openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Detections API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: 'Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.


    This API supports both key-based authentication and basic authentication.


    To use key-based authentication, create an API key, then specify the key in the header of your API calls.


    To use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.


    In both cases, the API key is subsequently used for authorization when the rule runs.

    > warn

    > If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.


    > If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.


    To create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.

    '
  name: Security Detections API
  x-displayName: Security detections
paths:
  /api/detection_engine/index:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/index</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts

        stored in it. Use with caution; prefer lifecycle policies or the UI when available.

        Call `GET /api/detection_engine/index` first to confirm the index that will be removed.

        '
      operationId: DeleteAlertsIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                - acknowledged
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not enough permissions response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: The Elastic Security alerts index to delete was not found.
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Index does not exist response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete an alerts index
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/index</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and

        whether its mapping is outdated. Use this to verify that an alert index is provisioned before creating

        or running rules that write alerts to it.

        '
      operationId: ReadAlertsIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    index_mapping_outdated: false
                    name: .alerts-security.alerts-default
              schema:
                type: object
                properties:
                  index_mapping_outdated:
                    nullable: true
                    type: boolean
                  name:
                    type: string
                required:
                - name
                - index_mapping_outdated
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: API [GET /api/detection_engine/index] is unauthorized for the current user. Check Security and Kibana feature privileges (detection engine / alerts) for the space.
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not enough permissions response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: Elastic Security alert index is not found for the current space.
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Reads the alert index name if it exists
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/index</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates an index for Elastic Security alerts. Calling this API is not

        required for the detection engine to function properly. You can create

        rules and alerts without calling this API.

        '
      operationId: CreateAlertsIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                - acknowledged
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not enough permissions response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: A prerequisite resource required to create the alerts index was not found.
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create an alerts index
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/privileges:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/privileges</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves whether or not the user is authenticated, and the user''s Kibana

        space and index privileges, which determine if the user can create an

        index for the Elastic Security alerts generated by

        detection engine rules.

        '
      operationId: ReadPrivileges
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    application: {}
                    cluster:
                      all: true
                      manage: true
                      manage_api_key: true
                      manage_index_templates: true
                      manage_ml: true
                      manage_own_api_key: true
                      manage_pipeline: true
                      manage_security: true
                      manage_transform: true
                      monitor: true
                      monitor_ml: true
                      monitor_transform: true
                    has_all_requested: true
                    has_encryption_key: true
                    index:
                      .alerts-security.alerts-default:
                        all: true
                        create: true
                        create_doc: true
                        create_index: true
                        delete: true
                        delete_index: true
                        index: true
                        maintenance: true
                        manage: true
                        monitor: true
                        read: true
                        view_index_metadata: true
                        write: true
                    is_authenticated: true
                    username: elastic
              schema:
                type: object
                properties:
                  has_encryption_key:
                    type: boolean
                  is_authenticated:
                    type: boolean
                required:
                - is_authenticated
                - has_encryption_key
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Returns user privileges for the Kibana space
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a detection rule using the `rule_id` or `id` field.


        The URL query must include one of the following:


        * `id` - `DELETE /api/detection_engine/rules?id=<id>`

        * `rule_id`- `DELETE /api/detection_engine/rules?rule_id=<rule_id>`


        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.

        '
      operationId: DeleteRule
      parameters:
      - description: The rule's `id` value.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Detections_API_UUID'
      - description: The rule's `rule_id` value.
        in: query
        name: rule_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      responses:
        '200':
          content:
            application/json:
              examples:
                deletedRule:
                  summary: Response shape after a rule is deleted
                  value:
                    actions: []
                    created_at: '2020-02-03T11:19:04.259Z'
                    created_by: elastic
                    description: Process started by MS Office program in user folder
                    enabled: false
                    false_positives: []
                    from: now-4200s
                    id: c41d170b-8ba6-4de6-b8ec-76440a35ace3
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: event.action:Process*
                    references: []
                    risk_score: 50
                    rule_id: process_started_by_ms_office_user_folder
                    severity: low
                    tags:
                    - tag
                    throttle: null
                    to: now
                    type: query
                    updated_at: '2020-02-03T11:19:04.462Z'
                    updated_by: elastic
                    version: 3
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Delete a detection rule
      tags:
      - Security Detections API
      x-codeSamples:
      - lang: cURL
        source: "curl \\\n  --request DELETE https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n  --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieve a detection rule using the `rule_id` or `id` field.


        The URL query must include one of the following:


        * `id` - `GET /api/detection_engine/rules?id=<id>`

        * `rule_id` - `GET /api/detection_engine/rules?rule_id=<rule_id>`


        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.

        '
      operationId: ReadRule
      parameters:
      - description: The rule's `id` value.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Detections_API_UUID'
      - description: The rule's `rule_id` value.
        in: query
        name: rule_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Example response for a retrieved rule
                  value:
                    created_at: '2020-02-03T11:19:04.259Z'
                    created_by: elastic
                    description: Process started by MS Office program in user folder
                    enabled: false
                    execution_summary:
                      last_execution:
                        date: '2022-03-23T16:06:12.787Z'
                        message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                        metrics:
                          execution_gap_duration_s: 0
                          total_indexing_duration_ms: 15
                          total_search_duration_ms: 135
                        status: partial failure
                        status_order: 20
                    false_positives: []
                    filters:
                    - query:
                        match:
                          event.action:
                            query: 'Process Create (rule: ProcessCreate)'
                            type: phrase
                    from: now-4200s
                    id: c41d170b-8ba6-4de6-b8ec-76440a35ace3
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    required_fields:
                    - ecs: true
                      name: process.name
                      type: keyword
                    - ecs: true
                      name: process.parent.name
                      type: keyword
                    risk_score: 21
                    rule_id: process_started_by_ms_office_user_folder
                    setup: ''
                    severity: low
                    tags:
                    - child process
                    - ms office
                    threat:
                    - framework: MITRE ATT&CK
                      tactic:
                        id: TA0001
                        name: Initial Access
                        reference: https://attack.mitre.org/tactics/TA0001
                      technique:
                      - id: T1193
                        name: Spearphishing Attachment
                        reference: https://attack.mitre.org/techniques/T1193
                    to: now-300s
                    type: query
                    updated_at: '2020-02-03T11:19:04.462Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: 'Indicates a successful call.

            > info

            > These fields are under development and their usage or schema may change: execution_summary.

            '
      summary: Retrieve a detection rule
      tags:
      - Security Detections API
      x-codeSamples:
      - lang: cURL
        source: "curl \\\n  --request GET https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n  --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update specific fields of an existing detection rule using the `rule_id` or `id` field.


        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.

        > warn

        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user''s key gets assigned to the affected rules. If the user''s key gets deleted or the user becomes inactive, the rules will stop running.


        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

        '
      operationId: PatchRule
      requestBody:
        content:
          application/json:
            examples:
              example1:
                summary: Patch query rule
                value:
                  id: 14b7b513-3d8d-4b22-b7da-a7ae632f7e76
                  name: New name
              example2:
                summary: Patch EQL rule
                value:
                  rule_id: process_started_by_ms_office_program_possible_payload
                  threat:
                  - framework: MITRE ATT&CK
                    tactic:
                      id: TA0001
                      name: Initial Access
                      reference: https://attack.mitre.org/tactics/TA0001
                    technique:
                    - id: T1193
                      name: Spearphishing Attachment
                      reference: https://attack.mitre.org/techniques/T1193
              example3:
                summary: Patch threshold rule
                value:
                  id: 005d2c4f-51ca-493d-a2bd-20ef076339b1
                  query: 'agent.version : * and agent.id : "243d9b4f-ca01-4311-8e5c-9abbee91afd8"'
                  threshold:
                    cardinality: []
                    field: []
                    value: 600
              example4:
                summary: Patch new terms rule
                value:
                  history_window_start: now-3d
                  id: 569aac91-40dc-4807-a8ae-a2c8698089c4
                  new_terms_fields:
                  - Endpoint.policy.applied.artifacts.global.identifiers.name
              example5:
                summary: Patch esql rule
                value:
                  id: 0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd
                  query: "FROM logs-abc*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp)\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) \n| KEEP event_rate\n"
              example6:
                summary: Patch indicator match rule
                value:
                  id: 462f1986-10fe-40a3-a22c-2b1c9c4c48fd
                  threat_query: '@timestamp >= "now-30d/d" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:"false"'
              example7:
                summary: Patch machine learning rule
                value:
                  anomaly_threshold: 50
                  id: 60b13926-289b-41b1-a537-197ef1fa5059
                  machine_learning_job_id:
                  - auth_high_count_logon_events_ea
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RulePatchProps'
        description: '> info

          > You cannot modify the `id` or `rule_id` values.

          '
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Example response for an updated rule
                  value:
                    actions: []
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Updated description for the rule.
                    enabled: false
                    false_positives: []
                    filters:
                    - query: null
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: Updated Rule Name
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                    - package: o365
                    required_fields:
                    - name: process.parent.name
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                    - child process
                    - ms office
                    threat: []
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Patch a detection rule
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new detection rule.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n\nYou can create the following types of rules:\n\n* **Custom query**: Searches the defined indices and creates an alert when a document matches the rule's KQL query.\n* **Event correlation**: Searches the defined indices and creates an alert when results match an [Event Query Language (EQL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) query.\n* **Threshold**: Searches the defined indices and creates an alert when the number of times the specified field's value meets the threshold during a single execution. When there are multiple values that meet the threshold, an alert is generated for each value.\n  For example, if the threshold `field` is `source.ip` and its `value` is `10`, an alert is generated for every source IP address that appears in at least 10 of the rule's search results. If you're interested, see [Terms Aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) for more information.\n* **Indicator match**: Creates an alert when fields match values defined in the specified [Elasticsearch index](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html). For example, you can create an index for IP addresses and use this index to create an alert whenever an event's `destination.ip` equals a value in the index. The index's field mappings should be [ECS-compliant](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html).\n* **New terms**: Generates an alert for each new term detected in source documents within a specified time range.\n* **ES|QL**: Uses [Elasticsearch Query Language (ES|QL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html) to find events and aggregate search results.\n* **Machine learning rules**: Creates an alert when a machine learning job discovers an anomaly above the defined threshold.\n> info\n> To create machine learning rules, you must have the [appropriate license](https://www.elastic.co/subscriptions) or use a [cloud deployment](https://cloud.elastic.co/registration). Additionally, for the machine learning rule to function correctly, the associated machine learning job must be running.\n\nTo retrieve machine learning job IDs, which are required to create machine learning jobs, call the [Elasticsearch Get jobs API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-job.html). Machine learning jobs that contain `siem` in the `groups` field can be used to create rules:\n\n```json\n...\n\"job_id\": \"linux_anomalous_network_activity_ecs\",\n\"job_type\": \"anomaly_detector\",\n\"job_version\": \"7.7.0\",\n\"groups\": [\n  \"auditbeat\",\n  \"process\",\n  \"siem\"\n],\n...\n```\n\nAdditionally, you can set up notifications for when rules create alerts. The notifications use the [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting). Each action type requires a connector. Connectors store the information required to send notifications via external systems. The following connector types are supported for rule notifications:\n\n* Slack\n* Email\n* PagerDuty\n* Webhook\n* Microsoft Teams\n* IBM Resilient\n* Jira\n* ServiceNow ITSM\n> info\n> For more information on PagerDuty fields, see [Send a v2 Event](https://developer.pagerduty.com/docs/events-api-v2/trigger-events/).\n\nTo retrieve connector IDs, which are required to configure rule notifications, call the [Find objects API](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findsavedobjects) with `\"type\": \"action\"` in the request payload.\n\nFor detailed information on Kibana actions and alerting, and additional API calls, see:\n\n* [Alerting API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting)\n* [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting)\n* [Connectors API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-connectors)\n"
      operationId: CreateRule
      requestBody:
        content:
          application/json:
            examples:
              example1:
                description: Query rule that searches for processes started by MS Office
                summary: Query rule
                value:
                  description: Process started by MS Office program - possible payload
                  enabled: false
                  filters:
                  - query:
                      match:
                        event.action:
                          query: 'Process Create (rule: ProcessCreate)'
                          type: phrase
                  from: now-70m
                  interval: 1h
                  language: kuery
                  name: MS Office child process
                  query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                  related_integrations:
                  - package: o365
                    version: ^2.3.2
                  required_fields:
                  - name: process.parent.name
                    type: keyword
                  risk_score: 50
                  rule_id: process_started_by_ms_office_program
                  severity: low
                  tags:
                  - child process
                  - ms office
                  type: query
              example2:
                description: Threshold rule that detects multiple failed login attempts to a Windows host from the same external source IP address
                summary: Threshold rule
                value:
                  description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.
                  enabled: true
                  exceptions_list:
                  - id: int-ips
                    namespace_type: single
                    type: detection
                  from: now-180s
                  index:
                  - winlogbeat-*
                  interval: 2m
                  name: Windows server prml-19
                  query: host.name:prml-19 and event.category:authentication and event.outcome:failure
                  required_fields:
                  - name: source.ip
                    type: ip
                  risk_score: 30
                  rule_id: liv-win-ser-logins
                  severity: low
                  severity_mapping:
                  - field: source.geo.city_name
                    operator: equals
                    severity: low
                    value: Manchester
                  - field: source.geo.city_name
                    operator: equals
                    severity: medium
                    value: London
                  - field: source.geo.city_name
                    operator: equals
                    severity: high
                    value: Birmingham
                  - field: source.geo.city_name
                    operator: equals
                    severity: critical
                    value: Wallingford
                  tags:
                  - Brute force
                  threshold:
                    field: source.ip
                    value: 20
                  type: threshold
              example3:
                description: Machine learning rule that creates alerts, and sends Slack notifications, when the linux_anomalous_network_activity_ecs machine learning job discovers anomalies with a threshold of 70 or above.
                summary: Machine learning rule
                value:
                  actions:
                  - action_type_id: .slack
                    group: default
                    id: 5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5
                    params:
                      message: 'Urgent: {{context.rule.description}}'
                  anomaly_threshold: 70
                  description: Generates alerts when the job discovers anomalies over 70
                  enabled: true
                  from: now-6m
                  interval: 5m
                  machine_learning_job_id: linux_anomalous_network_activity_ecs
                  name: Anomalous Linux network activity
                  note: Shut down the internet.
                  risk_score: 70
                  rule_id: ml_linux_network_high_threshold
                  setup: This rule requires data coming in from Elastic Defend.
                  severity: high
                  tags:
                  - machine learning
                  - Linux
                  type: machine_learning
              example4:
                description: Event correlation rule that creates alerts when the Windows rundll32.exe process makes unusual network connections
                summary: EQL rule
                value:
                  description: Unusual rundll32.exe network connection
                  language: eql
                  name: rundll32.exe network connection
                  query: sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]
                  required_fields:
                  - name: event.type
                    type: keyword
                  - name: process.args
                    type: keyword
                  - name: process.args_count
                    type: long
                  - name: process.entity_id
                    type: keyword
                  - name: process.name
                    type: keyword
                  - name: process.pe.original_file_name
                    type: keyword
                  risk_score: 21
                  rule_id: eql-outbound-rundll32-connections
                  severity: low
                  tags:
                  - EQL
                  - Windows
                  - rundll32.exe
                  type: eql
              example5:
                description: 'Indicator match rule that creates an alert when one of the following is true: The event''s destination IP address and port number matches destination IP and port values in the threat_index index; The event''s source IP address matches a host IP address value in the threat_index index.

