Elastic Stack (ELK Stack) Security Detections API
Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.This API supports both key-based authentication and basic authentication.To use key-based authentication, create an API key, then specify the key in the header of your API calls.To use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.In both cases, the API key is subsequently used for authorization when the rule runs.> warn> If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.> If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.To create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.
Elastic Stack (ELK Stack) Security Detections API is one of 132 APIs that Elastic Stack (ELK Stack) publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Security Detections API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.
This API exposes 29 operations across 22 paths, and defines 269 schemas. It is described by OpenAPI 3.2.0.
Requests are made against a single base URL, https://{kibana_url}.
29 operations
22 paths
269 schemas
3 DELETE7 GET1 PATCH16 POST2 PUT
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 2
Elastic Stack (ELK Stack) Security Detections API declares
2 security schemes
for authenticating requests.
An API key is passed in the header as Authorization (apiKeyAuth).
It accepts HTTP basic authentication (basicAuth).
By default, every request must be authenticated.
apiKeyAuth— These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…
Paths & Operations 29
Across 22 paths, the API surfaces 29 operations — 3 DELETE, 7 GET, 1 PATCH, 16 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.
Security Detections API 29
Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hit…
POST
/api/detection_engine/attacks/assignees
Assign and unassign users from attack discovery alerts
POST
/api/detection_engine/attacks/search
Find and/or aggregate attack discovery alerts
POST
/api/detection_engine/attacks/status
Set attack discovery alerts workflow status
POST
/api/detection_engine/attacks/tags
Add and remove attack discovery alert tags
DELETE
/api/detection_engine/index
Delete an alerts index
GET
/api/detection_engine/index
Reads the alert index name if it exists
POST
/api/detection_engine/index
Create an alerts index
GET
/api/detection_engine/privileges
Returns user privileges for the Kibana space
DELETE
/api/detection_engine/rules
Delete a detection rule
GET
/api/detection_engine/rules
Retrieve a detection rule
PATCH
/api/detection_engine/rules
Patch a detection rule
POST
/api/detection_engine/rules
Create a detection rule
PUT
/api/detection_engine/rules
Update a detection rule
POST
/api/detection_engine/rules/_bulk_action
Apply a bulk action to detection rules
POST
/api/detection_engine/rules/_export
Export detection rules
GET
/api/detection_engine/rules/_find
List all detection rules
POST
/api/detection_engine/rules/_import
Import detection rules
PUT
/api/detection_engine/rules/prepackaged
Install prebuilt detection rules and Timelines
GET
/api/detection_engine/rules/prepackaged/_status
Retrieve the status of prebuilt detection rules and Timelines
POST
/api/detection_engine/rules/preview
Preview rule alerts generated on specified time range
POST
/api/detection_engine/signals/assignees
Assign and unassign users from detection alerts
POST
/api/detection_engine/signals/finalize_migrationdeprecated
Finalize detection alert migrations
DELETE
/api/detection_engine/signals/migrationdeprecated
Clean up detection alert migrations
POST
/api/detection_engine/signals/migrationdeprecated
Initiate a detection alert migration
GET
/api/detection_engine/signals/migration_statusdeprecated
Retrieve the status of detection alert migrations
POST
/api/detection_engine/signals/search
Find and/or aggregate detection alerts
POST
/api/detection_engine/signals/status
Set a detection alert status
POST
/api/detection_engine/signals/tags
Add and remove detection alert tags
GET
/api/detection_engine/tags
List all detection rule tags
Schemas 269
The contract defines 269 schemas that model the data the API accepts and returns. The most detailed are Security_Detections_API_ResponseFields (11 properties), Security_Detections_API_ThreatMatchRuleOptionalFields (10 properties), Security_Detections_API_MigrationFinalizationResult (8 properties), Security_Detections_API_BulkManualRuleRun (8 properties). Each schema is shown below with its type and property counts.
