PUT /api/detection_engine/rules
Api key auth Basic auth

Spaces method and path for this operation:

put /s/{space_id}/api/detection_engine/rules

Refer to Spaces for more information.

Update a detection rule using the rule_id or id field. The original rule is replaced, and all unspecified fields are deleted.

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

application/json

Body object Required


All unspecified fields are deleted. You cannot modify the id or rule_id values.

Any of:
Security_Detections_API_EqlRuleUpdateProps object Security_Detections_API_QueryRuleUpdateProps object Security_Detections_API_SavedQueryRuleUpdateProps object Security_Detections_API_ThresholdRuleUpdateProps object Security_Detections_API_ThreatMatchRuleUpdateProps object Security_Detections_API_MachineLearningRuleUpdateProps object Security_Detections_API_NewTermsRuleUpdateProps object Security_Detections_API_EsqlRuleUpdateProps object

Responses

  • 200 application/json

    Indicates a successful call.

    Any of:
    Security_Detections_API_EqlRule object Security_Detections_API_QueryRule object Security_Detections_API_SavedQueryRule object Security_Detections_API_ThresholdRule object Security_Detections_API_ThreatMatchRule object Security_Detections_API_MachineLearningRule object Security_Detections_API_NewTermsRule object Security_Detections_API_EsqlRule object
PUT /api/detection_engine/rules 
curl \
 --request PUT 'https://localhost:5601/api/detection_engine/rules' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"description":"A new description","id":"14b7b513-3d8d-4b22-b7da-a7ae632f7e76","name":"A new name for the rule","risk_score":22,"severity":"medium","type":"query"}'
Request examples 
{
  "description": "A new description",
  "id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76",
  "name": "A new name for the rule",
  "risk_score": 22,
  "severity": "medium",
  "type": "query"
}
{
  "description": "eql rule test",
  "id": "9b684efb-acf9-4323-9bff-8335b3867d14",
  "index": [
    "apm-*-transaction*"
  ],
  "language": "eql",
  "name": "New name for EQL rule",
  "query": "process where process.name == \"regsvr32.exe\"",
  "risk_score": 21,
  "severity": "low",
  "type": "eql"
}
{
  "description": "Description of threat rule test",
  "id": "005d2c4f-51ca-493d-a2bd-20ef076339b1",
  "language": "kuery",
  "name": "New name for threat rule",
  "query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"",
  "risk_score": 21,
  "severity": "low",
  "tags": [
    "new_tag"
  ],
  "threshold": {
    "cardinality": [],
    "field": [],
    "value": 400
  },
  "type": "threshold"
}
{
  "description": "New description",
  "history_window_start": "now-7d",
  "id": "569aac91-40dc-4807-a8ae-a2c8698089c4",
  "interval": "5m",
  "name": "New terms rule name",
  "new_terms_fields": [
    "Endpoint.policy.applied.artifacts.global.identifiers.name"
  ],
  "query": "agent.version : \"9.1.0\"",
  "risk_score": 21,
  "severity": "low",
  "type": "new_terms"
}
{
  "description": "New description for esql rule",
  "id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd",
  "language": "esql",
  "name": "New name for esql rule",
  "query": "FROM logs*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */\n| KEEP event_rate\n",
  "risk_score": 21,
  "severity": "low",
  "type": "esql"
}
{
  "description": "New description",
  "id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd",
  "name": "New name for Indicator Match rule",
  "query": "source.ip:* or destination.ip:*\\n",
  "risk_score": 99,
  "severity": "critical",
  "threat_index": [
    "filebeat-*",
    "logs-ti_*"
  ],
  "threat_mapping": [
    {
      "entries": [
        {
          "field": "source.ip",
          "type": "mapping",
          "value": "threat.indicator.ip"
        }
      ]
    },
    {
      "entries": [
        {
          "field": "destination.ip",
          "type": "mapping",
          "value": "threat.indicator.ip"
        }
      ]
    }
  ],
  "threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"",
  "type": "threat_match"
}
{
  "anomaly_threshold": 50,
  "description": "New description of ml rule",
  "id": "60b13926-289b-41b1-a537-197ef1fa5059",
  "machine_learning_job_id": [
    "auth_high_count_logon_events"
  ],
  "name": "New name of ml rule",
  "risk_score": 21,
  "severity": "low",
  "type": "machine_learning"
}
Response examples (200) 
{
  "actions": [],
  "created_at": "2020-04-07T14:51:09.755Z",
  "created_by": "elastic",
  "description": "Updated description for the rule.",
  "enabled": false,
  "false_positives": [],
  "filters": [
    {
      "query": null
    }
  ],
  "from": "now-70m",
  "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
  "immutable": false,
  "interval": "1h",
  "language": "kuery",
  "max_signals": 100,
  "name": "Updated Rule Name",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "references": [],
  "related_integrations": [
    {
      "package": "o365"
    }
  ],
  "required_fields": [
    {
      "name": "process.parent.name"
    }
  ],
  "risk_score": 50,
  "rule_id": "process_started_by_ms_office_program",
  "setup": "",
  "severity": "low",
  "tags": [
    "child process",
    "ms office"
  ],
  "threat": [],
  "to": "now",
  "type": "query",
  "updated_at": "2020-04-07T14:51:09.970Z",
  "updated_by": "elastic",
  "version": 2
}