                  '
                summary: Indicator match rule
                value:
                  actions: []
                  description: Checks for bad IP addresses listed in the ip-threat-list index
                  index:
                  - packetbeat-*
                  name: Bad IP threat match
                  query: destination.ip:* or host.ip:*
                  required_fields:
                  - name: destination.ip
                    type: ip
                  - name: destination.port
                    type: long
                  - name: host.ip
                    type: ip
                  risk_score: 50
                  severity: medium
                  threat_index:
                  - ip-threat-list
                  threat_mapping:
                  - entries:
                    - field: destination.ip
                      type: mapping
                      value: destination.ip
                    - field: destination.port
                      type: mapping
                      value: destination.port
                  - entries:
                    - field: source.ip
                      type: mapping
                      value: host.ip
                  threat_query: '*:*'
                  type: threat_match
              example6:
                description: New terms rule that creates alerts a new IP address is detected for a user
                summary: New terms rule
                value:
                  description: Detects a user associated with a new IP address
                  history_window_start: now-30d
                  index:
                  - auditbeat*
                  language: kuery
                  name: New User IP Detected
                  new_terms_fields:
                  - user.id
                  - source.ip
                  query: '*'
                  required_fields:
                  - name: user.id
                    type: keyword
                  - name: source.ip
                    type: ip
                  risk_score: 21
                  severity: medium
                  type: new_terms
              example7:
                description: esql rule that creates alerts from events that match an Excel parent process
                summary: Esql rule
                value:
                  description: Find Excel events
                  enabled: false
                  from: now-360s
                  interval: 5m
                  language: esql
                  name: Find Excel events
                  query: from auditbeat-8.10.2 METADATA _id, _version, _index | where process.parent.name == "EXCEL.EXE"
                  required_fields:
                  - name: process.parent.name
                    type: keyword
                  risk_score: 21
                  severity: low
                  tags: []
                  to: now
                  type: esql
              example8:
                description: Query rule that searches for processes started by MS Office and suppresses alerts by the process.parent.name field within a 5-hour time period
                summary: Query rule 2
                value:
                  alert_suppression:
                    duration:
                      unit: h
                      value: 5
                    group_by:
                    - process.parent.name
                    missing_fields_strategy: suppress
                  description: Process started by MS Office program - possible payload
                  enabled: false
                  filters:
                  - query:
                      match:
                        event.action:
                          query: 'Process Create (rule: ProcessCreate)'
                          type: phrase
                  from: now-70m
                  interval: 1h
                  language: kuery
                  name: MS Office child process
                  query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                  risk_score: 50
                  rule_id: process_started_by_ms_office_program
                  severity: low
                  tags:
                  - child process
                  - ms office
                  type: query
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RuleCreateProps'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  description: Example response for a query rule
                  summary: Query rule response
                  value:
                    actions: []
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Process started by MS Office program - possible payload
                    enabled: false
                    false_positives: []
                    filters:
                    - query:
                        match:
                          event.action:
                            query: 'Process Create (rule: ProcessCreate)'
                            type: phrase
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    - integration: graphactivitylogs
                      package: azure
                      version: ^1.11.4
                    required_fields:
                    - ecs: true
                      name: process.parent.name
                      type: keyword
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                    - child process
                    - ms office
                    threat: []
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 1
                example2:
                  description: Example response for a machine learning job rule
                  summary: Machine learning response
                  value:
                    actions:
                    - action_type_id: .slack
                      frequency:
                        notifyWhen: onActiveAlert
                        summary: true
                        throttle: null
                      group: default
                      id: 5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5
                      params:
                        message: 'Urgent: {{context.rule.description}}'
                    anomaly_threshold: 70
                    created_at: '2020-04-07T14:45:15.679Z'
                    created_by: elastic
                    description: Generates alerts when the job discovers anomalies over 70
                    enabled: true
                    false_positives: []
                    from: now-6m
                    id: 83876f66-3a57-4a99-bf37-416494c80f3b
                    immutable: false
                    interval: 5m
                    machine_learning_job_id: linux_anomalous_network_activity_ecs
                    max_signals: 100
                    name: Anomalous Linux network activity
                    note: Shut down the internet.
                    references: []
                    related_integrations: []
                    required_fields: []
                    risk_score: 70
                    rule_id: ml_linux_network_high_threshold
                    setup: ''
                    severity: high
                    status: going to run
                    status_date: '2020-04-07T14:45:21.685Z'
                    tags:
                    - machine learning
                    - Linux
                    threat: []
                    to: now
                    type: machine_learning
                    updated_at: '2020-04-07T14:45:15.892Z'
                    updated_by: elastic
                    version: 1
                example3:
                  description: Example response for a threshold rule
                  summary: Threshold rule response
                  value:
                    actions: []
                    author: []
                    created_at: '2020-07-22T10:27:23.486Z'
                    created_by: elastic
                    description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.
                    enabled: true
                    exceptions_list:
                    - id: int-ips
                      namespace_type: single
                      type: detection
                    false_positives: []
                    from: now-180s
                    id: 15dbde26-b627-4d74-bb1f-a5e0ed9e4993
                    immutable: false
                    index:
                    - winlogbeat-*
                    interval: 2m
                    language: kuery
                    max_signals: 100
                    name: Windows server prml-19
                    query: host.name:prml-19 and event.category:authentication and event.outcome:failure
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    required_fields:
                    - ecs: true
                      name: source.ip
                      type: ip
                    risk_score: 30
                    risk_score_mapping: []
                    rule_id: liv-win-ser-logins
                    setup: ''
                    severity: low
                    severity_mapping:
                    - field: source.geo.city_name
                      operator: equals
                      severity: low
                      value: Manchester
                    - field: source.geo.city_name
                      operator: equals
                      severity: medium
                      value: London
                    - field: source.geo.city_name
                      operator: equals
                      severity: high
                      value: Birmingham
                    - field: source.geo.city_name
                      operator: equals
                      severity: critical
                      value: Wallingford
                    tags:
                    - Brute force
                    threat: []
                    threshold:
                      field: source.ip
                      value: 20
                    to: now
                    type: threshold
                    updated_at: '2020-07-22T10:27:23.673Z'
                    updated_by: elastic
                    version: 1
                example4:
                  description: Example response for an EQL rule
                  summary: EQL rule response
                  value:
                    author: []
                    created_at: '2020-10-05T09:06:16.392Z'
                    created_by: elastic
                    description: Unusual rundll32.exe network connection
                    enabled: true
                    exceptions_list: []
                    false_positives: []
                    from: now-6m
                    id: 93808cae-b05b-4dc9-8479-73574b50f8b1
                    immutable: false
                    interval: 5m
                    language: eql
                    max_signals: 100
                    name: rundll32.exe network connection
                    query: sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    required_fields:
                    - ecs: true
                      name: event.type
                      type: keyword
                    - ecs: true
                      name: process.args
                      type: keyword
                    - ecs: true
                      name: process.args_count
                      type: long
                    - ecs: true
                      name: process.entity_id
                      type: keyword
                    - ecs: true
                      name: process.name
                      type: keyword
                    - ecs: true
                      name: process.pe.original_file_name
                      type: keyword
                    risk_score: 21
                    risk_score_mapping: []
                    rule_id: eql-outbound-rundll32-connections
                    setup: ''
                    severity: low
                    severity_mapping: []
                    tags:
                    - EQL
                    - Windows
                    - rundll32.exe
                    threat: []
                    throttle: no_actions
                    to: now
                    type: eql
                    updated_at: '2020-10-05T09:06:16.403Z'
                    updated_by: elastic
                    version: 1
                example5:
                  description: Example response for an indicator match rule
                  summary: Indicator match rule response
                  value:
                    author: []
                    created_at: '2020-10-06T07:07:58.227Z'
                    created_by: elastic
                    description: Checks for bad IP addresses listed in the ip-threat-list index
                    enabled: true
                    exceptions_list: []
                    false_positives: []
                    from: now-6m
                    id: d5daa13f-81fb-4b13-be2f-31011e1d9ae1
                    immutable: false
                    index:
                    - packetbeat-*
                    interval: 5m
                    language: kuery
                    max_signals: 100
                    name: Bad IP threat match
                    query: destination.ip:* or host.ip:*
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    required_fields:
                    - ecs: true
                      name: destination.ip
                      type: ip
                    - ecs: true
                      name: destination.port
                      type: long
                    - ecs: true
                      name: host.ip
                      type: ip
                    risk_score: 50
                    risk_score_mapping: []
                    rule_id: 608501e4-c768-4f64-9326-cec55b5d439b
                    setup: ''
                    severity: medium
                    severity_mapping: []
                    tags: []
                    threat: []
                    threat_index:
                    - ip-threat-list
                    threat_mapping:
                    - entries:
                      - field: destination.ip
                        type: mapping
                        value: destination.ip
                      - field: destination.port
                        type: mapping
                        value: destination.port
                    - entries:
                      - field: source.ip
                        type: mapping
                        value: host.ip
                    threat_query: '*:*'
                    to: now
                    type: threat_match
                    updated_at: '2020-10-06T07:07:58.237Z'
                    updated_by: elastic
                    version: 1
                example6:
                  description: Example response for a new terms rule
                  summary: New terms rule response
                  value:
                    author: []
                    created_at: '2020-10-06T07:07:58.227Z'
                    created_by: elastic
                    description: Detects a user associated with a new IP address
                    enabled: true
                    exceptions_list: []
                    false_positives: []
                    from: now-6m
                    history_window_start: now-30d
                    id: eb7225c0-566b-11ee-8b4f-bbf3afdeb9f4
                    immutable: false
                    index:
                    - auditbeat*
                    interval: 5m
                    language: kuery
                    max_signals: 100
                    name: New User IP Detected
                    new_terms_fields:
                    - user.id
                    - source.ip
                    query: '*'
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    required_fields:
                    - ecs: true
                      name: user.id
                      type: keyword
                    - ecs: true
                      name: source.ip
                      type: ip
                    risk_score: 21
                    risk_score_mapping: []
                    rule_id: c6f5d0bc-7be9-47d4-b2f3-073d22641e30
                    setup: ''
                    severity: medium
                    severity_mapping: []
                    tags: []
                    threat: []
                    to: now
                    type: new_terms
                    updated_at: '2020-10-06T07:07:58.237Z'
                    updated_by: elastic
                    version: 1
                example7:
                  description: Example response for an Esql rule
                  summary: Esql rule response
                  value:
                    actions: []
                    author: []
                    created_at: '2023-10-18T10:55:14.269Z'
                    created_by: elastic
                    description: Find Excel events
                    enabled: false
                    exceptions_list: []
                    false_positives: []
                    from: now-360s
                    id: d0f20490-6da4-11ee-b85e-09e9b661f2e2
                    immutable: false
                    interval: 5m
                    language: esql
                    max_signals: 100
                    name: Find Excel events
                    output_index: ''
                    query: from auditbeat-8.10.2 METADATA _id | where process.parent.name == "EXCEL.EXE"
                    references: []
                    related_integrations:
                    - package: o365
                      version: ^2.3.2
                    required_fields:
                    - ecs: true
                      name: process.parent.name
                      type: keyword
                    revision: 0
                    risk_score: 21
                    risk_score_mapping: []
                    rule_id: e4b53a89-debd-4a0d-a3e3-20606952e589
                    setup: ''
                    severity: low
                    severity_mapping: []
                    tags: []
                    threat: []
                    to: now
                    type: esql
                    updated_at: '2023-10-18T10:55:14.269Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Create a detection rule
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted.


        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.

        > warn

        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user''s key gets assigned to the affected rules. If the user''s key gets deleted or the user becomes inactive, the rules will stop running.


        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

        '
      operationId: UpdateRule
      requestBody:
        content:
          application/json:
            examples:
              example1:
                summary: Update query rule
                value:
                  description: A new description
                  id: 14b7b513-3d8d-4b22-b7da-a7ae632f7e76
                  name: A new name for the rule
                  risk_score: 22
                  severity: medium
                  type: query
              example2:
                summary: Update EQL rule
                value:
                  description: eql rule test
                  id: 9b684efb-acf9-4323-9bff-8335b3867d14
                  index:
                  - apm-*-transaction*
                  language: eql
                  name: New name for EQL rule
                  query: process where process.name == "regsvr32.exe"
                  risk_score: 21
                  severity: low
                  type: eql
              example3:
                summary: Update threshold rule
                value:
                  description: Description of threat rule test
                  id: 005d2c4f-51ca-493d-a2bd-20ef076339b1
                  language: kuery
                  name: New name for threat rule
                  query: 'agent.version : * and agent.id : "243d9b4f-ca01-4311-8e5c-9abbee91afd8"'
                  risk_score: 21
                  severity: low
                  tags:
                  - new_tag
                  threshold:
                    cardinality: []
                    field: []
                    value: 400
                  type: threshold
              example4:
                summary: Update new terms rule
                value:
                  description: New description
                  history_window_start: now-7d
                  id: 569aac91-40dc-4807-a8ae-a2c8698089c4
                  interval: 5m
                  name: New terms rule name
                  new_terms_fields:
                  - Endpoint.policy.applied.artifacts.global.identifiers.name
                  query: 'agent.version : "9.1.0"'
                  risk_score: 21
                  severity: low
                  type: new_terms
              example5:
                summary: Update esql rule
                value:
                  description: New description for esql rule
                  id: 0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd
                  language: esql
                  name: New name for esql rule
                  query: 'FROM logs*

                    | STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */

                    | EVAL event_rate = count / DATE_DIFF("seconds", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */

                    | KEEP event_rate

                    '
                  risk_score: 21
                  severity: low
                  type: esql
              example6:
                summary: Update indicator match rule
                value:
                  description: New description
                  id: 462f1986-10fe-40a3-a22c-2b1c9c4c48fd
                  name: New name for Indicator Match rule
                  query: source.ip:* or destination.ip:*\n
                  risk_score: 99
                  severity: critical
                  threat_index:
                  - filebeat-*
                  - logs-ti_*
                  threat_mapping:
                  - entries:
                    - field: source.ip
                      type: mapping
                      value: threat.indicator.ip
                  - entries:
                    - field: destination.ip
                      type: mapping
                      value: threat.indicator.ip
                  threat_query: '@timestamp >= "now-30d/d" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:"true"'
                  type: threat_match
              example7:
                summary: Update machine learning rule
                value:
                  anomaly_threshold: 50
                  description: New description of ml rule
                  id: 60b13926-289b-41b1-a537-197ef1fa5059
                  machine_learning_job_id:
                  - auth_high_count_logon_events_ea
                  name: New name of ml rule
                  risk_score: 21
                  severity: low
                  type: machine_learning
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RuleUpdateProps'
        description: '> info

          > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.

          '
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Example response for an updated rule
                  value:
                    actions: []
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Updated description for the rule.
                    enabled: false
                    false_positives: []
                    filters:
                    - query: null
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: Updated Rule Name
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                    - package: o365
                    required_fields:
                    - name: process.parent.name
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                    - child process
                    - ms office
                    threat: []
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Update a detection rule
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/_bulk_action:
    post:
      description: "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/_bulk_action</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.\n\nThe edit action allows you to add, delete, or set tags, index patterns, investigation fields, rule actions and schedules for multiple rules at once. \nThe edit action is idempotent, meaning that if you add a tag to a rule that already has that tag, no changes are made. The same is true for other edit actions, for example removing an index pattern that is not specified in a rule will not result in any changes. The only exception is the `add_rule_actions` and `set_rule_actions` action, which is non-idempotent. This means that if you add or set a rule action to a rule that already has that action, a new action is created with a new unique ID.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n"
      operationId: PerformRulesBulkAction
      parameters:
      - description: 'Enables dry run mode for the request call.


          Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.


          To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.

          > info

          > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.