Security_Detections_API_ThreatMatchRuleRequiredFields
object
5 properties
5 required
Security_Detections_API_RuleUpdateProps
Security_Detections_API_ThresholdRuleUpdateProps
Security_Detections_API_EsqlRule
Security_Detections_API_NewTermsRuleResponseFields
Security_Detections_API_ThreatMatchRuleDefaultableFields
object
1 property
Security_Detections_API_NewTermsRuleCreateFields
Security_Detections_API_EsqlRuleResponseFields
Security_Detections_API_RuleSignatureId
string
A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not onl…
Security_Detections_API_NewTermsRuleOptionalFields
object
4 properties
Security_Detections_API_SetAlertsStatusByQueryBase
object
4 properties
2 required
Security_Detections_API_RuleIntervalFrom
string
Time from which data is analyzed each time the rule runs, using a date math range. For example, now-4200s means the rule analyzes data from 70 minutes before i…
Security_Detections_API_BulkActionEditPayload
Security_Detections_API_SiemErrorResponse
object
2 properties
2 required
Security_Detections_API_NewTermsRule
Security_Detections_API_BulkActionEditPayloadTimeline
object
Edits timeline of rules. - settimeline sets a timeline for rules. If the same timeline already exists for a rule, no changes are made.
2 properties
2 required
Security_Detections_API_RuleActionThrottle
Defines how often rule actions are taken.
Security_Detections_API_EsqlRuleCreateFields
Security_Detections_API_EqlRuleCreateFields
Security_Detections_API_AlertStatusExceptClosed
string
The status of an alert, which can be open, acknowledged, in-progress, or closed.
Security_Detections_API_ReasonEnum
string
Security_Detections_API_MaxSignals
integer
Maximum number of alerts the rule can create during a single run (the rule’s Max alerts per run [advanced setting](https://www.elastic.co/docs/solutions/securi…
Security_Detections_API_AlertSuppressionMissingFieldsStrategy
string
Describes how alerts will be generated for documents with missing suppress by fields: doNotSuppress - per each document a separate alert will be created suppre…
Security_Detections_API_BulkManualRuleRun
object
8 properties
2 required
Security_Detections_API_KillProcessParams
object
3 properties
2 required
Security_Detections_API_QueryAlertsBodyParams
object
8 properties
Security_Detections_API_RelatedIntegrationArray
array
Security_Detections_API_RuntimeFieldType
string
The data type for the runtime field type. Determines how the field value is indexed and queried.
Security_Detections_API_MachineLearningRuleCreateFields
Security_Detections_API_RulePatchProps
Security_Detections_API_RuleCreateProps
Security_Detections_API_RuleMetadata
object
Placeholder for metadata about the rule. info This field is overwritten when you save changes to the rule’s settings.
Security_Detections_API_EqlQueryLanguage
string
Security_Detections_API_EndpointResponseAction
object
2 properties
2 required
Security_Detections_API_IsRuleImmutable
boolean
This field determines whether the rule is a prebuilt Elastic rule. It will be replaced with the rulesource field.
Security_Detections_API_RuleVersion
integer
The rule's version number. - For prebuilt rules it represents the version of the rule's content in the source [detection-rules](https://github.com/elastic/dete…
Security_Detections_API_IndexPatternArray
array
Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanc…
Security_Detections_API_NormalizedRuleError
object
4 properties
3 required
Security_Detections_API_AlertsReindexOptions
object
3 properties
Security_Detections_API_AlertsIndexNamespace
string
Has no effect.
Security_Detections_API_ResponseAction
Security_Detections_API_EsqlRuleOptionalFields
object
1 property
Security_Detections_API_InvestigationFields
object
Schema for fields relating to investigation fields. These are user defined fields we use to highlight in various features in the UI such as alert details flyou…
1 property
1 required
Security_Detections_API_ThresholdField
The field on which the threshold is applied. If you specify an empty array ([]), alerts are generated when the query returns at least the number of results spe…
Security_Detections_API_RuleExceptionList
object
Array of [exception containers](https://www.elastic.co/docs/solutions/security/detect-and-alert/detection-rule-concepts), which define exceptions that prevent…
4 properties
4 required
Security_Detections_API_ThreatMappingEntry
object
4 properties
3 required
Security_Detections_API_QueryRuleUpdateProps
Security_Detections_API_GapFillStatus
string
Security_Detections_API_MachineLearningRuleRequiredFields
object
3 properties
3 required
Security_Detections_API_SavedQueryRuleCreateFields
Security_Detections_API_BulkManualRuleFillGaps
object
8 properties
2 required
Security_Detections_API_ThreatMatchRulePatchProps
Security_Detections_API_AlertsSortCombinations
Security_Detections_API_RuleExecutionMetrics
object
7 properties
Security_Detections_API_RulePreviewLogs
object
5 properties
3 required
Security_Detections_API_SetAttacksAssigneesByIds
object
3 properties
2 required
Security_Detections_API_AlertsSort
Security_Detections_API_AnomalyThreshold
integer
Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100.
