From 7f3ec3f1e48aabb6a192e60139935308f3cba785 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Tue, 15 Sep 2020 12:29:49 -0500
Subject: [PATCH] [Security Solution] [Detections] EQL Rule Creation (#76831)

* Use existing predicate helper to avoid hardcoded strings

* Render our field components with React.createElement

Without this, we get some bad behaviors:
* Cannot use React.memo'd components
* Cannot switch between UseField components (causes a "change in the
  order of hooks" error from React)

* WIP: EQL Rules can be created

WIP because: they're probably not treated well in the UI, and they're certainly not
going to execute properly, and there are no tests.

* Add unit tests for changes to schema + helpers

* Add unit tests for new EQL query input component

It's mostly just a glorified textarea for now.

* Add integration test for EQL Rule creation

* Does not assert the query language, as that is not displayed on Rule
  Details
* Does not exercise rule execution

* Use predicate helper

* Throw an error if an EQL Rule is executed

This is to prevent undefined behavior until EQL execution is
implemented.

* Fix failing tests

I changed the default value for the form field mock from an array to a
string; this fixes the few tests that were relying on it being an array.

* Audit our rule statements/switches

I made a pass through our treatment of RuleType to verify that EQL rules
would be treated appropriately. Since the default/fallthrough case is
typically the Query rule, and since this rule has the same
attributes/behavior as the new EQL rule, not much had to change here.

I converted a few if statements to exhaustive switches where possible,
and used predicate helpers in places where it was not.

* Add tests around use of custom components with UseField

There was an issue previously where memoized components would not work;
these are primarily regression tests covering that use case.

* Fix typo

* Add keys to UseField to ensure unmount

When swapping between the Custom Query and EQL rule types, we want to
ensure that the corresponding input component coming from UseField fully
unmounts and remounts with the new component.

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../components/use_field.test.tsx             |  62 ++++++-
 .../hook_form_lib/components/use_field.tsx    |   8 +-
 .../schemas/common/schemas.ts                 |   3 +-
 .../add_prepackaged_rules_type_dependents.ts  |  12 +-
 .../request/create_rules_type_dependents.ts   |  12 +-
 .../request/import_rules_type_dependents.ts   |  12 +-
 .../request/patch_rules_type_dependents.ts    |   8 +-
 .../request/update_rules_type_dependents.ts   |  12 +-
 .../schemas/response/rules_schema.test.ts     |  10 ++
 .../schemas/response/rules_schema.ts          |   9 +-
 .../common/detection_engine/utils.ts          |   4 +-
 .../common/machine_learning/helpers.ts        |   2 +-
 .../alerts_detection_rules_eql.spec.ts        | 167 ++++++++++++++++++
 .../security_solution/cypress/objects/rule.ts |  14 ++
 .../cypress/screens/create_new_rule.ts        |   4 +
 .../cypress/tasks/create_new_rule.ts          |  14 ++
 .../public/common/mock/test_providers.tsx     |   4 +-
 .../rules/add_item_form/index.test.tsx        |   2 +-
 .../rules/description_step/helpers.tsx        |   8 +
 .../rules/description_step/translations.tsx   |   7 +
 .../eql_query_bar/eql_query_bar.test.tsx      |  47 +++++
 .../rules/eql_query_bar/eql_query_bar.tsx     |  59 +++++++
 .../components/rules/eql_query_bar/index.ts   |   7 +
 .../components/rules/mitre/index.test.tsx     |   2 +-
 .../rules/select_rule_type/index.tsx          |  28 ++-
 .../rules/select_rule_type/translations.ts    |  15 ++
 .../rules/step_define_rule/index.tsx          |  78 ++++----
 .../rules/all/batch_actions.tsx               |   3 +-
 .../rules/create/helpers.test.ts              |  26 +++
 .../detection_engine/rules/create/helpers.ts  |  30 ++--
 .../detection_engine/rules/details/index.tsx  |   2 +-
 .../pages/detection_engine/rules/helpers.tsx  |  20 ++-
 .../routes/rules/create_rules_bulk_route.ts   |   8 +-
 .../routes/rules/create_rules_route.ts        |   8 +-
 .../routes/rules/import_rules_route.ts        |   8 +-
 .../routes/rules/update_rules_bulk_route.ts   |   8 +-
 .../routes/rules/update_rules_route.ts        |   8 +-
 .../detection_engine/signals/get_filter.ts    |   1 +
 .../signals/signal_rule_alert_type.ts         |   5 +-
 39 files changed, 618 insertions(+), 119 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts

diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
index c14471991ccd33..dbf53a9f0a359a 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import React, { useEffect } from 'react';
+import React, { useEffect, FunctionComponent } from 'react';
 import { act } from 'react-dom/test-utils';
 
 import { registerTestBed, TestBed } from '../shared_imports';
@@ -237,4 +237,64 @@ describe('<UseField />', () => {
       expect(serializer).not.toBeCalled();
     });
   });
+
+  describe('custom components', () => {
+    interface MyForm {
+      name: string;
+    }
+
+    let formHook: FormHook<MyForm> | null = null;
+
+    beforeEach(() => {
+      formHook = null;
+    });
+
+    const onFormHook = (_form: FormHook<MyForm>) => {
+      formHook = _form;
+    };
+
+    const TestComp = ({
+      component,
+      onForm,
+    }: {
+      component: FunctionComponent<any>;
+      onForm: (form: FormHook<MyForm>) => void;
+    }) => {
+      const { form } = useForm<MyForm>();
+
+      useEffect(() => {
+        onForm(form);
+      }, [onForm, form]);
+
+      return (
+        <Form form={form}>
+          <UseField path="name" defaultValue="myName" component={component} />
+        </Form>
+      );
+    };
+
+    it('allows function components', () => {
+      const Component = () => <textarea data-test-subj="function-component" />;
+      const setup = registerTestBed(TestComp, {
+        defaultProps: { onForm: onFormHook, component: Component },
+        memoryRouter: { wrapComponent: false },
+      });
+      const testBed = setup() as TestBed;
+
+      expect(testBed.exists('function-component')).toEqual(true);
+      expect(formHook?.getFormData()).toEqual({ name: 'myName' });
+    });
+
+    it('allows memoized function components', () => {
+      const Component = React.memo(() => <textarea data-test-subj="memoized-component" />);
+      const setup = registerTestBed(TestComp, {
+        defaultProps: { onForm: onFormHook, component: Component },
+        memoryRouter: { wrapComponent: false },
+      });
+      const testBed = setup() as TestBed;
+
+      expect(testBed.exists('memoized-component')).toEqual(true);
+      expect(formHook?.getFormData()).toEqual({ name: 'myName' });
+    });
+  });
 });
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
index 3a3ab0dab5e932..6b913f246abbb6 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
@@ -49,7 +49,7 @@ function UseFieldComp<T = unknown>(props: Props<T>) {
   } = props;
 
