As the title suggests, some prebuilt security rules are failing due to some fields not being present in the Elastic Defend telemetry. From this example, the rule logic has process.command_line , However, the file telemetry for Elastic Defend does not have process.command_line I saw a numerous numbe…

Some prebuilt security rules have missing fields

leandrojmp (Leandro Pereira) May 3, 2026, 1:54pm 2

I would suggest that you open an issue on the detection rules repository, listing the rules with problems.

Topic		Replies	Views
Elastic SIEM. Security rules doesn't work SIEM	12	2246	December 27, 2021
Error while enabling security rules Elastic Security	1	76	May 20, 2025
Prebuilt security rule not working with fleet architecture Elastic Agent detection-rules	1	288	July 21, 2023
27 default Elastic Security rules contain definitions to non-existant indices and are broken Elastic Security	5	395	May 24, 2022
New "Elastic Defend" integration not recognized by rules (8.6.2) Endpoint Security	3	829	March 24, 2023