Security_Detections_API_RuleNameOverride
string
Sets which field in the source event is used to populate the alert's signal.rule.name value (in the UI, this value is displayed on the Rules page in the Rule c…
Security_Detections_API_SkippedAlertsIndexMigration
object
1 property
1 required
Security_Detections_API_AlertSuppression
object
Defines alert suppression configuration.
3 properties
1 required
Security_Detections_API_RuleActionFrequency
object
The action frequency defines when the action runs (for example, only on rule execution or at specific time intervals).
3 properties
3 required
Security_Detections_API_AlertSuppressionDuration
object
2 properties
2 required
Security_Detections_API_EqlRuleUpdateProps
Security_Detections_API_EsqlRuleCreateProps
Security_Detections_API_Reason
The reason for closing the alerts. Can be one of following predefined reasons: [falsepositive, duplicate, truepositive, benignpositive, automatedclosure, other…
Security_Detections_API_EsqlRuleUpdateProps
Security_Detections_API_BulkActionEditPayloadInvestigationFields
object
Edits investigation fields of rules. - addinvestigationfields adds investigation fields to rules. If an investigation field already exists for a rule, no chang…
2 properties
2 required
Security_Detections_API_PlatformErrorResponse
object
3 properties
3 required
Security_Detections_API_AlertsIndexMigrationSuccess
object
3 properties
3 required
Security_Detections_API_SavedQueryId
string
Kibana [saved search](https://www.elastic.co/docs/explore-analyze/discover/search-sessions) used by the rule to create alerts.
Security_Detections_API_SetAttacksStatusByIds
Security_Detections_API_ThreatIndicatorPath
string
Defines the path to the threat indicator in the indicator documents (optional)
Security_Detections_API_RelatedIntegration
object
Related integration is a potential dependency of a rule. It's assumed that if the user installs one of the related integrations of a rule, the rule might start…
3 properties
2 required
Security_Detections_API_BulkActionsDryRunErrCode
string
Security_Detections_API_EqlRule
Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression
object
1 property
1 required
Security_Detections_API_SetAlertTags
object
Object with list of tags to add and remove.
2 properties
2 required
Security_Detections_API_ErrorSchema
object
5 properties
1 required
Security_Detections_API_BulkActionEditPayloadAlertSuppression
Security_Detections_API_ExternalRuleCustomizedFields
array
An array of customized field names — that is, fields that the user has modified from their base value. Defaults to an empty array.
Security_Detections_API_ThresholdRuleOptionalFields
object
5 properties
Security_Detections_API_InvestigationGuide
string
Notes to help investigate alerts produced by the rule.
Security_Detections_API_TiebreakerField
string
Sets a secondary field for sorting events
Security_Detections_API_SavedQueryRuleCreateProps
Security_Detections_API_RuleAction
object
7 properties
3 required
Security_Detections_API_RiskScore
integer
A numerical representation of the alert's severity from 0 to 100, where: 0 - 21 represents low severity 22 - 47 represents medium severity 48 - 73 represents h…
Security_Detections_API_EcsMapping
object
Map Osquery results columns or static values to Elastic Common Schema (ECS) fields. Example: "ecsmapping": {"process.pid": {"field": "pid"}}
Security_Detections_API_AlertsIndex
string
(deprecated) Has no effect.
Security_Detections_API_RuleFalsePositiveArray
array
String array used to describe common reasons why the rule may issue false-positive alerts. Defaults to an empty array.
