Apply a bulk action to detection rules Beta

POST /api/detection_engine/rules/_bulk_action

Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.

Query parameters

  • dry_run boolean

    Enables dry run mode for the request call.

application/json; Elastic-Api-Version=2023-10-31

Body object

One of:

Responses

  • 200 application/json; Elastic-Api-Version=2023-10-31

    OK

    One of:
POST /api/detection_engine/rules/_bulk_action
curl \
 -X POST https://localhost:5601/api/detection_engine/rules/_bulk_action \
 -H "Content-Type: application/json; Elastic-Api-Version=2023-10-31"
{
  "action": "delete",
  "ids": [
    "string"
  ],
  "query": "string"
}
{
  "action": "disable",
  "ids": [
    "string"
  ],
  "query": "string"
}
{
  "action": "enable",
  "ids": [
    "string"
  ],
  "query": "string"
}
{
  "action": "export",
  "ids": [
    "string"
  ],
  "query": "string"
}
{
  "action": "duplicate",
  "duplicate": {
    "include_exceptions": true,
    "include_expired_exceptions": true
  },
  "ids": [
    "string"
  ],
  "query": "string"
}
{
  "action": "run",
  "ids": [
    "string"
  ],
  "query": "string",
  "run": {
    "end_date": "string",
    "start_date": "string"
  }
}
{
  "action": "edit",
  "edit": [
    {
      "type": "add_tags",
      "value": [
        "string"
      ]
    }
  ],
  "ids": [
    "string"
  ],
  "query": "string"
}
Response examples (200)
{
  "attributes": {
    "errors": [
      {
        "err_code": "IMMUTABLE",
        "message": "string",
        "rules": [
          {
            "id": "string",
            "name": "string"
          }
        ],
        "status_code": 42
      }
    ],
    "results": {
      "created": [
        {
          "actions": [
            {
              "action_type_id": "string",
              "alerts_filter": {},
              "frequency": {
                "notifyWhen": "onActiveAlert",
                "summary": true,
                "throttle": "no_actions"
              },
              "group": "string",
              "id": "string",
              "params": {},
              "uuid": "string"
            }
          ],
          "alias_purpose": "savedObjectConversion",
          "alias_target_id": "string",
          "author": [
            "string"
          ],
          "building_block_type": "string",
          "description": "string",
          "enabled": true,
          "exceptions_list": [
            {
              "id": "string",
              "list_id": "string",
              "namespace_type": "agnostic",
              "type": "detection"
            }
          ],
          "false_positives": [
            "string"
          ],
          "from": "string",
          "interval": "string",
          "investigation_fields": {
            "field_names": [
              "string"
            ]
          },
          "license": "string",
          "max_signals": 42,
          "meta": {},
          "name": "string",
          "namespace": "string",
          "note": "string",
          "outcome": "exactMatch",
          "output_index": "string",
          "references": [
            "string"
          ],
          "related_integrations": [
            {
              "integration": "string",
              "package": "string",
              "version": "string"
            }
          ],
          "required_fields": [
            {
              "ecs": true,
              "name": "string",
              "type": "string"
            }
          ],
          "response_actions": [
            {
              "action_type_id": ".osquery",
              "params": {
                "ecs_mapping": {
                  "additionalProperty1": {
                    "field": "string",
                    "value": "string"
                  },
                  "additionalProperty2": {
                    "field": "string",
                    "value": "string"
                  }
                },
                "pack_id": "string",
                "queries": [
                  {
                    "ecs_mapping": {
                      "additionalProperty1": {
                        "field": "string",
                        "value": "string"
                      },
                      "additionalProperty2": {
                        "field": "string",
                        "value": "string"
                      }
                    },
                    "id": "string",
                    "platform": "string",
                    "query": "string",
                    "removed": true,
                    "snapshot": true,
                    "version": "string"
                  }
                ],
                "query": "string",
                "saved_query_id": "string",
                "timeout": 42.0
              }
            }
          ],
          "risk_score": 42,
          "risk_score_mapping": [
            {
              "field": "string",
              "operator": "equals",
              "risk_score": 42,
              "value": "string"
            }
          ],
          "rule_name_override": "string",
          "setup": "string",
          "severity": "low",
          "severity_mapping": [
            {
              "field": "string",
              "operator": "equals",
              "severity": "low",
              "value": "string"
            }
          ],
          "tags": [
            "string"
          ],
          "threat": [
            {
              "framework": "string",
              "tactic": {
                "id": "string",
                "name": "string",
                "reference": "string"
              },
              "technique": [
                {
                  "id": "string",
                  "name": "string",
                  "reference": "string",
                  "subtechnique": [
                    {
                      "id": "string",
                      "name": "string",
                      "reference": "string"
                    }
                  ]
                }
              ]
            }
          ],
          "throttle": "no_actions",
          "timeline_id": "string",
          "timeline_title": "string",
          "timestamp_override": "string",
          "timestamp_override_fallback_disabled": true,
          "to": "string",
          "version": 42,
          "created_at": "2024-05-04T09:42:00+00:00",
          "created_by": "string",
          "execution_summary": {
            "last_execution": {
              "date": "2024-05-04T09:42:00+00:00",
              "message": "string",
              "metrics": {
                "execution_gap_duration_s": 42,
                "total_enrichment_duration_ms": 42,
                "total_indexing_duration_ms": 42,
                "total_search_duration_ms": 42
              },