          '
        in: query
        name: dry_run
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            examples:
              example01:
                description: The following request activates all rules with the test tag.
                summary: Enable - Enable all rules with the test tag
                value:
                  action: enable
                  query: 'alert.attributes.tags: "test"'
              example02:
                description: The following request enables the rule with the specified ID.
                summary: Enable - Enable a specific rule by ID.
                value:
                  action: enable
                  ids:
                  - 748694f0-6977-4ea5-8384-cd2e39730779
              example03:
                description: The following request disables the rule with the specified ID.
                summary: Disable - Disable a specific rule by ID
                value:
                  action: disable
                  ids:
                  - 748694f0-6977-4ea5-8384-cd2e39730779
              example04:
                description: The following request duplicates rules with the specified IDs, including exceptions but not expired exceptions.
                summary: Duplicate - Duplicate rules with specific IDs
                value:
                  action: duplicate
                  duplicate:
                    include_exceptions: true
                    include_expired_exceptions: false
                  ids:
                  - 748694f0-6977-4ea5-8384-cd2e39730779
                  - 461a4c22-416e-4009-a9a7-cf79656454bf
              example05:
                description: The following request deletes the rule with the specified ID.
                summary: Delete - Delete a specific rule by ID
                value:
                  action: delete
                  ids:
                  - cf4abfd1-7c37-4519-ab0f-5ea5c75fac60
              example06:
                description: The following request runs the rule with the specified ID within the given date range.
                summary: Run - Run a specific rule by ID
                value:
                  action: run
                  ids:
                  - 748694f0-6977-4ea5-8384-cd2e39730779
                  run:
                    end_date: '2025-03-10T23:59:59.999Z'
                    start_date: '2025-03-01T00:00:00.000Z'
              example07:
                description: The following request exports the rules with the specified IDs.
                summary: Export - Export specific rules by ID
                value:
                  action: export
                  ids:
                  - 748694f0-6977-4ea5-8384-cd2e39730779
              example08:
                description: The following request will validate that the add_index_patterns bulk action can be successfully applied to three rules. The dry_run parameter is specified in query parameters, e.g. POST api/detection_engine/rules/_bulk_action?dry_run=true
                summary: Edit - dry run - Validate add_index_patterns bulk action
                value:
                  action: edit
                  edit:
                  - type: add_index_patterns
                    value:
                    - test-*
                  ids:
                  - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                  - dc015d10-0831-11ed-ac8b-05a222bd8d4a
                  - de8f5af0-0831-11ed-ac8b-05a222bd8d4a
              example09:
                description: The following request adds the tag "tag-1" to the rules with the specified IDs. If the tag already exists for a rule, no changes are made.
                summary: Edit - Add a tag to rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: add_tags
                    value:
                    - tag-1
                  ids:
                  - 8bc7dad0-9320-11ec-9265-8b772383a08d
                  - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example10:
                description: The following request adds two tags at the same time, tag-1 and tag-2, to the rules that have the IDs sent in the payload. If the tags already exist for a rule, no changes are made.
                summary: Edit - Add two tags to rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: add_tags
                    value:
                    - tag-1
                    - tag-2
                  ids:
                  - 8bc7dad0-9320-11ec-9265-8b772383a08d
                  - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example11:
                description: The following request removes the tag "tag-1" from the rules with the specified IDs. If the tag does not exist for a rule, no changes are made.
                summary: Edit - Delete a tag from rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: delete_tags
                    value:
                    - tag-1
                  ids:
                  - 8bc7dad0-9320-11ec-9265-8b772383a08d
                  - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example12:
                description: The following request sets the tags "tag-1" and "tag-2" for the rules with the specified IDs, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.
                summary: Edit - Set (overwrite existing) tags for rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_tags
                    value:
                    - tag-1
                    - tag-2
                  ids:
                  - 8bc7dad0-9320-11ec-9265-8b772383a08d
                  - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example13:
                description: The following request adds the index pattern "test-*" to the rules with the specified IDs. If the index pattern already exists for a rule, no changes are made.
                summary: Edit - Add index patterns to rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: add_index_patterns
                    value:
                    - test-*
                  ids:
                  - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                  - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example14:
                description: The following request removes the index pattern "test-*" from the rules with the specified IDs. If the index pattern does not exist for a rule, no changes are made.
                summary: Edit - Remove index patterns from rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: delete_index_patterns
                    value:
                    - test-*
                  ids:
                  - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                  - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example15:
                description: The following request sets the index patterns "test-*" and "prod-*" for the rules with the specified IDs, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.
                summary: Edit - Set (overwrite existing) index patterns for rules patterns (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_index_patterns
                    value:
                    - test-*
                  ids:
                  - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                  - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example16:
                description: The following request adds investigation field to the rules with the specified IDs.
                summary: Edit - Add investigation field to rules
                value:
                  action: edit
                  edit:
                  - type: add_investigation_fields
                    value:
                      field_names:
                      - alert.status
                  ids:
                  - 12345678-1234-1234-1234-1234567890ab
                  - 87654321-4321-4321-4321-0987654321ba
              example17:
                description: The following request deletes investigation fields from the rules with the specified IDs. If the field does not exist for a rule, no changes are made.
                summary: Edit - Delete investigation fields from rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: delete_investigation_fields
                  ids:
                  - 12345678-1234-1234-1234-1234567890ab
                  - 87654321-4321-4321-4321-0987654321ba
                  value:
                  - field1
                  - field2
              example18:
                description: The following request sets investigation fields for the rules with the specified IDs, overwriting any existing investigation fields. If the set of investigation fields is the same as the existing investigation fields, no changes are made.
                summary: Edit - Set (overwrite existing) investigation fields for rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_investigation_fields
                    value:
                    - field1
                    - field2
                  ids:
                  - 12345678-1234-1234-1234-1234567890ab
                  - 87654321-4321-4321-4321-0987654321ba
              example19:
                description: The following request sets a timeline template for the rules with the specified IDs. If the same timeline template is already set for a rule, no changes are made.
                summary: Edit - Set (overwrite existing) timeline template for rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_timeline
                    value:
                      timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                      timeline_title: Alerts Involving a Single User Timeline
                  ids:
                  - eacdfc95-e007-41c9-986e-4b2cbdfdc71b
              example20:
                description: The following request sets a schedule for the rules with the specified IDs. If the same schedule is already set for a rule, no changes are made.
                summary: Edit - Set (overwrite existing) schedule for rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_schedule
                    value:
                      interval: 1h
                      lookback: 30m
                  ids:
                  - 99887766-5544-3322-1100-aabbccddeeff
              example21:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules (non-idempotent)
                value:
                  action: edit
                  edit:
                  - type: add_rule_actions
                    value:
                      actions:
                      - group: default
                        id: 20fbf986-a270-460e-80f3-7b83c08b430f
                        params:
                          body: The message body
                  ids:
                  - 9e946bfc-3118-4c77-bb25-67d781191928
              example22:
                description: The following request sets rule actions for the rules with the specified IDs. Each action receives its own unique ID.
                summary: Edit - Set (overwrite existing) rule actions for rules (non-idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_rule_actions
                    value:
                      actions:
                      - group: default
                        id: 20fbf986-a270-460e-80f3-7b83c08b430f
                        params:
                          body: The message body
                  ids:
                  - 9e946bfc-3118-4c77-bb25-67d781191928
              example23:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for a webhook connector
                value:
                  action: edit
                  edit:
                  - type: add_rule_actions
                    value:
                      actions:
                      - group: default3
                        id: 20fbf986-a270-460e-80f3-7b83c08b430f
                        params:
                          body: The message body
                  ids:
                  - 9e946bfc-3118-4c77-bb25-67d781191921
              example24:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for an email connector
                value:
                  action: edit
                  edit:
                  - type: add_rule_actions
                    value:
                      actions:
                      - group: default3
                        id: 20fbf986-a270-460e-80f3-7b83c08b430f
                        params:
                          message: The message body
                          subject: Subject
                          to: address@domain.com
                  ids:
                  - 9e946bfc-3118-4c77-bb25-67d781191921
              example25:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for a slack connector
                value:
                  action: edit
                  edit:
                  - type: add_rule_actions
                    value:
                      actions:
                      - group: default3
                        id: 20fbf986-a270-460e-80f3-7b83c08b430f
                        params:
                          message: The content of the message
                  ids:
                  - 9e946bfc-3118-4c77-bb25-67d781191921
              example26:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for a PagerDuty connector
                value:
                  action: edit
                  edit:
                  - type: add_rule_actions
                    value:
                      actions:
                      - group: default3
                        id: 20fbf986-a270-460e-80f3-7b83c08b430f
                        params:
                          eventAction: trigger
                          severity: critical
                          summary: The message body
                          timestamp: '2023-10-31T00:00:00.000Z'
                  ids:
                  - 9e946bfc-3118-4c77-bb25-67d781191921
              example27:
                description: The following request set alert suppression to the rules with the specified IDs.
                summary: Edit - Set alert suppression to rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_alert_suppression
                    value:
                      duration:
                        unit: h
                        value: 1
                      group_by:
                      - source.ip
                      missing_fields_strategy: suppress
                  ids:
                  - 12345678-1234-1234-1234-1234567890ab
                  - 87654321-4321-4321-4321-0987654321ba
              example28:
                description: The following request set alert suppression to threshold rules with the specified IDs.
                summary: Edit - Set alert suppression to threshold rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: set_alert_suppression_for_threshold
                    value:
                      duration:
                        unit: h
                        value: 1
                  ids:
                  - 12345678-1234-1234-1234-1234567890ab
                  - 87654321-4321-4321-4321-0987654321ba
              example29:
                description: The following request removes alert suppression from the rules with the specified IDs. If the rules do not have alert suppression, no changes are made.
                summary: Edit - Removes alert suppression from rules (idempotent)
                value:
                  action: edit
                  edit:
                  - type: delete_alert_suppression
                  ids:
                  - 12345678-1234-1234-1234-1234567890ab
                  - 87654321-4321-4321-4321-0987654321ba
              example30:
                description: The following request triggers the filling of gaps for the specified rule ids and time range
                summary: Fill Gaps - Manually trigger the filling of gaps for specified rules
                value:
                  action: fill_gaps
                  ids:
                  - 748694f0-6977-4ea5-8384-cd2e39730779
                  - 164d0918-f720-4c9f-9f5c-c5122587cf19
                  run:
                    end_date: '2025-03-10T23:59:59.999Z'
                    start_date: '2025-03-01T00:00:00.000Z'
            schema:
              oneOf:
              - $ref: '#/components/schemas/Security_Detections_API_BulkDeleteRules'
              - $ref: '#/components/schemas/Security_Detections_API_BulkDisableRules'
              - $ref: '#/components/schemas/Security_Detections_API_BulkEnableRules'
              - $ref: '#/components/schemas/Security_Detections_API_BulkExportRules'
              - $ref: '#/components/schemas/Security_Detections_API_BulkDuplicateRules'
              - $ref: '#/components/schemas/Security_Detections_API_BulkManualRuleRun'
              - $ref: '#/components/schemas/Security_Detections_API_BulkManualRuleFillGaps'
              - $ref: '#/components/schemas/Security_Detections_API_BulkEditRules'
      responses:
        '200':
          content:
            application/json:
              examples:
                example01:
                  description: In this response one rule was updated and one was skipped. Objects returned in attributes.results.skipped will only include rules' id, name, and skip_reason.
                  summary: Successful response
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped:
                        - id: 51658332-a15e-4c9e-912a-67214e2e2359
                          name: Skipped rule
                          skip_reason: RULE_NOT_MODIFIED
                        updated:
                        - anomaly_threshold: 50
                          author:
                          - Elastic
                          created_at: '2022-02-21T14:14:13.801Z'
                          created_by: elastic
                          description: A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.
                          enabled: true
                          exceptions_list: []
                          execution_summary:
                            last_execution:
                              date: '2022-03-23T16:06:12.787Z'
                              message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                              metrics:
                                execution_gap_duration_s: 0
                                total_indexing_duration_ms: 15
                                total_search_duration_ms: 135
                              status: partial failure
                              status_order: 20
                          false_positives:
                          - DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded.
                          from: now-45m
                          id: 8bc7dad0-9320-11ec-9265-8b772383a08d
                          immutable: false
                          interval: 15m
                          license: Elastic License v2
                          machine_learning_job_id:
                          - packetbeat_dns_tunneling_ea
                          max_signals: 100
                          name: DNS Tunneling [Duplicate]
                          references:
                          - https://www.elastic.co/docs/reference/machine-learning/ootb-ml-jobs-siem
                          related_integrations: []
                          required_fields: []
                          risk_score: 21
                          risk_score_mapping: []
                          rule_id: 7289bf08-4e91-4c70-bf01-e04c4c5d7756
                          setup: ''
                          severity: low
                          severity_mapping: []
                          tags:
                          - Elastic
                          - Network
                          - Threat Detection
                          - ML
                          threat: []
                          to: now
                          type: machine_learning
                          updated_at: '2022-02-21T17:05:50.883Z'
                          updated_by: elastic
                          version: 6
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 1
                        total: 2
                    rules_count: 1
                    success: true
                example02:
                  description: If processing of any rule fails, a partial error outputs the ID and/or name of the affected rule and the corresponding error, as well as successfully processed rules (in the same format as a successful 200 request).
                  summary: Partial failure
                  value:
                    value:
                      attributes:
                        errors:
                        - message: Index patterns can't be added. Machine learning rule doesn't have index patterns property
                          rules:
                          - id: 8bc7dad0-9320-11ec-9265-8b772383a08d
                            name: DNS Tunneling [Duplicate]
                          status_code: 500
                        results:
                          created: []
                          deleted: []
                          skipped: []
                          updated:
                          - actions: []
                            author:
                            - Elastic
                            created_at: '2022-02-21T14:14:17.883Z'
                            created_by: elastic
                            description: Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.
                            enabled: true
                            exceptions_list: []
                            execution_summary:
                              last_execution:
                                date: '2022-03-23T16:06:12.787Z'
                                message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                                metrics:
                                  execution_gap_duration_s: 0
                                  total_indexing_duration_ms: 15
                                  total_search_duration_ms: 135
                                status: partial failure
                                status_order: 20
                            false_positives: []
                            from: now-6m
                            id: 8e5c1a40-9320-11ec-9265-8b772383a08d
                            immutable: false
                            index:
                            - apm-*-transaction*
                            - traces-apm*
                            - auditbeat-*
                            - filebeat-*
                            - logs-*
                            - packetbeat-*
                            - winlogbeat-*
                            - added-by-id-*
                            interval: 5m
                            language: kuery
                            license: Elastic License v2
                            max_signals: 10000
                            name: External Alerts [Duplicate]
                            query: 'event.kind:alert and not event.module:(endgame or endpoint)

                              '
                            references: []
                            related_integrations: []
                            required_fields: []
                            risk_score: 47
                            risk_score_mapping:
                            - field: event.risk_score
                              operator: equals
                              value: ''
                            rule_id: 941faf98-0cdc-4569-b16d-4af962914d61
                            rule_name_override: message
                            setup: ''
                            severity: medium
                            severity_mapping:
                            - field: event.severity
                              operator: equals
                              severity: low
                              value: '21'
                            - field: event.severity
                              operator: equals
                              severity: medium
                              value: '47'
                            - field: event.severity
                              operator: equals
                              severity: high
                              value: '73'
                            - field: event.severity
                              operator: equals
                              severity: critical
                              value: '99'
                            tags:
                            - Elastic
                            - Network
                            - Windows
                            - APM
                            - macOS
                            - Linux
                            threat: []
                            timestamp_override: event.ingested
                            to: now
                            type: query
                            updated_at: '2022-02-21T16:56:22.818Z'
                            updated_by: elastic
                            version: 5
                        summary:
                          failed: 1
                          skipped: 0
                          succeeded: 1
                          total: 2
                      message: Bulk edit partially failed
                      rules_count: 2
                      status_code: 500
                      success: false
                example03:
                  description: The attributes.errors section of the response shows that two rules failed to update and one succeeded. The same results would be returned if you ran the request without dry run mode enabled. Notice that there are no arrays in attributes.results. In dry run mode, rule updates are not applied and saved to Elasticsearch, so the endpoint wouldn’t return results for rules that have been updated, created, or deleted.
                  summary: Dry run
                  value:
                    attributes:
                      errors:
                      - err_code: IMMUTABLE
                        message: Elastic rule can't be edited
                        rules:
                        - id: 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                          name: Unusual AWS Command for a User
                        status_code: 500
                      - err_code: MACHINE_LEARNING_INDEX_PATTERN
                        message: Machine learning rule doesn't have index patterns
                        rules:
                        - id: dc015d10-0831-11ed-ac8b-05a222bd8d4a
                          name: Suspicious Powershell Script [Duplicate]
                        status_code: 500
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated: []
                      summary:
                        failed: 2
                        skipped: 0
                        succeeded: 1
                        total: 3
                    message: Bulk edit partially failed
                    status_code: 500
                example04:
                  description: This example presents the successful setting of tags for 2 rules. There was a difference between the set of tags that were being added and the tags that were already set in the rules, that's why the rules were updated.
                  summary: Set tags successsully for 2 rules
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated:
                        - actions: []
                          author: []
                          created_at: '2025-03-25T11:46:41.899Z'
                          created_by: elastic
                          description: test
                          enabled: false
                          exceptions_list: []
                          false_positives: []
                          filters: []
                          from: now-6m
                          id: 738112cd-6cfa-414a-8457-2a658845d6ba
                          immutable: false
                          index:
                          - apm-*-transaction*
                          - auditbeat-*
                          - endgame-*
                          - filebeat-*
                          - logs-*
                          - packetbeat-*
                          - traces-apm*
                          - winlogbeat-*
                          - -*elastic-cloud-logs-*
                          interval: 5m
                          language: kuery
                          license: ''
                          max_signals: 100
                          meta:
                            kibana_siem_app_url: http://localhost:5601/kbn/app/security
                          name: Rule 1
                          output_index: ''
                          query: '*'
                          references: []
                          related_integrations: []
                          required_fields: []
                          revision: 1
                          risk_score: 21
                          risk_score_mapping: []
                          rule_id: 6fb746a0-dfe5-40fa-b03f-5cbb84f3e32e
                          rule_source:
                            type: internal
                          setup: ''
                          severity: low
                          severity_mapping: []
                          tags:
                          - tag-1
                          - tag-2
                          threat: []
                          to: now
                          type: query
                          updated_at: '2025-03-25T11:47:11.350Z'
                          updated_by: elastic
                          version: 2
                        - actions:
                          - action_type_id: .webhook
                            frequency:
                              notifyWhen: onActiveAlert
                              summary: true
                              throttle: null
                            group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: Hello
                            uuid: 580e2e16-5e91-411c-999b-7b75a11ed441
                          author: []
                          created_at: '2025-03-25T09:49:08.343Z'
                          created_by: elastic
                          description: test
                          enabled: false
                          exceptions_list: []
                          false_positives: []
                          filters: []
                          from: now-360s
                          id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                          immutable: false
                          index:
                          - apm-*-transaction*
                          - auditbeat-*
                          - endgame-*
                          - filebeat-*
                          - logs-*
                          - packetbeat-*
                          - traces-apm*
                          - winlogbeat-*
                          - -*elastic-cloud-logs-*
                          interval: 3m
                          investigation_fields:
                            field_names:
                            - alert.status
                            - Endpoint.policy.applied.artifacts.global.channel
                          language: kuery
                          license: ''
                          max_signals: 100
                          meta:
                            from: 3m
                            kibana_siem_app_url: http://localhost:5601/kbn/app/security
                          name: Rule 2
                          output_index: ''
                          query: '*'
                          references: []
                          related_integrations: []
                          required_fields: []
                          revision: 33
                          risk_score: 21
                          risk_score_mapping: []
                          rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                          rule_source:
                            type: internal
                          setup: ''
                          severity: low
                          severity_mapping: []
                          tags:
                          - tag-1
                          - tag-2
                          threat: []
                          timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                          timeline_title: Alerts Involving a Single User Timeline
                          to: now
                          type: query
                          updated_at: '2025-03-25T11:47:11.357Z'
                          updated_by: elastic
                          version: 24
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 2
                        total: 2
                    rules_count: 2
                    success: true
                example05:
                  description: This example presents the idempotent behavior of the edit action with set_tags request. Both rules already had exactly the same tags that were being added, so no changes were made in any of them.
                  summary: Idempotent behavior of set_tags
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped:
                        - id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                          name: Rule 1
                          skip_reason: RULE_NOT_MODIFIED
                        - id: 738112cd-6cfa-414a-8457-2a658845d6ba
                          name: Rule 2
                          skip_reason: RULE_NOT_MODIFIED
                        updated: []
                      summary:
                        failed: 0
                        skipped: 2
                        succeeded: 0
                        total: 2
                    rules_count: 2
                    success: true
                example06:
                  description: This example presents the idempotent behavior of the edit action with add_tags request. One rule was updated and one was skipped. The rule that was skipped already had all the tags that were being added.
                  summary: Idempotent behavior of add_tags
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped:
                        - id: 738112cd-6cfa-414a-8457-2a658845d6ba
                          name: Test Rule 2
                          skip_reason: RULE_NOT_MODIFIED
                        updated:
                        - actions:
                          - action_type_id: .webhook
                            frequency:
                              notifyWhen: onActiveAlert
                              summary: true
                              throttle: null
                            group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: Hello
                            uuid: 580e2e16-5e91-411c-999b-7b75a11ed441
                          author: []
                          created_at: '2025-03-25T09:49:08.343Z'
                          created_by: elastic
                          description: test
                          enabled: false
                          exceptions_list: []
                          false_positives: []
                          filters: []
                          from: now-360s
                          id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                          immutable: false
                          index:
                          - apm-*-transaction*
                          - auditbeat-*
                          - endgame-*
                          - filebeat-*
                          - logs-*
                          - packetbeat-*
                          - traces-apm*
                          - winlogbeat-*
                          - -*elastic-cloud-logs-*
                          interval: 3m
                          investigation_fields:
                            field_names:
                            - alert.status
                            - Endpoint.policy.applied.artifacts.global.channel
                          language: kuery
                          license: ''
                          max_signals: 100
                          meta:
                            from: 3m
                            kibana_siem_app_url: http://localhost:5601/kbn/app/security
                          name: Test rule
                          output_index: ''
                          query: '*'
                          references: []
                          related_integrations: []
                          required_fields: []
                          revision: 34
                          risk_score: 21
                          risk_score_mapping: []
                          rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                          rule_source:
                            type: internal
                          setup: ''
                          severity: low
                          severity_mapping: []
                          tags:
                          - tag-1
                          - tag-2
                          - tag-4
                          threat: []
                          timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                          timeline_title: Alerts Involving a Single User Timeline
                          to: now
                          type: query
                          updated_at: '2025-03-25T11:55:12.752Z'
                          updated_by: elastic
                          version: 25
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 1
                        total: 2
                    rules_count: 2
                    success: true
                example07:
                  description: This example shows a non-idempotent nature of the set_rule_actions requests. Regardless if the actions are the same as the existing actions for a rule, the actions are always set in the rule and receive a new unique ID.
                  summary: Non-idempotent behavior for set_rule_actions
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated:
                        - actions:
                          - action_type_id: .webhook
                            frequency:
                              notifyWhen: onActiveAlert
                              summary: true
                              throttle: null
                            group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: Hello
                            uuid: e48428e5-efac-4856-b8ad-b271c14eaa91
                          author: []
                          created_at: '2025-03-25T09:49:08.343Z'
                          created_by: elastic
                          description: test
                          enabled: false
                          exceptions_list: []
                          false_positives: []
                          filters: []
                          from: now-360s
                          id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                          immutable: false
                          index:
                          - apm-*-transaction*
                          - auditbeat-*
                          - endgame-*
                          - filebeat-*
                          - logs-*
                          - packetbeat-*
                          - traces-apm*
                          - winlogbeat-*
                          - -*elastic-cloud-logs-*
                          interval: 3m
                          investigation_fields:
                            field_names:
                            - alert.status
                            - Endpoint.policy.applied.artifacts.global.channel
                          language: kuery
                          license: ''
                          max_signals: 100
                          meta:
                            from: 3m
                            kibana_siem_app_url: http://localhost:5601/kbn/app/security
                          name: Test rule
                          output_index: ''
                          query: '*'
                          references: []
                          related_integrations: []
                          required_fields: []
                          revision: 39
                          risk_score: 21
                          risk_score_mapping: []
                          rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                          rule_source:
                            type: internal
                          setup: ''
                          severity: low
                          severity_mapping: []
                          tags:
                          - tag-1
                          - tag-2
                          - tag-4
                          threat: []
                          timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                          timeline_title: Alerts Involving a Single User Timeline
                          to: now
                          type: query
                          updated_at: '2025-03-25T12:17:40.528Z'
                          updated_by: elastic
                          version: 30
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 1
                        total: 1
                    rules_count: 1
                    success: true
                example08:
                  description: This example shows a non-idempotent nature of the add_rule_actions requests. Regardless if the added action is the same as another existing action for a rule, the new action is added to the rule and receives a new unique ID.
                  summary: Non-idempotent behavior for add_rule_actions
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated:
                        - actions:
                          - action_type_id: .webhook
                            frequency:
                              notifyWhen: onActiveAlert
                              summary: true
                              throttle: null
                            group: default
                            id: 76af173d-38d8-4a9a-b2cc-a3c695b845b4
                            params:
                              body: Message body
                            uuid: 0309347e-3954-429c-9168-5da2663389af
                          - action_type_id: .webhook
                            frequency:
                              notifyWhen: onActiveAlert
                              summary: true
                              throttle: null
                            group: default
                            id: 76af173d-38d8-4a9a-b2cc-a3c695b845b4
                            params:
                              body: Message body
                            uuid: 49ddaa94-d63d-410e-90dc-8c1bad9552bd
                          author: []
                          created_at: '2025-04-02T12:42:03.400Z'
                          created_by: elastic
                          description: test
                          enabled: false
                          exceptions_list: []
                          false_positives: []
                          filters: []
                          from: now-6m
                          id: 0d3eb0cd-88c4-4651-ac87-6d9f0cb87217
                          immutable: false
                          index:
                          - apm-*-transaction*
                          - auditbeat-*
                          - endgame-*
                          - filebeat-*
                          - logs-*
                          - packetbeat-*
                          - traces-apm*
                          - winlogbeat-*
                          - -*elastic-cloud-logs-*
                          interval: 5m
                          language: kuery
                          license: ''
                          max_signals: 100
                          meta:
                            kibana_siem_app_url: http://localhost:5601/kbn/app/security
                          name: Jacek test rule
                          output_index: ''
                          query: '*'
                          references: []
                          related_integrations: []
                          required_fields: []
                          revision: 2
                          risk_score: 21
                          risk_score_mapping: []
                          rule_id: 2684c020-1370-4719-ac27-eafe6428fe10
                          rule_source:
                            type: internal
                          setup: ''
                          severity: low
                          severity_mapping: []
                          tags: []
                          threat: []
                          to: now
                          type: query
                          updated_at: '2025-04-02T12:51:40.215Z'
                          updated_by: elastic
                          version: 2
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 1
                        total: 1
                    rules_count: 1
                    success: true
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_BulkEditActionResponse'
                - $ref: '#/components/schemas/Security_Detections_API_BulkExportActionResponse'
          description: OK
      summary: Apply a bulk action to detection rules
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/_export:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_export</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Export detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:

        - Actions

        - Exception lists

        > info

        > Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.


