Security Detections API

List all detection rules

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_find</span></div>

Refer to Spaces for more information.

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

get/api/detection_engine/rules/_find

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/detection_engine/rules/_find
  • Auth
    • API key in header Authorization
    • or HTTP basic

Query parameters

fieldsstring[]

List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or use comma-separated values when supported by your client.

filterstring

Search query

Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:

  • name
  • enabled
  • tags
  • createdBy
  • interval
  • updatedBy

info Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

sort_field'created_at' | 'createdAt' | 'enabled' | 'execution_summary.last_execution.date' | 'execution_summary.last_execution.metrics.execution_gap_duration_s' | 'execution_summary.last_execution.metrics.total_indexing_duration_ms' | 'execution_summary.last_execution.metrics.total_search_duration_ms' | 'execution_summary.last_execution.status' | 'name' | 'risk_score' | 'riskScore' | 'severity' | 'updated_at' | 'updatedAt'

Field to sort by

sort_order'asc' | 'desc'

Sort order

pageinteger

Page number

per_pageinteger

Rules per page

gaps_range_startstring

Gaps range start

gaps_range_endstring

Gaps range end

gap_fill_statusesSecurityDetectionsAPIGapFillStatus[]

Gap fill statuses

gap_auto_fill_scheduler_idstring

Gap auto fill scheduler ID used to determine gap fill status for rules

Response

Successful response

info These fields are under development and their usage or schema may change: execution_summary.

pageinteger required
perPageinteger required
totalinteger required

Changes

  • f2ad87b81412Revision changes
    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status

    • breaking

      added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status

    • info

      removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status

  • 04c196070f95Revision changes
    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status

    • info

      the response's property default value 100 was removed for the status