   const form = useFormContext();
-  const componentToRender = component ?? 'input';
+  const ComponentToRender = component ?? 'input';
   // For backward compatibility we merge the "componentProps" prop into the "rest"
   const propsToForward =
     componentProps !== undefined ? { ...componentProps, ...rest } : { ...rest };
@@ -91,9 +91,9 @@ function UseFieldComp<T = unknown>(props: Props<T>) {
     return children!(field);
   }
 
-  if (componentToRender === 'input') {
+  if (ComponentToRender === 'input') {
     return (
-      <input
+      <ComponentToRender
         type={field.type}
         onChange={field.onChange}
         value={(field.value as unknown) as string}
@@ -102,7 +102,7 @@ function UseFieldComp<T = unknown>(props: Props<T>) {
     );
   }
 
-  return componentToRender({ field, ...propsToForward });
+  return <ComponentToRender {...{ field, ...propsToForward }} />;
 }
 
 export const UseField = React.memo(UseFieldComp) as typeof UseFieldComp;
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
index 498b561a818f2d..f002e13a07cf18 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
@@ -130,7 +130,7 @@ export type Query = t.TypeOf<typeof query>;
 export const queryOrUndefined = t.union([query, t.undefined]);
 export type QueryOrUndefined = t.TypeOf<typeof queryOrUndefined>;
 
-export const language = t.keyof({ kuery: null, lucene: null });
+export const language = t.keyof({ eql: null, kuery: null, lucene: null });
 export type Language = t.TypeOf<typeof language>;
 
 export const languageOrUndefined = t.union([language, t.undefined]);
@@ -294,6 +294,7 @@ export const toOrUndefined = t.union([to, t.undefined]);
 export type ToOrUndefined = t.TypeOf<typeof toOrUndefined>;
 
 export const type = t.keyof({
+  eql: null,
   machine_learning: null,
   query: null,
   saved_query: null,
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts
index 6a51f724fc9e6d..c244b9aca9ad06 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { AddPrepackagedRulesSchema } from './add_prepackaged_rules_schema';
 
 export const validateAnomalyThreshold = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: AddPrepackagedRulesSchema): strin
 };
 
 export const validateQuery = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: AddPrepackagedRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: AddPrepackagedRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -93,7 +95,7 @@ export const validateTimelineTitle = (rule: AddPrepackagedRulesSchema): string[]
 };
 
 export const validateThreshold = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts
index af665ff8c81d2d..91b14fa9b999c2 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { CreateRulesSchema } from './create_rules_schema';
 
 export const validateAnomalyThreshold = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateQuery = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -93,7 +95,7 @@ export const validateTimelineTitle = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts
index 269181449e9e94..87264d84fd73a4 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { ImportRulesSchema } from './import_rules_schema';
 
 export const validateAnomalyThreshold = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateQuery = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -93,7 +95,7 @@ export const validateTimelineTitle = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts
index a229771a7c05cd..c974f73926c212 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { PatchRulesSchema } from './patch_rules_schema';
 
 export const validateQuery = (rule: PatchRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -19,7 +21,7 @@ export const validateQuery = (rule: PatchRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: PatchRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -67,7 +69,7 @@ export const validateId = (rule: PatchRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: PatchRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts
index 44182d250c8013..5f297fb9688fc5 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { UpdateRulesSchema } from './update_rules_schema';
 
 export const validateAnomalyThreshold = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateQuery = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -103,7 +105,7 @@ export const validateId = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts
index b3f9096b514834..36fc063761840f 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts
@@ -633,6 +633,16 @@ describe('rules_schema', () => {
       expect(fields.length).toEqual(2);
     });
 
+    test('should return two fields for a rule of type "eql"', () => {
+      const fields = addQueryFields({ type: 'eql' });
+      expect(fields.length).toEqual(2);
+    });
+
+    test('should return two fields for a rule of type "threshold"', () => {
+      const fields = addQueryFields({ type: 'threshold' });
+      expect(fields.length).toEqual(2);
+    });
+
     test('should return two fields for a rule of type "saved_query"', () => {
       const fields = addQueryFields({ type: 'saved_query' });
       expect(fields.length).toEqual(2);
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts
index 04df25d805f9e8..c26a7efb0c2882 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts
@@ -8,9 +8,9 @@ import * as t from 'io-ts';
 import { isObject } from 'lodash/fp';
 import { Either, left, fold } from 'fp-ts/lib/Either';
 import { pipe } from 'fp-ts/lib/pipeable';
-import { typeAndTimelineOnlySchema, TypeAndTimelineOnly } from './type_timeline_only_schema';
-import { isMlRule } from '../../../machine_learning/helpers';
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import {
   actions,
   anomaly_threshold,
@@ -66,6 +66,7 @@ import {
   DefaultRiskScoreMappingArray,
   DefaultSeverityMappingArray,
 } from '../types';
+import { typeAndTimelineOnlySchema, TypeAndTimelineOnly } from './type_timeline_only_schema';
 