        > You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportsavedobjectsdefault) and [import](https://www.elastic.co/docs/api/doc/kibana/operation/operation-importsavedobjectsdefault) any necessary connectors before importing detection rules.


        > Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.

        '
      operationId: ExportRules
      parameters:
      - description: Determines whether a summary of the exported rules is returned.
        in: query
        name: exclude_export_details
        required: false
        schema:
          default: false
          type: boolean
      - description: 'File name for saving the exported rules.

          > info

          > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.

          '
        in: query
        name: file_name
        required: false
        schema:
          default: export.ndjson
          type: string
      requestBody:
        content:
          application/json:
            examples:
              exportByRuleIds:
                summary: Request body to export a subset of rules
                value:
                  objects:
                  - rule_id: 343580b5-c811-447c-8d2d-2ccf052c6900
                  - rule_id: 2938c9fa-53eb-4c04-b79c-33cbf041b18d
            schema:
              nullable: true
              type: object
              properties:
                objects:
                  description: Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified.
                  items:
                    type: object
                    properties:
                      rule_id:
                        $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
                    required:
                    - rule_id
                  type: array
              required:
              - objects
        required: false
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                sampleNdjson:
                  value: '{"rule_id":"343580b5-c811-447c-8d2d-2ccf052c6900","name":"Example rule","type":"query","enabled":true}

                    {"exception_list":true}

                    {"export_summary":{"total_rules":1,"exceptions_count":0}}

                    '
              schema:
                description: 'An `.ndjson` file containing the returned rules.


                  Each line in the file represents an object (a rule, exception list parent container, or exception list item), and the last line includes a summary of what was exported.

                  '
                format: binary
                type: string
          description: Indicates a successful call.
      summary: Export detection rules
      tags:
      - Security Detections API
      x-codeSamples:
      - lang: cURL
        source: "curl -X POST \"localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson\" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'\n{\n  \"objects\": [\n    {\n      \"rule_id\":\"343580b5-c811-447c-8d2d-2ccf052c6900\"\n    },\n    {\n      \"rule_id\":\"2938c9fa-53eb-4c04-b79c-33cbf041b18d\"\n    }\n  ]\n}\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.'
      operationId: FindRules
      parameters:
      - description: 'List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).

          If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or

          use comma-separated values when supported by your client.

          '
        in: query
        name: fields
        required: false
        schema:
          items:
            type: string
          type: array
      - description: 'Search query


          Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:

          - name

          - enabled

          - tags

          - createdBy

          - interval

          - updatedBy

          > info

          > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

          '
        in: query
        name: filter
        required: false
        schema:
          type: string
      - description: Field to sort by
        in: query
        name: sort_field
        required: false
        schema:
          $ref: '#/components/schemas/Security_Detections_API_FindRulesSortField'
      - description: Sort order
        in: query
        name: sort_order
        required: false
        schema:
          $ref: '#/components/schemas/Security_Detections_API_SortOrder'
      - description: Page number
        in: query
        name: page
        required: false
        schema:
          default: 1
          minimum: 1
          type: integer
      - description: Rules per page
        in: query
        name: per_page
        required: false
        schema:
          default: 20
          minimum: 0
          type: integer
      - description: Gaps range start
        in: query
        name: gaps_range_start
        required: false
        schema:
          type: string
      - description: Gaps range end
        in: query
        name: gaps_range_end
        required: false
        schema:
          type: string
      - description: Gap fill statuses
        in: query
        name: gap_fill_statuses
        required: false
        schema:
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
      - description: Gap auto fill scheduler ID used to determine gap fill status for rules
        in: query
        name: gap_auto_fill_scheduler_id
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    data:
                    - created_at: '2020-02-02T10:05:19.613Z'
                      created_by: elastic
                      description: Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.
                      enabled: false
                      execution_summary:
                        last_execution:
                          date: '2022-03-23T16:06:12.787Z'
                          message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                          metrics:
                            execution_gap_duration_s: 0
                            total_indexing_duration_ms: 15
                            total_search_duration_ms: 135
                          status: partial failure
                          status_order: 20
                      false_positives: []
                      from: now-6m
                      id: 89761517-fdb0-4223-b67b-7621acc48f9e
                      immutable: true
                      index:
                      - winlogbeat-*
                      interval: 5m
                      language: kuery
                      max_signals: 33
                      name: Windows Script Executing PowerShell
                      query: 'event.action:"Process Create (rule: ProcessCreate)" and process.parent.name:("wscript.exe" or "cscript.exe") and process.name:"powershell.exe"'
                      references: []
                      related_integrations:
                      - package: o365
                        version: ^2.3.2
                      required_fields:
                      - ecs: true
                        name: event.action
                        type: keyword
                      - ecs: true
                        name: process.name
                        type: keyword
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                      risk_score: 21
                      rule_id: f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc
                      setup: ''
                      severity: low
                      tags:
                      - Elastic
                      - Windows
                      threat:
                      - framework: MITRE ATT&CK
                        tactic:
                          id: TA0002
                          name: Execution
                          reference: https://attack.mitre.org/tactics/TA0002/
                        technique:
                        - id: T1193
                          name: Spearphishing Attachment
                          reference: https://attack.mitre.org/techniques/T1193/
                      to: now
                      type: query
                      updated_at: '2020-02-02T10:05:19.830Z'
                      updated_by: elastic
                    page: 1
                    perPage: 5
                    total: 4
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
                    type: array
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  warnings:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_WarningSchema'
                    type: array
                required:
                - page
                - perPage
                - total
                - data
          description: 'Successful response

            > info

            > These fields are under development and their usage or schema may change: execution_summary.

            '
      summary: List all detection rules
      tags:
      - Security Detections API
      x-codeSamples:
      - lang: cURL
        source: 'curl -X GET "localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows" -H ''kbn-xsrf: true''

          '
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/_import:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_import</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Import detection rules from an `.ndjson` file, including actions and exception lists. The request must include:

        - The `Content-Type: multipart/form-data` HTTP header.

        - A link to the `.ndjson` file containing the rules.

        > warn

        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user''s key gets assigned to the affected rules. If the user''s key gets deleted or the user becomes inactive, the rules will stop running.


        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

        > info

        > To import rules with actions, you need at least Read privileges for the Action and Connectors feature. To overwrite or add new connectors, you need All privileges for the Actions and Connectors feature. To import rules without actions, you don’t need Actions and Connectors privileges. Refer to [Enable and access detections](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges) for more information.


        > info

        > Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.


        > You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportsavedobjectsdefault) and [import](https://www.elastic.co/docs/api/doc/kibana/operation/operation-importsavedobjectsdefault) any necessary connectors before importing detection rules.


        > Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.

        '
      operationId: ImportRules
      parameters:
      - description: Determines whether existing rules with the same `rule_id` are overwritten.
        in: query
        name: overwrite
        required: false
        schema:
          default: false
          type: boolean
      - description: Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.
        in: query
        name: overwrite_exceptions
        required: false
        schema:
          default: false
          type: boolean
      - description: Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.
        in: query
        name: overwrite_action_connectors
        required: false
        schema:
          default: false
          type: boolean
      - description: Generates a new list ID for each imported exception list.
        in: query
        name: as_new_list
        required: false
        schema:
          default: false
          type: boolean
      requestBody:
        content:
          multipart/form-data:
            examples:
              rulesFile:
                summary: Multipart part containing a rule export
                value:
                  file: rules_import.ndjson
            schema:
              type: object
              properties:
                file:
                  description: The `.ndjson` file containing the rules.
                  format: binary
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Import rules with success
                  value:
                    errors: []
                    exceptions_errors: []
                    exceptions_success: true
                    exceptions_success_count: 0
                    rules_count: 1
                    success: true
                    success_count: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  action_connectors_errors:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                    type: array
                  action_connectors_success:
                    type: boolean
                  action_connectors_success_count:
                    minimum: 0
                    type: integer
                  action_connectors_warnings:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_WarningSchema'
                    type: array
                  errors:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                    type: array
                  exceptions_errors:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                    type: array
                  exceptions_success:
                    type: boolean
                  exceptions_success_count:
                    minimum: 0
                    type: integer
                  rules_count:
                    minimum: 0
                    type: integer
                  success:
                    type: boolean
                  success_count:
                    minimum: 0
                    type: integer
                required:
                - exceptions_success
                - exceptions_success_count
                - exceptions_errors
                - rules_count
                - success
                - success_count
                - errors
                - action_connectors_errors
                - action_connectors_warnings
                - action_connectors_success
                - action_connectors_success_count
          description: Indicates a successful call.
      summary: Import detection rules
      tags:
      - Security Detections API
      x-codeSamples:
      - lang: cURL
        source: 'curl -X POST "<KibanaURL>/api/detection_engine/rules/_import"

          -u <username>:<password> -H ''kbn-xsrf: true''

          -H ''Content-Type: multipart/form-data''

          --form "file=@<link to file>"

          '
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/prepackaged:
    put:
      description: "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb put\">put</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/prepackaged</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall and update all Elastic prebuilt detection rules and Timelines.\n\nThis endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. \nWhen you call this endpoint, it will:\n- Install any new prebuilt detection rules that are not currently installed in your system.\n- Update any existing prebuilt detection rules that have been modified or improved by Elastic.\n- Install any new prebuilt Timelines that are not currently installed in your system.\n- Update any existing prebuilt Timelines that have been modified or improved by Elastic.\n\nThis ensures that your detection engine is always up-to-date with the latest rules and Timelines, \nproviding you with the most current and effective threat detection capabilities.\n"
      operationId: InstallPrebuiltRulesAndTimelines
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    rules_installed: 112
                    rules_updated: 0
                    timelines_installed: 5
                    timelines_updated: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  rules_installed:
                    description: The number of rules installed
                    minimum: 0
                    type: integer
                  rules_updated:
                    description: The number of rules updated
                    minimum: 0
                    type: integer
                  timelines_installed:
                    description: The number of timelines installed
                    minimum: 0
                    type: integer
                  timelines_updated:
                    description: The number of timelines updated
                    minimum: 0
                    type: integer
                required:
                - rules_installed
                - rules_updated
                - timelines_installed
                - timelines_updated
          description: Indicates a successful call
      summary: Install prebuilt detection rules and Timelines
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/prepackaged/_status:
    get:
      description: "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/detection_engine/rules/prepackaged/_status</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve the status of all Elastic prebuilt detection rules and Timelines. \n\nThis endpoint provides detailed information about the number of custom rules, installed prebuilt rules, available prebuilt rules that are not installed, outdated prebuilt rules, installed prebuilt timelines, available prebuilt timelines that are not installed, and outdated prebuilt timelines.\n"
      operationId: ReadPrebuiltRulesAndTimelinesStatus
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    rules_custom_installed: 0
                    rules_installed: 0
                    rules_not_installed: 112
                    rules_not_updated: 0
                    timelines_installed: 0
                    timelines_not_installed: 0
                    timelines_not_updated: 0
              schema:
                additionalProperties: false
                type: object
                properties:
                  rules_custom_installed:
                    description: The total number of custom rules
                    minimum: 0
                    type: integer
                  rules_installed:
                    description: The total number of installed prebuilt rules
                    minimum: 0
                    type: integer
                  rules_not_installed:
                    description: The total number of available prebuilt rules that are not installed
                    minimum: 0
                    type: integer
                  rules_not_updated:
                    description: The total number of outdated prebuilt rules
                    minimum: 0
                    type: integer
                  timelines_installed:
                    description: The total number of installed prebuilt timelines
                    minimum: 0
                    type: integer
                  timelines_not_installed:
                    description: The total number of available prebuilt timelines that are not installed
                    minimum: 0
                    type: integer
                  timelines_not_updated:
                    description: The total number of outdated prebuilt timelines
                    minimum: 0
                    type: integer
                required:
                - rules_custom_installed
                - rules_installed
                - rules_not_installed
                - rules_not_updated
                - timelines_installed
                - timelines_not_installed
                - timelines_not_updated
          description: Indicates a successful call
      summary: Retrieve the status of prebuilt detection rules and Timelines
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/rules/preview:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/preview</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short

        time window, without persisting a rule or writing alerts. Use the response to validate queries, see sample

        matching documents, and inspect execution logs. Pair `invocationCount` and `timeframeEnd` to cap run time.

        '
      operationId: RulePreview
      parameters:
      - description: Enables logging and returning in response ES queries, performed during rule execution
        in: query
        name: enable_logged_requests
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            examples:
              queryRule:
                value:
                  description: Find matching events
                  from: now-24h
                  index:
                  - logs-*
                  invocationCount: 1
                  language: kuery
                  max_signals: 20
                  name: Rule preview
                  query: 'process.name : *'
                  risk_score: 25
                  severity: low
                  timeframeEnd: '2025-01-20T12:00:00.000Z'
                  to: now
                  type: query
            schema:
              anyOf:
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              - allOf:
                - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
                - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              discriminator:
                propertyName: type
        description: 'Rule create payload (same shape as `POST /api/detection_engine/rules` for a given `type`) plus

          `invocationCount` and `timeframeEnd` to control how the preview is executed. Optional

          `enable_logged_requests` surfaces Elasticsearch request logging for debugging.

          '
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    isAborted: false
                    logs:
                    - duration: 45
                      errors: []
                      requests: []
                      startedAt: '2025-01-20T10:00:00.000Z'
                      warnings: []
                    previewId: 7f1c9d1e-4c8a-4a3e-9a5d-0d4f6e1b2a90
              schema:
                type: object
                properties:
                  isAborted:
                    type: boolean
                  logs:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_RulePreviewLogs'
                    type: array
                  previewId:
                    $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
                required:
                - logs
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].timeframeEnd: expected string, received null'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Preview rule alerts generated on specified time range
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/assignees:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/assignees</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Assign users to detection alerts, and unassign them from alerts.

        > info

        > You cannot add and remove the same assignee in the same request.

        '
      operationId: SetAlertAssignees
      requestBody:
        content:
          application/json:
            examples:
              add:
                $ref: '#/components/examples/Security_Detections_API_SetAlertAssigneesBodyAdd'
              remove:
                $ref: '#/components/examples/Security_Detections_API_SetAlertAssigneesBodyRemove'
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAlertAssigneesBody'
        description: User profile IDs to add or remove on each listed alert document ID.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                add:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 76
                    total: 1
                    updated: 1
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: 'Indicates a successful call. The body matches an Elasticsearch update-by-query response

            (for example `took`, `updated`, `failures`).

            '
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one alert id is required to update assignees'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Assign and unassign users from detection alerts
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/finalize_migration:
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/finalize_migration</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **DEPRECATED.** Completes a legacy alert index migration. Do not automate against this in new code.

        **WARNING:** Finalizing swaps read aliases; confirm the migration has finished successfully before calling.


        Finalize successful migrations of detection alerts. This replaces the original index''s alias with the

        successfully migrated index''s alias. The endpoint is idempotent, so you can poll until a migration

        finishes and then call this operation once.

        '
      operationId: FinalizeAlertsMigration
      requestBody:
        content:
          application/json:
            examples:
              oneMigration:
                value:
                  migration_ids:
                  - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
            schema:
              example:
                migration_ids:
                - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
              type: object
              properties:
                migration_ids:
                  description: Array of `migration_id`s to finalize.
                  items:
                    type: string
                  minItems: 1
                  type: array
              required:
              - migration_ids
        description: Array of `migration_id`s to finalize
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    migrations:
                    - completed: true
                      destinationIndex: .siem-signals-default-000002-r000016
                      id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                      sourceIndex: .siem-signals-default-000002
                      status: success
                      updated: '2021-01-06T22:05:56.859Z'
                      version: 16
              schema:
                items:
                  $ref: '#/components/schemas/Security_Detections_API_MigrationFinalizationResult'
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].migration_ids: at least one migration id is required to finalize'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Finalize detection alert migrations
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/migration:
    delete:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **DEPRECATED.** Cleanup API for old migration artifacts. Do not add new call sites.

        **WARNING:** This schedules deletions; ensure no production reads still point at the source index.


        Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of

        the migration process. A successful migration can leave both the old and new indices present, so the old

        index may be deleted. While you can delete these indices manually, the endpoint applies a deletion policy

        to the relevant index, causing it to be deleted after 30 days, and removes other migration-specific artifacts.

        '
      operationId: AlertsMigrationCleanup
      requestBody:
        content:
          application/json:
            examples:
              cleanupMigrations:
                value:
                  migration_ids:
                  - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
            schema:
              example:
                migration_ids:
                - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
              type: object
              properties:
                migration_ids:
                  description: Array of `migration_id`s to cleanup.
                  items:
                    type: string
                  minItems: 1
                  type: array
              required:
              - migration_ids
        description: Array of `migration_id`s to cleanup
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    migrations:
                    - destinationIndex: .siem-signals-default-000002-r000016
                      id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                      sourceIndex: .siem-signals-default-000002
                      status: success
                      updated: '2021-01-06T22:05:56.859Z'
                      version: 16
              schema:
                items:
                  $ref: '#/components/schemas/Security_Detections_API_MigrationCleanupResult'
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].migration_ids: at least one migration id is required to run cleanup'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Clean up detection alert migrations
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **DEPRECATED.** Legacy API for on-demand reindexing of old `.siem-signals-*` alert indices. Do not build new

        integrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead.

