Security Detections API

Delete a detection rule

Changed on Sep 9, 2026

Spaces method and path for this operation:

<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

Refer to Spaces for more information.

Delete a detection rule using the rule_id or id field.

The URL query must include one of the following:

id - DELETE /api/detection_engine/rules?id=<id>
rule_id- DELETE /api/detection_engine/rules?rule_id=<rule_id>

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

delete/api/detection_engine/rules

Request

Base URL
https://localhost:5601
URL
https://localhost:5601/api/detection_engine/rules
Auth
- API key in header Authorization
- or HTTP basic

Query parameters

idstring uuid

A universally unique identifier

The rule's id value.

rule_idstring

A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same rule_ids.

The rule's rule_id value.

Response

Indicates a successful call.

Example response

{
  "actions": [
    {
      "frequency": {
        "throttle": "1h"
      }
    }
  ],
  "description": "Detects anomalous Windows process creation events.",
  "name": "Anomalous Windows Process Creation",
  "related_integrations": [
    {
      "integration": "activitylogs",
      "package": "azure",
      "version": "~1.1.6"
    }
  ],
  "response_actions": [
    {
      "params": {
        "config": {
          "linux": {
            "timeout": 60
          },
          "macos": {
            "timeout": 60
          },
          "windows": {
            "timeout": 60
          }
        }
      }
    }
  ],
  "throttle": "1h"
}

Changes

Sep 9, 2026f2ad87b81412 Revision changes
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
Aug 26, 202604c196070f95 Revision changes
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status

Operation history (4 revisions)