---
title: "Changes to Apply a bulk action to detection rules"
method: POST
path: "/api/detection_engine/rules/_bulk_action"
---

# Changes to Apply a bulk action to detection rules

`POST /api/detection_engine/rules/_bulk_action`

> Every recorded change to this endpoint, newest first.
> 176 revisions in range; 20 not diffed.

## Timeline

Changed in 4 of 176 revisions.

- **2026-09-09** `f2ad87b81412` — 48 breaking, 48 info
- **2026-08-26** `04c196070f95` — 24 info
- **2026-08-03** `f418569a8423` — 96 breaking, 24 warning, 24 info
- **2026-08-03** `707a2918b22b` — 24 warning

## Changes

- **2026-09-09** `f2ad87b81412` — 48 breaking, 48 info
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - added `subschema #1, subschema #2` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_OsqueryResponseAction]/params/queries/items/ecs_mapping/additionalProperties/value` response property `oneOf` list for the response status `200`
  - …56 more
- **2026-08-26** `04c196070f95` — 24 info
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
  - the `max_signals` response's property default value `100` was removed for the status `200`
- **2026-08-03** `f418569a8423` — 96 breaking, 24 warning, 24 info
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/Security_Detections_API_KillProcessParams, #/components/schemas/Security_Detections_API_SuspendProcessParams` to the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/updated/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response property `oneOf` list for the response status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/created/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_EsqlRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_MachineLearningRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_NewTermsRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_QueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_SavedQueryRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThreatMatchRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - the `oneOf[#/components/schemas/Security_Detections_API_BulkEditActionResponse]/attributes/results/deleted/items/anyOf[#/components/schemas/Security_Detections_API_ThresholdRule]/allOf[subschema #1]/response_actions/items/oneOf[#/components/schemas/Security_Detections_API_EndpointResponseAction]/params/oneOf[#/components/schemas/Security_Detections_API_ProcessesParams]/` response's property type changed from `object` to no type for status `200`
  - …104 more
- …earlier changes are on the page: https://skmtc.dev/elastic/apis/kibana-apis/changes/api/detection_engine/rules/_bulk_action/post

---

[Operation](https://skmtc.dev/elastic/apis/kibana-apis/docs/api/detection_engine/rules/_bulk_action/post.md) · [API](https://skmtc.dev/elastic/apis/kibana-apis.md) · [Page](https://skmtc.dev/elastic/apis/kibana-apis/changes/api/detection_engine/rules/_bulk_action/post)