        **WARNING:** Migrations can be resource intensive and should be planned during a maintenance window.


        Initiate a migration of detection alerts. Migrations are initiated per index. The process is not destructive

        and should not remove existing data, but it can consume significant cluster resources. Plan capacity accordingly.

        '
      operationId: CreateAlertsMigration
      requestBody:
        content:
          application/json:
            examples:
              singleIndex:
                value:
                  index:
                  - .siem-signals-default-000001
            schema:
              allOf:
              - type: object
                properties:
                  index:
                    description: Array of index names to migrate.
                    items:
                      format: nonempty
                      minLength: 1
                      type: string
                    minItems: 1
                    type: array
                required:
                - index
              - $ref: '#/components/schemas/Security_Detections_API_AlertsReindexOptions'
        description: Alerts migration parameters
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    indices:
                    - index: .siem-signals-default-000001,
                      migration_id: 923f7c50-505f-11eb-ae0a-3fa2e626a51d
                      migration_index: .siem-signals-default-000001-r000016
              schema:
                type: object
                properties:
                  indices:
                    items:
                      oneOf:
                      - $ref: '#/components/schemas/Security_Detections_API_AlertsIndexMigrationSuccess'
                      - $ref: '#/components/schemas/Security_Detections_API_AlertsIndexMigrationError'
                      - $ref: '#/components/schemas/Security_Detections_API_SkippedAlertsIndexMigration'
                    type: array
                required:
                - indices
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].index: at least one index name is required to start a migration'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Initiate a detection alert migration
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/migration_status:
    get:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration_status</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **DEPRECATED.** This endpoint was used for historical `.siem-signals-*` index migration workflows. Do not use

        for new automations; there is no supported replacement in this public API.

        **WARNING:** Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations.


        Retrieves indices that contain detection alerts of a particular age, along with migration information for

        each of those indices.

        '
      operationId: ReadAlertsMigrationStatus
      parameters:
      - description: Maximum age of qualifying detection alerts
        in: query
        name: from
        required: true
        schema:
          description: 'Time from which data is analyzed. For example, now-4200s means the rule analyzes data from 70 minutes

            before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).

            '
          example: now-30d
          format: date-math
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    indices:
                    - index: .siem-signals-default-000002
                      is_outdated: true
                      migrations:
                      - id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                        status: pending
                        updated: '2021-01-06T20:41:37.173Z'
                        version: 16
                      signal_versions:
                      - count: 100
                        version: 15
                      - count: 87
                        version: 16
                      version: 15
                    - index: .siem-signals-default-000003
                      is_outdated: false
                      migrations: []
                      signal_versions:
                      - count: 54
                        version: 16
                      version: 16
              schema:
                type: object
                properties:
                  indices:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_IndexMigrationStatus'
                    type: array
                required:
                - indices
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query].from: expected date-math, received null'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Retrieve the status of detection alert migrations
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/search:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/search</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Find and/or aggregate detection alerts that match the given query.'
      operationId: SearchAlerts
      requestBody:
        content:
          application/json:
            examples:
              query:
                value:
                  aggs:
                    alertsByGrouping:
                      terms:
                        field: host.name
                        size: 10
                    missingFields:
                      missing:
                        field: host.name
                  query:
                    bool:
                      filter:
                      - bool:
                          filter:
                          - match_phrase:
                              kibana.alert.workflow_status: open
                          must: []
                          must_not:
                          - exists:
                              field: kibana.alert.building_block_type
                          should: []
                      - range:
                          '@timestamp':
                            gte: '2025-01-17T08:00:00.000Z'
                            lte: '2025-01-18T07:59:59.999Z'
                  runtime_mappings: {}
                  size: 0
            schema:
              $ref: '#/components/schemas/Security_Detections_API_QueryAlertsBodyParams'
              description: Elasticsearch query and aggregation request
        description: Search and/or aggregation query
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    _shards:
                      failed: 0
                      skipped: 0
                      successful: 1
                      total: 1
                    aggregations:
                      alertsByGrouping:
                        buckets:
                        - doc_count: 5
                          key: Host-f43kkddfyc
                        doc_count_error_upper_bound: 0
                        sum_other_doc_count: 0
                      missingFields:
                        doc_count: 0
                    hits:
                      hits: []
                      max_score: null
                      total:
                        relation: eq
                        value: 5
                    timed_out: false
                    took: 0
              schema:
                additionalProperties: true
                description: Elasticsearch search response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Failed to parse search request: unknown query clause in bool filter'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Find and/or aggregate detection alerts
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/status:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/status</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Set the status of one or more detection alerts.'
      operationId: SetAlertsStatus
      requestBody:
        content:
          application/json:
            examples:
              byId:
                value:
                  signal_ids:
                  - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: closed
              byQuery:
                value:
                  conflicts: proceed
                  query:
                    bool:
                      filter:
                      - '@timestamp':
                          format: strict_date_optional_time
                          gte: '2024-10-23T07:00:00.000Z'
                          lte: '2025-01-21T20:12:11.704Z'
                        range: null
                      - bool:
                          filter:
                            bool:
                              filter:
                              - match_phrase:
                                  kibana.alert.workflow_status: open
                              - '@timestamp':
                                  format: strict_date_optional_time
                                  gte: '2024-10-23T07:00:00.000Z'
                                  lte: '2025-01-21T20:12:11.704Z'
                                range: null
                              must: []
                              must_not:
                              - exists:
                                  field: kibana.alert.building_block_type
                              should: []
                      must: []
                      must_not: []
                      should: []
                  status: closed
            schema:
              oneOf:
              - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByIds'
              - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByQuery'
        description: An object containing desired status and explicit alert ids or a query to select alerts
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                byId:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 81
                    total: 1
                    updated: 1
                    version_conflicts: 0
                byQuery:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 100
                    total: 17
                    updated: 17
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].signal_ids: at least one alert id is required to update status'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Set a detection alert status
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/signals/tags:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/tags</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Add tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request.

        > info

        > You cannot add and remove the same alert tag in the same request.

        '
      operationId: SetAlertTags
      requestBody:
        content:
          application/json:
            examples:
              add:
                $ref: '#/components/examples/Security_Detections_API_SetAlertTagsBodyAdd'
              remove:
                $ref: '#/components/examples/Security_Detections_API_SetAlertTagsBodyRemove'
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAlertTagsBody'
        description: An object containing tags to add or remove and alert ids the changes will be applied
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    batches: 1,
                    deleted: 0,
                    failures: []
                    noops: 0,
                    requests_per_second: -1,
                    retries:
                      bulk: 0,
                      search: 0
                    throttled_millis: 0,
                    throttled_until_millis: 0,
                    timed_out: false,
                    took: 68,
                    total: 1,
                    updated: 1,
                    version_conflicts: 0,
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].tags: cannot add and remove the same tag in a single request'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Add and remove detection alert tags
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/detection_engine/tags:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/tags</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        List all unique tags from all detection rules.'
      operationId: ReadTags
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                  - zeek
                  - suricata
                  - windows
                  - linux
                  - network
                  - initial access
                  - remote access
                  - phishing
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          description: Indicates a successful call
      summary: List all detection rule tags
      tags:
      - Security Detections API
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Detections_API_CloseAlertsByIds:
      type: object
      properties:
        reason:
          $ref: '#/components/schemas/Security_Detections_API_Reason'
        signal_ids:
          description: 'List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.'
          items:
            format: nonempty
            minLength: 1
            type: string
          minItems: 1
          type: array
        status:
          enum:
          - closed
          type: string
      required:
      - signal_ids
      - status
    Security_Detections_API_ThresholdField:
      description: The field on which the threshold is applied. If you specify an empty array ([]), alerts are generated when the query returns at least the number of results specified in the value field.
      oneOf:
      - type: string
      - items:
          type: string
        maxItems: 5
        minItems: 0
        type: array
    Security_Detections_API_SavedObjectResolveOutcome:
      enum:
      - exactMatch
      - aliasMatch
      - conflict
      type: string
    Security_Detections_API_NewTermsRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ProcessesParams:
      type: object
      properties:
        command:
          description: 'To run an endpoint response action, specify a value for the command field. Example: "command": "isolate"'
          enum:
          - kill-process
          - suspend-process
          type: string
        comment:
          description: 'Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: "comment": "Check processes"'
          type: string
        config:
          type: object
          properties:
            field:
              description: Field to use instead of process.pid
              type: string
            overwrite:
              default: true
              description: Whether to overwrite field with process.pid
              type: boolean
          required:
          - field
      required:
      - command
      - config
    Security_Detections_API_EcsMapping:
      additionalProperties:
        type: object
        properties:
          field:
            type: string
          value:
            oneOf:
            - type: string
            - items:
                type: string
              type: array
      description: 'Map Osquery results columns or static values to Elastic Common Schema (ECS) fields. Example: "ecs_mapping": {"process.pid": {"field": "pid"}}'
      type: object
    Security_Detections_API_ThresholdRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
      - type: object
        properties:
          language:
            $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
        required:
        - language
    Security_Detections_API_RuleDetailsInError:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
      required:
      - id
    Security_Detections_API_ThreatTactic:
      description: 'Object containing information on the attack type

        '
      type: object
      properties:
        id:
          description: Tactic ID
          type: string
        name:
          description: Tactic name
          type: string
        reference:
          description: Tactic reference
          type: string
      required:
      - id
      - name
      - reference
    Security_Detections_API_RuleFilterArray:
      description: 'The query and filter context array used to define the conditions for when alerts are created from events. Defaults to an empty array.

        > info

        > This field is not supported for ES|QL rules.

        '
      items: {}
      type: array
    Security_Detections_API_AlertsIndex:
      deprecated: true
      description: (deprecated) Has no effect.
      type: string
    Security_Detections_API_QueryRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
    Security_Detections_API_NewTermsRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields'
    Security_Detections_API_OsqueryQuery:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Detections_API_EcsMapping'
        id:
          description: Query ID
          type: string
        platform:
          type: string
        query:
          description: Query to run
          type: string
        removed:
          type: boolean
        snapshot:
          type: boolean
        version:
          description: Query version
          type: string
      required:
      - id
      - query
    Security_Detections_API_QueryAlertsBodyParams:
      type: object
      properties:
        _source:
          oneOf:
          - type: boolean
          - type: string
          - items:
              type: string
            type: array
        aggs:
          additionalProperties: true
          type: object
        fields:
          items:
            type: string
          type: array
        query:
          additionalProperties: true
          type: object
        runtime_mappings:
          additionalProperties: true
          type: object
        size:
          minimum: 0
          type: integer
        sort:
          $ref: '#/components/schemas/Security_Detections_API_AlertsSort'
        track_total_hits:
          type: boolean
    Security_Detections_API_ResponseAction:
      discriminator:
        mapping:
          .endpoint: '#/components/schemas/Security_Detections_API_EndpointResponseAction'
          .osquery: '#/components/schemas/Security_Detections_API_OsqueryResponseAction'
        propertyName: action_type_id
      oneOf:
      - $ref: '#/components/schemas/Security_Detections_API_OsqueryResponseAction'
      - $ref: '#/components/schemas/Security_Detections_API_EndpointResponseAction'
    Security_Detections_API_ThreatMatchRuleRequiredFields:
      type: object
      properties:
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        threat_index:
          $ref: '#/components/schemas/Security_Detections_API_ThreatIndex'
        threat_mapping:
          $ref: '#/components/schemas/Security_Detections_API_ThreatMapping'
        threat_query:
          $ref: '#/components/schemas/Security_Detections_API_ThreatQuery'
        type:
          description: Rule type
          enum:
          - threat_match
          type: string
      required:
      - type
      - query
      - threat_query
      - threat_mapping
      - threat_index
    Security_Detections_API_RuleExecutionStatus:
      description: 'Custom execution status of Security rules that is different from the status used in the Alerting Framework. We merge our custom status with the Framework''s status to determine the resulting status of a rule.

        - going to run - @deprecated Replaced by the ''running'' status but left for backwards compatibility with rule execution events already written to Event Log in the prior versions of Kibana. Don''t use when writing rule status changes.

        - running - Rule execution started but not reached any intermediate or final status.

        - partial failure - Rule can partially fail for various reasons either in the middle of an execution (in this case we update its status right away) or in the end of it. So currently this status can be both intermediate and final at the same time. A typical reason for a partial failure: not all the indices that the rule searches over actually exist.

        - failed - Rule failed to execute due to unhandled exception or a reason defined in the business logic of its executor function.

        - succeeded - Rule executed successfully without any issues. Note: this status is just an indication of a rule''s "health". The rule might or might not generate any alerts despite of it.'
      enum:
      - going to run
      - running
      - partial failure
      - failed
      - succeeded
      type: string
    Security_Detections_API_InternalRuleSource:
      description: Type of rule source for internally sourced rules, i.e. created within the Kibana apps.
      type: object
      properties:
        type:
          enum:
          - internal
          type: string
      required:
      - type
    Security_Detections_API_PlatformErrorResponse:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
      required:
      - statusCode
      - error
      - message
    Security_Detections_API_EqlRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_EqlRuleResponseFields'
    Security_Detections_API_EqlRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_EqlRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
    Security_Detections_API_ThresholdRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRulePatchFields'
    Security_Detections_API_ReasonEnum:
      enum:
      - false_positive
      - duplicate
      - true_positive
      - benign_positive
      - automated_closure
      - other
      type: string
    Security_Detections_API_SavedQueryRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields'
    Security_Detections_API_RuleFalsePositiveArray:
      description: String array used to describe common reasons why the rule may issue false-positive alerts. Defaults to an empty array.
      items:
        type: string
      type: array
    Security_Detections_API_BulkActionEditPayload:
      anyOf:
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadTags'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadIndexPatterns'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadInvestigationFields'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadTimeline'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadRuleActions'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSchedule'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadAlertSuppression'
    Security_Detections_API_EsqlRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleResponseFields'
    Security_Detections_API_RequiredFieldInput:
      description: Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type.
      type: object
      properties:
        name:
          description: Name of an Elasticsearch field
          format: nonempty
          minLength: 1
          type: string
        type:
          description: Type of the Elasticsearch field
          format: nonempty
          minLength: 1
          type: string
      required:
      - name
      - type
    Security_Detections_API_MigrationCleanupResult:
      type: object
      properties:
        destinationIndex:
          type: string
        error:
          type: object
          properties:
            message:
              type: string
            status_code:
              type: integer
          required:
          - message
          - status_code
        id:
          type: string
        sourceIndex:
          type: string
        status:
          enum:
          - success
          - failure
          - pending
          type: string
        updated:
          format: date-time
          type: string
        version:
          type: string
      required:
      - id
      - destinationIndex
      - status
      - sourceIndex
      - version
      - updated
    Security_Detections_API_ThresholdValue:
      description: The threshold value from which an alert is generated.
      minimum: 1
      type: integer
    Security_Detections_API_AlertVersion:
      type: object
      properties:
        count:
          type: integer
        version:
          type: integer
      required:
      - version
      - count
    Security_Detections_API_WarningSchema:
      type: object
      properties:
        actionPath:
          type: string
        buttonLabel:
          type: string
        message:
          type: string
        type:
          type: string
      required:
      - type
      - message
      - actionPath
    Security_Detections_API_BulkActionEditPayloadTags:
      description: 'Edits tags of rules.


        - `add_tags` adds tags to rules. If a tag already exists for a rule, no changes are made.

        - `delete_tags` removes tags from rules. If a tag does not exist for a rule, no changes are made.

        - `set_tags` sets tags for rules, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.

        '
      type: object
      properties:
        type:
          enum:
          - add_tags
          - delete_tags
          - set_tags
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
      required:
      - type
      - value
    Security_Detections_API_ThreatMatchRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        concurrent_searches:
          $ref: '#/components/schemas/Security_Detections_API_ConcurrentSearches'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        items_per_search:
          $ref: '#/components/schemas/Security_Detections_API_ItemsPerSearch'
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
        threat_filters:
          $ref: '#/components/schemas/Security_Detections_API_ThreatFilters'
        threat_indicator_path:
          $ref: '#/components/schemas/Security_Detections_API_ThreatIndicatorPath'
        threat_language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_SiemErrorResponse:
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
      required:
      - status_code
      - message
    Security_Detections_API_RulePreviewLoggedRequest:
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        duration:
          type: integer
        request:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        request_type:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
    Security_Detections_API_MachineLearningRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRulePatchFields'
    Security_Detections_API_BulkActionEditPayloadSetAlertSuppression:
      type: object
      properties:
        type:
          enum:
          - set_alert_suppression
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
      required:
      - type
      - value
    Security_Detections_API_ThreatMatchRulePatchFields:
      allOf:
      - type: object
        properties:
          query:
            $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
          threat_index:
            $ref: '#/components/schemas/Security_Detections_API_ThreatIndex'
          threat_mapping:
            $ref: '#/components/schemas/Security_Detections_API_ThreatMapping'
          threat_query:
            $ref: '#/components/schemas/Security_Detections_API_ThreatQuery'
          type:
            description: Rule type
            enum:
            - threat_match
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields'
    Security_Detections_API_RequiredField:
      description: "Describes an Elasticsearch field that is needed for the rule to function.\n\nAlmost all types of Security rules check source event documents for a match to some kind of\nquery or filter. If a document has certain field with certain values, then it's a match and\nthe rule will generate an alert.\n\nRequired field is an event field that must be present in the source indices of a given rule.\n\n@example\nconst standardEcsField: RequiredField = {\n  name: 'event.action',\n  type: 'keyword',\n  ecs: true,\n};\n\n@example\nconst nonEcsField: RequiredField = {\n  name: 'winlog.event_data.AttributeLDAPDisplayName',\n  type: 'keyword',\n  ecs: false,\n};\n"
      type: object
      properties:
        ecs:
          description: Indicates whether the field is ECS-compliant. This property is only present in responses. Its value is computed based on field’s name and type.
          type: boolean
        name:
          description: Name of an Elasticsearch field
          format: nonempty
          minLength: 1
          type: string
        type:
          description: Type of the Elasticsearch field
          format: nonempty
          minLength: 1
          type: string
      required:
      - name
      - type
      - ecs
    Security_Detections_API_AlertStatusExceptClosed:
      description: The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.
      enum:
      - open
      - acknowledged
      - in-progress
      type: string
    Security_Detections_API_FindRulesSortField:
      enum:
      - created_at
      - createdAt
      - enabled
      - execution_summary.last_execution.date
      - execution_summary.last_execution.metrics.execution_gap_duration_s
      - execution_summary.last_execution.metrics.total_indexing_duration_ms
      - execution_summary.last_execution.metrics.total_search_duration_ms
      - execution_summary.last_execution.status
      - name
      - risk_score
      - riskScore
      - severity
      - updated_at
      - updatedAt
      type: string
    Security_Detections_API_RuleVersion:
      description: "The rule's version number.\n\n- For prebuilt rules it represents the version of the rule's content in the source [detection-rules](https://github.com/elastic/detection-rules) repository (and the corresponding `security_detection_engine` Fleet package that is used for distributing prebuilt rules). \n- For custom rules it is set to `1` when the rule is created. \n> info\n> It is not incremented on each update. Compare this to the `revision` field.\n"
      minimum: 1
      type: integer
    Security_Detections_API_ThreatSubtechnique:
      type: object
      properties:
        id:
          description: Subtechnique ID
          type: string
        name:
          description: Subtechnique name
          type: string
        reference:
          description: Subtechnique reference
          type: string
      required:
      - id
      - name
      - reference
    Security_Detections_API_TimestampField:
      description: Specifies the name of the event timestamp field used for sorting a sequence of events. Not to be confused with `timestamp_override`, which specifies the more general field used for querying events within a range. Defaults to the @timestamp ECS field.
      type: string
    Security_Detections_API_BulkExportActionResponse:
      type: string
    Security_Detections_API_RuleExecutionMetrics:
      type: object
      properties:
        execution_gap_duration_s:
          description: Duration in seconds of execution gap
          minimum: 0
          type: integer
        frozen_indices_queried_count:
          description: Count of frozen indices queried during the rule execution. These indices could not be entirely excluded after applying the time range filter.
          minimum: 0
          type: integer
        gap_range:
          description: Range of the execution gap
          type: object
          properties:
            gte:
              description: Start date of the execution gap
              type: string
            lte:
              description: End date of the execution gap
              type: string
          required:
          - gte
          - lte
        gap_reason:
          description: Detected reason for the execution gap
          type: object
          properties:
            type:
              description: The type of reason for the gap (rule_disabled or rule_did_not_run)
              enum:
              - rule_disabled
              - rule_did_not_run
              type: string
          required:
          - type
        total_enrichment_duration_ms:
          description: Total time spent enriching documents during current rule execution cycle
          minimum: 0
          type: integer
        total_indexing_duration_ms:
          description: Total time spent indexing documents during current rule execution cycle
          minimum: 0
          type: integer
        total_search_duration_ms:
          description: Total time spent performing ES searches as measured by Kibana; includes network latency and time spent serializing/deserializing request/response
          minimum: 0
          type: integer
    Security_Detections_API_RuleAction:
      type: object
      properties:
        action_type_id:
          description: "The action type used for sending notifications, can be:\n\n  - `.slack`\n  - `.slack_api`\n  - `.email`\n  - `.index`\n  - `.pagerduty`\n  - `.swimlane`\n  - `.webhook`\n  - `.servicenow`\n  - `.servicenow-itom`\n  - `.servicenow-sir`\n  - `.jira`\n  - `.resilient`\n  - `.opsgenie`\n  - `.teams`\n  - `.torq`\n  - `.tines`\n  - `.d3security`\n"
          type: string
        alerts_filter:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionAlertsFilter'
        frequency:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionFrequency'
        group:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionGroup'
        id:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionId'
        params:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionParams'
        uuid:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
      required:
      - action_type_id
      - id
      - params
    Security_Detections_API_RuleSignatureId:
      description: A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.
      type: string
    Security_Detections_API_DataViewId:
      type: string
    Security_Detections_API_AlertSuppressionDurationUnit:
      description: Time unit
      enum:
      - s
      - m
      - h
      type: string
    Security_Detections_API_SavedQueryRuleRequiredFields:
      type: object
      properties:
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
        type:
          description: Rule type
          enum:
          - saved_query
          type: string
      required:
      - type
      - saved_id
    Security_Detections_API_MachineLearningRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields'
    Security_Detections_API_SavedQueryRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleResponseFields'
    Security_Detections_API_RuleRevision:
      description: 'The rule''s revision number.


