{
  "opencollection": "1.0.0",
  "info": {
    "name": "Kibana APIs Actions Security Detections API API",
    "version": "1.0"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "Authorization",
      "value": "{{Authorization}}",
      "placement": "header"
    }
  },
  "items": [
    {
      "info": {
        "name": "Security Detections API",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Reads the alert index name if it exists",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/index"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/index</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and\nwhether its mapping is outdated. Use this to verify that an alert index is provisioned before creating\nor runnin"
        },
        {
          "info": {
            "name": "Create an alerts index",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/index"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/index</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates an index for Elastic Security alerts. Calling this API is not\nrequired for the detection engine to function properly. You can create\nrules and alerts without calling this API.\n"
        },
        {
          "info": {
            "name": "Delete an alerts index",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{kibana_url}/api/detection_engine/index"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb delete\">delete</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/index</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPermanently deletes the Elastic Security alerts backing index in the current space, including the alerts\nstored in it. Use with caution; prefer lifecycle policies or the UI when available.\nCall `GET /api/detect"
        },
        {
          "info": {
            "name": "Returns user privileges for the Kibana space",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/privileges"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/privileges</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieves whether or not the user is authenticated, and the user's Kibana\nspace and index privileges, which determine if the user can create an\nindex for the Elastic Security alerts generated by\ndetection engine"
        },
        {
          "info": {
            "name": "Retrieve a detection rule",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/rules",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "query",
                "description": "The rule's `id` value."
              },
              {
                "name": "rule_id",
                "value": "",
                "type": "query",
                "description": "The rule's `rule_id` value."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `GET /api/detection_engine/rules?id=<id>`\n* `rule_id` - `GET /api/detection_engine/rules?rule_i"
        },
        {
          "info": {
            "name": "Create a detection rule",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/rules",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new detection rule.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted "
        },
        {
          "info": {
            "name": "Update a detection rule",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/detection_engine/rules",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule ident"
        },
        {
          "info": {
            "name": "Patch a detection rule",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://{kibana_url}/api/detection_engine/rules",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb patch\">patch</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing detection rule using the `rule_id` or `id` field.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when "
        },
        {
          "info": {
            "name": "Delete a detection rule",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{kibana_url}/api/detection_engine/rules",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "query",
                "description": "The rule's `id` value."
              },
              {
                "name": "rule_id",
                "value": "",
                "type": "query",
                "description": "The rule's `rule_id` value."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb delete\">delete</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `DELETE /api/detection_engine/rules?id=<id>`\n* `rule_id`- `DELETE /api/detection_engine/rul"
        },
        {
          "info": {
            "name": "Apply a bulk action to detection rules",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/rules/_bulk_action",
            "params": [
              {
                "name": "dry_run",
                "value": "",
                "type": "query",
                "description": "Enables dry run mode for the request call.\n\nEnable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.\n\nTo enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.\n> info\n> Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.\n"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/_bulk_action</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.\n\nThe edit ac"
        },
        {
          "info": {
            "name": "Export detection rules",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/rules/_export",
            "params": [
              {
                "name": "exclude_export_details",
                "value": "",
                "type": "query",
                "description": "Determines whether a summary of the exported rules is returned."
              },
              {
                "name": "file_name",
                "value": "",
                "type": "query",
                "description": "File name for saving the exported rules.\n> info\n> When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.\n"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/_export</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:\n- Actions\n- Exception lists\n> info\n> Rule actions and connectors are included in the e"
        },
        {
          "info": {
            "name": "List all detection rules",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/rules/_find",
            "params": [
              {
                "name": "fields",
                "value": "",
                "type": "query",
                "description": "List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).\nIf omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or\nuse comma-separated values when supported by your client.\n"
              },
              {
                "name": "filter",
                "value": "",
                "type": "query",
                "description": "Search query\n\nFilters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:\n- name\n- enabled\n- tags\n- createdBy\n- interval\n- updatedBy\n> info\n> Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.\n"
              },
              {
                "name": "sort_field",
                "value": "",
                "type": "query",
                "description": "Field to sort by"
              },
              {
                "name": "sort_order",
                "value": "",
                "type": "query",
                "description": "Sort order"
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Page number"
              },
              {
                "name": "per_page",
                "value": "",
                "type": "query",
                "description": "Rules per page"
              },
              {
                "name": "gaps_range_start",
                "value": "",
                "type": "query",
                "description": "Gaps range start"
              },
              {
                "name": "gaps_range_end",
                "value": "",
                "type": "query",
                "description": "Gaps range end"
              },
              {
                "name": "gap_fill_statuses",
                "value": "",
                "type": "query",
                "description": "Gap fill statuses"
              },
              {
                "name": "gap_auto_fill_scheduler_id",
                "value": "",
                "type": "query",
                "description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/_find</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page."