 /**
  * This is the required fields for the rules schema response. Put all required properties on
@@ -205,7 +206,7 @@ export const addTimelineTitle = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mi
 };
 
 export const addQueryFields = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mixed[] => {
-  if (['query', 'saved_query', 'threshold'].includes(typeAndTimelineOnly.type)) {
+  if (['eql', 'query', 'saved_query', 'threshold'].includes(typeAndTimelineOnly.type)) {
     return [
       t.exact(t.type({ query: dependentRulesSchema.props.query })),
       t.exact(t.type({ language: dependentRulesSchema.props.language })),
@@ -229,7 +230,7 @@ export const addMlFields = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mixed[]
 };
 
 export const addThresholdFields = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mixed[] => {
-  if (typeAndTimelineOnly.type === 'threshold') {
+  if (isThresholdRule(typeAndTimelineOnly.type)) {
     return [
       t.exact(t.type({ threshold: dependentRulesSchema.props.threshold })),
       t.exact(t.partial({ saved_id: dependentRulesSchema.props.saved_id })),
diff --git a/x-pack/plugins/security_solution/common/detection_engine/utils.ts b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
index a72d641fbaf783..170d28cb5a725a 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/utils.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
@@ -17,4 +17,6 @@ export const hasNestedEntry = (entries: EntriesArray): boolean => {
   return found.length > 0;
 };
 
-export const isThresholdRule = (ruleType: Type) => ruleType === 'threshold';
+export const isEqlRule = (ruleType: Type | undefined) => ruleType === 'eql';
+export const isThresholdRule = (ruleType: Type | undefined) => ruleType === 'threshold';
+export const isQueryRule = (ruleType: Type | undefined) => ruleType === 'query';
diff --git a/x-pack/plugins/security_solution/common/machine_learning/helpers.ts b/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
index 73dc30f238c7e1..73b14afb5d0c9a 100644
--- a/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
+++ b/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
@@ -23,4 +23,4 @@ export const isJobFailed = (jobState: string, datafeedState: string): boolean =>
   return failureStates.includes(jobState) || failureStates.includes(datafeedState);
 };
 
-export const isMlRule = (ruleType: Type) => ruleType === 'machine_learning';
+export const isMlRule = (ruleType: Type | undefined) => ruleType === 'machine_learning';
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts
new file mode 100644
index 00000000000000..c65cd8406099a9
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts
@@ -0,0 +1,167 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { eqlRule } from '../objects/rule';
+
+import {
+  CUSTOM_RULES_BTN,
+  RISK_SCORE,
+  RULE_NAME,
+  RULES_ROW,
+  RULES_TABLE,
+  SEVERITY,
+} from '../screens/alerts_detection_rules';
+import {
+  ABOUT_FALSE_POSITIVES,
+  ABOUT_INVESTIGATION_NOTES,
+  ABOUT_MITRE,
+  ABOUT_RISK,
+  ABOUT_RULE_DESCRIPTION,
+  ABOUT_SEVERITY,
+  ABOUT_STEP,
+  ABOUT_TAGS,
+  ABOUT_URLS,
+  DEFINITION_CUSTOM_QUERY,
+  DEFINITION_INDEX_PATTERNS,
+  DEFINITION_TIMELINE,
+  DEFINITION_STEP,
+  INVESTIGATION_NOTES_MARKDOWN,
+  INVESTIGATION_NOTES_TOGGLE,
+  RULE_ABOUT_DETAILS_HEADER_TOGGLE,
+  RULE_NAME_HEADER,
+  SCHEDULE_LOOPBACK,
+  SCHEDULE_RUNS,
+  SCHEDULE_STEP,
+} from '../screens/rule_details';
+
+import {
+  goToManageAlertsDetectionRules,
+  waitForAlertsIndexToBeCreated,
+  waitForAlertsPanelToBeLoaded,
+} from '../tasks/alerts';
+import {
+  changeToThreeHundredRowsPerPage,
+  filterByCustomRules,
+  goToCreateNewRule,
+  goToRuleDetails,
+  waitForLoadElasticPrebuiltDetectionRulesTableToBeLoaded,
+  waitForRulesToBeLoaded,
+} from '../tasks/alerts_detection_rules';
+import {
+  createAndActivateRule,
+  fillAboutRuleAndContinue,
+  selectEqlRuleType,
+  fillDefineEqlRuleAndContinue,
+} from '../tasks/create_new_rule';
+import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
+import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
+
+import { DETECTIONS_URL } from '../urls/navigation';
+
+describe('Detection rules, EQL', () => {
+  before(() => {
+    esArchiverLoad('timeline');
+  });
+
+  after(() => {
+    esArchiverUnload('timeline');
+  });
+
+  it('Creates and activates a new EQL rule', () => {
+    loginAndWaitForPageWithoutDateRange(DETECTIONS_URL);
+    waitForAlertsPanelToBeLoaded();
+    waitForAlertsIndexToBeCreated();
+    goToManageAlertsDetectionRules();
+    waitForLoadElasticPrebuiltDetectionRulesTableToBeLoaded();
+    goToCreateNewRule();
+    selectEqlRuleType();
+    fillDefineEqlRuleAndContinue(eqlRule);
+    fillAboutRuleAndContinue(eqlRule);
+    createAndActivateRule();
+
+    cy.get(CUSTOM_RULES_BTN).invoke('text').should('eql', 'Custom rules (1)');
+
+    changeToThreeHundredRowsPerPage();
+    waitForRulesToBeLoaded();
+
+    const expectedNumberOfRules = 1;
+    cy.get(RULES_TABLE).then(($table) => {
+      cy.wrap($table.find(RULES_ROW).length).should('eql', expectedNumberOfRules);
+    });
+
+    filterByCustomRules();
+
+    cy.get(RULES_TABLE).then(($table) => {
+      cy.wrap($table.find(RULES_ROW).length).should('eql', 1);
+    });
+    cy.get(RULE_NAME).invoke('text').should('eql', eqlRule.name);
+    cy.get(RISK_SCORE).invoke('text').should('eql', eqlRule.riskScore);
+    cy.get(SEVERITY).invoke('text').should('eql', eqlRule.severity);
+    cy.get('[data-test-subj="rule-switch"]').should('have.attr', 'aria-checked', 'true');
+
+    goToRuleDetails();
+
+    let expectedUrls = '';
+    eqlRule.referenceUrls.forEach((url) => {
+      expectedUrls = expectedUrls + url;
+    });
+    let expectedFalsePositives = '';
+    eqlRule.falsePositivesExamples.forEach((falsePositive) => {
+      expectedFalsePositives = expectedFalsePositives + falsePositive;
+    });
+    let expectedTags = '';
+    eqlRule.tags.forEach((tag) => {
+      expectedTags = expectedTags + tag;
+    });
+    let expectedMitre = '';
+    eqlRule.mitre.forEach((mitre) => {
+      expectedMitre = expectedMitre + mitre.tactic;
+      mitre.techniques.forEach((technique) => {
+        expectedMitre = expectedMitre + technique;
+      });
+    });
+    const expectedIndexPatterns = [
+      'apm-*-transaction*',
+      'auditbeat-*',
+      'endgame-*',
+      'filebeat-*',
+      'logs-*',
+      'packetbeat-*',
+      'winlogbeat-*',
+    ];
+
+    cy.get(RULE_NAME_HEADER).invoke('text').should('eql', `${eqlRule.name} Beta`);
+
+    cy.get(ABOUT_RULE_DESCRIPTION).invoke('text').should('eql', eqlRule.description);
+    cy.get(ABOUT_STEP).eq(ABOUT_SEVERITY).invoke('text').should('eql', eqlRule.severity);
+    cy.get(ABOUT_STEP).eq(ABOUT_RISK).invoke('text').should('eql', eqlRule.riskScore);
+    cy.get(ABOUT_STEP).eq(ABOUT_URLS).invoke('text').should('eql', expectedUrls);
+    cy.get(ABOUT_STEP)
+      .eq(ABOUT_FALSE_POSITIVES)
+      .invoke('text')
+      .should('eql', expectedFalsePositives);
+    cy.get(ABOUT_STEP).eq(ABOUT_MITRE).invoke('text').should('eql', expectedMitre);
+    cy.get(ABOUT_STEP).eq(ABOUT_TAGS).invoke('text').should('eql', expectedTags);
+
+    cy.get(RULE_ABOUT_DETAILS_HEADER_TOGGLE).eq(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
+    cy.get(ABOUT_INVESTIGATION_NOTES).invoke('text').should('eql', INVESTIGATION_NOTES_MARKDOWN);
+
+    cy.get(DEFINITION_INDEX_PATTERNS).then((patterns) => {
+      cy.wrap(patterns).each((pattern, index) => {
+        cy.wrap(pattern).invoke('text').should('eql', expectedIndexPatterns[index]);
+      });
+    });
+    cy.get(DEFINITION_STEP)
+      .eq(DEFINITION_CUSTOM_QUERY)
+      .invoke('text')
+      .should('eql', `${eqlRule.customQuery} `);
+    cy.get(DEFINITION_STEP).eq(2).invoke('text').should('eql', 'Event Correlation');
+    cy.get(DEFINITION_STEP).eq(DEFINITION_TIMELINE).invoke('text').should('eql', 'None');
+
+    cy.get(SCHEDULE_STEP).eq(SCHEDULE_RUNS).invoke('text').should('eql', '5m');
+    cy.get(SCHEDULE_STEP).eq(SCHEDULE_LOOPBACK).invoke('text').should('eql', '1m');
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index df6b792296f9d7..0624606fe8481a 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -156,3 +156,17 @@ export const machineLearningRule: MachineLearningRule = {
   mitre: [mitre1],
   note: '# test markdown',
 };
+
+export const eqlRule: CustomRule = {
+  customQuery: 'process where process_name == "explorer.exe"',
+  name: 'New EQL Rule',
+  description: 'New EQL rule description.',
+  severity: 'High',
+  riskScore: '17',
+  tags: ['test', 'newRule'],
+  referenceUrls: ['https://www.google.com/', 'https://elastic.co/'],
+  falsePositivesExamples: ['False1', 'False2'],
+  mitre: [mitre1, mitre2],
+  note: '# test markdown',
+  timelineId: '0162c130-78be-11ea-9718-118a926974a4',
+};
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
index 397d0c01421796..1c25ed88c3beee 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
@@ -30,6 +30,10 @@ export const DEFINE_CONTINUE_BUTTON = '[data-test-subj="define-continue"]';
 
