# Import rules from public detection rules repo

**URL:** <https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344>\
**Category:** SIEM\
**Created:** [August 18, 2020, 4:33am UTC](https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344 "2020-08-18T04:33:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bornatalebi](https://avatars.discourse-cdn.com/v4/letter/b/e68b1a/32.png) [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\
**Post date:** [August 18, 2020, 4:33am UTC](https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344/1 "2020-08-18T04:33:36Z")

</div>

Hi  
I want to import new rules from the repo but the rule's format is json or toml but SIEM only accepts ndjson files. should i manually convert them? is there a tool you recommend?

---

<div class="post-metadata">

**Author:** ![stephmilovic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephmilovic/32/146835_2.png) [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)\
**Post date:** [August 18, 2020, 6:59pm UTC](https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344/2 "2020-08-18T18:59:18Z")

</div>

Hi @bornatalebi, thanks for posting. I'd recommend using node to convert the files. There is a nice recursive solution posted on [this gist](https://gist.github.com/bzerangue/7bf6610079659e57b8d50ecb94928c31#gistcomment-3165857).

---

<div class="post-metadata">

**Author:** ![rw-access](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rw-access/32/47998_2.png) [@rw-access](https://discuss.elastic.co/u/rw-access)\
**Post date:** [August 18, 2020, 7:39pm UTC](https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344/3 "2020-08-18T19:39:32Z")

</div>

Hello @bornatalebi,

We have a workflow for this, but it goes the other way. Instead, you push rules _into_ Kibana using the `kibana-upload` command. There's some "use at your own risk" disclaimers, and we still recommend waiting for stack releases to get the latest, production-ready rules. But if you want to live on the edge and use the repository, check out the [CLI guide](https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2020, 7:39pm UTC](https://discuss.elastic.co/t/import-rules-from-public-detection-rules-repo/245344/4 "2020-09-15T19:39:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.