---
title: stack kb security-detections-api rule-preview cli command
description: Preview rule alerts generated on specified time range Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4089/reference/elastic-cli/cli/stack/kb/security-detections-api/rule-preview
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-detections-api rule-preview cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-detections-api rule-preview \
  --description <description> \
  --name <name> \
  --risk-score <risk-score> \
  --severity <severity> \
  --type <type> \
  --invocation-count <invocation-count> \
  --timeframe-end <timeframe-end> \
  [options]
```

Preview rule alerts generated on specified time range
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--description string required">
  </definition>
  <definition term="--name string required">
  </definition>
  <definition term="--risk-score number required">
  </definition>
  <definition term="--severity enum required">
    **Values:** low, medium, high, critical
  </definition>
  <definition term="--type enum required">
    Rule type
    **Values:** esql
  </definition>
  <definition term="--invocation-count number required">
  </definition>
  <definition term="--timeframe-end string required">
  </definition>
  <definition term="--enable-logged-requests">
    Enables logging and returning in response ES queries, performed during rule execution
  </definition>
  <definition term="--actions string[]">
    Array defining the automated actions (notifications) taken when alerts are generated.
    **Repeatable:** pass `--actions` multiple times to supply more than one value
  </definition>
  <definition term="--alias-purpose enum">
    **Values:** savedObjectConversion, savedObjectImport
  </definition>
  <definition term="--alias-target-id string">
  </definition>
  <definition term="--author string[]">
    **Repeatable:** pass `--author` multiple times to supply more than one value
  </definition>
  <definition term="--building-block-type string">
  </definition>
  <definition term="--enabled">
  </definition>
  <definition term="--exceptions-list string[]">
    **Repeatable:** pass `--exceptions-list` multiple times to supply more than one value
  </definition>
  <definition term="--false-positives string[]">
    **Repeatable:** pass `--false-positives` multiple times to supply more than one value
  </definition>
  <definition term="--from string">
  </definition>
  <definition term="--interval string">
  </definition>
  <definition term="--investigation-fields string">
  </definition>
  <definition term="--license string">
  </definition>
  <definition term="--max-signals number">
  </definition>
  <definition term="--meta string">
  </definition>
  <definition term="--namespace string">
  </definition>
  <definition term="--note string">
  </definition>
  <definition term="--outcome enum">
    **Values:** exactMatch, aliasMatch, conflict
  </definition>
  <definition term="--output-index string">
  </definition>
  <definition term="--references string[]">
    **Repeatable:** pass `--references` multiple times to supply more than one value
  </definition>
  <definition term="--related-integrations string[]">
    **Repeatable:** pass `--related-integrations` multiple times to supply more than one value
  </definition>
  <definition term="--required-fields string[]">
    Elasticsearch fields and their types that need to be present for the rule to function.
    > info
    The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.
    **Repeatable:** pass `--required-fields` multiple times to supply more than one value
  </definition>
  <definition term="--response-actions string[]">
    **Repeatable:** pass `--response-actions` multiple times to supply more than one value
  </definition>
  <definition term="--risk-score-mapping string[]">
    **Repeatable:** pass `--risk-score-mapping` multiple times to supply more than one value
  </definition>
  <definition term="--rule-id string">
  </definition>
  <definition term="--rule-name-override string">
  </definition>
  <definition term="--setup string">
  </definition>
  <definition term="--severity-mapping string[]">
    **Repeatable:** pass `--severity-mapping` multiple times to supply more than one value
  </definition>
  <definition term="--tags string[]">
    **Repeatable:** pass `--tags` multiple times to supply more than one value
  </definition>
  <definition term="--threat string[]">
    **Repeatable:** pass `--threat` multiple times to supply more than one value
  </definition>
  <definition term="--throttle string">
  </definition>
  <definition term="--timeline-id string">
  </definition>
  <definition term="--timeline-title string">
  </definition>
  <definition term="--timestamp-override string">
  </definition>
  <definition term="--timestamp-override-fallback-disabled">
  </definition>
  <definition term="--to string">
  </definition>
  <definition term="--version number">
  </definition>
  <definition term="--language enum">
    **Values:** esql
  </definition>
  <definition term="--query string">
  </definition>
  <definition term="--alert-suppression string">
  </definition>
  <definition term="--data-view-id string">
  </definition>
  <definition term="--event-category-override string">
  </definition>
  <definition term="--filters string[]">
    **Repeatable:** pass `--filters` multiple times to supply more than one value
  </definition>
  <definition term="--index string[]">
    **Repeatable:** pass `--index` multiple times to supply more than one value
  </definition>
  <definition term="--tiebreaker-field string">
  </definition>
  <definition term="--timestamp-field string">
  </definition>
  <definition term="--saved-id string">
  </definition>
  <definition term="--threshold string">
  </definition>
  <definition term="--threat-index string[]">
    **Repeatable:** pass `--threat-index` multiple times to supply more than one value
  </definition>
  <definition term="--threat-mapping string[]">
    **Repeatable:** pass `--threat-mapping` multiple times to supply more than one value
  </definition>
  <definition term="--threat-query string">
  </definition>
  <definition term="--concurrent-searches number">
  </definition>
  <definition term="--items-per-search number">
  </definition>
  <definition term="--threat-filters string[]">
    **Repeatable:** pass `--threat-filters` multiple times to supply more than one value
  </definition>
  <definition term="--threat-indicator-path string">
  </definition>
  <definition term="--threat-language enum">
    **Values:** kuery, lucene
  </definition>
  <definition term="--anomaly-threshold number">
  </definition>
  <definition term="--machine-learning-job-id string">
    **Repeatable:** pass `--machine-learning-job-id` multiple times to supply more than one value
  </definition>
  <definition term="--history-window-start string">
  </definition>
  <definition term="--new-terms-fields string[]">
    **Repeatable:** pass `--new-terms-fields` multiple times to supply more than one value
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>