Security_Detections_API_Threshold
object
3 properties
2 required
Security_Detections_API_SavedQueryRuleResponseFields
Security_Detections_API_ThreatMatchRuleResponseFields
Security_Detections_API_CloseAlertsByQuery
object
5 properties
2 required
Security_Detections_API_MachineLearningRule
Security_Detections_API_MachineLearningRulePatchProps
Security_Detections_API_SetAlertTagsBody
object
2 properties
2 required
Security_Detections_API_RuleActionId
string
The connector ID.
Security_Detections_API_AlertSuppressionGroupBy
array
Security_Detections_API_ThreatTactic
object
Object containing information on the attack type
3 properties
3 required
Security_Detections_API_ExternalRuleHasBaseVersion
boolean
Determines whether an external/prebuilt rule has its original, unmodified version present when the calculation of its customization status is performed (ruleso…
Security_Detections_API_TimelineTemplateId
string
Timeline template ID
Security_Detections_API_SetupGuide
string
Populates the rule’s setup guide with instructions on rule prerequisites such as required integrations, configuration steps, and anything else needed for the r…
Security_Detections_API_TimestampOverride
string
Sets the time field used to query indices. When unspecified, rules query the @timestamp field. The source field must be an Elasticsearch date data type.
Security_Detections_API_AlertTags
array
List of keywords to organize related alerts into categories that you can filter and group.
Security_Detections_API_NormalizedRuleAction
object
5 properties
2 required
Security_Detections_API_RulePreviewLoggedRequest
object
4 properties
Security_Detections_API_RunScriptOsConfigValues
object
3 properties
Security_Detections_API_NewTermsRuleUpdateProps
Security_Detections_API_SetAlertsStatusByQuery
Security_Detections_API_BulkDisableRules
object
7 properties
1 required
Security_Detections_API_EqlRuleCreateProps
Security_Detections_API_MachineLearningRuleUpdateProps
Security_Detections_API_RuleRevision
integer
The rule's revision number. It represents the version of rule's object in Kibana. It is set to 0 when the rule is installed or created and then gets incremente…
Security_Detections_API_SavedObjectResolveOutcome
string
Security_Detections_API_ThresholdRuleDefaultableFields
object
1 property
Security_Detections_API_RuleResponse
Security_Detections_API_SavedQueryRulePatchFields
Security_Detections_API_OsqueryResponseAction
object
2 properties
2 required
Security_Detections_API_RuleIntervalTo
string
Security_Detections_API_OsqueryQuery
object
7 properties
2 required
Security_Detections_API_QueryRulePatchProps
Security_Detections_API_BulkEditActionResponse
object
5 properties
1 required
Security_Detections_API_UpdateRelatedAlerts
boolean
When true, the change is also applied to detection alerts related to the attacks via kibana.alert.attackdiscovery.alertids.
Security_Detections_API_ThreatMapping
array
Array of entries objects that define mappings between the source event fields and the values in the Elasticsearch threat index. Each entries object must contai…
Security_Detections_API_BulkActionEditPayloadSetAlertSuppression
object
2 properties
2 required
Security_Detections_API_ThresholdRuleResponseFields
Security_Detections_API_RequiredFieldArray
array
Security_Detections_API_DefaultParams
object
2 properties
1 required
Security_Detections_API_TimelineTemplateTitle
string
Timeline template title
Security_Detections_API_ThresholdRuleCreateProps
Security_Detections_API_RuleExecutionStatus
string
Custom execution status of Security rules that is different from the status used in the Alerting Framework. We merge our custom status with the Framework's sta…
Security_Detections_API_BulkActionEditPayloadRuleActions
object
Edits rule actions of rules. - addruleactions adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exis…
2 properties
2 required
Security_Detections_API_RunscriptParams
object
Run a script on the Elastic Defend host that triggered the alert.
3 properties
1 required
Security_Detections_API_BulkDuplicateRules
object
8 properties
1 required
Security_Detections_API_ThrottleForBulkActions
string
Defines the maximum interval in which a rule’s actions are executed. info The rule level throttle field is deprecated in Elastic Security 8.8 and will remain a…
Security_Detections_API_ThreatIndex
array
Elasticsearch indices used to check which field values generate alerts.
