Security detections
Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the Alerts page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.
If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.
If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.