        },
        {
          "info": {
            "name": "Import detection rules",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/rules/_import",
            "params": [
              {
                "name": "overwrite",
                "value": "",
                "type": "query",
                "description": "Determines whether existing rules with the same `rule_id` are overwritten."
              },
              {
                "name": "overwrite_exceptions",
                "value": "",
                "type": "query",
                "description": "Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten."
              },
              {
                "name": "overwrite_action_connectors",
                "value": "",
                "type": "query",
                "description": "Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten."
              },
              {
                "name": "as_new_list",
                "value": "",
                "type": "query",
                "description": "Generates a new list ID for each imported exception list."
              }
            ],
            "body": {
              "type": "multipart-form",
              "data": [
                {
                  "name": "file",
                  "type": "text",
                  "value": ""
                }
              ]
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/_import</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport detection rules from an `.ndjson` file, including actions and exception lists. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- A link to the `.ndjson` file containi"
        },
        {
          "info": {
            "name": "Install prebuilt detection rules and Timelines",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{kibana_url}/api/detection_engine/rules/prepackaged"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/prepackaged</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall and update all Elastic prebuilt detection rules and Timelines.\n\nThis endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. \nWhen you call this endpo"
        },
        {
          "info": {
            "name": "Retrieve the status of prebuilt detection rules and Timelines",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/rules/prepackaged/_status"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/prepackaged/_status</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve the status of all Elastic prebuilt detection rules and Timelines. \n\nThis endpoint provides detailed information about the number of custom rules, installed prebuilt rules, available prebu"
        },
        {
          "info": {
            "name": "Preview rule alerts generated on specified time range",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/rules/preview",
            "params": [
              {
                "name": "enable_logged_requests",
                "value": "",
                "type": "query",
                "description": "Enables logging and returning in response ES queries, performed during rule execution"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/preview</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSimulates a detection rule using the same rule type and query logic as a persisted rule, over a short\ntime window, without persisting a rule or writing alerts. Use the response to validate queries, see samp"
        },
        {
          "info": {
            "name": "Assign and unassign users from detection alerts",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/signals/assignees",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/assignees</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAssign users to detection alerts, and unassign them from alerts.\n> info\n> You cannot add and remove the same assignee in the same request.\n"
        },
        {
          "info": {
            "name": "Finalize detection alert migrations",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/signals/finalize_migration",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/finalize_migration</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**DEPRECATED.** Completes a legacy alert index migration. Do not automate against this in new code.\n**WARNING:** Finalizing swaps read aliases; confirm the migration has finished successfully b"
        },
        {
          "info": {
            "name": "Initiate a detection alert migration",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/signals/migration",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/migration</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**DEPRECATED.** Legacy API for on-demand reindexing of old `.siem-signals-*` alert indices. Do not build new\nintegrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead.\n*"
        },
        {
          "info": {
            "name": "Clean up detection alert migrations",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{kibana_url}/api/detection_engine/signals/migration",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb delete\">delete</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/migration</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**DEPRECATED.** Cleanup API for old migration artifacts. Do not add new call sites.\n**WARNING:** This schedules deletions; ensure no production reads still point at the source index.\n\nMigrations fav"
        },
        {
          "info": {
            "name": "Retrieve the status of detection alert migrations",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/signals/migration_status",
            "params": [
              {
                "name": "from",
                "value": "",
                "type": "query",
                "description": "Maximum age of qualifying detection alerts"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/migration_status</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**DEPRECATED.** This endpoint was used for historical `.siem-signals-*` index migration workflows. Do not use\nfor new automations; there is no supported replacement in this public API.\n**WARNING:**"
        },
        {
          "info": {
            "name": "Find and/or aggregate detection alerts",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/signals/search",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/search</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFind and/or aggregate detection alerts that match the given query."
        },
        {
          "info": {
            "name": "Set a detection alert status",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/signals/status",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/status</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSet the status of one or more detection alerts."
        },
        {
          "info": {
            "name": "Add and remove detection alert tags",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/detection_engine/signals/tags",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/signals/tags</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request.\n> info\n> You cannot add and remove the same alert tag in the same request.\n"
        },
        {
          "info": {
            "name": "List all detection rule tags",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/detection_engine/tags"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/tags</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all unique tags from all detection rules."
        }
      ]
    }
  ],
  "bundled": true
}