# SIEM Detection rule reload

**URL:** <https://discuss.elastic.co/t/siem-detection-rule-reload/270045>\
**Category:** SIEM\
**Created:** [April 13, 2021, 5:54pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045 "2021-04-13T17:54:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![PublicName](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Post date:** [April 13, 2021, 5:54pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045/1 "2021-04-13T17:54:12Z")

</div>

Due to a rather nasty upgrade that resulted in a bugs. One of which is every SIEM rule no longer works each one has a different reason so going 1 by 1 isn't really an option.

Is it possible to wipe and reload all rules to match the current version of Kibana?

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [April 14, 2021, 11:47am UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045/2 "2021-04-14T11:47:07Z")

</div>

Do you only have elastic pre-build rules or do you also have custom rules?

---

<div class="post-metadata">

**Author:** ![PublicName](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Post date:** [April 14, 2021, 4:12pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045/3 "2021-04-14T16:12:12Z")

</div>

All Elastic. I stopped doing the custom ones a few versions back until the upgrades stop blowing up in my face. One cluster will work the other fails. They are in near lock step.

---

<div class="post-metadata">

**Author:** ![stephmilovic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephmilovic/32/146835_2.png) [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)\
**Post date:** [April 14, 2021, 9:46pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045/4 "2021-04-14T21:46:42Z")

</div>

Hi @PublicName

This is possible by

1. Go to the Rules page
2. Put the "Rows per page" setting as high as it goes
3. Select all in table
4. Bulk Actions \> Delete Selected
5. A button with Load Elastic prebuilt detection rules will appear once the delete has proccess and you can reload all the rules

---

<div class="post-metadata">

**Author:** ![PublicName](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Post date:** [April 14, 2021, 10:07pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045/5 "2021-04-14T22:07:21Z")

</div>

That worked a treat all are normal again.

Alternate acceptable answer: Hey dummy open your eyes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2021, 10:07pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045/6 "2021-05-12T22:07:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.