--- title: Create a Cloud SIEM Detection Rule description: Learn how to create a Cloud SIEM detection rule for your integration. breadcrumbs: >- Docs > Extend Datadog > Datadog Integrations > Create a Cloud SIEM Detection Rule --- # Create a Cloud SIEM Detection Rule ## Overview{% #overview %} This guide provides steps for creating a Cloud SIEM detection rule and outlines best practices for rule configuration. [Datadog Cloud SIEM (Security Information and Event Management)](https://docs.datadoghq.com/security/cloud_siem/) unifies developer, operation, and security teams through one platform. Datadog provides a set of out-of-the-box detection rules for many features and integrations. View these rules in your [SIEM Detection Rules list](https://app.datadoghq.com/security/siem/rules?deprecated=hide&groupBy=tactic&product=siem&sort=rule_name). Datadog Cloud SIEM detection rules are out-of-the-box content that can be added to integrations and are ready to use upon installation. To create a Datadog integration, see [Create a New Integration](https://docs.datadoghq.com/extend/integrations/agent_integration/). ## Create a detection rule{% #create-a-detection-rule %} ### Build a detection rule{% #build-a-detection-rule %} To enhance security insights for users, partners can create their own out-of-the-box detection rules as part of a Datadog integration. Detection rules can be added as an out-of-the-box asset for integrations. In your Datadog sandbox, [create a new rule](https://app.datadoghq.com/security/siem/rules/new?product=siem). {% image source="https://datadog-docs.imgix.net/images/extend/integrations/detection_rule.59f033618a69926f7973d7cea29af534.png?auto=format" alt="The Create a New Rule page in Datadog's Detection Rules area" /%} Follow best practices outlined in this guide to configure the detection rule. ### Upload your Detection Rule{% #upload-your-detection-rule %} Within your integration in the Integration Developer Platform, navigate to the Content tab. From here, select **Import Detection Rule** to choose from a list of available detection rules. You can select up to 10 detection rules to include with your integration. {% image source="https://datadog-docs.imgix.net/images/extend/integrations/content_tab.5b98536823cb5877d0a7e8757393296c.png?auto=format" alt="The Content tab in the Developer Platform" /%} ## Verify your detection rule in production{% #verify-your-detection-rule-in-production %} To see the out-of-the-box detection rule, the relevant integration tile must be `Installed` in Datadog, and Cloud SIEM must be enabled. 1. Find your detection rule in the [Detection Rules list](https://app.datadoghq.com/security/siem/rules?deprecated=hide&groupBy=tactic&product=siem&sort=rule_name), and click to expand it. 1. Ensure that its logos render correctly. 1. Verify that the rule is enabled. ### Example of a well-defined detection rule{% #example-of-a-well-defined-detection-rule %} Selecting a rule type and defining search queries: {% image source="https://datadog-docs.imgix.net/images/extend/integrations/SIEM_detection_rule_top.bb3365992de75a6679f9deeb21860bd2.png?auto=format" alt="Steps 1-3 of a filled-out detection rule creation form" /%} Setting rule cases and writing the notification message: {% image source="https://datadog-docs.imgix.net/images/extend/integrations/SIEM_detection_rule_bottom.14d938ce4f6f3fd27ae51d687f0ae141.png?auto=format" alt="Steps 4 and 5 of a filled-out detection rule creation form" /%} For more information, see the documentation on [configuring a detection rule](https://docs.datadoghq.com/security/cloud_siem/detection_rules). ## Understanding validation messages{% #understanding-validation-messages %} ### Rule JSON parsing{% #rule-json-parsing %} ``` File= in collection= is an invalid JSON: error= ``` This error means that the JSON located at `` is considered invalid JSON ### Rule ID/Rule name{% #rule-idrule-name %} ``` partnerRuleId is empty for rule name="" - partnerRuleId= is available ``` A `partnerRuleId` is required for each rule and is missing. Use the generated ``. ``` partnerRuleId= is in the incorrect format for rule name="", it must follow the format=^[a-z0-9]{3}-[a-z0-9]{3}-[a-z0-9]{3}$ - partnerRuleId= is available ``` The rule name is not in the correct format. Use the generated `partnerRuleId: ` to fix the issue. ``` Duplicate partnerRuleId= for rule name="" - must be unique and it is already used in rule_ids="" - = is available ``` Each `partnerRuleId` must be unique. The current ID is already being used. The newly generated `partnerRuleId` is available. ``` Duplicate name="" for = - name must be unique. ``` Each rule name must be unique. The current name is already being used. Update the rule name to be unique. ### MITRE tags{% #mitre-tags %} ``` The rule with partnerRuleId= contains a MITRE tag tactic but it does not contain the tag `security:attack`, please add it ``` When a rule contains a MITRE tag `tactic:`, the tag `security:attack` must be added to the list of tags. ``` The MITRE tactic/technique tag= for partnerRuleId= appears to be incorrect (i.e. it does not exist in the MITRE framework). ``` The listed tactic/technique tag `` does not follow the [MITRE framework](https://attack.mitre.org/). Please select a valid MITRE tag. ### Cases{% #cases %} ``` The case status for = is incorrect, it should be one of . ``` The case status must be either `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, or `INFO`. ``` The case ordering for partnerRuleId= is incorrect, please modify to order cases from the highest severity to the lowest. ``` Each rule definition must be ordered by decreasing severity. Please reorder the cases into `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, and `INFO`. ### Source tags{% #source-tags %} ``` source= in the tags of the rule with partnerRule= is not supported by Datadog documentation. ``` Reach out to Datadog to address the issue. ### Rule content validation/ rule update{% #rule-content-validation-rule-update %} ``` = name="" - error= ``` Reach out to Datadog to address the issue. ``` Internal failure for = name=""- Contact Datadog Team ``` Reach out to Datadog to address the issue. ## Further reading{% #further-reading %} - [Log Detection Rules](https://docs.datadoghq.com/security/cloud_siem/detection_rules)