List all detection rules

Server: https://{kibana_url}

GET /api/detection_engine/rules/_find

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

Query Parameters

fields [] string

List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or use comma-separated values when supported by your client.

filter string

Search query

Filters the returned results according to the value of the specified field, using the alert.attributes.

name
enabled
tags
createdBy
interval
updatedBy

info Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

sort_field enum

Field to sort by

Values: created_at createdAt enabled execution_summary.last_execution.date execution_summary.last_execution.metrics.execution_gap_duration_s execution_summary.last_execution.metrics.total_indexing_duration_ms execution_summary.last_execution.metrics.total_search_duration_ms execution_summary.last_execution.status name risk_score riskScore severity updated_at updatedAt

sort_order enum

Sort order

Values: asc desc

page integer · min: 1 · default: 1

Page number

per_page integer · min: 0 · default: 20

Rules per page

gaps_range_start string

Gaps range start

gaps_range_end string

Gaps range end

gap_fill_statuses [] enum

Gap fill statuses

Values: unfilled in_progress filled error

gap_auto_fill_scheduler_id string

Gap auto fill scheduler ID used to determine gap fill status for rules

Response

Successful response

info These fields are under development and their usage or schema may change: execution_summary.

application/json

Examples

Request curl 1 / 1 language

curl Shell

curl -X GET "localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows" \
  -H 'kbn-xsrf: true'

Response

{
  "data": [
    {
      "created_at": "2020-02-02T10:05:19.613Z",
      "created_by": "elastic",
      "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.",
      "enabled": false,
      "execution_summary": {
        "last_execution": {
          "date": "2022-03-23T16:06:12.787Z",
          "message": "This rule attempted to query data from Elasticsearch indices listed in the \u0022Index pattern\u0022 section of the rule definition, but no matching index was found.",
          "metrics": {
            "execution_gap_duration_s": 0,
            "total_indexing_duration_ms": 15,
            "total_search_duration_ms": 135
          },
          "status": "partial failure",
          "status_order": 20
        }
      },
      "false_positives": [],
      "from": "now-6m",
      "id": "89761517-fdb0-4223-b67b-7621acc48f9e",
      "immutable": true,
      "index": [
        "winlogbeat-*"
      ],
      "interval": "5m",
      "language": "kuery",
      "max_signals": 33,
      "name": "Windows Script Executing PowerShell",
      "query": "event.action:\u0022Process Create (rule: ProcessCreate)\u0022 and process.parent.name:(\u0022wscript.exe\u0022 or \u0022cscript.exe\u0022) and process.name:\u0022powershell.exe\u0022",
      "references": [],
      "related_integrations": [
        {
          "package": "o365",
          "version": "^2.3.2"
        }
      ],
      "required_fields": [
        {
          "ecs": true,
          "name": "event.action",
          "type": "keyword"
        },
        {
          "ecs": true,
          "name": "process.name",
          "type": "keyword"
        },
        {
          "ecs": true,
          "name": "process.parent.name",
          "type": "keyword"
        }
      ],
      "risk_score": 21,
      "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc",
      "setup": "",
      "severity": "low",
      "tags": [
        "Elastic",
        "Windows"
      ],
      "threat": [
        {
          "framework": "MITRE ATT\u0026CK",
          "tactic": {
            "id": "TA0002",
            "name": "Execution",
            "reference": "https://attack.mitre.org/tactics/TA0002/"
          },
          "technique": [
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "reference": "https://attack.mitre.org/techniques/T1193/"
            }
          ]
        }
      ],
      "to": "now",
      "type": "query",
      "updated_at": "2020-02-02T10:05:19.830Z",
      "updated_by": "elastic"
    }
  ],
  "page": 1,
  "perPage": 5,
  "total": 4
}

Query Parameters { fields , filter , sort_field , sort_order , page , per_page , gaps_range_start , gaps_range_end , gap_fill_statuses , gap_auto_fill_scheduler_id , }

Response

Query Parameters