GET /api/detection_engine/rules/_find
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/detection_engine/rules/_find

Refer to Spaces for more information.

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

Query parameters

  • fields array[string]

    List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or use comma-separated values when supported by your client.

  • filter string

    Search query

    Filters the returned results according to the value of the specified field, using the alert.attributes.: syntax, where can be:

    • name
    • enabled
    • tags
    • createdBy
    • interval
    • updatedBy

    Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

  • sort_field string

    Field to sort by

    Values are created_at, createdAt, enabled, execution_summary.last_execution.date, execution_summary.last_execution.metrics.execution_gap_duration_s, execution_summary.last_execution.metrics.total_indexing_duration_ms, execution_summary.last_execution.metrics.total_search_duration_ms, execution_summary.last_execution.status, name, risk_score, riskScore, severity, updated_at, or updatedAt.

  • sort_order string

    Sort order

    Values are asc or desc.

  • page integer

    Page number

    Minimum value is 1. Default value is 1.

  • per_page integer

    Rules per page

    Minimum value is 0. Default value is 20.

  • gaps_range_start string

    Gaps range start

  • gaps_range_end string

    Gaps range end

  • gap_fill_statuses array[string]

    Gap fill statuses

    Values are unfilled, in_progress, filled, or error.

  • gap_auto_fill_scheduler_id string

    Gap auto fill scheduler ID used to determine gap fill status for rules

Responses

  • 200 application/json

    Successful response

    These fields are under development and their usage or schema may change: execution_summary.

    Hide response attributes Show response attributes object
    • data array[object] Required
      Any of:
      eql object query object saved_query object threshold object threat_match object machine_learning object new_terms object esql object
    • page integer Required
    • perPage integer Required
    • total integer Required
    • warnings array[object]
      Hide warnings attributes Show warnings attributes object
      • actionPath string Required
      • buttonLabel string
      • message string Required
      • type string Required
GET /api/detection_engine/rules/_find 
curl -X GET "localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows" -H 'kbn-xsrf: true'
Response examples (200) 
{
  "data": [
    {
      "created_at": "2020-02-02T10:05:19.613Z",
      "created_by": "elastic",
      "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.",
      "enabled": false,
      "execution_summary": {
        "last_execution": {
          "date": "2022-03-23T16:06:12.787Z",
          "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
          "metrics": {
            "execution_gap_duration_s": 0,
            "total_indexing_duration_ms": 15,
            "total_search_duration_ms": 135
          },
          "status": "partial failure",
          "status_order": 20
        }
      },
      "false_positives": [],
      "from": "now-6m",
      "id": "89761517-fdb0-4223-b67b-7621acc48f9e",
      "immutable": true,
      "index": [
        "winlogbeat-*"
      ],
      "interval": "5m",
      "language": "kuery",
      "max_signals": 33,
      "name": "Windows Script Executing PowerShell",
      "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"",
      "references": [],
      "related_integrations": [
        {
          "package": "o365",
          "version": "^2.3.2"
        }
      ],
      "required_fields": [
        {
          "ecs": true,
          "name": "event.action",
          "type": "keyword"
        },
        {
          "ecs": true,
          "name": "process.name",
          "type": "keyword"
        },
        {
          "ecs": true,
          "name": "process.parent.name",
          "type": "keyword"
        }
      ],
      "risk_score": 21,
      "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc",
      "setup": "",
      "severity": "low",
      "tags": [
        "Elastic",
        "Windows"
      ],
      "threat": [
        {
          "framework": "MITRE ATT&CK",
          "tactic": {
            "id": "TA0002",
            "name": "Execution",
            "reference": "https://attack.mitre.org/tactics/TA0002/"
          },
          "technique": [
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "reference": "https://attack.mitre.org/techniques/T1193/"
            }
          ]
        }
      ],
      "to": "now",
      "type": "query",
      "updated_at": "2020-02-02T10:05:19.830Z",
      "updated_by": "elastic"
    }
  ],
  "page": 1,
  "perPage": 5,
  "total": 4
}