diff --git a/.chloggen/rule_new.yaml b/.chloggen/rule_new.yaml
new file mode 100755
index 0000000000..35b29d4c95
--- /dev/null
+++ b/.chloggen/rule_new.yaml
@@ -0,0 +1,22 @@
+# Use this changelog template to create an entry for release notes.
+#
+# If your change doesn't affect end users you should instead start
+# your pull request title with [chore] or use the "Skip Changelog" label.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: new_component
+
+# The name of the area of concern in the attributes-registry, (e.g. http, cloud, db)
+component: security-rule
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Introducing a new security rule namespace
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+# The values here must be integers.
+issues: [903]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yaml b/.github/ISSUE_TEMPLATE/bug_report.yaml
index 35d7e1ad75..d65a7ffc55 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yaml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yaml
@@ -71,6 +71,7 @@ body:
- area:process
- area:profile
- area:rpc
+ - area:security-rule
- area:server
- area:service
- area:session
diff --git a/.github/ISSUE_TEMPLATE/change_proposal.yaml b/.github/ISSUE_TEMPLATE/change_proposal.yaml
index 7ca9195edb..920ab75c84 100644
--- a/.github/ISSUE_TEMPLATE/change_proposal.yaml
+++ b/.github/ISSUE_TEMPLATE/change_proposal.yaml
@@ -63,6 +63,7 @@ body:
- area:process
- area:profile
- area:rpc
+ - area:security-rule
- area:server
- area:service
- area:session
diff --git a/.github/ISSUE_TEMPLATE/new-conventions.yaml b/.github/ISSUE_TEMPLATE/new-conventions.yaml
index 89ab5516f4..e63b412b75 100644
--- a/.github/ISSUE_TEMPLATE/new-conventions.yaml
+++ b/.github/ISSUE_TEMPLATE/new-conventions.yaml
@@ -72,6 +72,7 @@ body:
- area:process
- area:profile
- area:rpc
+ - area:security-rule
- area:server
- area:service
- area:session
diff --git a/docs/attributes-registry/README.md b/docs/attributes-registry/README.md
index 4d80dbfe2f..91df4271b1 100644
--- a/docs/attributes-registry/README.md
+++ b/docs/attributes-registry/README.md
@@ -84,6 +84,7 @@ Currently, the following namespaces exist:
- [Process](process.md)
- [Profile](profile.md)
- [RPC](rpc.md)
+- [Security Rule](security-rule.md)
- [Server](server.md)
- [Service](service.md)
- [Session](session.md)
diff --git a/docs/attributes-registry/security-rule.md b/docs/attributes-registry/security-rule.md
new file mode 100644
index 0000000000..ada53fab99
--- /dev/null
+++ b/docs/attributes-registry/security-rule.md
@@ -0,0 +1,24 @@
+
+
+
+
+
+# Security Rule
+
+## Security Rule
+
+Describes security rule attributes. Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
+
+| Attribute | Type | Description | Examples | Stability |
+|---|---|---|---|---|
+| `security_rule.category` | string | A categorization value keyword used by the entity using the rule for detection of this event | `Attempted Information Leak` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.description` | string | The description of the rule generating the event. | `Block requests to public DNS over HTTPS / TLS protocols` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.license` | string | Name of the license under which the rule used to generate this event is made available. | `Apache 2.0` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.name` | string | The name of the rule or signature generating the event. | `BLOCK_DNS_over_TLS` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.reference` | string | Reference URL to additional information about the rule used to generate this event. [1] | `https://en.wikipedia.org/wiki/DNS_over_TLS` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.ruleset.name` | string | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | `Standard_Protocol_Filters` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.uuid` | string | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | `550e8400-e29b-41d4-a716-446655440000`; `1100110011` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+| `security_rule.version` | string | The version / revision of the rule being used for analysis. | `1.0.0` | ![Experimental](https://img.shields.io/badge/-experimental-blue) |
+
+**[1] `security_rule.reference`:** The URL can point to the vendor’s documentation about the rule. If that’s not available, it can also be a link to a more general page describing this type of alert.
diff --git a/model/security-rule/registry.yaml b/model/security-rule/registry.yaml
new file mode 100644
index 0000000000..bd4c9cb5ff
--- /dev/null
+++ b/model/security-rule/registry.yaml
@@ -0,0 +1,60 @@
+groups:
+ - id: registry.security_rule
+ display_name: Security Rule
+ type: attribute_group
+ brief: >
+ Describes security rule attributes. Rule fields are used to capture the specifics of any observer or agent rules
+ that generate alerts or other notable events.
+ attributes:
+ - id: security_rule.category
+ type: string
+ stability: experimental
+ brief: >
+ A categorization value keyword used by the entity using the rule for detection of this event
+ examples: ['Attempted Information Leak']
+ - id: security_rule.description
+ type: string
+ stability: experimental
+ brief: >
+ The description of the rule generating the event.
+ examples: ['Block requests to public DNS over HTTPS / TLS protocols']
+ - id: security_rule.license
+ type: string
+ stability: experimental
+ brief: >
+ Name of the license under which the rule used to generate this event is made available.
+ examples: ['Apache 2.0']
+ - id: security_rule.name
+ type: string
+ stability: experimental
+ brief: >
+ The name of the rule or signature generating the event.
+ examples: ['BLOCK_DNS_over_TLS']
+ - id: security_rule.reference
+ type: string
+ stability: experimental
+ brief: >
+ Reference URL to additional information about the rule used to generate this event.
+ note: >
+ The URL can point to the vendor’s documentation about the rule.
+ If that’s not available, it can also be a link to a more general page describing this type of alert.
+ examples: ['https://en.wikipedia.org/wiki/DNS_over_TLS']
+ - id: security_rule.ruleset.name
+ type: string
+ stability: experimental
+ brief: >
+ Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.
+ examples: ['Standard_Protocol_Filters']
+ - id: security_rule.uuid
+ type: string
+ stability: experimental
+ brief: >
+ A rule ID that is unique within the scope of a set or group of agents, observers, or other entities
+ using the rule for detection of this event.
+ examples: ['550e8400-e29b-41d4-a716-446655440000', '1100110011']
+ - id: security_rule.version
+ type: string
+ stability: experimental
+ brief: >
+ The version / revision of the rule being used for analysis.
+ examples: ['1.0.0']