List all detection rules

GET /api/detection_engine/rules/_find
Api key auth

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

Query parameters

  • fields array[string]
  • filter string

    Search query

    Filters the returned results according to the value of the specified field, using the alert.attributes.: syntax, where can be:

    • name
    • enabled
    • tags
    • createdBy
    • interval
    • updatedBy

    Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

  • sort_field string

    Field to sort by

    Values are created_at, createdAt, enabled, execution_summary.last_execution.date, execution_summary.last_execution.metrics.execution_gap_duration_s, execution_summary.last_execution.metrics.total_indexing_duration_ms, execution_summary.last_execution.metrics.total_search_duration_ms, execution_summary.last_execution.status, name, risk_score, riskScore, severity, updated_at, or updatedAt.

  • sort_order string

    Sort order

    Values are asc or desc.

  • page integer

    Page number

    Minimum value is 1. Default value is 1.

  • per_page integer

    Rules per page

    Minimum value is 0. Default value is 20.

  • gaps_range_start string

    Gaps range start

  • gaps_range_end string

    Gaps range end

Responses

  • 200 application/json

    Successful response

    These fields are under development and their usage or schema may change: execution_summary.

    Hide response attributes Show response attributes object
    • data array[object] Required
      Any of:
      Security_Detections_API_EqlRule object Security_Detections_API_QueryRule object Security_Detections_API_SavedQueryRule object Security_Detections_API_ThresholdRule object Security_Detections_API_ThreatMatchRule object Security_Detections_API_MachineLearningRule object Security_Detections_API_NewTermsRule object Security_Detections_API_EsqlRule object
    • page integer Required
    • perPage integer Required
    • total integer Required
GET /api/detection_engine/rules/_find 
curl -X GET "localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows" -H 'kbn-xsrf: true'
Response examples (200) 
{ "data": [ { "id": "89761517-fdb0-4223-b67b-7621acc48f9e", "to": "now", "from": "now-6m", "name": "Windows Script Executing PowerShell", "tags": [ "Elastic", "Windows" ], "type": "query", "index": [ "winlogbeat-*" ], "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"", "setup": "", "threat": [ { "tactic": { "id": "TA0002", "name": "Execution", "reference": "https://attack.mitre.org/tactics/TA0002/" }, "framework": "MITRE ATT&CK", "technique": [ { "id": "T1193", "name": "Spearphishing Attachment", "reference": "https://attack.mitre.org/techniques/T1193/" } ] } ], "enabled": false, "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", "interval": "5m", "language": "kuery", "severity": "low", "immutable": true, "created_at": "2020-02-02T10:05:19.613Z", "created_by": "elastic", "references": [], "risk_score": 21, "updated_at": "2020-02-02T10:05:19.830Z", "updated_by": "elastic", "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", "max_signals": 33, "false_positives": [], "required_fields": [ { "ecs": true, "name": "event.action", "type": "keyword" }, { "ecs": true, "name": "process.name", "type": "keyword" }, { "ecs": true, "name": "process.parent.name", "type": "keyword" } ], "execution_summary": { "last_execution": { "date": "2022-03-23T16:06:12.787Z", "status": "partial failure", "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", "metrics": { "execution_gap_duration_s": 0, "total_search_duration_ms": 135, "total_indexing_duration_ms": 15 }, "status_order": 20 } }, "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ] } ], "page": 1, "total": 4, "perPage": 5 }