Security_Detections_API_EventCategoryOverride
string
Security_Detections_API_BulkExportActionResponse
string
Security_Detections_API_MigrationCleanupResult
object
7 properties
6 required
Security_Detections_API_EqlRulePatchFields
Security_Detections_API_KqlQueryLanguage
string
Security_Detections_API_FindRulesSortField
string
Security_Detections_API_BuildingBlockType
string
Determines if the rule acts as a building block. If yes, the value must be default. By default, building-block alerts are not displayed in the UI. These rules…
Security_Detections_API_NewTermsRuleDefaultableFields
object
1 property
Security_Detections_API_SavedQueryRuleRequiredFields
object
2 properties
2 required
Security_Detections_API_ResponseFields
object
11 properties
11 required
Security_Detections_API_ThreatArray
array
Security_Detections_API_MachineLearningRulePatchFields
Security_Detections_API_ThreatQuery
string
Query used to determine which fields in the Elasticsearch index are used for generating alerts.
Security_Detections_API_QueryRule
Security_Detections_API_QueryRuleResponseFields
Security_Detections_API_QueryRuleDefaultableFields
object
2 properties
Security_Detections_API_EqlRuleResponseFields
Security_Detections_API_RuleQuery
string
[Query](https://www.elastic.co/docs/explore-analyze/query-filter) used by the rule to create alerts. - For indicator match rules, only the query’s results are…
Security_Detections_API_BulkActionEditPayloadSchedule
object
Overwrites schedule of rules. - setschedule sets a schedule for rules. If the same schedule already exists for a rule, no changes are made. Both interval and l…
2 properties
2 required
Security_Detections_API_ThresholdRuleCreateFields
Security_Detections_API_IsExternalRuleCustomized
boolean
Determines whether an external/prebuilt rule has been customized by the user (i.e. any of its fields have been modified and diverged from the base value).
Security_Detections_API_ExceptionListType
string
The exception type
Security_Detections_API_MigrationStatus
object
4 properties
4 required
Security_Detections_API_RuleExecutionSummary
object
Summary of the last execution of a rule. info This field is under development and its usage or schema may change
1 property
1 required
Security_Detections_API_AlertVersion
object
2 properties
2 required
Security_Detections_API_SetAlertAssigneesBody
object
2 properties
2 required
Security_Detections_API_QueryRuleCreateProps
Security_Detections_API_SortOrder
string
Security_Detections_API_BulkEnableRules
object
7 properties
1 required
Security_Detections_API_CloseAlertsByIds
object
3 properties
2 required
Security_Detections_API_SetAlertsStatusByIds
Security_Detections_API_QueryRuleCreateFields
Security_Detections_API_AlertsIndexMigrationError
object
2 properties
2 required
Security_Detections_API_IndexMigrationStatus
object
5 properties
5 required
Security_Detections_API_UUID
string
A universally unique identifier
Security_Detections_API_SuspendProcessParams
object
3 properties
2 required
Security_Detections_API_RiskScoreMapping
array
Overrides generated alerts' riskscore with a value from the source event
Security_Detections_API_SavedQueryRule
Security_Detections_API_EqlRequiredFields
object
3 properties
3 required
Security_Detections_API_RuleExecutionStatusOrder
integer
Security_Detections_API_MachineLearningRuleCreateProps
Security_Detections_API_RuleName
string
A human-readable name for the rule.
Security_Detections_API_RuleActionNotifyWhen
string
Defines how often rules run actions.
Security_Detections_API_EsqlQueryLanguage
string
Security_Detections_API_RuleActionGroup
string
Optionally groups actions by use cases. Use default for alert notifications.
