---
title: Before you begin
description: Prerequisites and initial setup tasks before creating and running detection rules.
url: https://www.elastic.co/docs/solutions/security/detect-and-alert/before-you-begin
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Before you begin
Before you can create and run detection rules, confirm that your environment meets the infrastructure requirements and that your users have the necessary privileges. Some tasks only need to be done once during initial setup, while others should be revisited as your environment evolves. If you're new to Elastic Security detections, check out [Detection rule concepts](https://www.elastic.co/docs/solutions/security/detect-and-alert/detection-rule-concepts) for an overview of how rules work.

## One-time setup

These tasks are typically completed once when you first configure detection capabilities:
- [Turn on detections](https://www.elastic.co/docs/solutions/security/detect-and-alert/turn-on-detections): Enable the Detections feature for your deployment type. On Serverless, detections are on by default.
- [Detections privileges](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges): Understand the cluster, index, and Kibana privileges required for detection features, and review predefined roles and the authorization model.


## Revisit as your environment changes

You might need to revisit the following as you onboard new data sources, add users, or expand your detection coverage:
- [User roles and privileges](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges): As your team grows or responsibilities shift, review and update role assignments to ensure analysts have the access they need.
- [Advanced data source configuration](https://www.elastic.co/docs/solutions/security/detect-and-alert/advanced-data-source-configuration): Revisit cross-cluster search setup, data tier exclusions, and index mode settings when you add new clusters, change data retention policies, or onboard data sources that use different index configurations.