Create Detection Rule from Logs

What it's for

Turn an investigation query into a permanent detection rule.

Steps

1. In Table View, use the Create Detection Rule icon (shield), or context menu → `Create Detection Rule`.
2. Opens `/management/detection-rules?create=true` with the query preloaded.
3. Complete the rules wizard (Detection Rules).

Expected result

• Rules wizard open with SQL query preloaded.

See also

• Detection Rules