# Detection rules manual run: cannot be scheduled earlier than 90 days ago

**URL:** <https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033>\
**Category:** Elastic Security\
**Tags:** detection-rules\
**Created:** [October 28, 2025, 6:30am UTC](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033 "2025-10-28T06:30:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![niklaskurvinen](https://avatars.discourse-cdn.com/v4/letter/n/cdc98d/32.png) [@niklaskurvinen](https://discuss.elastic.co/u/niklaskurvinen)\
**Post date:** [October 28, 2025, 6:30am UTC](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033/1 "2025-10-28T06:30:34Z")

</div>

Hi,

Just came across the “Manual rule run cannot be scheduled earlier than 90 days ago” message for the first time. Is there a reason for this limitation and more importantly; can I override it? Tried to find any kind of information here in the forums, on github and just on _the internet._ I get that you might want to avoid to spawn a crazy amount of 1 minute lookback runs by mistake but even then it should be a warning rather than a full stop? And the start date shouldn’t be a factor at all, just the total time. If I want to run my rules agains data from a specific week in 2022 that shouldn’t be a problem, right?

In my case I have a huge dataset that I use when testing new and modified rules, but I don’t want to ingest this data every 90 days just to be able to run rules against it.

Does anyone got tips or ideas on how this could be circumvented or if there’s some other way to run detection rules further back in time?

---

<div class="post-metadata">

**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\
**Post date:** [October 30, 2025, 11:02am UTC](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033/2 "2025-10-30T11:02:40Z")

</div>

Hey, unfortunately it’s not possible to override this limit.

I created issue with idea of introduce this limit as config.

> <https://github.com/elastic/kibana/issues/241257>
>
> \### Add ability to override 90-day limit for manual rule runs
> 
> Right now, the 90…-day limit for manual rule runs is hard-coded.  
> 
> Some users \[need to be able\](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033) to override this limit.
> 
> As a minimal change, we can add a Kibana config setting to override the this value.  
> 
> We’ll also need to update the UI (modal window to schedule manual runs) and validation to use this configurable limit instead of the hard-coded one.

---

<div class="post-metadata">

**Author:** ![niklaskurvinen](https://avatars.discourse-cdn.com/v4/letter/n/cdc98d/32.png) [@niklaskurvinen](https://discuss.elastic.co/u/niklaskurvinen)\
**Post date:** [October 31, 2025, 4:33am UTC](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033/3 "2025-10-31T04:33:00Z")

</div>

Thanks @Nikita_Khristinin!