        It represents the version of rule''s object in Kibana. It is set to `0` when the rule is installed or created and then gets incremented on each update.

        > info

        > Not all updates to any rule fields will increment the revision. Only those fields that are considered static `rule parameters` can trigger revision increments. For example, an update to a rule''s query or index fields will increment the rule''s revision by `1`. However, changes to dynamic or technical fields like enabled or execution_summary will not cause revision increments.

        '
      minimum: 0
      type: integer
    Security_Detections_API_EsqlRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          language:
            $ref: '#/components/schemas/Security_Detections_API_EsqlQueryLanguage'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          query:
            $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          type:
            description: Rule type
            enum:
            - esql
            type: string
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
    Security_Detections_API_MachineLearningRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields'
    Security_Detections_API_BulkActionEditPayloadAlertSuppression:
      anyOf:
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppression'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold'
      - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression'
    Security_Detections_API_SetAlertsStatusByIds:
      discriminator:
        mapping:
          closed: '#/components/schemas/Security_Detections_API_CloseAlertsByIds'
        propertyName: status
      oneOf:
      - $ref: '#/components/schemas/Security_Detections_API_CloseAlertsByIds'
      - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByIdsBase'
    Security_Detections_API_AlertSuppression:
      description: Defines alert suppression configuration.
      type: object
      properties:
        duration:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDuration'
        group_by:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionGroupBy'
        missing_fields_strategy:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionMissingFieldsStrategy'
      required:
      - group_by
    Security_Detections_API_BulkActionEditPayloadTimeline:
      description: 'Edits timeline of rules.


        - `set_timeline` sets a timeline for rules. If the same timeline already exists for a rule, no changes are made.

        '
      type: object
      properties:
        type:
          enum:
          - set_timeline
          type: string
        value:
          type: object
          properties:
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          required:
          - timeline_id
          - timeline_title
      required:
      - type
      - value
    Security_Detections_API_BulkDeleteRules:
      type: object
      properties:
        action:
          enum:
          - delete
          type: string
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
    Security_Detections_API_CloseAlertsByQuery:
      type: object
      properties:
        conflicts:
          default: abort
          enum:
          - abort
          - proceed
          type: string
        query:
          additionalProperties: true
          type: object
        reason:
          $ref: '#/components/schemas/Security_Detections_API_Reason'
        status:
          enum:
          - closed
          type: string
      required:
      - query
      - status
    Security_Detections_API_RelatedIntegration:
      description: 'Related integration is a potential dependency of a rule. It''s assumed that if the user installs

        one of the related integrations of a rule, the rule might start to work properly because it will

        have source events (generated by this integration) potentially matching the rule''s query.


        NOTE: Proper work is not guaranteed, because a related integration, if installed, can be

        configured differently or generate data that is not necessarily relevant for this rule.


        Related integration is a combination of a Fleet package and (optionally) one of the

        package''s "integrations" that this package contains. It is represented by 3 properties:


        - `package`: name of the package (required, unique id)

        - `version`: version of the package (required, semver-compatible)

        - `integration`: name of the integration of this package (optional, id within the package)


        There are Fleet packages like `windows` that contain only one integration; in this case,

        `integration` should be unspecified. There are also packages like `aws` and `azure` that contain

        several integrations; in this case, `integration` should be specified.

        '
      example:
        integration: activitylogs
        package: azure
        version: ~1.1.6
      type: object
      properties:
        integration:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        package:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        version:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
      required:
      - package
      - version
    Security_Detections_API_QueryRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
    Security_Detections_API_NewTermsRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleResponseFields'
    Security_Detections_API_GapFillStatus:
      enum:
      - unfilled
      - in_progress
      - filled
      - error
      type: string
    Security_Detections_API_SetAlertsStatusByIdsBase:
      type: object
      properties:
        signal_ids:
          description: 'List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.'
          items:
            format: nonempty
            minLength: 1
            type: string
          minItems: 1
          type: array
        status:
          $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
      required:
      - signal_ids
      - status
    Security_Detections_API_KqlQueryLanguage:
      enum:
      - kuery
      - lucene
      type: string
    Security_Detections_API_NewTermsRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields'
    Security_Detections_API_QueryRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleResponseFields'
    Security_Detections_API_RequiredFieldArray:
      items:
        $ref: '#/components/schemas/Security_Detections_API_RequiredField'
      type: array
    Security_Detections_API_SetupGuide:
      description: Populates the rule’s setup guide with instructions on rule prerequisites such as required integrations, configuration steps, and anything else needed for the rule to work correctly.
      type: string
    Security_Detections_API_AlertTags:
      description: List of keywords to organize related alerts into categories that you can filter and group.
      items:
        $ref: '#/components/schemas/Security_Detections_API_AlertTag'
      type: array
    Security_Detections_API_NewTermsFields:
      description: Fields to monitor for new values.
      items:
        type: string
      maxItems: 3
      minItems: 1
      type: array
    Security_Detections_API_SavedQueryRulePatchFields:
      allOf:
      - type: object
        properties:
          saved_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
          type:
            description: Rule type
            enum:
            - saved_query
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields'
    Security_Detections_API_NormalizedRuleAction:
      additionalProperties: false
      type: object
      properties:
        alerts_filter:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionAlertsFilter'
        frequency:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionFrequency'
        group:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionGroup'
        id:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionId'
        params:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionParams'
      required:
      - id
      - params
    Security_Detections_API_SetAlertAssigneesBody:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Security_Detections_API_AlertAssignees'
          description: Details about the assignees to assign and unassign.
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
      required:
      - assignees
      - ids
    Security_Detections_API_EqlRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_EqlRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
    Security_Detections_API_EsqlQueryLanguage:
      enum:
      - esql
      type: string
    Security_Detections_API_MachineLearningRulePatchFields:
      allOf:
      - type: object
        properties:
          anomaly_threshold:
            $ref: '#/components/schemas/Security_Detections_API_AnomalyThreshold'
          machine_learning_job_id:
            $ref: '#/components/schemas/Security_Detections_API_MachineLearningJobId'
          type:
            description: Rule type
            enum:
            - machine_learning
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
    Security_Detections_API_BuildingBlockType:
      description: 'Determines if the rule acts as a building block. If yes, the value must be `default`.

        By default, building-block alerts are not displayed in the UI. These rules are used as a foundation for other rules that do generate alerts.

        For more information, refer to [About building block rules](https://www.elastic.co/docs/solutions/security/detect-and-alert/about-building-block-rules).

        '
      type: string
    Security_Detections_API_ThreatMatchRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields'
    Security_Detections_API_RuleExceptionList:
      description: 'Array of [exception containers](https://www.elastic.co/docs/solutions/security/detect-and-alert/detection-rule-concepts), which define exceptions that prevent the rule from generating alerts even when its other criteria are met.

        '
      type: object
      properties:
        id:
          description: ID of the exception container
          format: nonempty
          minLength: 1
          type: string
        list_id:
          description: List ID of the exception container
          format: nonempty
          minLength: 1
          type: string
        namespace_type:
          description: Determines the exceptions validity in rule's Kibana space
          enum:
          - agnostic
          - single
          type: string
        type:
          $ref: '#/components/schemas/Security_Detections_API_ExceptionListType'
      required:
      - id
      - list_id
      - type
      - namespace_type
    Security_Detections_API_ThreatIndex:
      description: Elasticsearch indices used to check which field values generate alerts.
      items:
        type: string
      type: array
    Security_Detections_API_TimestampOverrideFallbackDisabled:
      description: Disables the fallback to the event's @timestamp field
      type: boolean
    Security_Detections_API_Reason:
      description: 'The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.'
      oneOf:
      - $ref: '#/components/schemas/Security_Detections_API_ReasonEnum'
      - type: string
    Security_Detections_API_UUID:
      description: A universally unique identifier
      format: uuid
      type: string
    Security_Detections_API_ThreatMatchRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields'
    Security_Detections_API_RuleActionAlertsFilter:
      additionalProperties: true
      description: "Object containing an action’s conditional filters.\n\n- `timeframe` (object, optional): Object containing the time frame for when this action can be run.\n    - `days` (array of integers, required): List of days of the week on which this action will be run. Days of the week are expressed as numbers between `1-7`, where `1` is Monday and `7` is Sunday. To select all days of the week, enter an empty array.\n    - `hours` (object, required): The hours of the day during which this action will run. Hours of the day are expressed as two strings in the format `hh:mm` in `24` hour time. A start of `00:00` and an end of `24:00` means the action can run all day.\n        - start (string, required): Start time in `hh:mm` format.\n        - end (string, required): End time in `hh:mm` format.\n    - `timezone` (string, required): An ISO timezone name, such as `Europe/Madrid` or `America/New_York`. Specific offsets such as `UTC` or `UTC+1` will also work, but lack built-in DST.\n- `query` (object, optional): Object containing a query filter which gets applied to an action and determines whether the action should run.\n    - `kql` (string, required): A KQL string.\n    - `filters` (array of objects, required): Array of filter objects, as defined in the `kbn-es-query` package.\n"
      type: object
    Security_Detections_API_InvestigationFields:
      description: 'Schema for fields relating to investigation fields. These are user defined fields we use to highlight

        in various features in the UI such as alert details flyout and exceptions auto-population from alert.

        '
      type: object
      properties:
        field_names:
          items:
            $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
          minItems: 1
          type: array
      required:
      - field_names
    Security_Detections_API_TimelineTemplateTitle:
      description: Timeline template title
      type: string
    Security_Detections_API_MaxSignals:
      default: 100
      description: 'Maximum number of alerts the rule can create during a single run (the rule’s Max alerts per run [advanced setting](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#rule-ui-advanced-params) value).

        > info

        > This setting can be superseded by the [Kibana configuration setting](https://www.elastic.co/docs/reference/kibana/configuration-reference/alerting-settings) `xpack.alerting.rules.run.alerts.max`, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, the rule can generate no more than 1000 alerts even if `max_signals` is set higher.

        '
      minimum: 1
      type: integer
    Security_Detections_API_TiebreakerField:
      description: Sets a secondary field for sorting events
      type: string
    Security_Detections_API_MachineLearningRuleRequiredFields:
      type: object
      properties:
        anomaly_threshold:
          $ref: '#/components/schemas/Security_Detections_API_AnomalyThreshold'
        machine_learning_job_id:
          $ref: '#/components/schemas/Security_Detections_API_MachineLearningJobId'
        type:
          description: Rule type
          enum:
          - machine_learning
          type: string
      required:
      - type
      - machine_learning_job_id
      - anomaly_threshold
    Security_Detections_API_ThresholdRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdAlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
    Security_Detections_API_QueryRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
      - type: object
        properties:
          language:
            $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
          query:
            $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        required:
        - query
        - language
    Security_Detections_API_SortOrder:
      enum:
      - asc
      - desc
      type: string
    Security_Detections_API_QueryRuleRequiredFields:
      type: object
      properties:
        type:
          description: Rule type
          enum:
          - query
          type: string
      required:
      - type
    Security_Detections_API_RunScriptOsConfigValues:
      minProperties: 1
      type: object
      properties:
        scriptId:
          type: string
        scriptInput:
          type: string
        timeout:
          description: Specify the timeout in seconds for the script execution
          example: 60
          type: integer
    Security_Detections_API_EqlRulePatchFields:
      allOf:
      - type: object
        properties:
          language:
            $ref: '#/components/schemas/Security_Detections_API_EqlQueryLanguage'
            description: Query language to use
          query:
            $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
          type:
            description: Rule type
            enum:
            - eql
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
    Security_Detections_API_BulkActionEditPayloadSchedule:
      description: "Overwrites schedule of rules. \n\n- `set_schedule` sets a schedule for rules. If the same schedule already exists for a rule, no changes are made.\n\nBoth `interval` and `lookback` have a format of \"{integer}{time_unit}\", where accepted time units are `s` for seconds, `m` for minutes, and `h` for hours. The integer must be positive and larger than 0. Examples: \"45s\", \"30m\", \"6h\"\n"
      type: object
      properties:
        type:
          enum:
          - set_schedule
          type: string
        value:
          type: object
          properties:
            interval:
              description: Interval in which the rule runs. For example, `"1h"` means the rule runs every hour.
              example: 1h
              pattern: ^[1-9]\d*[smh]$
              type: string
            lookback:
              description: 'Lookback time for the rules.


                Additional look-back time that the rule analyzes. For example, "10m" means the rule analyzes the last 10 minutes of data in addition to the frequency interval.

                '
              example: 1h
              pattern: ^[1-9]\d*[smh]$
              type: string
          required:
          - interval
          - lookback
      required:
      - type
      - value
    Security_Detections_API_AlertsSort:
      oneOf:
      - $ref: '#/components/schemas/Security_Detections_API_AlertsSortCombinations'
      - items:
          $ref: '#/components/schemas/Security_Detections_API_AlertsSortCombinations'
        type: array
    Security_Detections_API_OsqueryResponseAction:
      type: object
      properties:
        action_type_id:
          enum:
          - .osquery
          type: string
        params:
          $ref: '#/components/schemas/Security_Detections_API_OsqueryParams'
      required:
      - action_type_id
      - params
    Security_Detections_API_NewTermsRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
      - type: object
        properties:
          language:
            $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
        required:
        - language
    Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression:
      type: object
      properties:
        type:
          enum:
          - delete_alert_suppression
          type: string
      required:
      - type
    Security_Detections_API_ThreatMatchRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ThreatMapping:
      description: "Array of entries objects that define mappings between the source event fields and the values in the Elasticsearch threat index. Each entries object must contain these fields:\n\n- field: field from the event indices on which the rule runs\n- type: must be mapping\n- value: field from the Elasticsearch threat index\n  \nYou can use Boolean and and or logic to define the conditions for when matching fields and values generate alerts. Sibling entries objects are evaluated using or logic, whereas multiple entries in a single entries object use and logic. See Example of Threat Match rule which uses both `and` and `or` logic.\n"
      items:
        type: object
        properties:
          entries:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ThreatMappingEntry'
            type: array
        required:
        - entries
      minItems: 1
      type: array
    Security_Detections_API_AlertsSortCombinations:
      anyOf:
      - type: string
      - additionalProperties: true
        type: object
    Security_Detections_API_SavedQueryRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
    Security_Detections_API_RuleUpdateProps:
      anyOf:
      - $ref: '#/components/schemas/Security_Detections_API_EqlRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps'
      discriminator:
        mapping:
          eql: '#/components/schemas/Security_Detections_API_EqlRuleUpdateProps'
          esql: '#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps'
          machine_learning: '#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps'
          new_terms: '#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps'
          query: '#/components/schemas/Security_Detections_API_QueryRuleUpdateProps'
          saved_query: '#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps'
          threat_match: '#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps'
          threshold: '#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps'
        propertyName: type
    Security_Detections_API_DefaultParams:
      type: object
      properties:
        command:
          enum:
          - isolate
          type: string
        comment:
          type: string
      required:
      - command
    Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold:
      type: object
      properties:
        type:
          enum:
          - set_alert_suppression_for_threshold
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdAlertSuppression'
      required:
      - type
      - value
    Security_Detections_API_ThresholdRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields'
    Security_Detections_API_ThresholdRuleRequiredFields:
      type: object
      properties:
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        threshold:
          $ref: '#/components/schemas/Security_Detections_API_Threshold'
        type:
          description: Rule type
          enum:
          - threshold
          type: string
      required:
      - type
      - query
      - threshold
    Security_Detections_API_AlertsReindexOptions:
      type: object
      properties:
        requests_per_second:
          description: The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API.
          minimum: 1
          type: integer
        size:
          description: Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API.
          minimum: 1
          type: integer
        slices:
          description: The number of subtasks for the migration task. Corresponds to slices on the Reindex API.
          minimum: 1
          type: integer
    Security_Detections_API_ConcurrentSearches:
      minimum: 1
      type: integer
    Security_Detections_API_QueryRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateFields'
    Security_Detections_API_RuleActionThrottle:
      description: Defines how often rule actions are taken.
      oneOf:
      - enum:
        - no_actions
        - rule
        type: string
      - description: Time interval in seconds, minutes, hours, or days.
        example: 1h
        pattern: ^[1-9]\d*[smhd]$
        type: string
    Security_Detections_API_BulkExportRules:
      type: object
      properties:
        action:
          enum:
          - export
          type: string
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
    Security_Detections_API_ThreatMappingEntry:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        negate:
          type: boolean
        type:
          enum:
          - mapping
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
      required:
      - field
      - type
      - value
    Security_Detections_API_ThreatMatchRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleResponseFields'
    Security_Detections_API_AlertSuppressionMissingFieldsStrategy:
      description: 'Describes how alerts will be generated for documents with missing suppress by fields:

        doNotSuppress - per each document a separate alert will be created

        suppress - only alert will be created per suppress by bucket'
      enum:
      - doNotSuppress
      - suppress
      type: string
    Security_Detections_API_RuleExecutionStatusOrder:
      type: integer
    Security_Detections_API_ExternalRuleHasBaseVersion:
      description: Determines whether an external/prebuilt rule has its original, unmodified version present when the calculation of its customization status is performed (`rule_source.is_customized` and `rule_source.customized_fields`).
      type: boolean
    Security_Detections_API_EqlRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateFields'
    Security_Detections_API_RuleExecutionSummary:
      description: 'Summary of the last execution of a rule.

