Imports rules from an
Detection rule actions are included in the exported file, but the connectors used by the actions are not included.
Use the Saved Objects UI in Kibana (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to export and import any connectors used by your detection rule actions before you export and import the detection rules.
POST <kibana host>:<port>/api/detection_engine/rules/_import
The request must include:
Content-Type: multipart/form-dataHTTP header.
A link to the
.ndjsonfile containing the rules.
For example, using cURL:
Determines whether existing rules with the same
No, defaults to
Imports the rules in the
detection_rules.ndjson file and overwrites
existing rules with the same
curl -X POST "api/detection_engine/rules/_import?overwrite=true" -H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data' --form "file=@detection_rules.ndjson"
- Indicates a successful call.