 export const DEFINE_EDIT_BUTTON = '[data-test-subj="edit-define-rule"]';
 
+export const EQL_TYPE = '[data-test-subj="eqlRuleType"]';
+
+export const EQL_QUERY_INPUT = '[data-test-subj="eqlQueryBarTextInput"]';
+
 export const IMPORT_QUERY_FROM_SAVED_TIMELINE_LINK =
   '[data-test-subj="importQueryFromSavedTimeline"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
index 3fa300ce9d8d0f..f26a77171462c6 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
@@ -50,6 +50,8 @@ import {
   THRESHOLD_TYPE,
   DEFINE_EDIT_BUTTON,
   ABOUT_EDIT_BUTTON,
+  EQL_TYPE,
+  EQL_QUERY_INPUT,
 } from '../screens/create_new_rule';
 import { TIMELINE } from '../screens/timeline';
 
@@ -209,6 +211,14 @@ export const fillDefineThresholdRuleAndContinue = (rule: ThresholdRule) => {
   cy.get(CUSTOM_QUERY_INPUT).should('not.exist');
 };
 
+export const fillDefineEqlRuleAndContinue = (rule: CustomRule) => {
+  cy.get(EQL_QUERY_INPUT).type(rule.customQuery);
+  cy.get(EQL_QUERY_INPUT).invoke('text').should('eq', rule.customQuery);
+  cy.get(DEFINE_CONTINUE_BUTTON).should('exist').click({ force: true });
+
+  cy.get(EQL_QUERY_INPUT).should('not.exist');
+};
+
 export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRule) => {
   cy.get(MACHINE_LEARNING_DROPDOWN).click({ force: true });
   cy.contains(MACHINE_LEARNING_LIST, rule.machineLearningJob).click();
@@ -227,3 +237,7 @@ export const selectMachineLearningRuleType = () => {
 export const selectThresholdRuleType = () => {
   cy.get(THRESHOLD_TYPE).click({ force: true });
 };
+
+export const selectEqlRuleType = () => {
+  cy.get(EQL_TYPE).click({ force: true });
+};
diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 5a4eaad72ac322..8c186addf783d8 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -77,11 +77,11 @@ const TestProvidersComponent: React.FC<Props> = ({
 
 export const TestProviders = React.memo(TestProvidersComponent);
 
