Sign in
Security Detections API

Preview rule alerts generated on specified time range

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/preview</span></div>

Refer to Spaces for more information.

Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short time window, without persisting a rule or writing alerts. Use the response to validate queries, see sample matching documents, and inspect execution logs. Pair invocationCount and timeframeEnd to cap run time.

post/api/detection_engine/rules/preview

Query parameters

enable_logged_requestsboolean

Enables logging and returning in response ES queries, performed during rule execution

Request body

OR
OR
OR
OR
OR
OR
OR

Example request

{
  "actions": [
    {
      "frequency": {
        "throttle": "1h"
      }
    }
  ],
  "description": "Detects anomalous Windows process creation events.",
  "name": "Anomalous Windows Process Creation",
  "related_integrations": [
    {
      "integration": "activitylogs",
      "package": "azure",
      "version": "~1.1.6"
    }
  ],
  "response_actions": [
    {
      "params": {
        "config": {
          "linux": {
            "timeout": 60
          },
          "macos": {
            "timeout": 60
          },
          "windows": {
            "timeout": 60
          }
        }
      }
    }
  ],
  "throttle": "1h"
}

Response

Successful response

isAbortedboolean
previewIdstring nonempty

A string that does not contain only whitespace characters

Changes

Changed in 4 of the 176 revisions of this API.44

  • f2ad87b8141211See the full diff
    • ▲

      removed subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 from the request body anyOf list

      request-body-any-of-removed

    • ○

      added subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 to the request body anyOf list

      request-body-any-of-added

  • 04c196070f9511See the full diff
    • ▲

      removed subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 from the request body anyOf list

      request-body-any-of-removed

    • ○

      added subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 to the request body anyOf list

      request-body-any-of-added

  • f418569a842311See the full diff
    • ▲

      removed subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 from the request body anyOf list

      request-body-any-of-removed

    • ○

      added subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 to the request body anyOf list

      request-body-any-of-added

  • 707a2918b22b11See the full diff
    • ▲

      removed subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 from the request body anyOf list

      request-body-any-of-removed

    • ○

      added subschema #1 subschema #2 subschema #3 subschema #4 subschema #5 subschema #6 subschema #7 subschema #8 to the request body anyOf list

      request-body-any-of-added

Of the 176 revisions, 20 have no diff computed.