Bulk update ESCU detections

[cseiler-gmp]

Is there a way to bulk update enabled ESCU detections when a new version with a lot of metadata changes like the MITRE changes in 5.27 are released? (This is with version detection enabled, ES version 8.3.0)

[livehybrid]

Hi @cseiler-gmp 

How are you currently managing your ESCU rules? Do you just enable the ones that come with ESCU or are you cloning them and then enabling them? 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[cseiler-gmp]

Currently just enabling them via Enterprise Security Content Management UI, not cloning them out unless we have a very specific logic change that would need to be made for our environment. The searches are still knowledge objects owned by ESCU.