# Restricting rights to detection rules

**URL:** <https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777>\
**Category:** Elastic Security\
**Created:** [August 12, 2024, 12:58pm UTC](https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777 "2024-08-12T12:58:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcou](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@marcou](https://discuss.elastic.co/u/marcou)\
**Post date:** [August 12, 2024, 12:58pm UTC](https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777/1 "2024-08-12T12:58:19Z")

</div>

Hello,

we would like to give our analysts the option to create detection rules, but they should not be able to activate them. The engineer should only be able to activate them after an engineer has looked at them.

However, we have not found a way to restrict a user's rights to detection rules. If you do this via the index permissions, the user is also extremely restricted when it comes to case and alarm processing.

Have we overlooked something here or is it really not possible? If it doesn't work, we would really like this feature. 🙂

Best regards  
Marco

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [August 13, 2024, 10:01am UTC](https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777/2 "2024-08-13T10:01:10Z")

</div>

Hey @marcou

At the moment it's not possible to restrict rights to rule in a way it can be created by one user and enabled by another.

Configured Security Feature [Detections prerequisites and requirements | Elastic Security Solution [8.15] | Elastic](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) gives permission to edit or read rules through API/UI and do not have capabilities to limit enable rule functionality.

Please create feature request in Kibana issues [Issues · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues) and I will tag appropriate teams to look into it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2024, 10:01am UTC](https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777/3 "2024-09-10T10:01:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.