---
type: api
title: Get information about rules
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-get-alerting-rules-find
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-get-alerting-rules-find
products:
  - Kibana
---

# Get information about rules

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/alerting/rules/_find`
- `GET` `/s/{space_id}/api/alerting/rules/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Query String Parameters

- `per_page` (number · min: 0 · default: 10)
  The number of rules to return per page.
- `page` (number · min: 1 · default: 1)
  The page number to return.
- `search` (string)
  An Elasticsearch simple_query_string query that filters the objects in the response.
- `default_search_operator` (enum  · default: OR)
  The default operator to use for the simple_query_string.
  Values: `OR`, `AND`
- `search_fields` (union [] string | string)
  The fields to perform the simple_query_string parsed query against.
  Any of: `string[]` or `string`
- `sort_field` (string)
  Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.
- `sort_order` (enum)
  Determines the sort order.
  Values: `asc`, `desc`
- `has_reference` (object)
  Filters the rules that have a relation with the reference objects with a specific type and identifier.
- `fields` (union [] string | string)
  The fields to return in the `attributes` key of the response.
  Any of: `string[]` or `string`
- `filter` (string)
  A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.
- `filter_consumers` ([] string)

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `actions` ([] object)
  - `alerts_filter` (object)
    Defines a period that limits whether the action runs.
    - `query` (object)
      - `dsl` (string)
        A filter written in Elasticsearch Query Domain Specific Language (DSL).
      - `filters` ([] object)
        A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
        - `$state` (object)
          - `store` (enum)
            A filter can be either specific to an application context or applied globally.
            Values: `appState`, `globalState`
        - `meta` (map string to object)
        - `query` (map string to object)
      - `kql` (string)
        A filter written in Kibana Query Language (KQL).
    - `timeframe` (object)
      - `days` ([] enum)
        Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.
        Values: `1`, `2`, `3`, `4`, `5`, `6`, `7`
      - `hours` (object)
        - `end` (string)
          The end of the time frame in 24-hour notation (`hh:mm`).
        - `start` (string)
          The start of the time frame in 24-hour notation (`hh:mm`).
      - `timezone` (string)
        The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended.
  - `connector_type_id` (string)
    The type of connector. This property appears in responses but cannot be set in requests.
  - `frequency` (object)
    - `notify_when` (enum)
      Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
      Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
    - `summary` (boolean)
      Indicates whether the action is a summary.
    - `throttle` (string) — nullable
      The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
  - `group` (string)
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`.
  - `id` (string)
    The identifier for the connector saved object.
  - `params` (map string to object)
    The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
  - `use_alert_data_for_template` (boolean)
    Indicates whether to use alert data as a template.
  - `uuid` (string)
    A universally unique identifier (UUID) for the action.
- `active_snoozes` ([] string)
- `alert_delay` (object)
  Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
  - `active` (number)
    The number of consecutive runs that must meet the rule conditions.
- `api_key_created_by_user` (boolean) — nullable
  Indicates whether the API key that is associated with the rule was created by the user.
- `api_key_owner` (string) — nullable
  The owner of the API key that is associated with the rule and used to run background tasks.
- `artifacts` (object)
  - `dashboards` ([] object)
    - `id` (string)
  - `investigation_guide` (object)
    - `blob` (string)
      User-created content that describes alert causes and remdiation.
- `consumer` (string)
  The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
- `created_at` (string)
  The date and time that the rule was created.
- `created_by` (string) — nullable
  The identifier for the user that created the rule.
- `enabled` (boolean)
  Indicates whether you want to run the rule on an interval basis after it is created.
- `execution_status` (object)
  - `error` (object)
    - `message` (string)
      Error message.
    - `reason` (enum)
      Reason for error.
      Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`
  - `last_duration` (number)
    Duration of last execution of the rule.
  - `last_execution_date` (string)
    The date and time when rule was executed last.
  - `status` (enum)
    Status of rule execution.
    Values: `ok`, `active`, `error`, `warning`, `pending`, `unknown`
  - `warning` (object)
    - `message` (string)
      Warning message.
    - `reason` (enum)
      Reason for warning.
      Values: `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`
- `flapping` (object) — nullable
