Initialize security solution flows

POST /api/security_solution/initialize

Spaces method and path for this operation:

post /s/{space_id}/api/security_solution/initialize

Refer to Spaces for more information.

Run one or more Security Solution initialization flows for the current space. Each flow provisions a specific set of assets, for example list indices, security data views, prebuilt detection rules, endpoint protection, AI prompts, or detection rule monitoring assets. Only the requested flows are run, and the response reports a result for each one.

application/json

Body Required

The initialization flows to run.

flows array[string] Required

Identifier for an initialization flow.

At least 1 element. Values are create-list-indices, security-data-views, init-prebuilt-rules, init-endpoint-protection, init-ai-prompts, or init-detection-rule-monitoring.

Responses

200 application/json

Indicates a successful call. Returns a result for each requested flow.
Hide response attribute Show response attribute object
- flows object Required
  
  Per-flow results. Only requested flows appear in the response, so all properties are optional. Each flow is either a typed ready result or an error result.
  
  Hide flows attributes Show flows attributes object
  
  create-list-indices object
  
  One of:
  Security_Solution_Initialization_API_CreateListIndicesReadyResult object Security_Solution_Initialization_API_InitializationFlowErrorResult object
  
  init-ai-prompts object
  
  One of:
  Security_Solution_Initialization_API_PackageInstallReadyResult object Security_Solution_Initialization_API_InitializationFlowErrorResult object
  
  Hide attributes Show attributes
  
  payload object Required
  
  Hide payload attributes Show payload attributes object
  
  install_status string Required
  
  Fleet package installation status (e.g., installed, already_installed).
  
  name string Required
  
  version string Required
  
  status string Required
  
  Value is ready.
  
  init-detection-rule-monitoring object
  
  One of:
  Security_Solution_Initialization_API_InstallDetectionEngineRuleMonitoringAssetsReadyResult object Security_Solution_Initialization_API_InitializationFlowErrorResult object
  
  init-endpoint-protection object
  
  One of:
  Security_Solution_Initialization_API_PackageInstallReadyResult object Security_Solution_Initialization_API_InitializationFlowErrorResult object
  
  Hide attributes Show attributes
  
  payload object Required
  
  Hide payload attributes Show payload attributes object
  
  install_status string Required
  
  Fleet package installation status (e.g., installed, already_installed).
  
  name string Required
  
  version string Required
  
  status string Required
  
  Value is ready.
  
  init-prebuilt-rules object
  
  One of:
  Security_Solution_Initialization_API_PackageInstallReadyResult object Security_Solution_Initialization_API_InitializationFlowErrorResult object
  
  Hide attributes Show attributes
  
  payload object Required
  
  Hide payload attributes Show payload attributes object
  
  install_status string Required
  
  Fleet package installation status (e.g., installed, already_installed).
  
  name string Required
  
  version string Required
  
  status string Required
  
  Value is ready.
  
  security-data-views object
  
  One of:
  Security_Solution_Initialization_API_SecurityDataViewsReadyResult object Security_Solution_Initialization_API_InitializationFlowErrorResult object
  
  Hide attributes Show attributes
  
  payload object Required
  
  Hide payload attributes Show payload attributes object
  
  alertDataView object Required
  
  Hide alertDataView attributes Show alertDataView attributes object
  
  id string Required
  
  patternList array[string] Required
  
  title string Required
  
  attackDataView object
  
  Hide attackDataView attributes Show attackDataView attributes object
  
  id string Required
  
  patternList array[string] Required
  
  title string Required
  
  defaultDataView object Required
  
  Hide defaultDataView attributes Show defaultDataView attributes object
  
  id string Required
  
  patternList array[string] Required
  
  title string Required
  
  kibanaDataViews array[object] Required
  
  Hide kibanaDataViews attributes Show kibanaDataViews attributes object
  
  id string Required
  
  patternList array[string] Required
  
  title string Required
  
  signalIndexName string Required
  
  status string Required
  
  Value is ready.

POST /api/security_solution/initialize

curl \
 --request POST 'https://localhost:5601/api/security_solution/initialize' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"flows\": [\n    \"init-prebuilt-rules\",\n    \"init-endpoint-protection\",\n    \"init-ai-prompts\"\n  ]\n}"'

Request example

{
  "flows": [
    "init-prebuilt-rules",
    "init-endpoint-protection",
    "init-ai-prompts"
  ]
}

Response examples (200)

{
  "flows": {
    "init-ai-prompts": {
      "payload": {
        "install_status": "installed",
        "name": "security_ai_prompts",
        "version": "8.17.1"
      },
      "status": "ready"
    },
    "init-endpoint-protection": {
      "payload": {
        "install_status": "already_installed",
        "name": "endpoint",
        "version": "8.17.1"
      },
      "status": "ready"
    },
    "init-prebuilt-rules": {
      "payload": {
        "install_status": "installed",
        "name": "security_detection_engine",
        "version": "8.17.1"
      },
      "status": "ready"
    }
  }
}