stack kb security-detections-api perform-rules-bulk-action cli command

Auth required 
elastic stack kb security-detections-api perform-rules-bulk-action \
  --action <action> \
  [options]

Apply a bulk action to detection rules

--action enum required

Values: edit

--dry-run

Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter dry_run=true to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.

info Dry run mode is not supported for the export bulk action. A 400 error will be returned in the request response.

--gap-auto-fill-scheduler-id string
Gap auto fill scheduler ID used to determine gap fill status for rules
--gap-fill-statuses string[]

Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).

Repeatable: pass --gap-fill-statuses multiple times to supply more than one value

--gaps-range-end string
Gaps range end, valid only when query is provided
--gaps-range-start string
Gaps range start, valid only when query is provided
--ids string[]

Array of rule ids to which a bulk action will be applied. Do not use rule's rule_id here. Only valid when query property is undefined.

Repeatable: pass --ids multiple times to supply more than one value

--query string
Query to filter rules.
--duplicate string
Duplicate object that describes applying an update action.
--run string
Object that describes applying a manual rule run action.
--fill-gaps string
Object that describes applying a manual gap fill action for the specified time range.
--edit string[]

Array of objects containing the edit operations

Repeatable: pass --edit multiple times to supply more than one value

--input-file string
path to a JSON file to use as command input
--json

output as JSON