Security Detections API

Preview rule alerts generated on specified time range

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/preview</span></div>

Refer to Spaces for more information.

Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short time window, without persisting a rule or writing alerts. Use the response to validate queries, see sample matching documents, and inspect execution logs. Pair invocationCount and timeframeEnd to cap run time.

post/api/detection_engine/rules/preview

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/detection_engine/rules/preview
  • Auth
    • API key in header Authorization
    • or HTTP basic

Query parameters

enable_logged_requestsboolean

Enables logging and returning in response ES queries, performed during rule execution

Request body

OR
OR
OR
OR
OR
OR
OR

Example request

{
  "actions": [
    {
      "frequency": {
        "throttle": "1h"
      }
    }
  ],
  "description": "Detects anomalous Windows process creation events.",
  "name": "Anomalous Windows Process Creation",
  "related_integrations": [
    {
      "integration": "activitylogs",
      "package": "azure",
      "version": "~1.1.6"
    }
  ],
  "response_actions": [
    {
      "params": {
        "config": {
          "linux": {
            "timeout": 60
          },
          "macos": {
            "timeout": 60
          },
          "windows": {
            "timeout": 60
          }
        }
      }
    }
  ],
  "throttle": "1h"
}

Response

Successful response

isAbortedboolean
previewIdstring nonempty

A string that does not contain only whitespace characters

Changes

  • f2ad87b81412Revision changes
    • breaking

      removed subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 from the request body anyOf list

    • info

      added subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 to the request body anyOf list

  • 04c196070f95Revision changes
    • breaking

      removed subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 from the request body anyOf list

    • info

      added subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 to the request body anyOf list