Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions docs/detections/rules-ui-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -105,13 +105,13 @@ TIP: You can hide the *integrations* badge in the Rules tables. Go to *{kib}* ->
[[edit-rules-settings]]
=== Modify existing rules settings

You can edit an existing rule's settings, and can bulk edit index patterns, tags, and Timeline templates for multiple rules at once.
You can edit an existing rule's settings, and can bulk edit settings for multiple rules at once.

[NOTE]
====
For prebuilt Elastic rules, you can't modify most settings. You can only edit <<rule-schedule, rule actions>> and <<detections-ui-exceptions, add exceptions>>.

If you try to bulk edit with both prebuilt and custom rules selected, the action will affect only custom rules.
If you try to bulk edit with both prebuilt and custom rules selected, the action will affect only the rules that can be modified.
====

. Go to *Manage* -> *Rules*.
Expand All @@ -120,6 +120,11 @@ If you try to bulk edit with both prebuilt and custom rules selected, the action
* Bulk edit multiple rules: Select the rules you want to edit, then select an action from the *Bulk actions* menu:
** *Index patterns*: Add or delete the index patterns used by all selected rules.
** *Tags*: Add or delete tags on all selected rules.
** *Add rule actions*: Add <<rule-notifications,notification actions>> on all selected rules.
+
NOTE: The action frequency you select applies to all actions (both new and existing) on all selected rules. If you don't want to change the frequency of existing actions, update the rules separately.

** *Update rule schedules*: Update the <<rule-schedule,schedules>> and look-back times on all selected rules.
** *Apply Timeline template*: Apply a specified <<timeline-templates-ui, Timeline template>> to the selected rules. You can also choose *None* to remove Timeline templates from the selected rules.
. On the flyout that opens, update the settings.
. If available, select *Overwrite all selected _x_* to overwrite the settings on the rules. For example, if you're adding tags to multiple rules, selecting *Overwrite all selected rules tags* removes all the rules' original tags and replaces them with the tags you specify.
Expand Down