Security_Detections_API_ProcessesParams
Security_Detections_API_NewTermsRulePatchFields
Security_Detections_API_QueryRuleRequiredFields
object
1 property
1 required
Security_Detections_API_ThresholdRulePatchProps
Security_Detections_API_NewTermsRulePatchProps
Security_Detections_API_RuleActionAlertsFilter
object
Object containing an action’s conditional filters. - timeframe (object, optional): Object containing the time frame for when this action can be run. - days (ar…
Security_Detections_API_EsqlRuleRequiredFields
object
3 properties
3 required
Security_Detections_API_NewTermsRuleRequiredFields
object
4 properties
4 required
Security_Detections_API_AlertAssignees
object
2 properties
2 required
Security_Detections_API_QueryRulePatchFields
Security_Detections_API_ThresholdRulePatchFields
Security_Detections_API_ThreatMatchRuleOptionalFields
object
10 properties
Security_Detections_API_SeverityMapping
array
Overrides generated alerts' severity with values from the source event
Security_Detections_API_ThreatMatchRuleCreateFields
Security_Detections_API_ThresholdAlertSuppression
object
Defines alert suppression configuration.
1 property
1 required
Security_Detections_API_BulkDeleteRules
object
7 properties
1 required
Security_Detections_API_ThresholdRuleRequiredFields
object
3 properties
3 required
Security_Detections_API_WarningSchema
object
4 properties
3 required
Security_Detections_API_BulkEditActionResults
object
4 properties
4 required
Security_Detections_API_SavedQueryRuleDefaultableFields
object
1 property
Security_Detections_API_RuleReferenceArray
array
Array containing notes about or references to relevant information about the rule. Defaults to an empty array.
Security_Detections_API_ThreatSubtechnique
object
3 properties
3 required
Security_Detections_API_RulePreviewParams
object
2 properties
2 required
Security_Detections_API_RuleAuthorArray
array
The rule’s author.
Security_Detections_API_RuleFilterArray
array
The query and filter context array used to define the conditions for when alerts are created from events. Defaults to an empty array. info This field is not su…
Security_Detections_API_BulkEditActionSummary
object
A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the edit action is used to add a tag to a…
4 properties
4 required
Security_Detections_API_RuleLicense
string
The rule's license.
Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold
object
2 properties
2 required
Security_Detections_API_RequiredField
object
Describes an Elasticsearch field that is needed for the rule to function. Almost all types of Security rules check source event documents for a match to some k…
3 properties
3 required
Security_Detections_API_EqlRulePatchProps
Security_Detections_API_RuleDescription
string
The rule’s description.
Security_Detections_API_ThreatFilters
array
Security_Detections_API_AlertIds
array
A list of alerts ids.
Security_Detections_API_ThresholdRule
Security_Detections_API_MigrationFinalizationResult
object
8 properties
7 required
Security_Detections_API_SetAttacksTagsByIds
object
3 properties
2 required
Security_Detections_API_SetAlertsStatusByIdsBase
object
2 properties
2 required
Security_Detections_API_BulkEditRules
object
8 properties
2 required
Security_Detections_API_ItemsPerSearch
integer
Security_Detections_API_BulkActionEditPayloadIndexPatterns
object
Edits index patterns of rulesClient. - addindexpatterns adds index patterns to rules. If an index pattern already exists for a rule, no changes are made. - del…
3 properties
2 required
Security_Detections_API_CloseAttacksByIds
object
4 properties
2 required
Security_Detections_API_RuleDetailsInError
object
2 properties
1 required
Security_Detections_API_NewTermsFields
array
Fields to monitor for new values.
Security_Detections_API_TimestampOverrideFallbackDisabled
boolean
Disables the fallback to the event's @timestamp field
Security_Detections_API_ConcurrentSearches
integer
Security_Detections_API_SavedObjectResolveAliasPurpose
string
Security_Detections_API_IsRuleEnabled
boolean
Determines whether the rule is enabled. Defaults to true.
Security_Detections_API_SavedObjectResolveAliasTargetId
string
Security_Detections_API_SavedQueryRuleOptionalFields
object
5 properties
Security_Detections_API_NonEmptyString
string
A string that does not contain only whitespace characters
Security_Detections_API_SavedQueryRulePatchProps
Security_Detections_API_ExternalRuleSource
object
Type of rule source for externally sourced rules, i.e. rules that have an external source, such as the Elastic Prebuilt rules repo.
4 properties
4 required
Security_Detections_API_Threat
object
info Currently, only threats described using the MITRE ATT&CK™ framework are supported.