        > info

        > This field is under development and its usage or schema may change

        '
      type: object
      properties:
        last_execution:
          type: object
          properties:
            date:
              description: Date of the last execution
              format: date-time
              type: string
            message:
              type: string
            metrics:
              $ref: '#/components/schemas/Security_Detections_API_RuleExecutionMetrics'
            status:
              $ref: '#/components/schemas/Security_Detections_API_RuleExecutionStatus'
              description: Status of the last execution
            status_order:
              $ref: '#/components/schemas/Security_Detections_API_RuleExecutionStatusOrder'
          required:
          - date
          - status
          - status_order
          - message
          - metrics
      required:
      - last_execution
    Security_Detections_API_SavedQueryRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_BulkEnableRules:
      type: object
      properties:
        action:
          enum:
          - enable
          type: string
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
    Security_Detections_API_EsqlRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields'
    Security_Detections_API_ThresholdRulePatchFields:
      allOf:
      - type: object
        properties:
          query:
            $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
          threshold:
            $ref: '#/components/schemas/Security_Detections_API_Threshold'
          type:
            description: Rule type
            enum:
            - threshold
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields'
    Security_Detections_API_TimestampOverride:
      description: Sets the time field used to query indices. When unspecified, rules query the `@timestamp` field. The source field must be an Elasticsearch date data type.
      type: string
    Security_Detections_API_ExceptionListType:
      description: The exception type
      enum:
      - detection
      - rule_default
      - endpoint
      - endpoint_trusted_apps
      - endpoint_trusted_devices
      - endpoint_events
      - endpoint_host_isolation_exceptions
      - endpoint_blocklists
      type: string
    Security_Detections_API_RuleActionNotifyWhen:
      description: Defines how often rules run actions.
      enum:
      - onActiveAlert
      - onThrottleInterval
      - onActionGroupChange
      type: string
    Security_Detections_API_EsqlRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateFields'
    Security_Detections_API_RunscriptParams:
      description: '> warn

        > This functionality is currently not available

        '
      type: object
      properties:
        command:
          enum:
          - runscript
          type: string
        comment:
          description: Add a note that explains or describes the action. You can find your comment in the response actions history log
          type: string
        config:
          type: object
          properties:
            linux:
              $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
            macos:
              $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
            windows:
              $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
      required:
      - command
    Security_Detections_API_SkippedAlertsIndexMigration:
      type: object
      properties:
        index:
          type: string
      required:
      - index
    Security_Detections_API_ExternalRuleSource:
      description: Type of rule source for externally sourced rules, i.e. rules that have an external source, such as the Elastic Prebuilt rules repo.
      type: object
      properties:
        customized_fields:
          $ref: '#/components/schemas/Security_Detections_API_ExternalRuleCustomizedFields'
        has_base_version:
          $ref: '#/components/schemas/Security_Detections_API_ExternalRuleHasBaseVersion'
        is_customized:
          $ref: '#/components/schemas/Security_Detections_API_IsExternalRuleCustomized'
        type:
          enum:
          - external
          type: string
      required:
      - type
      - is_customized
      - has_base_version
      - customized_fields
    Security_Detections_API_SavedQueryRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields'
    Security_Detections_API_RuleLicense:
      description: The rule's license.
      type: string
    Security_Detections_API_AlertSuppressionDuration:
      type: object
      properties:
        unit:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDurationUnit'
        value:
          minimum: 1
          type: integer
      required:
      - value
      - unit
    Security_Detections_API_SavedObjectResolveAliasPurpose:
      enum:
      - savedObjectConversion
      - savedObjectImport
      type: string
    Security_Detections_API_ThreatMatchRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields'
    Security_Detections_API_SetAlertTagsBody:
      type: object
      properties:
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
        tags:
          $ref: '#/components/schemas/Security_Detections_API_SetAlertTags'
      required:
      - ids
      - tags
    Security_Detections_API_ThresholdAlertSuppression:
      description: Defines alert suppression configuration.
      type: object
      properties:
        duration:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDuration'
      required:
      - duration
    Security_Detections_API_EsqlRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields'
    Security_Detections_API_MachineLearningJobId:
      description: Machine learning job ID(s) the rule monitors for anomaly scores.
      oneOf:
      - type: string
      - items:
          type: string
        minItems: 1
        type: array
    Security_Detections_API_MigrationStatus:
      type: object
      properties:
        id:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        status:
          enum:
          - success
          - failure
          - pending
          type: string
        updated:
          format: date-time
          type: string
        version:
          type: integer
      required:
      - id
      - status
      - version
      - updated
    Security_Detections_API_MachineLearningRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
    Security_Detections_API_ThreatQuery:
      description: Query used to determine which fields in the Elasticsearch index are used for generating alerts.
      type: string
    Security_Detections_API_RuleQuery:
      description: '[Query](https://www.elastic.co/docs/explore-analyze/query-filter) used by the rule to create alerts.


        - For indicator match rules, only the query’s results are used to determine whether an alert is generated.

        - ES|QL rules have additional query requirements. Refer to [Create ES|QL](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#create-esql-rule) rules for more information.

        '
      type: string
    Security_Detections_API_RuleAuthorArray:
      description: The rule’s author.
      items:
        type: string
      type: array
    Security_Detections_API_QueryRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields'
    Security_Detections_API_NewTermsRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields'
    Security_Detections_API_SavedQueryRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRulePatchFields'
    Security_Detections_API_QueryRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRulePatchFields'
    Security_Detections_API_QueryRulePatchFields:
      allOf:
      - type: object
        properties:
          type:
            description: Rule type
            enum:
            - query
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields'
    Security_Detections_API_RuleIntervalFrom:
      description: Time from which data is analyzed each time the rule runs, using a date math range. For example, now-4200s means the rule analyzes data from 70 minutes before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).
      format: date-math
      type: string
    Security_Detections_API_MigrationFinalizationResult:
      type: object
      properties:
        completed:
          type: boolean
        destinationIndex:
          type: string
        error:
          type: object
          properties:
            message:
              type: string
            status_code:
              type: integer
          required:
          - message
          - status_code
        id:
          type: string
        sourceIndex:
          type: string
        status:
          enum:
          - success
          - failure
          - pending
          type: string
        updated:
          format: date-time
          type: string
        version:
          type: string
      required:
      - id
      - completed
      - destinationIndex
      - status
      - sourceIndex
      - version
      - updated
    Security_Detections_API_TimelineTemplateId:
      description: Timeline template ID
      type: string
    Security_Detections_API_ResponseFields:
      type: object
      properties:
        created_at:
          format: date-time
          type: string
        created_by:
          type: string
        execution_summary:
          $ref: '#/components/schemas/Security_Detections_API_RuleExecutionSummary'
        id:
          $ref: '#/components/schemas/Security_Detections_API_UUID'
        immutable:
          $ref: '#/components/schemas/Security_Detections_API_IsRuleImmutable'
        required_fields:
          $ref: '#/components/schemas/Security_Detections_API_RequiredFieldArray'
        revision:
          $ref: '#/components/schemas/Security_Detections_API_RuleRevision'
        rule_id:
          $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
        rule_source:
          $ref: '#/components/schemas/Security_Detections_API_RuleSource'
        updated_at:
          format: date-time
          type: string
        updated_by:
          type: string
      required:
      - id
      - rule_id
      - immutable
      - rule_source
      - updated_at
      - updated_by
      - created_at
      - created_by
      - revision
      - related_integrations
      - required_fields
    Security_Detections_API_BulkEditActionResponse:
      type: object
      properties:
        attributes:
          type: object
          properties:
            errors:
              items:
                $ref: '#/components/schemas/Security_Detections_API_NormalizedRuleError'
              type: array
            results:
              $ref: '#/components/schemas/Security_Detections_API_BulkEditActionResults'
            summary:
              $ref: '#/components/schemas/Security_Detections_API_BulkEditActionSummary'
          required:
          - results
          - summary
        message:
          type: string
        rules_count:
          type: integer
        status_code:
          type: integer
        success:
          type: boolean
      required:
      - attributes
    Security_Detections_API_AlertIds:
      description: A list of alerts `id`s.
      items:
        format: nonempty
        minLength: 1
        type: string
      minItems: 1
      type: array
    Security_Detections_API_InvestigationGuide:
      description: Notes to help investigate alerts produced by the rule.
      type: string
    Security_Detections_API_ThreatArray:
      items:
        $ref: '#/components/schemas/Security_Detections_API_Threat'
      type: array
    Security_Detections_API_EsqlRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
    Security_Detections_API_BulkDisableRules:
      type: object
      properties:
        action:
          enum:
          - disable
          type: string
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
    Security_Detections_API_EqlRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_EqlRulePatchFields'
    Security_Detections_API_RiskScore:
      description: 'A numerical representation of the alert''s severity from 0 to 100, where:

        * `0` - `21` represents low severity

        * `22` - `47` represents medium severity

        * `48` - `73` represents high severity

        * `74` - `100` represents critical severity

        '
      maximum: 100
      minimum: 0
      type: integer
    Security_Detections_API_RulePreviewParams:
      type: object
      properties:
        invocationCount:
          type: integer
        timeframeEnd:
          format: date-time
          type: string
      required:
      - invocationCount
      - timeframeEnd
    Security_Detections_API_BulkDuplicateRules:
      type: object
      properties:
        action:
          enum:
          - duplicate
          type: string
        duplicate:
          description: Duplicate object that describes applying an update action.
          type: object
          properties:
            include_exceptions:
              description: Whether to copy exceptions from the original rule
              type: boolean
            include_expired_exceptions:
              description: Whether to copy expired exceptions from the original rule
              type: boolean
          required:
          - include_exceptions
          - include_expired_exceptions
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
    Security_Detections_API_ThreatTechnique:
      type: object
      properties:
        id:
          description: Technique ID
          type: string
        name:
          description: Technique name
          type: string
        reference:
          description: Technique reference
          type: string
        subtechnique:
          description: 'Array containing more specific information on the attack technique.

            '
          items:
            $ref: '#/components/schemas/Security_Detections_API_ThreatSubtechnique'
          type: array
      required:
      - id
      - name
      - reference
    Security_Detections_API_ErrorSchema:
      additionalProperties: false
      type: object
      properties:
        error:
          type: object
          properties:
            message:
              type: string
            status_code:
              minimum: 400
              type: integer
          required:
          - status_code
          - message
        id:
          type: string
        item_id:
          minLength: 1
          type: string
        list_id:
          minLength: 1
          type: string
        rule_id:
          $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      required:
      - error
    Security_Detections_API_EqlRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateFields'
    Security_Detections_API_ThresholdCardinality:
      description: The field on which the cardinality is applied.
      items:
        type: object
        properties:
          field:
            description: The field on which to calculate and compare the cardinality.
            type: string
          value:
            description: The threshold value from which an alert is generated based on unique number of values of cardinality.field.
            minimum: 0
            type: integer
        required:
        - field
        - value
      type: array
    Security_Detections_API_BulkManualRuleRun:
      type: object
      properties:
        action:
          enum:
          - run
          type: string
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
        run:
          description: Object that describes applying a manual rule run action.
          type: object
          properties:
            end_date:
              description: End date of the manual rule run
              type: string
            start_date:
              description: Start date of the manual rule run
              type: string
          required:
          - start_date
          - end_date
      required:
      - action
      - run
    Security_Detections_API_AlertsIndexNamespace:
      description: Has no effect.
      type: string
    Security_Detections_API_BulkActionSkipResult:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        skip_reason:
          oneOf:
          - $ref: '#/components/schemas/Security_Detections_API_BulkEditSkipReason'
          - $ref: '#/components/schemas/Security_Detections_API_BulkGapsFillingSkipReason'
      required:
      - id
      - skip_reason
    Security_Detections_API_ThreatMatchRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRulePatchFields'
    Security_Detections_API_BulkActionsDryRunErrCode:
      enum:
      - IMMUTABLE
      - PREBUILT_CUSTOMIZATION_LICENSE
      - MACHINE_LEARNING_AUTH
      - MACHINE_LEARNING_INDEX_PATTERN
      - ESQL_INDEX_PATTERN
      - MANUAL_RULE_RUN_FEATURE
      - MANUAL_RULE_RUN_DISABLED_RULE
      - THRESHOLD_RULE_TYPE_IN_SUPPRESSION
      - UNSUPPORTED_RULE_IN_SUPPRESSION_FOR_THRESHOLD
      - RULE_FILL_GAPS_DISABLED_RULE
      - USER_INSUFFICIENT_RULE_PRIVILEGES
      type: string
    Security_Detections_API_Threat:
      description: '> info

        > Currently, only threats described using the MITRE ATT&CK&trade; framework are supported.

        '
      type: object
      properties:
        framework:
          description: Relevant attack framework
          type: string
        tactic:
          $ref: '#/components/schemas/Security_Detections_API_ThreatTactic'
        technique:
          description: Array containing information on the attack techniques (optional)
          items:
            $ref: '#/components/schemas/Security_Detections_API_ThreatTechnique'
          type: array
      required:
      - framework
      - tactic
    Security_Detections_API_NonEmptyString:
      description: A string that does not contain only whitespace characters
      format: nonempty
      minLength: 1
      type: string
    Security_Detections_API_SetAlertsStatusByQueryBase:
      type: object
      properties:
        conflicts:
          default: abort
          enum:
          - abort
          - proceed
          type: string
        query:
          additionalProperties: true
          type: object
        status:
          $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
      required:
      - query
      - status
    Security_Detections_API_SeverityMapping:
      description: Overrides generated alerts' severity with values from the source event
      items:
        type: object
        properties:
          field:
            description: Source event field used to override the default `severity`.
            type: string
          operator:
            enum:
            - equals
            type: string
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          value:
            type: string
        required:
        - field
        - operator
        - severity
        - value
      type: array
    Security_Detections_API_RuleName:
      description: A human-readable name for the rule.
      example: Anomalous Windows Process Creation
      minLength: 1
      type: string
    Security_Detections_API_NewTermsRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
    Security_Detections_API_SetAlertsStatusByQuery:
      discriminator:
        mapping:
          closed: '#/components/schemas/Security_Detections_API_CloseAlertsByQuery'
        propertyName: status
      oneOf:
      - $ref: '#/components/schemas/Security_Detections_API_CloseAlertsByQuery'
      - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByQueryBase'
    Security_Detections_API_BulkEditActionSummary:
      description: A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the `edit` action is used to add a tag to a rule that already has that tag, or to delete an index pattern that is not specified in a rule. Objects returned in `attributes.results.skipped` will only include rules' `id`, `name`, and `skip_reason`.
      type: object
      properties:
        failed:
          type: integer
        skipped:
          type: integer
        succeeded:
          type: integer
        total:
          type: integer
      required:
      - failed
      - skipped
      - succeeded
      - total
    Security_Detections_API_BulkManualRuleFillGaps:
      type: object
      properties:
        action:
          enum:
          - fill_gaps
          type: string
        fill_gaps:
          description: Object that describes applying a manual gap fill action for the specified time range.
          type: object
          properties:
            end_date:
              description: End date of the manual gap fill
              type: string
            start_date:
              description: Start date of the manual gap fill
              type: string
          required:
          - start_date
          - end_date
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
      - fill_gaps
    Security_Detections_API_EqlRequiredFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_EqlQueryLanguage'
          description: Query language to use
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        type:
          description: Rule type
          enum:
          - eql
          type: string
      required:
      - type
      - query
      - language
    Security_Detections_API_IndexMigrationStatus:
      type: object
      properties:
        index:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        is_outdated:
          type: boolean
        migrations:
          items:
            $ref: '#/components/schemas/Security_Detections_API_MigrationStatus'
          type: array
        signal_versions:
          items:
            $ref: '#/components/schemas/Security_Detections_API_AlertVersion'
          type: array
        version:
          type: integer
      required:
      - index
      - version
      - signal_versions
      - migrations
      - is_outdated
    Security_Detections_API_MachineLearningRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
    Security_Detections_API_RuleCreateProps:
      anyOf:
      - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
      discriminator:
        mapping:
          eql: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
          esql: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
          machine_learning: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
          new_terms: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
          query: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
          saved_query: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
          threat_match: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
          threshold: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
        propertyName: type
    Security_Detections_API_Severity:
      description: 'Severity level of alerts produced by the rule, which must be one of the following:

        * `low`: Alerts that are of interest but generally not considered to be security incidents

        * `medium`: Alerts that require investigation

        * `high`: Alerts that require immediate investigation

        * `critical`: Alerts that indicate it is highly likely a security incident has occurred

        '
      enum:
      - low
      - medium
      - high
      - critical
      type: string
    Security_Detections_API_ThreatMatchRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
      - type: object
        properties:
          language:
            $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
        required:
        - language
    Security_Detections_API_RuleActionFrequency:
      description: The action frequency defines when the action runs (for example, only on rule execution or at specific time intervals).
      type: object
      properties:
        notifyWhen:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionNotifyWhen'
        summary:
          description: Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          type: boolean
        throttle:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          nullable: true
      required:
      - summary
      - notifyWhen
      - throttle
    Security_Detections_API_AlertSuppressionGroupBy:
      items:
        type: string
      maxItems: 3
      minItems: 1
      type: array
    Security_Detections_API_AlertTag:
      description: Use alert tags to organize related alerts into categories that you can filter and group.
      format: nonempty
      minLength: 1
      type: string
    Security_Detections_API_ThreatFilters:
      items:
        description: Query and filter context array used to filter documents from the Elasticsearch index containing the threat values
      type: array
    Security_Detections_API_RuleActionId:
      description: The connector ID.
      type: string
    Security_Detections_API_RuleIntervalTo:
      type: string
    Security_Detections_API_BulkEditActionResults:
      type: object
      properties:
        created:
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          type: array
        deleted:
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          type: array
        skipped:
          items:
            $ref: '#/components/schemas/Security_Detections_API_BulkActionSkipResult'
          type: array
        updated:
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          type: array
      required:
      - updated
      - created
      - deleted
      - skipped
    Security_Detections_API_EsqlRuleRequiredFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_EsqlQueryLanguage'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        type:
          description: Rule type
          enum:
          - esql
          type: string
      required:
      - type
      - language
      - query
    Security_Detections_API_EsqlRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateFields'
    Security_Detections_API_IndexPatternArray:
      description: 'Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanced Settings → `securitySolution:defaultIndex`).