-export const useFormFieldMock = (options?: Partial<FieldHook>): FieldHook => {
+export const useFormFieldMock = <T,>(options?: Partial<FieldHook<T>>): FieldHook<T> => {
   return {
     path: 'path',
     type: 'type',
-    value: [],
+    value: ('mockedValue' as unknown) as T,
     isPristine: false,
     isValidating: false,
     isValidated: false,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx
index 890e66c8767c4b..362dfed4b8e72d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx
@@ -13,7 +13,7 @@ import { useFormFieldMock } from '../../../../common/mock/test_providers';
 describe('AddItem', () => {
   it('renders correctly', () => {
     const Component = () => {
-      const field = useFormFieldMock();
+      const field = useFormFieldMock<unknown>({ value: [] });
 
       return (
         <AddItem
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
index 680ca78fc222e8..0c866ae0bd926d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
@@ -383,6 +383,14 @@ export const buildRuleTypeDescription = (label: string, ruleType: Type): ListIte
         },
       ];
     }
+    case 'eql': {
+      return [
+        {
+          title: label,
+          description: i18n.EQL_TYPE_DESCRIPTION,
+        },
+      ];
+    }
     default:
       return assertUnreachable(ruleType);
   }
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx
index 76217964a87cb4..124ef9e6484034 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx
@@ -34,6 +34,13 @@ export const ML_TYPE_DESCRIPTION = i18n.translate(
   }
 );
 
+export const EQL_TYPE_DESCRIPTION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.eqlRuleTypeDescription',
+  {
+    defaultMessage: 'Event Correlation',
+  }
+);
+
 export const QUERY_TYPE_DESCRIPTION = i18n.translate(
   'xpack.securitySolution.detectionEngine.createRule.queryRuleTypeDescription',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx
new file mode 100644
index 00000000000000..331c0ba4c44914
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow, mount } from 'enzyme';
+
+import { useFormFieldMock } from '../../../../common/mock';
+import { mockQueryBar } from '../../../pages/detection_engine/rules/all/__mocks__/mock';
+import { EqlQueryBar, EqlQueryBarProps } from './eql_query_bar';
+
+describe('EqlQueryBar', () => {
+  let mockField: EqlQueryBarProps['field'];
+
+  beforeEach(() => {
+    mockField = useFormFieldMock({
+      value: mockQueryBar,
+    });
+  });
+
+  it('renders correctly', () => {
+    const wrapper = shallow(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+
+    expect(wrapper.find('[data-test-subj="myQueryBar"]')).toHaveLength(1);
+  });
+
+  it('sets the field value on input change', () => {
+    const wrapper = mount(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+
+    wrapper
+      .find('[data-test-subj="eqlQueryBarTextInput"]')
+      .first()
+      .simulate('change', { target: { value: 'newQuery' } });
+
+    const expected = {
+      filters: [],
+      query: {
+        query: 'newQuery',
+        language: 'eql',
+      },
+    };
+
+    expect(mockField.setValue).toHaveBeenCalledWith(expected);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx
new file mode 100644
index 00000000000000..e3f33ea9b9b870
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, useCallback, ChangeEvent } from 'react';
+import { EuiFormRow, EuiTextArea } from '@elastic/eui';
+
+import { FieldHook, getFieldValidityAndErrorMessage } from '../../../../shared_imports';
+import { DefineStepRule } from '../../../pages/detection_engine/rules/types';
+
+export interface EqlQueryBarProps {
+  dataTestSubj: string;
+  field: FieldHook<DefineStepRule['queryBar']>;
+  idAria?: string;
+}
+
+export const EqlQueryBar: FC<EqlQueryBarProps> = ({ dataTestSubj, field, idAria }) => {
+  const { setValue } = field;
+  const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+  const fieldValue = field.value.query.query as string;
+
+  const handleChange = useCallback(
+    (e: ChangeEvent<HTMLTextAreaElement>) => {
+      const newQuery = e.target.value;
+
+      setValue({
+        filters: [],
+        query: {
+          query: newQuery,
+          language: 'eql',
+        },
+      });
+    },
+    [setValue]
+  );
+
+  return (
+    <EuiFormRow
+      label={field.label}
+      labelAppend={field.labelAppend}
+      helpText={field.helpText}
+      error={errorMessage}
+      isInvalid={isInvalid}
+      fullWidth
+      data-test-subj={dataTestSubj}
+      describedByIds={idAria ? [idAria] : undefined}
+    >
+      <EuiTextArea
+        data-test-subj="eqlQueryBarTextInput"
+        fullWidth
+        isInvalid={isInvalid}
+        value={fieldValue}
+        onChange={handleChange}
+      />
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts
new file mode 100644
index 00000000000000..fcbe069c1f57f8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { EqlQueryBar } from './eql_query_bar';
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx
index ecf1bda807b68c..23b3519cee5825 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx
@@ -13,7 +13,7 @@ import { useFormFieldMock } from '../../../../common/mock';
 describe('AddMitreThreat', () => {
   it('renders correctly', () => {
     const Component = () => {
-      const field = useFormFieldMock();
+      const field = useFormFieldMock<unknown>({ value: [] });
 
       return (
         <AddMitreThreat
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
index 6f5f3361d2b3e1..169e4f81d34986 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
@@ -8,7 +8,11 @@ import React, { useCallback, useMemo } from 'react';
 import { EuiCard, EuiFlexGrid, EuiFlexItem, EuiFormRow, EuiIcon } from '@elastic/eui';
 
