Retrieve the status of detection alert migrations Deprecated

GET /api/detection_engine/signals/migration_status
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/detection_engine/signals/migration_status

Refer to Spaces for more information.

DEPRECATED. This endpoint was used for historical .siem-signals-* index migration workflows. Do not use for new automations; there is no supported replacement in this public API. WARNING: Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations.

Retrieves indices that contain detection alerts of a particular age, along with migration information for each of those indices.

Query parameters

  • from string(date-math) Required

    Maximum age of qualifying detection alerts

Responses

  • 200 application/json

    Successful response

    Hide response attribute Show response attribute object
    • indices array[object] Required
      Hide indices attributes Show indices attributes object
      • index string(nonempty) Required

        A string that does not contain only whitespace characters

        Minimum length is 1.

      • is_outdated boolean Required
      • migrations array[object] Required
        Hide migrations attributes Show migrations attributes object
        • id string(nonempty) Required

          A string that does not contain only whitespace characters

          Minimum length is 1.

        • status string Required

          Values are success, failure, or pending.

        • updated string(date-time) Required
        • version integer Required
      • signal_versions array[object] Required
        Hide signal_versions attributes Show signal_versions attributes object
        • count integer Required
        • version integer Required
      • version integer Required
  • 400 application/json

    Invalid input data response

    One of:
    Security_Detections_API_PlatformErrorResponse object Security_Detections_API_SiemErrorResponse object
  • 401 application/json

    Unsuccessful authentication response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 500 application/json

    Internal server error response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
GET /api/detection_engine/signals/migration_status 
curl \
 --request GET 'https://localhost:5601/api/detection_engine/signals/migration_status?from=now-30d' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "indices": [
    {
      "index": ".siem-signals-default-000002",
      "is_outdated": true,
      "migrations": [
        {
          "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
          "status": "pending",
          "updated": "2021-01-06T20:41:37.173Z",
          "version": 16
        }
      ],
      "signal_versions": [
        {
          "count": 100,
          "version": 15
        },
        {
          "count": 87,
          "version": 16
        }
      ],
      "version": 15
    },
    {
      "index": ".siem-signals-default-000003",
      "is_outdated": false,
      "migrations": [],
      "signal_versions": [
        {
          "count": 54,
          "version": 16
        }
      ],
      "version": 16
    }
  ]
}
Response examples (400) 
{
  "error": "Bad Request",
  "message": "[request query].from: expected date-math, received null",
  "statusCode": 400
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
Response examples (500) 
{
  "message": "Internal Server Error",
  "status_code": 500
}