diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
new file mode 100644
index 000000000..2af0b7c90
--- /dev/null
+++ b/.github/workflows/backport.yml
@@ -0,0 +1,66 @@
+name: backport
+on:
+  pull_request_target:
+    branches:
+      - main
+    types:
+      - labeled
+      - closed
+
+jobs:
+  backport:
+    name: on merge
+    if: |
+      github.event.pull_request.merged == true
+      && contains(github.event.pull_request.labels.*.name, 'backport: auto')
+      && (
+        (github.event.action == 'labeled' && github.event.label.name == 'backport: auto')
+        || (github.event.action == 'closed')
+      )
+    runs-on: ubuntu-latest
+    strategy:
+      max-parallel: 1
+      matrix:
+        target_branch: [7.13]
+
+    steps:
+      - uses: craftech-io/slack-action@v1
+        with:
+          slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          status: failure
+        if: failure()
+
+      - name: Checkout repo
+        uses: actions/checkout@v2
+
+      - name: Set github config
+        run: |
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+
+      - name: Update branches
+        run: |
+          git fetch origin ${{matrix.target_branch}} --unshallow
+          git checkout -f ${{matrix.target_branch}}
+          git status
+          git log -1 --format='%H'
+
+      - name: Backport commit
+        run: |
+          echo "Cherry-pick from $GITHUB_SHA to ${{matrix.target_branch}}"
+          git cherry-pick -x ${{github.event.pull_request.merge_commit_sha}}
+
+          # See https://github.com/elastic/detection-rules/issues/1171
+          # Eventually, this cherry pick command will be:
+          # git-cherry-pick --no-commit
+          # <python code to remove irrelevant rules>
+          # git commit --author ... --message ...
+
+          echo "Push new commit to ${{matrix.target_branch}}"
+          git push
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{matrix.target_branch}}