        > info

        > This field is not supported for ES|QL rules.

        '
      items:
        type: string
      type: array
    Security_Detections_API_RuleNameOverride:
      description: Sets which field in the source event is used to populate the alert's `signal.rule.name` value (in the UI, this value is displayed on the Rules page in the Rule column). When unspecified, the rule’s `name` value is used. The source field must be a string data type.
      type: string
    Security_Detections_API_ThrottleForBulkActions:
      description: 'Defines the maximum interval in which a rule’s actions are executed.

        > info

        > The rule level `throttle` field is deprecated in Elastic Security 8.8 and will remain active for at least the next 12 months.

        > In Elastic Security 8.8 and later, you can use the `frequency` field to define frequencies for individual actions. Actions without frequencies will acquire a converted version of the rule’s `throttle` field. In the response, the converted `throttle` setting appears in the individual actions'' `frequency` field.

        '
      enum:
      - rule
      - 1h
      - 1d
      - 7d
      type: string
    Security_Detections_API_AlertsIndexMigrationSuccess:
      type: object
      properties:
        index:
          type: string
        migration_id:
          type: string
        migration_index:
          type: string
      required:
      - index
      - migration_id
      - migration_index
    Security_Detections_API_NewTermsRuleRequiredFields:
      type: object
      properties:
        history_window_start:
          $ref: '#/components/schemas/Security_Detections_API_HistoryWindowStart'
        new_terms_fields:
          $ref: '#/components/schemas/Security_Detections_API_NewTermsFields'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        type:
          description: Rule type
          enum:
          - new_terms
          type: string
      required:
      - type
      - query
      - new_terms_fields
      - history_window_start
    Security_Detections_API_BulkEditRules:
      type: object
      properties:
        action:
          enum:
          - edit
          type: string
        edit:
          description: Array of objects containing the edit operations
          items:
            $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
          minItems: 1
          type: array
        gap_auto_fill_scheduler_id:
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          type: string
        gap_fill_statuses:
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          type: array
        gaps_range_end:
          description: Gaps range end, valid only when query is provided
          type: string
        gaps_range_start:
          description: Gaps range start, valid only when query is provided
          type: string
        ids:
          description: 'Array of rule `id`s to which a bulk action will be applied. Do not use rule''s `rule_id` here.

            Only valid when query property is undefined.

            '
          items:
            type: string
          minItems: 1
          type: array
        query:
          description: Query to filter rules.
          type: string
      required:
      - action
      - edit
    Security_Detections_API_SavedQueryRuleCreateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields'
    Security_Detections_API_ItemsPerSearch:
      minimum: 1
      type: integer
    Security_Detections_API_RelatedIntegrationArray:
      items:
        $ref: '#/components/schemas/Security_Detections_API_RelatedIntegration'
      type: array
    Security_Detections_API_ThreatIndicatorPath:
      description: Defines the path to the threat indicator in the indicator documents (optional)
      type: string
    Security_Detections_API_EndpointResponseAction:
      type: object
      properties:
        action_type_id:
          enum:
          - .endpoint
          type: string
        params:
          oneOf:
          - $ref: '#/components/schemas/Security_Detections_API_DefaultParams'
          - $ref: '#/components/schemas/Security_Detections_API_ProcessesParams'
          - $ref: '#/components/schemas/Security_Detections_API_RunscriptParams'
      required:
      - action_type_id
      - params
    Security_Detections_API_AlertAssignees:
      type: object
      properties:
        add:
          items:
            description: A list of user profile `uid`s to assign. Users need to activate their user profile by logging into Kibana at least once.
            format: nonempty
            minLength: 1
            type: string
          type: array
        remove:
          items:
            description: A list of user profile `uid`s to unassign. Users need to activate their user profile by logging into Kibana at least once.
            format: nonempty
            minLength: 1
            type: string
          type: array
      required:
      - add
      - remove
    Security_Detections_API_RuleInterval:
      description: Frequency of rule execution, using a date math range. For example, "1h" means the rule runs every hour. Defaults to 5m (5 minutes).
      type: string
    Security_Detections_API_AnomalyThreshold:
      description: Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100.
      minimum: 0
      type: integer
    Security_Detections_API_AlertsIndexMigrationError:
      type: object
      properties:
        error:
          type: object
          properties:
            message:
              type: string
            status_code:
              type: string
          required:
          - message
          - status_code
        index:
          type: string
      required:
      - index
      - error
    Security_Detections_API_Threshold:
      type: object
      properties:
        cardinality:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdCardinality'
        field:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdField'
        value:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdValue'
      required:
      - field
      - value
    Security_Detections_API_RulePatchProps:
      anyOf:
      - $ref: '#/components/schemas/Security_Detections_API_EqlRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRulePatchProps'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRulePatchProps'
    Security_Detections_API_ThresholdRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields'
    Security_Detections_API_QueryRuleUpdateProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
      - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateFields'
    Security_Detections_API_BulkActionEditPayloadRuleActions:
      description: 'Edits rule actions of rules.


        - `add_rule_actions` adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exists for a rule, it will be added again with a new unique ID.

        - `set_rule_actions` sets rule actions for rules. This action is non-idempotent, meaning that even if the same set of rule actions already exists for a rule, it will be set again and the actions will receive new unique IDs.

        '
      type: object
      properties:
        type:
          enum:
          - add_rule_actions
          - set_rule_actions
          type: string
        value:
          type: object
          properties:
            actions:
              items:
                $ref: '#/components/schemas/Security_Detections_API_NormalizedRuleAction'
              type: array
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_ThrottleForBulkActions'
          required:
          - actions
      required:
      - type
      - value
    Security_Detections_API_MachineLearningRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
    Security_Detections_API_NewTermsRulePatchFields:
      allOf:
      - type: object
        properties:
          history_window_start:
            $ref: '#/components/schemas/Security_Detections_API_HistoryWindowStart'
          new_terms_fields:
            $ref: '#/components/schemas/Security_Detections_API_NewTermsFields'
          query:
            $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
          type:
            description: Rule type
            enum:
            - new_terms
            type: string
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields'
    Security_Detections_API_RuleReferenceArray:
      description: Array containing notes about or references to relevant information about the rule. Defaults to an empty array.
      items:
        type: string
      type: array
    Security_Detections_API_SavedQueryRuleResponseFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
      - type: object
        properties:
          language:
            $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
        required:
        - language
    Security_Detections_API_EqlOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        event_category_override:
          $ref: '#/components/schemas/Security_Detections_API_EventCategoryOverride'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        tiebreaker_field:
          $ref: '#/components/schemas/Security_Detections_API_TiebreakerField'
        timestamp_field:
          $ref: '#/components/schemas/Security_Detections_API_TimestampField'
    Security_Detections_API_BulkEditSkipReason:
      enum:
      - RULE_NOT_MODIFIED
      type: string
    Security_Detections_API_RuleSource:
      description: Discriminated union that determines whether the rule is internally sourced (created within the Kibana app) or has an external source, such as the Elastic Prebuilt rules repo.
      discriminator:
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/Security_Detections_API_ExternalRuleSource'
      - $ref: '#/components/schemas/Security_Detections_API_InternalRuleSource'
    Security_Detections_API_RiskScoreMapping:
      description: Overrides generated alerts' risk_score with a value from the source event
      items:
        type: object
        properties:
          field:
            description: Source event field used to override the default `risk_score`.
            type: string
          operator:
            enum:
            - equals
            type: string
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          value:
            type: string
        required:
        - field
        - operator
        - value
      type: array
    Security_Detections_API_RuleDescription:
      description: The rule’s description.
      example: Detects anomalous Windows process creation events.
      minLength: 1
      type: string
    Security_Detections_API_SavedQueryId:
      description: Kibana [saved search](https://www.elastic.co/docs/explore-analyze/discover/search-sessions) used by the rule to create alerts.
      type: string
    Security_Detections_API_SavedObjectResolveAliasTargetId:
      type: string
    Security_Detections_API_OsqueryParams:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Detections_API_EcsMapping'
        pack_id:
          description: 'To specify a query pack, use the packId field. Example: "packId": "processes_elastic"'
          type: string
        queries:
          items:
            $ref: '#/components/schemas/Security_Detections_API_OsqueryQuery'
          type: array
        query:
          description: 'To run a single query, use the query field and enter a SQL query. Example: "query": "SELECT * FROM processes;"'
          type: string
        saved_query_id:
          description: 'To run a saved query, use the saved_query_id field and specify the saved query ID. Example: "saved_query_id": "processes_elastic"'
          type: string
        timeout:
          description: 'A timeout period, in seconds, after which the query will stop running. Overwriting the default timeout allows you to support queries that require more time to complete. The default and minimum supported value is 60. The maximum supported value is 900. Example: "timeout": 120.'
          type: number
    Security_Detections_API_MachineLearningRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleResponseFields'
    Security_Detections_API_RuleActionGroup:
      description: Optionally groups actions by use cases. Use `default` for alert notifications.
      type: string
    Security_Detections_API_ThresholdRuleCreateFields:
      allOf:
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields'
    Security_Detections_API_EventCategoryOverride:
      type: string
    Security_Detections_API_NewTermsRulePatchProps:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          id:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_id:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRulePatchFields'
    Security_Detections_API_ThresholdRule:
      allOf:
      - type: object
        properties:
          actions:
            description: Array defining the automated actions (notifications) taken when alerts are generated.
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleAction'
            type: array
          alias_purpose:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
          alias_target_id:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
          author:
            $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
          building_block_type:
            $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
          description:
            $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
          enabled:
            $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
          exceptions_list:
            items:
              $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            type: array
          false_positives:
            $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
          from:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
          interval:
            $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
          investigation_fields:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
          license:
            $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
          max_signals:
            $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
          meta:
            $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
          name:
            $ref: '#/components/schemas/Security_Detections_API_RuleName'
          namespace:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
          note:
            $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
          outcome:
            $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
          output_index:
            $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
          references:
            $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
          related_integrations:
            $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
          required_fields:
            description: 'Elasticsearch fields and their types that need to be present for the rule to function.

              > info

              > The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.

              '
            items:
              $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
            type: array
          response_actions:
            items:
              $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            type: array
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          risk_score_mapping:
            $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
          rule_name_override:
            $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
          setup:
            $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          severity_mapping:
            $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
          tags:
            $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          threat:
            $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
          throttle:
            $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
          timeline_id:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
          timeline_title:
            $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
          timestamp_override:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
          timestamp_override_fallback_disabled:
            $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
          to:
            $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
          version:
            $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        required:
        - name
        - description
        - risk_score
        - severity
        - version
        - tags
        - enabled
        - risk_score_mapping
        - severity_mapping
        - interval
        - from
        - to
        - actions
        - exceptions_list
        - author
        - false_positives
        - references
        - max_signals
        - threat
        - setup
        - related_integrations
        - required_fields
      - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleResponseFields'
    Security_Detections_API_IsRuleImmutable:
      deprecated: true
      description: This field determines whether the rule is a prebuilt Elastic rule. It will be replaced with the `rule_source` field.
      type: boolean
    Security_Detections_API_SetAlertTags:
      description: Object with list of tags to add and remove.
      type: object
      properties:
        tags_to_add:
          $ref: '#/components/schemas/Security_Detections_API_AlertTags'
        tags_to_remove:
          $ref: '#/components/schemas/Security_Detections_API_AlertTags'
      required:
      - tags_to_add
      - tags_to_remove
    Security_Detections_API_EqlQueryLanguage:
      enum:
      - eql
      type: string
    Security_Detections_API_BulkGapsFillingSkipReason:
      enum:
      - NO_GAPS_TO_FILL
      type: string
    Security_Detections_API_IsExternalRuleCustomized:
      description: Determines whether an external/prebuilt rule has been customized by the user (i.e. any of its fields have been modified and diverged from the base value).
      type: boolean
    Security_Detections_API_BulkActionEditPayloadIndexPatterns:
      description: 'Edits index patterns of rulesClient.


        - `add_index_patterns` adds index patterns to rules. If an index pattern already exists for a rule, no changes are made.

        - `delete_index_patterns` removes index patterns from rules. If an index pattern does not exist for a rule, no changes are made.

        - `set_index_patterns` sets index patterns for rules, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.

        '
      type: object
      properties:
        overwrite_data_views:
          description: Resets the data view for the rule.
          type: boolean
        type:
          enum:
          - add_index_patterns
          - delete_index_patterns
          - set_index_patterns
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
      required:
      - type
      - value
    Security_Detections_API_RuleResponse:
      anyOf:
      - $ref: '#/components/schemas/Security_Detections_API_EqlRule'
      - $ref: '#/components/schemas/Security_Detections_API_QueryRule'
      - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRule'
      - $ref: '#/components/schemas/Security_Detections_API_ThresholdRule'
      - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRule'
      - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRule'
      - $ref: '#/components/schemas/Security_Detections_API_NewTermsRule'
      - $ref: '#/components/schemas/Security_Detections_API_EsqlRule'
      discriminator:
        mapping:
          eql: '#/components/schemas/Security_Detections_API_EqlRule'
          esql: '#/components/schemas/Security_Detections_API_EsqlRule'
          machine_learning: '#/components/schemas/Security_Detections_API_MachineLearningRule'
          new_terms: '#/components/schemas/Security_Detections_API_NewTermsRule'
          query: '#/components/schemas/Security_Detections_API_QueryRule'
          saved_query: '#/components/schemas/Security_Detections_API_SavedQueryRule'
          threat_match: '#/components/schemas/Security_Detections_API_ThreatMatchRule'
          threshold: '#/components/schemas/Security_Detections_API_ThresholdRule'
        propertyName: type
    Security_Detections_API_HistoryWindowStart:
      description: Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.
      format: nonempty
      minLength: 1
      type: string
    Security_Detections_API_ExternalRuleCustomizedFields:
      description: An array of customized field names — that is, fields that the user has modified from their base value. Defaults to an empty array.
      items:
        type: object
        properties:
          field_name:
            description: Name of a user-modified field in the rule object.
            type: string
        required:
        - field_name
      type: array
    Security_Detections_API_RulePreviewLogs:
      type: object
      properties:
        duration:
          description: Execution duration in milliseconds
          type: integer
        errors:
          items:
            $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
          type: array
        requests:
          items:
            $ref: '#/components/schemas/Security_Detections_API_RulePreviewLoggedRequest'
          type: array
        startedAt:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        warnings:
          items:
            $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
          type: array
      required:
      - errors
      - warnings
      - duration
    Security_Detections_API_RuleActionParams:
      additionalProperties: true
      description: "Object containing the allowed connector fields, which varies according to the connector type.\n\nFor Slack:\n\n  - `message` (string, required): The notification message.\n\nFor email:\n\n  - `to`, `cc`, `bcc` (string): Email addresses to which the notifications are sent. At least one field must have a value.\n  - `subject` (string, optional): Email subject line.\n  - `message` (string, required): Email body text.\n\nFor Webhook:\n\n  - `body` (string, required): JSON payload.\n\nFor PagerDuty:\n\n  - `severity` (string, required): Severity of on the alert notification, can be: `Critical`, `Error`, `Warning` or `Info`.\n  - `eventAction` (string, required): Event [action type](https://v2.developer.pagerduty.com/docs/events-api-v2#event-action), which can be `trigger`, `resolve`, or `acknowledge`.\n  - `dedupKey` (string, optional): Groups alert notifications with the same PagerDuty alert.\n  - `timestamp` (DateTime, optional): ISO-8601 format [timestamp](https://v2.developer.pagerduty.com/docs/types#datetime).\n  - `component` (string, optional): Source machine component responsible for the event, for example `security-solution`.\n  - `group` (string, optional): Enables logical grouping of service components.\n  - `source` (string, optional): The affected system. Defaults to the Kibana saved object ID of the action.\n  - `summary` (string, options): Summary of the event. Defaults to `No summary provided`. Maximum length is 1024 characters.\n  - `class` (string, optional): Value indicating the class/type of the event.\n"
      type: object
    Security_Detections_API_NormalizedRuleError:
      type: object
      properties:
        err_code:
          $ref: '#/components/schemas/Security_Detections_API_BulkActionsDryRunErrCode'
        message:
          type: string
        rules:
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleDetailsInError'
          type: array
        status_code:
          type: integer
      required:
      - message
      - status_code
      - rules
    Security_Detections_API_BulkActionEditPayloadInvestigationFields:
      description: 'Edits investigation fields of rules.


        - `add_investigation_fields` adds investigation fields to rules. If an investigation field already exists for a rule, no changes are made.

        - `delete_investigation_fields` removes investigation fields from rules. If an investigation field does not exist for a rule, no changes are made.

        - `set_investigation_fields` sets investigation fields for rules. If the set of investigation fields is the same as the existing investigation fields, no changes are made.

        '
      type: object
      properties:
        type:
          enum:
          - add_investigation_fields
          - delete_investigation_fields
          - set_investigation_fields
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
      required:
      - type
      - value
    Security_Detections_API_IsRuleEnabled:
      description: Determines whether the rule is enabled. Defaults to true.
      type: boolean
    Security_Detections_API_RuleTagArray:
      description: String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array.
      items:
        type: string
      type: array
    Security_Detections_API_ThresholdRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_RuleMetadata:
      additionalProperties: true
      description: 'Placeholder for metadata about the rule.

        > info

        > This field is overwritten when you save changes to the rule’s settings.

        '
      type: object
  examples:
    Security_Detections_API_SetAlertTagsBodyRemove:
      value:
        ids:
        - 549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
        tags:
          tags_to_add: []
          tags_to_remove:
          - Duplicate
    Security_Detections_API_SetAlertAssigneesBodyAdd:
      value:
        assignees:
          add:
          - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
          remove: []
        ids:
        - 681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
    Security_Detections_API_SetAlertAssigneesBodyRemove:
      value:
        assignees:
          add: []
          remove:
          - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
        ids:
        - 681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
    Security_Detections_API_SetAlertTagsBodyAdd:
      value:
        ids:
        - 549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
        tags:
          tags_to_add:
          - Duplicate
          tags_to_remove: []
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"