  When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
  - `look_back_window` (number · min: 2 · max: 20)
    The minimum number of runs in which the threshold must be met.
  - `status_change_threshold` (number · min: 2 · max: 20)
    The minimum number of times an alert must switch states in the look back window.
- `id` (string)
  The identifier for the rule.
- `is_snoozed_until` (string) — nullable
  The date when the rule will no longer be snoozed.
- `last_run` (object) — nullable
  - `alerts_count` (object)
    - `active` (number) — nullable
      Number of active alerts during last run.
    - `ignored` (number) — nullable
      Number of ignored alerts during last run.
    - `new` (number) — nullable
      Number of new alerts during last run.
    - `recovered` (number) — nullable
      Number of recovered alerts during last run.
  - `outcome` (enum)
    Outcome of last run of the rule. Value could be succeeded, warning or failed.
    Values: `succeeded`, `warning`, `failed`
  - `outcome_msg` ([] string) — nullable
  - `outcome_order` (number)
    Order of the outcome.
  - `warning` (enum) — nullable
    Warning of last rule execution.
    Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`, `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`
- `mapped_params` (map string to object)
- `monitoring` (object)
  Monitoring details of the rule.
  - `run` (object)
    Rule run details.
    - `calculated_metrics` (object)
      Calculation of different percentiles and success ratio.
      - `p50` (number)
      - `p95` (number)
      - `p99` (number)
      - `success_ratio` (number)
    - `history` ([] object)
      History of the rule run.
      - `duration` (number)
        Duration of the rule run.
      - `outcome` (enum)
        Outcome of last run of the rule. Value could be succeeded, warning or failed.
        Values: `succeeded`, `warning`, `failed`
      - `success` (boolean)
        Indicates whether the rule run was successful.
      - `timestamp` (number)
        Time of rule run.
    - `last_run` (object)
      - `metrics` (object)
        - `duration` (number)
          Duration of most recent rule run.
        - `gap_duration_s` (number) — nullable
          Duration in seconds of rule run gap.
        - `gap_range` (object) — nullable
          - `gte` (string)
            End of the gap range.
          - `lte` (string)
            Start of the gap range.
        - `total_alerts_created` (number) — nullable
          Total number of alerts created during last rule run.
        - `total_alerts_detected` (number) — nullable
          Total number of alerts detected during last rule run.
        - `total_indexing_duration_ms` (number) — nullable
          Total time spent indexing documents during last rule run in milliseconds.
        - `total_search_duration_ms` (number) — nullable
          Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response.
      - `timestamp` (string)
        Time of the most recent rule run.
- `mute_all` (boolean)
  Indicates whether all alerts are muted.
- `muted_alert_ids` ([] string)
- `name` (string)
   The name of the rule.
- `next_run` (string) — nullable
  Date and time of the next run of the rule.
- `notify_when` (enum) — nullable
  Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
- `params` (map string to object)
  The parameters for the rule.
- `revision` (number)
  The rule revision number.
- `rule_type_id` (string)
  The rule type identifier.
- `running` (boolean) — nullable
  Indicates whether the rule is running.
- `schedule` (object)
  - `interval` (string)
    The interval is specified in seconds, minutes, hours, or days.
- `scheduled_task_id` (string)
  Identifier of the scheduled task.
- `snooze_schedule` ([] object)
  - `duration` (number)
    Duration of the rule snooze schedule.
  - `id` (string)
    Identifier of the rule snooze schedule.
  - `rRule` (object)
    - `byhour` ([] number) — nullable
    - `byminute` ([] number) — nullable
    - `bymonth` ([] number) — nullable
    - `bymonthday` ([] number) — nullable
    - `bysecond` ([] number) — nullable
    - `bysetpos` ([] number) — nullable
    - `byweekday` ([] number | string) — nullable
    - `byweekno` ([] number) — nullable
    - `byyearday` ([] number) — nullable
    - `count` (number)
      Number of times the rule should recur until it stops.
    - `dtstart` (string)
      Rule start date in Coordinated Universal Time (UTC).
    - `freq` (enum)
      Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY.
      Values: `0`, `1`, `2`, `3`, `4`, `5`, `6`
    - `interval` (number)
      Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks.
    - `tzid` (string)
      Indicates timezone abbreviation.
    - `until` (string)
      Recur the rule until this date.
    - `wkst` (enum)
      Indicates the start of week, defaults to Monday.
      Values: `MO`, `TU`, `WE`, `TH`, `FR`, `SA`, `SU`
  - `skipRecurrences` ([] string)
- `tags` ([] string)
- `throttle` (string) — nullable — deprecated
  Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
- `updated_at` (string)
  The date and time that the rule was updated most recently.
- `updated_by` (string) — nullable
  The identifier for the user that updated this rule most recently.
- `view_in_app_relative_url` (string) — nullable
  Relative URL to view rule in the app.
#### `400`

