# How often does Elastic Defend integration auto update signatures

**URL:** <https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370>\
**Category:** Elastic Security\
**Created:** [January 5, 2026, 4:00pm UTC](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370 "2026-01-05T16:00:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![etrevino-lumificyber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/etrevino-lumificyber/32/144667_2.png) [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\
**Post date:** [January 5, 2026, 4:00pm UTC](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370/1 "2026-01-05T16:00:23Z")

</div>

> **[Configure updates for protection artifacts | Elastic Security \[8.19\] | Elastic](https://www.elastic.co/guide/en/security/8.19/artifact-control.html)**

Regarding elastic defend integration auto updates. How frequently do these auto updates occur? How frequently are new threat detections updated?

---

<div class="post-metadata">

**Author:** ![discourse\_ai\_spam](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@discourse\_ai\_spam](https://discuss.elastic.co/u/discourse_ai_spam)\
**Post date:** [January 5, 2026, 4:00pm UTC](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370/2 "2026-01-05T16:00:27Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2026, 4:09pm UTC](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370/3 "2026-01-05T16:09:08Z")

</div>



---

<div class="post-metadata">

**Author:** ![Joe\_Desimone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_desimone/32/138779_2.png) [@Joe\_Desimone](https://discuss.elastic.co/u/Joe_Desimone)\
**Post date:** [January 5, 2026, 4:29pm UTC](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370/4 "2026-01-05T16:29:34Z")

</div>

Hello,

The protection [artifacts](https://github.com/elastic/protections-artifacts) that power Elastic Defend are continually updated to maintain a high efficacy against an evolving threat landscape. Some of these artifacts ship on fairly regular cadence, while others are more sporadic in response to emerging threats.

- PE and MachO malware models are updated once monthly
- Hash exceptionlists to mitigate model false positives are released daily (~Monday-Thursday)
- Behavioral rules are updated twice monthly
- Yara rules and ransomware protection are updated sporadically/as needed
- Global config, exceptions, and event filters are updated sporadically/as needed

Keep in mind that this not completely rigid and we may ship more or less often as needed to maintain our efficacy and stability targets. Also worth noting, default Elastic Defend checks for new updates once an hour by default.

Thank you!