Install Kibana alert rule for a package

Base URL: https://{kibana_url}

POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets
POST /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets

Auth

Install Kibana alert rule assets for a specific package version.

Required authorization

Privileges integrations-all and fleet-agent-policies-all

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
pkgName string required: Package name
pkgVersion string required: Package version

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

force boolean

Responses

Successful response

application/json

success boolean required

Bad Request

application/json

attributes object required
error string
errorType string
message string required
statusCode number

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Install alert rule assets for a specific package version

Console Kibana Dev Tools

POST kbn:/api/fleet/epm/packages/PKG_NAME/PKG_VERSION/rule_assets
{}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/epm/packages/${PKG_NAME}/${PKG_VERSION}/rule_assets" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{}'

Generated from the API spec

Response

Rule assets successfully installed

{
  "items": [
    {
      "id": "rule-asset-id-1",
      "type": "security_rule"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

Required authorization

Path parameters

Header parameters

Request body { }

Responses

Request body