Indicates an invalid schema or parameters.

#### `403`

Indicates that this call is forbidden.

## Code Examples

#### Console

```console
GET /api/alerting/rules/_find
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/alerting/rules/_find"
```

## Response Examples

#### Index threshold rule

A response that contains information about an index threshold rule.

```json
{
  "page": 1,
  "total": 1,
  "per_page": 10,
  "data": [
    {
      "id": "3583a470-74f6-11ed-9801-35303b735aef",
      "consumer": "alerts",
      "tags": [
        "cpu"
      ],
      "name": "my alert",
      "enabled": true,
      "throttle": "null",
      "schedule": {
        "interval": "1m"
      },
      "params": {
        "aggType": "avg",
        "termSize": 6,
        "thresholdComparator": "\u003E",
        "timeWindowSize": 5,
        "timeWindowUnit": "m",
        "groupBy": "top",
        "threshold": [
          1000
        ],
        "index": [
          "test-index"
        ],
        "timeField": "@timestamp",
        "aggField": "sheet.version",
        "termField": "name.keyword"
      },
      "revision": 1,
      "rule_type_id": ".index-threshold",
      "created_by": "elastic",
      "updated_by": "elastic",
      "created_at": "2022-12-05T23:40:33.132Z",
      "updated_at": "2022-12-05T23:40:33.132Z",
      "api_key_owner": "elastic",
      "mute_all": false,
      "muted_alert_ids": [],
      "scheduled_task_id": "3583a470-74f6-11ed-9801-35303b735aef",
      "execution_status": {
        "status": "ok",
        "last_execution_date": "2022-12-06T01:44:23.983Z",
        "last_duration": 48
      },
      "actions": [
        {
          "id": "9dca3e00-74f5-11ed-9801-35303b735aef",
          "group": "threshold met",
          "uuid": "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
          "params": {
            "level": "info",
            "message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}",
            "connector_type_id": ".server-log"
          },
          "frequency": {
            "summary": false,
            "notify_when": "onActionGroupChange",
            "throttle": "null"
          }
        }
      ],
      "last_run": {
        "alerts_count": {
          "new": 0,
          "ignored": 0,
          "recovered": 0,
          "active": 0
        },
        "outcome_msg": "null",
        "warning": "null",
        "outcome": "succeeded"
      },
      "next_run": "2022-12-06T01:45:23.912Z",
      "api_key_created_by_user": false
    }
  ]
}
```

#### Security rule

A response that contains information about a security rule that has conditional actions.

```json
{
  "page": 1,
  "total": 1,
  "per_page": 10,
  "data": [
    {
      "id": "6107a8f0-f401-11ed-9f8e-399c75a2deeb",
      "name": "security_rule",
      "consumer": "siem",
      "enabled": true,
      "tags": [],
      "throttle": "null",
      "revision": 1,
      "running": false,
      "schedule": {
        "interval": "1m"
      },
      "params": {
        "author": [],
        "description": "A security threshold rule.",
        "ruleId": "an_internal_rule_id",
        "falsePositives": [],
        "from": "now-3660s",
        "immutable": false,
        "license": "",
        "outputIndex": "",
        "meta": {
          "from": "1h",
          "kibana_siem_app_url": "https://localhost:5601/app/security"
        },
        "maxSignals": 100,
        "riskScore": 21,
        "riskScoreMapping": [],
        "severity": "low",
        "severityMapping": [],
        "threat": [],
        "to": "now",
        "references": [],
        "version": 1,
        "exceptionsList": [],
        "type": "threshold",
        "language": "kuery",
        "index": [
          "kibana_sample_data_logs"
        ],
        "query": "*",
        "filters": [],
        "threshold": {
          "field": [
            "bytes"
          ],
          "value": 1,
          "cardinality": []
        }
      },
      "rule_type_id": "siem.thresholdRule",
      "created_by": "elastic",
      "updated_by": "elastic",
      "created_at": "2023-05-16T15:50:28.358Z",
      "updated_at": "2023-05-16T20:25:42.559Z",
      "api_key_owner": "elastic",
      "notify_when": "null",
      "mute_all": false,
      "muted_alert_ids": [],
      "scheduled_task_id": "6107a8f0-f401-11ed-9f8e-399c75a2deeb",
      "execution_status": {
        "status": "ok",
        "last_execution_date": "2023-05-16T20:26:49.590Z",
        "last_duration": 166
      },
      "actions": [
        {
          "group": "default",
          "id": "49eae970-f401-11ed-9f8e-399c75a2deeb",
          "params": {
            "documents": [
              {
                "rule_id": {
                  "[object Object]": "null"
                },
                "rule_name": {
                  "[object Object]": "null"
                },
                "alert_id": {
                  "[object Object]": "null"
                },
                "context_message": {
                  "[object Object]": "null"
                }
              }
            ]
          },
          "connector_type_id": ".index",
          "frequency": {
            "summary": true,
            "notify_when": "onActiveAlert",
            "throttle": "null"
          },
          "uuid": "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
          "alerts_filter": {
            "timeframe": {
              "days": [
                7
              ],
              "timezone": "UTC",
              "hours": {
                "start": "08:00",
                "end": "17:00"
              }
            },
            "query": {
              "kql": "",
              "filters": [
                {
                  "meta": {
                    "disabled": false,
                    "negate": false,
                    "alias": "null",
                    "index": "c4bdca79-e69e-4d80-82a1-e5192c621bea",
                    "key": "client.geo.region_iso_code",
                    "field": "client.geo.region_iso_code",
                    "params": {
                      "query": "CA-QC",
                      "type": "phrase"
                    }
                  },
                  "$state": {
                    "store": "appState"
                  },
                  "query": {
                    "match_phrase": {
                      "client.geo.region_iso_code": "CA-QC"
                    }
                  }
                }
              ]
            }
          }
        }
      ],
      "last_run": {
        "alerts_count": {
          "new": 0,
          "ignored": 0,
          "recovered": 0,
          "active": 0
        },
        "outcome_msg": [
          "Rule execution completed successfully"
        ],
        "outcome_order": 0,
        "warning": "null",
        "outcome": "succeeded"
      },
      "next_run": "2023-05-16T20:27:49.507Z",
      "api_key_created_by_user": false
    }
  ]
}
```