Install prebuilt detection rules and Timelines

Base URL: https://{kibana_url}

PUT /api/detection_engine/rules/prepackaged

Auth

Install and update all Elastic prebuilt detection rules and Timelines.

This endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. When you call this endpoint, it will:

Install any new prebuilt detection rules that are not currently installed in your system.
Update any existing prebuilt detection rules that have been modified or improved by Elastic.
Install any new prebuilt Timelines that are not currently installed in your system.
Update any existing prebuilt Timelines that have been modified or improved by Elastic.

This ensures that your detection engine is always up-to-date with the latest rules and Timelines, providing you with the most current and effective threat detection capabilities.

Response

Indicates a successful call

application/json

rules_installed integer · min: 0 required: The number of rules installed
rules_updated integer · min: 0 required: The number of rules updated
timelines_installed integer · min: 0 required: The number of timelines installed
timelines_updated integer · min: 0 required: The number of timelines updated

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn:/api/detection_engine/rules/prepackaged

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/detection_engine/rules/prepackaged" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "rules_installed": 112,
  "rules_updated": 0,
  "timelines_installed": 5,
  "timelines_updated": 2
}