Missing pre-built rule

[reakaleek]

Describe the bug

The page with the URL https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_root_login_without_mfa was recently deleted.

Now, the URL just 404s.

This seems to be the related PR that might have caused this: elastic/detection-rules#5351. However, this PR only sets it to "deprecated".

Expected behavior

The URL should still be there and the page is should probably be marked as deprecated.

Steps to reproduce

No response

Tooling

• docs-builder
• migration tooling
• I'm not sure

[Mpdreamz]

This is because its moved into the _deprecated folder which we filter out:

docs-builder/src/Elastic.Documentation.Configuration/Toc/DetectionRules/DetectionRuleOverviewRef.cs

Line 49 in e40698d

.Where(f => !f.FullName.Contains($"{Path.DirectorySeparatorChar}_deprecated{Path.DirectorySeparatorChar}"))

@Mikaayenson should these deprecated rules still be visible on elastic.co, albeit with a large deprecated admonition?

[reakaleek]

Related to this, I found other entries that have many 404s in our logging list in https://github.com/elastic/docs-eng-team/issues/306

• /docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_ec2_snapshot_change_activity
• /docs/reference/security/prebuilt-rules/rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user
• /docs/reference/security/prebuilt-rules/rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse
• /docs/reference/security/prebuilt-rules/rules/integrations/azure/credential_access_key_vault_modified
• /docs/reference/security/prebuilt-rules/rules/linux/persistence_etc_file_creation
• /docs/reference/security/prebuilt-rules/rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion

[Mikaayenson]

++ @Mpdreamz That's right. If a rule is deprecated we should note that they are indeed deprecated.

[shashank-elastic]

@Mpdreamz Deprecated Rules historically have never been part of docs folder.

If we are drawing analogy from this https://www.elastic.co/guide/en/security/8.19/prebuilt-rules.html , we never list deprecated rules. Once moved _deprecated folder, the doc reference should be removed.

[reakaleek]

TODO: Sync with @nastasha-solomon on how to proceed here

[bmorelli25]

Could we add a generic "Deprecated rule" page that says something like:

The rule you're trying to view has been deprecated. You can view deprecated rules documentation in this folder.

More content (maybe words about deprecation and what that means)

And then any time a rule is deprecated and moved to the _deprecated directory, we automatically redirect the docs URL of the now deprecated rule to the generic deprecated rule page.

[bmorelli25]

That would be for parity with 8.x (short-term solution). If we deprecate a rule but folks can still use it, we should strive in the longer-term to keep that rule in our documentation with a deprecation warning until it is removed.

[nastasha-solomon]

I'm fairly certain that the prebuilt rule docs are frequently (if not always) referenced from the Security UI to give users additional reference material, so 1+ to redirecting users to docs page for deprecated prebuilt rules.

[reakaleek]

Decreased priority because this is the also the current behaviour

[cotti]

AI triage

Automated investigation against the current codebase. A human still needs to confirm before any code change.

Original concern

A prebuilt detection-rule page (e.g. .../prebuilt-rules/rules/integrations/aws/privilege_escalation_root_login_without_mfa) started 404ing after the rule was moved into the _deprecated/ folder in elastic/detection-rules.

Findings

• This is a docs-builder concern, not a misfiled Security-content issue. The rule content is sourced from elastic/detection-rules, but the decision to drop _deprecated rules from the rendered site is docs-builder code: src/Elastic.Documentation.Configuration/Toc/DetectionRules/DetectionRuleOverviewRef.cs:74 excludes any file under a _deprecated/ segment from the active rules listing (this is the line @Mpdreamz pointed to).
• Deprecated rules are no longer fully dropped. PR #3167 (commit eda7f352, merged 2026-06-01) "Surface deprecated prebuilt detection rules as a sibling nav page" now scans _deprecated/ (DetectionRuleOverviewRef.cs:89-108), attaches a DeprecatedSiblingRef (Toc/DocumentationSetFile.cs:464-487), and registers a synthetic "Deprecated prebuilt detection rules" page (src/Elastic.Markdown/Extensions/DetectionRules/DetectionRulesDocsBuilderExtension.cs:107-127).
• Deprecated rule pages render with a deprecation admonition — DetectionRuleFile.cs:200-209 emits a :::{warning} This rule has been deprecated…::: block when Rule.Maturity == "deprecated". This matches the consensus from @Mikaayenson / @bmorelli25 / @nastasha-solomon that deprecated rules should stay visible but clearly marked.
• But the originally-reported URL still 404s. The fix publishes deprecated rules at a new path (/rules/_deprecated/<name>), not the old per-rule path. Verified live today: the old URL …/integrations/aws/privilege_escalation_root_login_without_mfa → 404, while …/rules/_deprecated/privilege_escalation_root_login_without_mfa → 200. Same pattern holds for one of the siblings @reakaleek listed (…/linux/persistence_etc_file_creation: old 404, _deprecated 200).
• No old→new redirect was added. There is no redirect logic in the detection-rules extension; @bmorelli25's explicit ask to "automatically redirect the docs URL of the now-deprecated rule" is not implemented. (docs-builder does have redirect machinery — e.g. CodexUpdateRedirectsCommand / DeployUpdateRedirectsService — so this is wiring, not greenfield.)

Verdict

Partially done

The core "missing content" half is fixed by #3167: deprecated prebuilt rules are once again rendered (with a deprecation warning) and reachable via a sibling page, so they are no longer silently filtered out. What remains open is exactly the symptom this issue opened on — the original rule URL still 404s, because deprecated rules are republished under /rules/_deprecated/… with no redirect from the old path. This is squarely a docs-builder problem (the filtering, the new URL scheme, and any redirect would all live here); it is not misfiled to a content/Security repo, even though the rule files themselves come from elastic/detection-rules.

Proposal

Open questions before further work:

• Product / docs (ai:product-question): What is the desired end state for a rule that moves to _deprecated/? Options surfaced in-thread diverge: (a) keep it visible with a deprecation warning — already shipped; (b) redirect the old per-rule URL to the deprecated page so inbound links (incl. from the Security UI, per @nastasha-solomon) keep working; or (c) accept the 404 / remove it entirely to match 8.x behavior (per @shashank-elastic). @reakaleek's "sync with @nastasha-solomon" TODO is still unresolved, and priority was lowered because 404 "is the current behaviour."
• Engineering (ai:eng-question): If redirects are wanted, how should old paths map to new ones? elastic/detection-rules flattens deprecated rules into a single _deprecated/ folder, so the old integrations/aws/... segment no longer exists in source — the old→new mapping has to be derived (e.g. by rule id/filename) and fed into the existing redirect pipeline.

Related issues

• Prebuilt rules categories in 9.0+ #2397 (open) "Prebuilt rules categories in 9.0+" — sibling in the prebuilt-rules rendering/nav cluster; also a docs-builder concern, not misfiled.
• Be more specific when excluding deprecated detection rules #874 (closed 2025-03-31) "Be more specific when excluding deprecated detection rules" — prior decision on this exact _deprecated exclusion logic, and it references generating redirects for detection-rule pages. Useful precedent for the redirect question above.

Notes

• The broader 404 list lives in elastic/docs-eng-team#306 (per @reakaleek) — the same old→new redirect work would cover those entries too.