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
-import { isThresholdRule } from '../../../../../common/detection_engine/utils';
+import {
+  isThresholdRule,
+  isEqlRule,
+  isQueryRule,
+} from '../../../../../common/detection_engine/utils';
 import { FieldHook } from '../../../../shared_imports';
 import { useKibana } from '../../../../common/lib/kibana';
 import * as i18n from './translations';
@@ -37,6 +41,7 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
     },
     [field]
   );
+  const setEql = useCallback(() => setType('eql'), [setType]);
   const setMl = useCallback(() => setType('machine_learning'), [setType]);
   const setQuery = useCallback(() => setType('query'), [setType]);
   const setThreshold = useCallback(() => setType('threshold'), [setType]);
@@ -45,11 +50,20 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
     path: '#/management/stack/license_management',
   });
 
+  const eqlSelectableConfig = useMemo(
+    () => ({
+      isDisabled: isReadOnly,
+      onClick: setEql,
+      isSelected: isEqlRule(ruleType),
+    }),
+    [isReadOnly, ruleType, setEql]
+  );
+
   const querySelectableConfig = useMemo(
     () => ({
       isDisabled: isReadOnly,
       onClick: setQuery,
-      isSelected: !isMlRule(ruleType) && !isThresholdRule(ruleType),
+      isSelected: isQueryRule(ruleType),
     }),
     [isReadOnly, ruleType, setQuery]
   );
@@ -114,6 +128,16 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
             selectable={thresholdSelectableConfig}
           />
         </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiCard
+            data-test-subj="eqlRuleType"
+            title={i18n.EQL_TYPE_TITLE}
+            description={i18n.EQL_TYPE_DESCRIPTION}
+            icon={<EuiIcon size="l" type="bullseye" />}
+            isDisabled={eqlSelectableConfig.isDisabled && !eqlSelectableConfig.isSelected}
+            selectable={eqlSelectableConfig}
+          />
+        </EuiFlexItem>
       </EuiFlexGrid>
     </EuiFormRow>
   );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
index 3b85a7dfc765c7..e7b231ca74958e 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
@@ -6,6 +6,21 @@
 
 import { i18n } from '@kbn/i18n';
 
+export const EQL_TYPE_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.eqlTypeTitle',
+  {
+    defaultMessage: 'Event Correlation',
+  }
+);
+
+export const EQL_TYPE_DESCRIPTION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.eqlTypeDescription',
+  {
+    defaultMessage:
+      'Use Event Query Language (EQL) to match events, generate sequences, and stack data',
+  }
+);
+
 export const QUERY_TYPE_TITLE = i18n.translate(
   'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.queryTypeTitle',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
index 158f323b739e61..7846f0c406668c 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -46,6 +46,8 @@ import {
 } from '../../../../shared_imports';
 import { schema } from './schema';
 import * as i18n from './translations';
+import { isEqlRule, isThresholdRule } from '../../../../../common/detection_engine/utils';
+import { EqlQueryBar } from '../eql_query_bar';
 
 const CommonUseField = getUseField({ component: Field });
 
@@ -123,9 +125,10 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   }) as unknown) as [Partial<DefineStepRule>];
   const index = formIndex || initialState.index;
   const ruleType = formRuleType || initialState.ruleType;
-  const [
-    { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
-  ] = useFetchIndexPatterns(index, RuleStep.defineRule);
+  const [{ browserFields, indexPatterns, isLoading: indexPatternsLoading }] = useFetchIndexPatterns(
+    index,
+    RuleStep.defineRule
+  );
 
   // reset form when rule type changes
   useEffect(() => {
@@ -186,7 +189,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     <StepContentWrapper data-test-subj="definitionRule" addPadding={addPadding}>
       <StepRuleDescription
         columns={descriptionColumns}
-        indexPatterns={indexPatternQueryBar}
+        indexPatterns={indexPatterns}
         schema={filterRuleFieldsForType(schema as typeof schema & RuleFields, ruleType)}
         data={filterRuleFieldsForType(initialState, ruleType)}
       />
@@ -227,31 +230,46 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                   },
                 }}
               />
-              <UseField
-                path="queryBar"
-                config={{
-                  ...schema.queryBar,
-                  labelAppend: (
-                    <MyLabelButton
-                      data-test-subj="importQueryFromSavedTimeline"
-                      onClick={handleOpenTimelineSearch}
-                    >
-                      {i18n.IMPORT_TIMELINE_QUERY}
-                    </MyLabelButton>
-                  ),
-                }}
-                component={QueryBarDefineRule}
-                componentProps={{
-                  browserFields,
-                  idAria: 'detectionEngineStepDefineRuleQueryBar',
-                  indexPattern: indexPatternQueryBar,
-                  isDisabled: isLoading,
-                  isLoading: indexPatternLoadingQueryBar,
-                  dataTestSubj: 'detectionEngineStepDefineRuleQueryBar',
-                  openTimelineSearch,
-                  onCloseTimelineSearch: handleCloseTimelineSearch,
-                }}
-              />
+              {isEqlRule(ruleType) ? (
+                <UseField
+                  key="EqlQueryBar"
+                  path="queryBar"
+                  component={EqlQueryBar}
+                  componentProps={{
+                    idAria: 'detectionEngineStepDefineRuleEqlQueryBar',
+                    isDisabled: isLoading,
+                    isLoading: indexPatternsLoading,
+                    dataTestSubj: 'detectionEngineStepDefineRuleEqlQueryBar',
+                  }}
+                />
+              ) : (
+                <UseField
+                  key="QueryBarDefineRule"
+                  path="queryBar"
+                  config={{
+                    ...schema.queryBar,
+                    labelAppend: (
+                      <MyLabelButton
+                        data-test-subj="importQueryFromSavedTimeline"
+                        onClick={handleOpenTimelineSearch}
+                      >
+                        {i18n.IMPORT_TIMELINE_QUERY}
+                      </MyLabelButton>
+                    ),
+                  }}
+                  component={QueryBarDefineRule}
+                  componentProps={{
+                    browserFields,
+                    idAria: 'detectionEngineStepDefineRuleQueryBar',
+                    indexPattern: indexPatterns,
+                    isDisabled: isLoading,
+                    isLoading: indexPatternsLoading,
+                    dataTestSubj: 'detectionEngineStepDefineRuleQueryBar',
+                    openTimelineSearch,
+                    onCloseTimelineSearch: handleCloseTimelineSearch,
+                  }}
+                />
+              )}
             </>
           </RuleTypeEuiFormRow>
           <RuleTypeEuiFormRow $isVisible={isMlRule(ruleType)} fullWidth>
@@ -273,7 +291,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
             </>
           </RuleTypeEuiFormRow>
           <RuleTypeEuiFormRow
-            $isVisible={ruleType === 'threshold'}
+            $isVisible={isThresholdRule(ruleType)}
             data-test-subj="thresholdInput"
             fullWidth
           >
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
index 71cfbbf552d845..740cd63496682e 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
@@ -17,6 +17,7 @@ import {
 import { ActionToaster, displayWarningToast } from '../../../../../common/components/toasters';
 import { Rule } from '../../../../containers/detection_engine/rules';
 import * as detectionI18n from '../../translations';
+import { isMlRule } from '../../../../../../common/machine_learning/helpers';
 
