules
 - Table of Contents
 - Overview of this repository
 - Getting started
 - How to contribute
 - Detections as Code (DaC)
 - RTAs
 - Licensing
 - Questions? Problems? Suggestions?
## Overview of this repository
Detection Rules contains more than just static rule files. This repository also contains code for building Detections-as-code pipelines, unit testing in Python and integrating with the Detection Engine in Kibana.
| folder | description |
|------------------------------------------------ |------------------------------------------------------------------------------------ |
| `detection_rules/` | Python module for rule parsing, validating and packaging |
| `etc/` | Miscellaneous files, such as ECS and Beats schemas and configuration files |
| `hunting/` | Root directory where threat hunting package and queries are stored |
| `kibana/` | Python library for handling the API calls to Kibana and the Detection Engine |
| `kql/` | Python library for parsing and validating Kibana Query Language |
| `rules/` | Root directory where rules are stored |
| `rules_building_block/` | Root directory where building block rules are stored |
| `tests/` | Python code for unit testing rules |
## Getting started
Although rules can be added by manually creating `.toml` files, we don't recommend it. This repository also consists of a python module that aids rule creation and unit testing. Assuming you have Python 3.12+, run the below command to install the dependencies using the makefile:
 [code] 
Or install the dependencies using the following command:
 [code] 
Note: The `kibana` and `kql` packages are not available on PyPI and must be installed from the `lib` directory. The `hunting` package has optional dependencies to be installed with `pip3 install ".[hunting]`.
 [code] 
Remember, make sure to activate your virtual environment if you are using one. If installed via `make`, the associated virtual environment is created in `env/detection-rules-build/`.
If you are having trouble using a Python 3.12 environment, please see the relevant section in our troubleshooting guide.
To confirm that everything was properly installed, run with the `--help` flag
 [code] 
Note:
- If you are using a virtual environment, make sure to activate it before running the above command.
- If using Windows, you may have to also run ` \Scripts\pywin32_postinstall.py -install` depending on your python version.
The contribution guide describes how to use the `create-rule` and `test` commands to create