Initialize security solution flows

Base URL
https://{kibana_url}
  • POST /api/security_solution/initialize
  • POST /s/{space_id}/api/security_solution/initialize
Auth

Run one or more Security Solution initialization flows for the current space. Each flow provisions a specific set of assets, for example list indices, security data views, prebuilt detection rules, endpoint protection, AI prompts, or detection rule monitoring assets. Only the requested flows are run, and the response reports a result for each one.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

The initialization flows to run.

flows enum[] · min items: 1 required
Values: create-list-indices security-data-views init-prebuilt-rules init-endpoint-protection init-ai-prompts init-detection-rule-monitoring

Response

Indicates a successful call. Returns a result for each requested flow.

application/json
flows object required

Per-flow results. Only requested flows appear in the response, so all properties are optional. Each flow is either a typed ready result or an error result.

create-list-indices union oneOf
One of:
status enum required
Values: ready
init-ai-prompts union oneOf
One of:
status enum required
Values: ready
payload object required
install_status string required

Fleet package installation status (e.g., installed, already_installed).

name string required
version string required
init-detection-rule-monitoring union oneOf
One of:
status enum required
Values: ready
init-endpoint-protection union oneOf
One of:
status enum required
Values: ready
payload object required
install_status string required

Fleet package installation status (e.g., installed, already_installed).

name string required
version string required
init-prebuilt-rules union oneOf
One of:
status enum required
Values: ready
payload object required
install_status string required

Fleet package installation status (e.g., installed, already_installed).

name string required
version string required
security-data-views union oneOf
One of:
status enum required
Values: ready
payload object required
alertDataView object required
id string required
patternList string[] required
title string required
attackDataView object
id string required
patternList string[] required
title string required
defaultDataView object required
id string required
patternList string[] required
title string required
kibanaDataViews object[] required
id string required
patternList string[] required
title string required
signalIndexName string required
Base URL
https://{kibana_url}