3 properties
2 required
Security_Detections_API_BulkActionEditPayloadTags
object
Edits tags of rules. - addtags adds tags to rules. If a tag already exists for a rule, no changes are made. - deletetags removes tags from rules. If a tag does…
2 properties
2 required
Security_Detections_API_ThresholdValue
integer
The threshold value from which an alert is generated.
Security_Detections_API_RuleSource
Discriminated union that determines whether the rule is internally sourced (created within the Kibana app) or has an external source, such as the Elastic Prebu…
Security_Detections_API_ThresholdCardinality
array
The field on which the cardinality is applied.
Security_Detections_API_ThreatMatchRuleCreateProps
Security_Detections_API_BulkExportRules
object
7 properties
1 required
Security_Detections_API_RuleInterval
string
Frequency of rule execution, using a date math range. For example, "1h" means the rule runs every hour. Defaults to 5m (5 minutes).
Security_Detections_API_AlertSuppressionDurationUnit
string
Time unit
Security_Detections_API_ThreatMatchRuleUpdateProps
Security_Detections_API_OsqueryParams
object
6 properties
Security_Detections_API_DataViewId
string
Security_Detections_API_ThreatTechnique
object
4 properties
3 required
Security_Detections_API_MachineLearningJobId
Machine learning job ID(s) the rule monitors for anomaly scores.
Security_Detections_API_BulkGapsFillingSkipReason
string
Security_Detections_API_MachineLearningRuleResponseFields
Security_Detections_API_RuleTagArray
array
String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array.
Security_Detections_API_SavedQueryRuleUpdateProps
Security_Detections_API_EqlOptionalFields
object
7 properties
Security_Detections_API_TimestampField
string
Specifies the name of the event timestamp field used for sorting a sequence of events. Not to be confused with timestampoverride, which specifies the more gene…
Security_Detections_API_RuleActionParams
object
Object containing the allowed connector fields, which varies according to the connector type. For Slack: - message (string, required): The notification message…
Security_Detections_API_ThreatMatchRule
Security_Detections_API_Severity
string
Severity level of alerts produced by the rule, which must be one of the following: low: Alerts that are of interest but generally not considered to be security…
Security_Detections_API_InternalRuleSource
object
Type of rule source for internally sourced rules, i.e. created within the Kibana apps.
1 property
1 required
Security_Detections_API_QueryRuleOptionalFields
object
5 properties
Security_Detections_API_BulkEditSkipReason
string
Security_Detections_API_EsqlRulePatchProps
Security_Detections_API_MachineLearningRuleOptionalFields
object
1 property
Security_Detections_API_RequiredFieldInput
object
Input parameters to create a RequiredField. Does not include the ecs field, because ecs is calculated on the backend based on the field name and type.
2 properties
2 required
Security_Detections_API_AlertTag
string
Use alert tags to organize related alerts into categories that you can filter and group.
Security_Detections_API_ThreatMatchRulePatchFields
Security_Detections_API_SetAttacksStatusByIdsBase
object
3 properties
2 required
Security_Detections_API_BulkActionSkipResult
object
3 properties
2 required
Security_Detections_API_HistoryWindowStart
string
Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checki…
Security_Detections_API_NewTermsRuleCreateProps
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Elastic Stack (ELK Stack) 12
Other APIs Elastic Stack (ELK Stack) publishes across the network.
Elastic Cloud API
Elastic Stack (ELK Stack) Accounts API
Elastic Stack (ELK Stack) Actions API
Elastic Stack (ELK Stack) agent builder API
Elastic Stack (ELK Stack) Alerting API
Elastic Stack (ELK Stack) Alerting V2 API
Elastic Stack (ELK Stack) Analytics API
Elastic Stack (ELK Stack) APM agent configuration API
Elastic Stack (ELK Stack) APM agent keys API
Elastic Stack (ELK Stack) APM annotations API
Elastic Stack (ELK Stack) APM server schema API
Elastic Stack (ELK Stack) APM sourcemaps API
#Security Detections API
Where this information came from
This is an independent, third-party profile of Elastic Stack (ELK Stack) Security Detections API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.