Import rulesedit

Imports rules from an .ndjson file. The following configuration items are also included in the .ndjson file:

  • Actions
  • Exception lists

This API supports Token-based authentication only.

You need at least Read privileges for the Action and Connectors feature to import rules with actions. If you’re importing rules without actions, Action and Connectors feature privileges are not required. Refer to Enable and access detections for more information.

Although detection rule actions are included in the exported file, the connectors used by the actions are not included. Use the Saved Objects UI in Kibana (Stack ManagementKibanaSaved Objects) or the Saved Objects APIs (experimental) to export and import any necessary connectors before you export and import the detection rules.

Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the Import value lists UI (ManageRulesImport value lists) to export and import value lists separately.

Request URLedit

POST <kibana host>:<port>/api/detection_engine/rules/_import

The request must include:

  • The Content-Type: multipart/form-data HTTP header.
  • A link to the .ndjson file containing the rules.

For example, using cURL:

curl -X POST "<KibanaURL>/api/detection_engine/rules/_import"
-u <username>:<password> -H 'kbn-xsrf: true'
-H 'Content-Type: multipart/form-data'
--form "file=@<link to file>" 

The relative link to the .ndjson file containing the rules.

URL query parametersedit

Name Type Description Required



Determines whether existing rules with the same rule_id are overwritten.

No, defaults to false.



Determines whether existing exception lists with the same list_id are overwritten. Both the exception list container and its items are overwritten.

No, defaults to false.

Example requestedit

Imports the rules in the detection_rules.ndjson file and overwrites existing rules with the same rule_id values:

curl -X POST "api/detection_engine/rules/_import?overwrite=true"
-H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data'
--form "file=@detection_rules.ndjson"

Response codeedit

Indicates a successful call.

Example responseedit

    "success": true,
    "success_count": 1,
    "rules_count": 1,
    "errors": [],
    "exceptions_errors": [],
    "exceptions_success": true,
    "exceptions_success_count": 0