I’m trying to export all the 722 rules into an ndjson file, but the file is incomplete. There are two sets of rule: Elastic rules and Custom rules.

I go to Security > Overview > Rules > Select all 722 rules > Bulk Actions > Export selected.

However, the resulting output contains the following, which is NOT what I need.

Now, when I select the 20 Custom rules, I do get the expect output.

Any idea on how to fix this? Or am I doing something wrong?

Thanks for your help!