List all detection rules

Server: https://{kibana_url}

GET /api/detection_engine/rules/_find
GET /s/{space_id}/api/detection_engine/rules/_find

Api key auth Basic auth

Refer to Spaces for more information.

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

Query Parameters

Response

Successful response

info These fields are under development and their usage or schema may change: execution_summary.

application/json

Examples

Request curl 1 / 1 language

curl Shell

curl -X GET "localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows" \
  -H 'kbn-xsrf: true'

Response

{
  "data": [
    {
      "created_at": "2020-02-02T10:05:19.613Z",
      "created_by": "elastic",
      "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.",
      "enabled": false,
      "execution_summary": {
        "last_execution": {
          "date": "2022-03-23T16:06:12.787Z",
          "message": "This rule attempted to query data from Elasticsearch indices listed in the \u0022Index pattern\u0022 section of the rule definition, but no matching index was found.",
          "metrics": {
            "execution_gap_duration_s": 0,
            "total_indexing_duration_ms": 15,
            "total_search_duration_ms": 135
          },
          "status": "partial failure",
          "status_order": 20
        }
      },
      "false_positives": [],
      "from": "now-6m",
      "id": "89761517-fdb0-4223-b67b-7621acc48f9e",
      "immutable": true,
      "index": [
        "winlogbeat-*"
      ],
      "interval": "5m",
      "language": "kuery",
      "max_signals": 33,
      "name": "Windows Script Executing PowerShell",
      "query": "event.action:\u0022Process Create (rule: ProcessCreate)\u0022 and process.parent.name:(\u0022wscript.exe\u0022 or \u0022cscript.exe\u0022) and process.name:\u0022powershell.exe\u0022",
      "references": [],
      "related_integrations": [
        {
          "package": "o365",
          "version": "^2.3.2"
        }
      ],
      "required_fields": [
        {
          "ecs": true,
          "name": "event.action",
          "type": "keyword"
        },
        {
          "ecs": true,
          "name": "process.name",
          "type": "keyword"
        },
        {
          "ecs": true,
          "name": "process.parent.name",
          "type": "keyword"
        }
      ],
      "risk_score": 21,
      "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc",
      "setup": "",
      "severity": "low",
      "tags": [
        "Elastic",
        "Windows"
      ],
      "threat": [
        {
          "framework": "MITRE ATT\u0026CK",
          "tactic": {
            "id": "TA0002",
            "name": "Execution",
            "reference": "https://attack.mitre.org/tactics/TA0002/"
          },
          "technique": [
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "reference": "https://attack.mitre.org/techniques/T1193/"
            }
          ]
        }
      ],
      "to": "now",
      "type": "query",
      "updated_at": "2020-02-02T10:05:19.830Z",
      "updated_by": "elastic"
    }
  ],
  "page": 1,
  "perPage": 5,
  "total": 4
}

Query Parameters { fields , filter , sort_field , sort_order , page , per_page , gaps_range_start , gaps_range_end , }

Response

Query Parameters