---
title: stack kb security-detections-api perform-rules-bulk-action cli command
description: Apply a bulk action to detection rules 
url: https://www.elastic.co/elastic/docs-builder/docs/4097/reference/elastic-cli/cli/stack/kb/security-detections-api/perform-rules-bulk-action
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-detections-api perform-rules-bulk-action cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-detections-api perform-rules-bulk-action \
  --action <action> \
  [options]
```

Apply a bulk action to detection rules

## Options

<definitions>
  <definition term="--action enum required">
    **Values:** edit
  </definition>
  <definition term="--dry-run">
    Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.
    > info
    Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.
  </definition>
  <definition term="--gap-auto-fill-scheduler-id string">
    Gap auto fill scheduler ID used to determine gap fill status for rules
  </definition>
  <definition term="--gap-fill-statuses string[]">
    Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
    **Repeatable:** pass `--gap-fill-statuses` multiple times to supply more than one value
  </definition>
  <definition term="--gaps-range-end string">
    Gaps range end, valid only when query is provided
  </definition>
  <definition term="--gaps-range-start string">
    Gaps range start, valid only when query is provided
  </definition>
  <definition term="--ids string[]">
    Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.
    Only valid when query property is undefined.
    **Repeatable:** pass `--ids` multiple times to supply more than one value
  </definition>
  <definition term="--query string">
    Query to filter rules.
  </definition>
  <definition term="--duplicate string">
    Duplicate object that describes applying an update action.
  </definition>
  <definition term="--run string">
    Object that describes applying a manual rule run action.
  </definition>
  <definition term="--fill-gaps string">
    Object that describes applying a manual gap fill action for the specified time range.
  </definition>
  <definition term="--edit string[]">
    Array of objects containing the edit operations
    **Repeatable:** pass `--edit` multiple times to supply more than one value
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>