 interface GetBatchItems {
   closePopover: () => void;
@@ -62,7 +63,7 @@ export const getBatchItems = ({
         );
 
         const deactivatedIdsNoML = deactivatedIds.filter(
-          (id) => rules.find((r) => r.id === id)?.type !== 'machine_learning' ?? false
+          (id) => !isMlRule(rules.find((r) => r.id === id)?.type)
         );
 
         const mlRuleCount = deactivatedIds.length - deactivatedIdsNoML.length;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
index 79488231b29ee6..11222a0a95a80a 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
@@ -241,6 +241,32 @@ describe('helpers', () => {
 
       expect(result).toEqual(expected);
     });
+
+    test('returns query fields if type is eql', () => {
+      const mockStepData: DefineStepRule = {
+        ...mockData,
+        ruleType: 'eql',
+        queryBar: {
+          ...mockData.queryBar,
+          query: {
+            ...mockData.queryBar.query,
+            language: 'eql',
+            query: 'process where process_name == "explorer.exe"',
+          },
+        },
+      };
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        filters: mockStepData.queryBar.filters,
+        index: mockStepData.index,
+        language: 'eql',
+        query: 'process where process_name == "explorer.exe"',
+        type: 'eql',
+      };
+
+      expect(result).toEqual(expect.objectContaining(expected));
+    });
   });
 
   describe('formatScheduleStepData', () => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
index 0137777f8f8f22..2acb3e57c5a3b9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
@@ -9,9 +9,8 @@ import moment from 'moment';
 import deepmerge from 'deepmerge';
 
 import { NOTIFICATION_THROTTLE_NO_ACTIONS } from '../../../../../../common/constants';
+import { assertUnreachable } from '../../../../../../common/utility_types';
 import { transformAlertToRuleAction } from '../../../../../../common/detection_engine/transform_actions';
-import { isMlRule } from '../../../../../../common/machine_learning/helpers';
-import { isThresholdRule } from '../../../../../../common/detection_engine/utils';
 import { List } from '../../../../../../common/detection_engine/schemas/types';
 import { ENDPOINT_LIST_ID, ExceptionListType, NamespaceType } from '../../../../../shared_imports';
 import { Rule } from '../../../../containers/detection_engine/rules';
@@ -88,16 +87,25 @@ const isThresholdFields = <T>(
 ): fields is ThresholdRuleFields<T> => has('threshold', fields);
 
 export const filterRuleFieldsForType = <T extends RuleFields>(fields: T, type: Type) => {
-  if (isMlRule(type)) {
-    const { index, queryBar, threshold, ...mlRuleFields } = fields;
-    return mlRuleFields;
-  } else if (isThresholdRule(type)) {
-    const { anomalyThreshold, machineLearningJobId, ...thresholdRuleFields } = fields;
-    return thresholdRuleFields;
-  } else {
-    const { anomalyThreshold, machineLearningJobId, threshold, ...queryRuleFields } = fields;
-    return queryRuleFields;
+  switch (type) {
+    case 'machine_learning':
+      const { index, queryBar, threshold, ...mlRuleFields } = fields;
+      return mlRuleFields;
+    case 'threshold':
+      const { anomalyThreshold, machineLearningJobId, ...thresholdRuleFields } = fields;
+      return thresholdRuleFields;
+    case 'query':
+    case 'saved_query':
+    case 'eql':
+      const {
+        anomalyThreshold: _a,
+        machineLearningJobId: _m,
+        threshold: _t,
+        ...queryRuleFields
+      } = fields;
+      return queryRuleFields;
   }
+  assertUnreachable(type);
 };
 
 export const formatDefineStepData = (defineStepData: DefineStepRule): DefineStepRuleJson => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index 2988e031c4dd6d..68799f46eee57c 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -390,7 +390,7 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
                     <EuiToolTip
                       position="top"
                       content={
-                        rule?.type === 'machine_learning' && !hasMlPermissions
+                        isMlRule(rule?.type) && !hasMlPermissions
                           ? detectionI18n.ML_RULES_DISABLED_MESSAGE
                           : undefined
                       }
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
index aab73c5d5a1e5f..dbfb0333e48ee2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
@@ -11,7 +11,7 @@ import { useLocation } from 'react-router-dom';
 
 import { ActionVariable } from '../../../../../../triggers_actions_ui/public';
 import { RuleAlertAction } from '../../../../../common/detection_engine/types';
-import { isMlRule } from '../../../../../common/machine_learning/helpers';
+import { assertUnreachable } from '../../../../../common/utility_types';
 import { transformRuleToAlertAction } from '../../../../../common/detection_engine/transform_actions';
 import { Filter } from '../../../../../../../../src/plugins/data/public';
 import { ENDPOINT_LIST_ID } from '../../../../shared_imports';
@@ -310,15 +310,17 @@ export const redirectToDetections = (
 const getRuleSpecificRuleParamKeys = (ruleType: Type) => {
   const queryRuleParams = ['index', 'filters', 'language', 'query', 'saved_id'];
 
