IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [7.16] ›Elastic Security APIs ›Detections API
« Tags endpoint Export rules »

Import rulesedit

Imports rules from an .ndjson file.

Console supports Elasticsearch APIs only. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests. Please also note this API supports Token-based authentication only.

Detection rule actions are included in the exported file, but the connectors used by the actions are not included.

Use the Saved Objects UI in Kibana (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to export and import any connectors used by your detection rule actions before you export and import the detection rules.

Request URLedit

POST <kibana host>:<port>/api/detection_engine/rules/_import

The request must include:

  • The Content-Type: multipart/form-data HTTP header.
  • A link to the .ndjson file containing the rules.

For example, using cURL:

curl -X POST "<KibanaURL>/api/detection_engine/rules/_import"
-u <username>:<password> -H 'kbn-xsrf: true'
-H 'Content-Type: multipart/form-data'
--form "file=@<link to file>"

The relative link to the .ndjson file containing the rules.

URL query parametersedit

Name Type Description Required

overwrite

Boolean

Determines whether existing rules with the same rule_id are overwritten.

No, defaults to false.

Example requestedit

Imports the rules in the detection_rules.ndjson file and overwrites existing rules with the same rule_id values:

curl -X POST "api/detection_engine/rules/_import?overwrite=true"
-H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data'
--form "file=@detection_rules.ndjson"

Response codeedit

200
Indicates a successful call.
« Tags endpoint Export rules »