---
title: Manage detection rules at scale
description: Use workflows to audit rule health, surface rule errors, and automate rule operations across large detection rule sets in Elastic Security.
url: https://www.elastic.co/docs/explore-analyze/workflows/use-cases/security/manage-detection-rules
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4, Preview in 9.3
---

# Manage detection rules at scale
Teams that run large sets of detection rules (prebuilt, custom, or both) have recurring operational work. Rules need to be audited for health, errors need to be surfaced quickly, coverage needs to be tracked against a framework, and status often needs to flow back to an external tracker.
Use workflows to automate these rule-operations tasks. Workflows can query detection engine APIs on a schedule, post summaries to a chat channel, index results for dashboarding, or open a ticket when something is wrong, all using existing workflow building blocks.

## What you can automate

The following patterns combine [scheduled triggers](https://www.elastic.co/docs/explore-analyze/workflows/triggers/scheduled-triggers) with [Kibana request actions](/docs/explore-analyze/workflows/steps/kibana#kibana-request) to drive rule-operations work:
- **Audit rule health on a schedule.** A scheduled workflow queries the detection engine API for rule status, filters for rules in an error or disabled state, and publishes a daily summary.
- **Surface rule errors.** Use [`if` steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/if) to branch on rule status and send a targeted notification when the failing rule is business-critical.
- **Report on coverage.** Use [`foreach` steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/foreach) to iterate over rules, group by tag or framework mapping, and index the result to an Elasticsearch index for dashboard visualization.
- **Sync rule status to external systems.** Use [HTTP actions](https://www.elastic.co/docs/explore-analyze/workflows/steps/external-systems-apps) to mirror rule status into an external tracker, or post to Slack or PagerDuty when a rule crosses a threshold.


## How-to guides

Step-by-step guides for rule-operations workflows:
- [Run detection rules on demand](https://www.elastic.co/docs/explore-analyze/workflows/use-cases/security/manage-detection-rules/run-rules-on-demand): Manually re-run one or more detection rules over a configurable time range. Useful for gap-filling, post-incident review, and scheduled rule-health checks.


## Learn more

- [Scheduled triggers](https://www.elastic.co/docs/explore-analyze/workflows/triggers/scheduled-triggers): Run workflows on a cron-like schedule.
- [Kibana action steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/kibana): Reference for generic Kibana API requests.
- [Foreach step](https://www.elastic.co/docs/explore-analyze/workflows/steps/foreach): Iterate over arrays returned by API calls.
- [Detection rule concepts](https://www.elastic.co/docs/solutions/security/detect-and-alert/detection-rule-concepts): Background on how detection rules work.