Security Detections API

Update a detection rule

Changed on Sep 9, 2026

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

Refer to Spaces for more information.

Update a detection rule using the rule_id or id field. The original rule is replaced, and all unspecified fields are deleted.

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

warn When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

put/api/detection_engine/rules

Request

Base URL
https://localhost:5601
URL
https://localhost:5601/api/detection_engine/rules
Auth
- API key in header Authorization
- or HTTP basic

Request body

Example request

{
  "actions": [
    {
      "frequency": {
        "throttle": "1h"
      }
    }
  ],
  "description": "Detects anomalous Windows process creation events.",
  "name": "Anomalous Windows Process Creation",
  "related_integrations": [
    {
      "integration": "activitylogs",
      "package": "azure",
      "version": "~1.1.6"
    }
  ],
  "response_actions": [
    {
      "params": {
        "config": {
          "linux": {
            "timeout": 60
          },
          "macos": {
            "timeout": 60
          },
          "windows": {
            "timeout": 60
          }
        }
      }
    }
  ],
  "throttle": "1h"
}

Response

Indicates a successful call.

Example response

{
  "actions": [
    {
      "frequency": {
        "throttle": "1h"
      }
    }
  ],
  "description": "Detects anomalous Windows process creation events.",
  "name": "Anomalous Windows Process Creation",
  "related_integrations": [
    {
      "integration": "activitylogs",
      "package": "azure",
      "version": "~1.1.6"
    }
  ],
  "response_actions": [
    {
      "params": {
        "config": {
          "linux": {
            "timeout": 60
          },
          "macos": {
            "timeout": 60
          },
          "windows": {
            "timeout": 60
          }
        }
      }
    }
  ],
  "throttle": "1h"
}

Changes

Sep 9, 2026f2ad87b81412 Revision changes
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the ////////////// request property oneOf list
- breaking
  removed subschema #1 subschema #2 from the //////////////// request property oneOf list
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
- breaking
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////////// request property's maxLength was set to 30000
- warning
  the //////////////// request property's maxLength was set to 30000
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////////// request property's maxLength was set to 256
- warning
  the ////////////////// request property's maxLength was set to 8192
- warning
  the ////////////// request property's maxLength was set to 2000
- warning
  the //////////// request property's maxLength was set to 256
- warning
  the //////////////// request property's maxLength was set to 2000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the ////////////// request property's maxLength was set to 30000
- warning
  the ////////////// request property's maxLength was set to 256
- warning
  the //////////// request property's maxLength was set to 30000
- warning
  the //////////// request property's maxLength was set to 256
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the ////////////// request property oneOf list
- info
  added subschema #1 subschema #2 to the //////////////// request property oneOf list
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
Aug 26, 202604c196070f95 Revision changes
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the request property default value 100 was removed
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status
- info
  the response's property default value 100 was removed for the status

Operation history (4 revisions)