-  if (isMlRule(ruleType)) {
-    return ['anomaly_threshold', 'machine_learning_job_id'];
+  switch (ruleType) {
+    case 'machine_learning':
+      return ['anomaly_threshold', 'machine_learning_job_id'];
+    case 'threshold':
+      return ['threshold', ...queryRuleParams];
+    case 'query':
+    case 'saved_query':
+    case 'eql':
+      return queryRuleParams;
   }
-
-  if (ruleType === 'threshold') {
-    return ['threshold', ...queryRuleParams];
-  }
-
-  return queryRuleParams;
+  assertUnreachable(ruleType);
 };
 
 export const getActionMessageRuleParams = (ruleType: Type): string[] => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
index acd800e54040c3..959bf3186f1365 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
@@ -27,6 +27,7 @@ import { buildRouteValidation } from '../../../../utils/build_validation/route_v
 import { transformBulkError, createBulkErrorObject, buildSiemResponse } from '../utils';
 import { updateRulesNotifications } from '../../rules/update_rules_notifications';
 import { PartialFilter } from '../../types';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 
 export const createRulesBulkRoute = (router: IRouter, ml: SetupPlugins['ml']) => {
   router.post(
@@ -112,13 +113,10 @@ export const createRulesBulkRoute = (router: IRouter, ml: SetupPlugins['ml']) =>
                 });
               }
 
-              const query =
-                type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+              const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
               const language =
-                type !== 'machine_learning' && languageOrUndefined == null
-                  ? 'kuery'
-                  : languageOrUndefined;
+                !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
               // TODO: Fix these either with an is conversion or by better typing them within io-ts
               const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
index 482edb9925557b..701e5b5e706ed3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -24,6 +24,7 @@ import { transformError, buildSiemResponse } from '../utils';
 import { updateRulesNotifications } from '../../rules/update_rules_notifications';
 import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_saved_objects_client';
 import { PartialFilter } from '../../types';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 
 export const createRulesRoute = (router: IRouter, ml: SetupPlugins['ml']): void => {
   router.post(
@@ -86,13 +87,10 @@ export const createRulesRoute = (router: IRouter, ml: SetupPlugins['ml']): void
         exceptions_list: exceptionsList,
       } = request.body;
       try {
-        const query =
-          type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+        const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
         const language =
-          type !== 'machine_learning' && languageOrUndefined == null
-            ? 'kuery'
-            : languageOrUndefined;
+          !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
         // TODO: Fix these either with an is conversion or by better typing them within io-ts
         const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index 8a7215e5a5badd..60bb8c79243d7c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -19,6 +19,7 @@ import {
   ImportRulesSchema as ImportRulesResponseSchema,
   importRulesSchema as importRulesResponseSchema,
 } from '../../../../../common/detection_engine/schemas/response/import_rules_schema';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { IRouter } from '../../../../../../../../src/core/server';
 import { createPromiseFromStreams } from '../../../../../../../../src/core/server/utils/';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
@@ -174,13 +175,10 @@ export const importRulesRoute = (router: IRouter, config: ConfigType, ml: SetupP
                 } = parsedRule;
 
                 try {
-                  const query =
-                    type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+                  const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
                   const language =
-                    type !== 'machine_learning' && languageOrUndefined == null
-                      ? 'kuery'
-                      : languageOrUndefined;
+                    !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
                   // TODO: Fix these either with an is conversion or by better typing them within io-ts
                   const filters: PartialFilter[] | undefined = filtersRest as PartialFilter[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
index 518024387fed31..0e414e130849a5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
@@ -13,6 +13,7 @@ import {
   UpdateRulesBulkSchemaDecoded,
 } from '../../../../../common/detection_engine/schemas/request/update_rules_bulk_schema';
 import { rulesBulkSchema } from '../../../../../common/detection_engine/schemas/response/rules_bulk_schema';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { IRouter } from '../../../../../../../../src/core/server';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 import { SetupPlugins } from '../../../../plugin';
@@ -108,13 +109,10 @@ export const updateRulesBulkRoute = (router: IRouter, ml: SetupPlugins['ml']) =>
               });
             }
 
-            const query =
-              type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+            const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
             const language =
-              type !== 'machine_learning' && languageOrUndefined == null
-                ? 'kuery'
-                : languageOrUndefined;
+              !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
             // TODO: Fix these either with an is conversion or by better typing them within io-ts
             const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 299b99c4d37b02..553d084b626337 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -10,6 +10,7 @@ import {
   updateRulesSchema,
   UpdateRulesSchemaDecoded,
 } from '../../../../../common/detection_engine/schemas/request/update_rules_schema';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { IRouter } from '../../../../../../../../src/core/server';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 import { SetupPlugins } from '../../../../plugin';
@@ -87,13 +88,10 @@ export const updateRulesRoute = (router: IRouter, ml: SetupPlugins['ml']) => {
         exceptions_list: exceptionsList,
       } = request.body;
       try {
-        const query =
-          type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+        const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
         const language =
-          type !== 'machine_learning' && languageOrUndefined == null
-            ? 'kuery'
-            : languageOrUndefined;
+          !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
         // TODO: Fix these either with an is conversion or by better typing them within io-ts
         const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
index f77485f39a98d4..6323938d6903bf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
@@ -89,6 +89,7 @@ export const getFilter = async ({
   };
 
   switch (type) {
+    case 'eql':
     case 'threshold': {
       return savedId != null ? savedQueryFilter() : queryFilter();
     }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 7ee157beec789c..2b6587300a581e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -14,6 +14,7 @@ import {
   SERVER_APP_ID,
 } from '../../../../common/constants';
 import { isJobStarted, isMlRule } from '../../../../common/machine_learning/helpers';
+import { isThresholdRule, isEqlRule } from '../../../../common/detection_engine/utils';
 import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
 import { SetupPlugins } from '../../../plugin';
 import { getInputIndex } from './get_input_output_index';
@@ -244,7 +245,9 @@ export const signalRulesAlertType = ({
           if (bulkCreateDuration) {
             result.bulkCreateTimes.push(bulkCreateDuration);
           }
-        } else if (type === 'threshold' && threshold) {
+        } else if (isEqlRule(type)) {
+          throw new Error('EQL Rules are under development, execution is not yet implemented');
+        } else if (isThresholdRule(type) && threshold) {
           const inputIndex = await getInputIndex(services, version, index);
           const esFilter = await getFilter({
             type,