[nastasha-solomon]

Relates to https://github.com/elastic/docs-content-internal/issues/750. Follow-up to #3368.

The "latest documentation" banner on most 8.x Elastic Security prebuilt rule pages links to /docs or to a 9.x page that returns a 404. This PR updates the /en/security/*/ rule entries in v3-mapping.json so each rule page links to its 9.x page in the Prebuilt detection rules reference.

Changes

Change	Entries	Target
Added: rule matches a live 9.x rule page by title	949	That rule's 9.x page
Added: rule isn't published in 9.x yet	41	Prebuilt rules reference
Fixed: stale target, rule renamed or moved	92	The rule's current 9.x page
Fixed: stale target, rule deprecated	45	Prebuilt rules reference

After this change, every page linked from the 8.19 prebuilt rule reference has an entry. No security rule entry points to a page that doesn't exist.

How the entries were generated

• New entries: I matched each 8.x page name (the slugified rule name) to the rule titles linked from the live 9.x prebuilt rules reference. Each of the 949 pages matched exactly one live page. I used the live site instead of detection-rules main because they currently differ (see the note below).
• Stale entries: 137 existing entries pointed to 9.x URLs that return 404. Of those:
  • 19 matched a live page by title.
  • 73 were traced by rule_id through detection-rules history to the rule's current file, which is live.
  • 45 are deprecated, so they now point to the prebuilt rules reference instead of a 404.
• Not yet published: 41 rules are in the 8.19 docs but have no 9.x page yet, mostly the OpenAI ChatGPT Enterprise rules and a few added in October. These point to the prebuilt rules reference for now.

Verification

• Live targets: all 969 unique target URLs return 200 on www.elastic.co.
• JSON: the file parses, has no duplicate keys (14,009 keys), and the /en/security/*/ block stays sorted.
• Diff scope: no lines outside that block changed. The 137 removed lines are exactly the entries that were fixed.
• Banner output: UrlToV3 on sample pages gives the expected link. Combined with the fallback in Point 8.x prebuilt rule pages to the 9.x prebuilt rules reference #3368, the issue's own example, prebuilt-rule-8-19-14-potential-sap-netweaver-exploitation.html, links to /docs/reference/security/prebuilt-rules/rules/cross-platform/execution_sap_netweaver_webshell_exec.

Note: these entries will drift

The live 9.x prebuilt rules reference is built from detection-rules commit 230925f (2026-10-08). That's why rules added since then aren't live. Some rules have also moved since that commit. For example, A scheduled task was created became a building block rule on 2026-10-20. When the 9.x reference catches up, a few of these entries will need updating again, and the 41 hub entries can then point to their rule pages.

🤖 Generated with Claude Code

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}