Create multiple detection rules

deprecated

Server: https://{kibana_url}

POST /api/detection_engine/rules/_bulk_create
POST /s/{space_id}/api/detection_engine/rules/_bulk_create

Refer to Spaces for more information.

Create new detection rules in bulk.

warn This API is deprecated and will be removed in Kibana v9.0.

warn When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

Request

Response

Indicates a successful call.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/detection_engine/rules/_bulk_create
[
  {
    "description": "Process started by MS Office program - possible payload",
    "enabled": false,
    "filters": [
      {
        "query": {
          "match": {
            "event.action": {
              "query": "Process Create (rule: ProcessCreate)",
              "type": "phrase"
            }
          }
        }
      }
    ],
    "from": "now-6m",
    "interval": "5m",
    "language": "kuery",
    "name": "MS Office child process",
    "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
    "risk_score": 50,
    "rule_id": "process_started_by_ms_office_program_possible_payload",
    "severity": "low",
    "tags": [
      "child process",
      "ms office"
    ],
    "type": "query"
  },
  {
    "description": "Query with a rule_id for referencing an external id",
    "from": "now-6m",
    "name": "Second bulk rule",
    "query": "user.name: root or user.name: admin",
    "risk_score": 2,
    "rule_id": "query-rule-id-2",
    "severity": "low",
    "type": "query"
  }
]

curl Shell

curl -X POST "https://{kibana_url}/api/detection_engine/rules/_bulk_create" \
  -H "Content-Type: application/json" \
  -d '[
  {
    "description": "Process started by MS Office program - possible payload",
    "enabled": false,
    "filters": [
      {
        "query": {
          "match": {
            "event.action": {
              "query": "Process Create (rule: ProcessCreate)",
              "type": "phrase"
            }
          }
        }
      }
    ],
    "from": "now-6m",
    "interval": "5m",
    "language": "kuery",
    "name": "MS Office child process",
    "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
    "risk_score": 50,
    "rule_id": "process_started_by_ms_office_program_possible_payload",
    "severity": "low",
    "tags": [
      "child process",
      "ms office"
    ],
    "type": "query"
  },
  {
    "description": "Query with a rule_id for referencing an external id",
    "from": "now-6m",
    "name": "Second bulk rule",
    "query": "user.name: root or user.name: admin",
    "risk_score": 2,
    "rule_id": "query-rule-id-2",
    "severity": "low",
    "type": "query"
  }
]'

Response

No example

Request EqlRuleCreateProps | QueryRuleCreateProps | SavedQueryRuleCreateProps | ThresholdRuleCreateProps | ThreatMatchRuleCreateProps | MachineLearningRuleCreateProps | NewTermsRuleCreateProps | EsqlRuleCreateProps |

Response

Request