              "status": "going to run",
              "status_order": 42
            }
          },
          "id": "string",
          "immutable": true,
          "revision": 42,
          "rule_id": "string",
          "rule_source": {
            "is_customized": true,
            "type": "external"
          },
          "updated_at": "2024-05-04T09:42:00+00:00",
          "updated_by": "string",
          "language": "eql",
          "query": "string",
          "type": "eql",
          "alert_suppression": {
            "duration": {
              "unit": "s",
              "value": 42
            },
            "group_by": [
              "string"
            ],
            "missing_fields_strategy": "doNotSuppress"
          },
          "data_view_id": "string",
          "event_category_override": "string",
          "filters": [],
          "index": [
            "string"
          ],
          "tiebreaker_field": "string",
          "timestamp_field": "string"
        }
      ],
      "deleted": [
        {
          "actions": [
            {
              "action_type_id": "string",
              "alerts_filter": {},
              "frequency": {
                "notifyWhen": "onActiveAlert",
                "summary": true,
                "throttle": "no_actions"
              },
              "group": "string",
              "id": "string",
              "params": {},
              "uuid": "string"
            }
          ],
          "alias_purpose": "savedObjectConversion",
          "alias_target_id": "string",
          "author": [
            "string"
          ],
          "building_block_type": "string",
          "description": "string",
          "enabled": true,
          "exceptions_list": [
            {
              "id": "string",
              "list_id": "string",
              "namespace_type": "agnostic",
              "type": "detection"
            }
          ],
          "false_positives": [
            "string"
          ],
          "from": "string",
          "interval": "string",
          "investigation_fields": {
            "field_names": [
              "string"
            ]
          },
          "license": "string",
          "max_signals": 42,
          "meta": {},
          "name": "string",
          "namespace": "string",
          "note": "string",
          "outcome": "exactMatch",
          "output_index": "string",
          "references": [
            "string"
          ],
          "related_integrations": [
            {
              "integration": "string",
              "package": "string",
              "version": "string"
            }
          ],
          "required_fields": [
            {
              "ecs": true,
              "name": "string",
              "type": "string"
            }
          ],
          "response_actions": [
            {
              "action_type_id": ".osquery",
              "params": {
                "ecs_mapping": {
                  "additionalProperty1": {
                    "field": "string",
                    "value": "string"
                  },
                  "additionalProperty2": {
                    "field": "string",
                    "value": "string"
                  }
                },
                "pack_id": "string",
                "queries": [
                  {
                    "ecs_mapping": {
                      "additionalProperty1": {
                        "field": "string",
                        "value": "string"
                      },
                      "additionalProperty2": {
                        "field": "string",
                        "value": "string"
                      }
                    },
                    "id": "string",
                    "platform": "string",
                    "query": "string",
                    "removed": true,
                    "snapshot": true,
                    "version": "string"
                  }
                ],
                "query": "string",
                "saved_query_id": "string",
                "timeout": 42.0
              }
            }
          ],
          "risk_score": 42,
          "risk_score_mapping": [
            {
              "field": "string",
              "operator": "equals",
              "risk_score": 42,
              "value": "string"
            }
          ],
          "rule_name_override": "string",
          "setup": "string",
          "severity": "low",
          "severity_mapping": [
            {
              "field": "string",
              "operator": "equals",
              "severity": "low",
              "value": "string"
            }
          ],
          "tags": [
            "string"
          ],
          "threat": [
            {
              "framework": "string",
              "tactic": {
                "id": "string",
                "name": "string",
                "reference": "string"
              },
              "technique": [
                {
                  "id": "string",
                  "name": "string",
                  "reference": "string",
                  "subtechnique": [
                    {
                      "id": "string",
                      "name": "string",
                      "reference": "string"
                    }
                  ]
                }
              ]
            }
          ],
          "throttle": "no_actions",
          "timeline_id": "string",
          "timeline_title": "string",
          "timestamp_override": "string",
          "timestamp_override_fallback_disabled": true,
          "to": "string",
          "version": 42,
          "created_at": "2024-05-04T09:42:00+00:00",
          "created_by": "string",
          "execution_summary": {
            "last_execution": {
              "date": "2024-05-04T09:42:00+00:00",
              "message": "string",
              "metrics": {
                "execution_gap_duration_s": 42,
                "total_enrichment_duration_ms": 42,
                "total_indexing_duration_ms": 42,
                "total_search_duration_ms": 42
              },
              "status": "going to run",
              "status_order": 42
            }
          },
          "id": "string",
          "immutable": true,
          "revision": 42,
          "rule_id": "string",
          "rule_source": {
            "is_customized": true,
            "type": "external"
          },
          "updated_at": "2024-05-04T09:42:00+00:00",
          "updated_by": "string",
          "language": "eql",
          "query": "string",
          "type": "eql",
          "alert_suppression": {
            "duration": {
              "unit": "s",
              "value": 42
            },
            "group_by": [
              "string"
            ],
