# Extracting Detection Rule

**URL:** <https://discuss.elastic.co/t/extracting-detection-rule/330549>\
**Category:** SIEM\
**Created:** [April 22, 2023, 12:18pm UTC](https://discuss.elastic.co/t/extracting-detection-rule/330549 "2023-04-22T12:18:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aliz6](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@Aliz6](https://discuss.elastic.co/u/Aliz6)\
**Post date:** [April 22, 2023, 12:18pm UTC](https://discuss.elastic.co/t/extracting-detection-rule/330549/1 "2023-04-22T12:18:17Z")

</div>

Hi there, I was wondering if there is a way to extract all of the detection use cases (built-in and custom) in an excel sheet rather a json format file.

Any suggestions would be helpful.

Thanks.

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [April 27, 2023, 10:49am UTC](https://discuss.elastic.co/t/extracting-detection-rule/330549/2 "2023-04-27T10:49:20Z")

</div>

hello @Aliz6 ! Welcome to our community!

At this moment it is not possible to export detections rules in other format, rather then `.ndjson` according to [Export rules | Elastic Security Solution [8.7] | Elastic](https://www.elastic.co/guide/en/security/current/rules-api-export.html)

But once rules exported, `.ndjson` can be converted into `.csv` with using third party tools.  
I can't recommend any, as I never used any. But it looks like there are plenty of them.  
There is also a similar question on the forum: [Export rules into excel or CSV or PDF format](https://discuss.elastic.co/t/export-rules-into-excel-or-csv-or-pdf-format/311180)

Note: to export pre-built rules, you can duplicate them and then export. See [Manage detection rules | Elastic Security Solution [8.7] | Elastic](https://www.elastic.co/guide/en/security/current/rules-ui-management.html#import-export-rules-ui)

Hope this helps

Thank you, Vitalii

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2023, 10:49am UTC](https://discuss.elastic.co/t/extracting-detection-rule/330549/3 "2023-05-25T10:49:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.