diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 9f5faf50b..f5628f3c3 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -2253,3 +2253,36 @@ soc:
           severityTranslations:
             minor: low
             major: high
+          templateDetections:
+            suricata: |
+              alert tcp any any <> any any (msg:""; sid:[publicId];)
+            strelka: |
+              rule  {
+                meta:
+                  description = "";
+                strings:
+                  $x = \"string\";
+                condition:
+                  all of them;
+              }
+            elastalert: |
+              title:
+              id: [publicId]
+              status:
+              description:
+              references:
+                -
+              author:
+              date:
+              tags:
+                -
+              logsource:
+                product:
+                category:
+              detection:
+                selection:
+                condition: selection
+              falsepositives:
+                -
+              level:
+
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 1f64eb0bc..47d051e4e 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -119,7 +119,7 @@ soc:
             advanced: True
           rulesRepos:
             default: &eerulesRepos
-              description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Elastalert --> Full Update." 
+              description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Elastalert --> Full Update."
               global: True
               advanced: True
               forcedType: "[]{}"
@@ -319,6 +319,17 @@ soc:
         cases: *appSettings
         dashboards: *appSettings
         detections: *appSettings
+        detection:
+          templateDetections:
+            suricata:
+              description: The template used when creating a new Suricata detection. [publicId] will be replaced with an unused Public Id.
+              multiline: True
+            strelka:
+              description: The template used when creating a new Strelka detection.
+              multiline: True
+            elastalert:
+              description: The template used when creating a new ElastAlert detection. [publicId] will be replaced with an unused Public Id.
+              multiline: True
         grid:
           maxUploadSize:
             description: The maximum number of bytes for an uploaded PCAP import file.