---
title: stack kb security-detections-api find-rules cli command
description: List all detection rules Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4097/reference/elastic-cli/cli/stack/kb/security-detections-api/find-rules
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-detections-api find-rules cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-detections-api find-rules [options]
```

List all detection rules
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--fields string[]">
    List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).
    If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or
    use comma-separated values when supported by your client.
    **Repeatable:** pass `--fields` multiple times to supply more than one value
  </definition>
  <definition term="--filter string">
    Search query Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:
    - name
    - enabled
    - tags
    - createdBy
    - interval
    - updatedBy
  </definition>
</definitions>
> info
Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.
<definitions>
  <definition term="--sort-field enum">
    Field to sort by
    **Values:** created_at, createdAt, enabled, execution_summary.last_execution.date, execution_summary.last_execution.metrics.execution_gap_duration_s, execution_summary.last_execution.metrics.total_indexing_duration_ms, execution_summary.last_execution.metrics.total_search_duration_ms, execution_summary.last_execution.status, name, risk_score, riskScore, severity, updated_at, updatedAt
  </definition>
  <definition term="--sort-order enum">
    Sort order
    **Values:** asc, desc
  </definition>
  <definition term="--page number">
    Page number
  </definition>
  <definition term="--per-page number">
    Rules per page
  </definition>
  <definition term="--gaps-range-start string">
    Gaps range start
  </definition>
  <definition term="--gaps-range-end string">
    Gaps range end
  </definition>
  <definition term="--gap-fill-statuses string[]">
    Gap fill statuses
    **Repeatable:** pass `--gap-fill-statuses` multiple times to supply more than one value
  </definition>
  <definition term="--gap-auto-fill-scheduler-id string">
    Gap auto fill scheduler ID used to determine gap fill status for rules
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>