agent builder43

alerting23

alerting-v250

APM agent configuration7

APM agent keys1

APM annotations2

APM server schema1

APM sourcemaps3

cases34

connectors9

Dashboards5

Data streams3

data views15

Elastic Agent actions16

Elastic Agent binary download sources5

Elastic Agent policies14

Elastic Agent status1

Elastic Agents18

Elastic Package Manager (EPM)36

Fleet agentless policies7

Fleet cloud connectors6

Fleet cloud onboarding deployments5

Fleet enrollment API keys5

Fleet internals7

Fleet managed integrations7

Fleet outputs7

Fleet package policies9

Fleet proxies5

Fleet remote synced integrations2

Fleet Server hosts5

Fleet service tokens1

Fleet uninstall tokens3

Links5

logstash4

maintenance-window7

Markdowns5

Message Signing Service1

ml3

observability_ai_assistant1

roles5

saved objects16

Security AI Assistant API21

Security Attack discovery API16

Security Detections API29

Security Endpoint Exceptions API6

Security Endpoint Management API29

Security Entity Analytics API29

Security entity store19

Security Exceptions API16

Security Lists API18

Security Osquery API21

Security Solution Initialization API1

Security Timeline API17

short url4

slo15

spaces9

streams18

synthetics19

system2

Tags5

task manager1

upgrade1

uptime2

user session1

Visualizations5

workflows32

Security Detections API

List all detection rules

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules/_find</span></div>

Refer to Spaces for more information.

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

get/api/detection_engine/rules/_find

Query parameters

fieldsstring[]

List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or use comma-separated values when supported by your client.

filterstring

Search query

Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:

name
enabled
tags
createdBy
interval
updatedBy

info Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

Field to sort by

sort_order'asc' | 'desc'

Sort order

pageinteger

Page number

per_pageinteger

Rules per page

gaps_range_startstring

Gaps range start

gaps_range_endstring

Gaps range end

gap_fill_statusesSecurityDetectionsAPIGapFillStatus[]

Gap fill statuses

gap_auto_fill_scheduler_idstring

Gap auto fill scheduler ID used to determine gap fill status for rules

Response

Successful response

info These fields are under development and their usage or schema may change: execution_summary.

pageinteger required

perPageinteger required

totalinteger required

Changes

Changed in 4 of the 176 revisions of this API.481632

Sep 9, 2026f2ad87b814121616See the full diff
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////////// response property oneOf list for the response status
  response-property-one-of-added
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////////// response property oneOf list for the response status
  response-property-one-of-removed
Aug 26, 202604c196070f958See the full diff
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
Aug 3, 2026f418569a84233288See the full diff
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the ///////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the ///////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property ////////////////// from the response with the status
  response-required-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property ////////////////// from the response with the status
  response-optional-property-removed
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to ///////////////// response property for the response status
  response-property-discriminator-added
Aug 3, 2026707a2918b22b8See the full diff
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the ///////// response property for the response status
  response-property-enum-value-added

Of the 176 revisions, 20 have no diff computed.

Full history