RuleCheck

RuleCheck is a quality assurance tool for Elastic Security detection rules. It analyzes detection rules and queries from source repositories or live Kibana environments, identifying issues related to rule structure, query logic, compatibility, integration requirements, and operational state. The tool operates across two primary modes: Static analysis (repository-based): - Validates rule structure, query logic, required fields, and version compatibility - Checks integration prerequisites, timeline references, and ML job dependencies - No connection to a production environment is required Live validation (Kibana-connected): - Confirms rules are enabled and sources are available - Validates that queries execute successfully - Checks historical alert volume against expected ranges Workflow integration: - Supports CLI usage and GitHub Actions for pull-request validation - Tracks findings across runs to surface regressions - Provides a prioritized remediation queue with source links Scope and coverage: - Primary focus is Elastic Security rules, with version-aware checks for Stack, ECS, integration, and ATT&CK resources - Also parses Sigma rules with vendor-neutral checks - Supports up to 1,000 active rules and two Elastic environments under the standard subscription Data handling: - Each customer organization is stored in a separate database - Repository access requires read-only permissions - Kibana access is optional and scoped - AI-based checks are optional; when enabled, rule content is sent to the configured model provider - Retention periods are agreed during onboarding Pricing: - Complimentary baseline review available for selected teams - Annual subscription at $15,000/year (founding customer pricing)