            "missing_fields_strategy": "doNotSuppress"
          },
          "data_view_id": "string",
          "event_category_override": "string",
          "filters": [],
          "index": [
            "string"
          ],
          "tiebreaker_field": "string",
          "timestamp_field": "string"
        }
      ],
      "skipped": [
        {
          "id": "string",
          "name": "string",
          "skip_reason": "RULE_NOT_MODIFIED"
        }
      ],
      "updated": [
        {
          "actions": [
            {
              "action_type_id": "string",
              "alerts_filter": {},
              "frequency": {
                "notifyWhen": "onActiveAlert",
                "summary": true,
                "throttle": "no_actions"
              },
              "group": "string",
              "id": "string",
              "params": {},
              "uuid": "string"
            }
          ],
          "alias_purpose": "savedObjectConversion",
          "alias_target_id": "string",
          "author": [
            "string"
          ],
          "building_block_type": "string",
          "description": "string",
          "enabled": true,
          "exceptions_list": [
            {
              "id": "string",
              "list_id": "string",
              "namespace_type": "agnostic",
              "type": "detection"
            }
          ],
          "false_positives": [
            "string"
          ],
          "from": "string",
          "interval": "string",
          "investigation_fields": {
            "field_names": [
              "string"
            ]
          },
          "license": "string",
          "max_signals": 42,
          "meta": {},
          "name": "string",
          "namespace": "string",
          "note": "string",
          "outcome": "exactMatch",
          "output_index": "string",
          "references": [
            "string"
          ],
          "related_integrations": [
            {
              "integration": "string",
              "package": "string",
              "version": "string"
            }
          ],
          "required_fields": [
            {
              "ecs": true,
              "name": "string",
              "type": "string"
            }
          ],
          "response_actions": [
            {
              "action_type_id": ".osquery",
              "params": {
                "ecs_mapping": {
                  "additionalProperty1": {
                    "field": "string",
                    "value": "string"
                  },
                  "additionalProperty2": {
                    "field": "string",
                    "value": "string"
                  }
                },
                "pack_id": "string",
                "queries": [
                  {
                    "ecs_mapping": {
                      "additionalProperty1": {
                        "field": "string",
                        "value": "string"
                      },
                      "additionalProperty2": {
                        "field": "string",
                        "value": "string"
                      }
                    },
                    "id": "string",
                    "platform": "string",
                    "query": "string",
                    "removed": true,
                    "snapshot": true,
                    "version": "string"
                  }
                ],
                "query": "string",
                "saved_query_id": "string",
                "timeout": 42.0
              }
            }
          ],
          "risk_score": 42,
          "risk_score_mapping": [
            {
              "field": "string",
              "operator": "equals",
              "risk_score": 42,
              "value": "string"
            }
          ],
          "rule_name_override": "string",
          "setup": "string",
          "severity": "low",
          "severity_mapping": [
            {
              "field": "string",
              "operator": "equals",
              "severity": "low",
              "value": "string"
            }
          ],
          "tags": [
            "string"
          ],
          "threat": [
            {
              "framework": "string",
              "tactic": {
                "id": "string",
                "name": "string",
                "reference": "string"
              },
              "technique": [
                {
                  "id": "string",
                  "name": "string",
                  "reference": "string",
                  "subtechnique": [
                    {
                      "id": "string",
                      "name": "string",
                      "reference": "string"
                    }
                  ]
                }
              ]
            }
          ],
          "throttle": "no_actions",
          "timeline_id": "string",
          "timeline_title": "string",
          "timestamp_override": "string",
          "timestamp_override_fallback_disabled": true,
          "to": "string",
          "version": 42,
          "created_at": "2024-05-04T09:42:00+00:00",
          "created_by": "string",
          "execution_summary": {
            "last_execution": {
              "date": "2024-05-04T09:42:00+00:00",
              "message": "string",
              "metrics": {
                "execution_gap_duration_s": 42,
                "total_enrichment_duration_ms": 42,
                "total_indexing_duration_ms": 42,
                "total_search_duration_ms": 42
              },
              "status": "going to run",
              "status_order": 42
            }
          },
          "id": "string",
          "immutable": true,
          "revision": 42,
          "rule_id": "string",
          "rule_source": {
            "is_customized": true,
            "type": "external"
          },
          "updated_at": "2024-05-04T09:42:00+00:00",
          "updated_by": "string",
          "language": "eql",
          "query": "string",
          "type": "eql",
          "alert_suppression": {
            "duration": {
              "unit": "s",
              "value": 42
            },
            "group_by": [
              "string"
            ],
            "missing_fields_strategy": "doNotSuppress"
          },
          "data_view_id": "string",
          "event_category_override": "string",
          "filters": [],
          "index": [
            "string"
          ],
          "tiebreaker_field": "string",
          "timestamp_field": "string"
        }
      ]
    },
    "summary": {
      "failed": 42,
      "skipped": 42,
      "succeeded": 42,
      "total": 42
    }
  },
  "message": "string",
  "rules_count": 42,
  "status_code": 42,
  "success": true
}
string