agent builder43

alerting23

alerting-v250

APM agent configuration7

APM agent keys1

APM annotations2

APM server schema1

APM sourcemaps3

cases34

connectors9

Dashboards5

Data streams3

data views15

Elastic Agent actions16

Elastic Agent binary download sources5

Elastic Agent policies14

Elastic Agent status1

Elastic Agents18

Elastic Package Manager (EPM)36

Fleet agentless policies7

Fleet cloud connectors6

Fleet cloud onboarding deployments5

Fleet enrollment API keys5

Fleet internals7

Fleet managed integrations7

Fleet outputs7

Fleet package policies9

Fleet proxies5

Fleet remote synced integrations2

Fleet Server hosts5

Fleet service tokens1

Fleet uninstall tokens3

Links5

logstash4

maintenance-window7

Markdowns5

Message Signing Service1

ml3

observability_ai_assistant1

roles5

saved objects16

Security AI Assistant API21

Security Attack discovery API16

Security Detections API29

Security Endpoint Exceptions API6

Security Endpoint Management API29

Security Entity Analytics API29

Security entity store19

Security Exceptions API16

Security Lists API18

Security Osquery API21

Security Solution Initialization API1

Security Timeline API17

short url4

slo15

spaces9

streams18

synthetics19

system2

Tags5

task manager1

upgrade1

uptime2

user session1

Visualizations5

workflows32

Security Detections API

Delete a detection rule

Spaces method and path for this operation:

<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

Refer to Spaces for more information.

Delete a detection rule using the rule_id or id field.

The URL query must include one of the following:

id - DELETE /api/detection_engine/rules?id=<id>
rule_id- DELETE /api/detection_engine/rules?rule_id=<rule_id>

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

delete/api/detection_engine/rules

Query parameters

idstring uuid

A universally unique identifier

The rule's id value.

rule_idstring

A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same rule_ids.

The rule's rule_id value.

Response

Indicates a successful call.

Example response

{
  "actions": [
    {
      "frequency": {
        "throttle": "1h"
      }
    }
  ],
  "description": "Detects anomalous Windows process creation events.",
  "name": "Anomalous Windows Process Creation",
  "related_integrations": [
    {
      "integration": "activitylogs",
      "package": "azure",
      "version": "~1.1.6"
    }
  ],
  "response_actions": [
    {
      "params": {
        "config": {
          "linux": {
            "timeout": 60
          },
          "macos": {
            "timeout": 60
          },
          "windows": {
            "timeout": 60
          }
        }
      }
    }
  ],
  "throttle": "1h"
}

Changes

Changed in 4 of the 176 revisions of this API.481632

Sep 9, 2026f2ad87b814121616See the full diff
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the ////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added subschema #1 subschema #2 to the //////////////// response property oneOf list for the response status
  response-property-one-of-added
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the ////////////// response property oneOf list for the response status
  response-property-one-of-removed
- ○
  removed subschema #1 subschema #2 from the //////////////// response property oneOf list for the response status
  response-property-one-of-removed
Aug 26, 202604c196070f958See the full diff
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
- ○
  the response's property default value 100 was removed for the status
  response-property-default-value-removed
Aug 3, 2026f418569a84233288See the full diff
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  added to the /////////////// response property oneOf list for the response status
  response-property-one-of-added
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  the /////////////// response's property type changed from object to no type for status
  response-property-type-changed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ▲
  removed the required property //////////////// from the response with the status
  response-required-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ●
  removed the optional property //////////////// from the response with the status
  response-optional-property-removed
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
- ○
  added discriminator to /////////////// response property for the response status
  response-property-discriminator-added
Aug 3, 2026707a2918b22b8See the full diff
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added
- ●
  added the new endpoint_custom_yara_signatures enum value to the /////// response property for the response status
  response-property-enum-value-added

Of the 176 revisions, 20 have no diff computed.

Full history