# Prebuilt Security Detection Rules Integration

**URL:** <https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785>\
**Category:** Elastic Search\
**Created:** [December 10, 2024, 7:05pm UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785 "2024-12-10T19:05:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![juancamiloll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juancamiloll/32/110326_2.png) [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\
**Post date:** [December 10, 2024, 7:05pm UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785/1 "2024-12-10T19:05:48Z")

</div>

Hello,

Could someone explain me to which agent policy should I apply this integration taking into account that I have a separate server for each instance?

1 Logstash server  
1 Elasticsearch server  
1 Kibana server  
1 Fleet server

Additionally I would appreciate if someone could clarify me if what I consider is right or wrong regarding this integration I understand that it activates additional rules for the “Security” section that are not by default and that are additional?

Thanks

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/243145560a3971226650cddcac7afdfaa231317d.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/b/db58503a1423f4741463d308f7becda4468c97ed.png)

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [December 11, 2024, 12:09am UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785/2 "2024-12-11T00:09:21Z")

</div>

You do not actually need to add this to an integration policy -- it can be slightly confusing but to download or update the rules, open the "pre built security rules" integration and instead of clicking the normal add pre built... button, instead click **Settings** \> **Install Prebuilt Security Detection Rules assets**. Then [import(external, opens in a new tab or window)](https://www.elastic.co/guide/en/security/master/rules-ui-management.html#load-prebuilt-rules) the rules into the Detection engine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2025, 12:09am UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-integration/371785/3 "2025-01-08T00:09:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
