topic Bulk update ESCU detections in Splunk Enterprise Security

Bulk update ESCU detections

cseiler-gmp — Mon, 11 May 2026 19:05:23 GMT

Is there a way to bulk update enabled ESCU detections when a new version with a lot of metadata changes like the MITRE changes in 5.27 are released? (This is with version detection enabled, ES version 8.3.0)

Re: Bulk update ESCU detections

livehybrid — Mon, 11 May 2026 19:19:51 GMT

Hi @cseiler-gmp

How are you currently managing your ESCU rules? Do you just enable the ones that come with ESCU or are you cloning them and then enabling them?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Bulk update ESCU detections

cseiler-gmp — Mon, 11 May 2026 19:21:53 GMT

Currently just enabling them via Enterprise Security Content Management UI, not cloning them out unless we have a very specific logic change that would need to be made for our environment. The searches are still knowledge objects owned by ESCU.