stack kb security-detections-api import-rules cli command

elastic stack kb security-detections-api import-rules [options]
		

Import detection rules

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--overwrite

Determines whether existing rules with the same rule_id are overwritten.

--overwrite-exceptions

Determines whether existing exception lists with the same list_id are overwritten. Both the exception list container and its items are overwritten.

--overwrite-action-connectors

Determines whether existing actions with the same kibana.alert.rule.actions.id are overwritten.

--as-new-list

Generates a new list ID for each imported exception list.

--file string

The .ndjson file containing the rules.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON