Detections API
editDetections API
editThis functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
You can create rules that automatically turn events and external alerts sent to Elastic Security into detection alerts. These alerts are displayed on the Detections page.
For more information on detection alerts, and the difference between events, external alerts, and detection alerts, see detections terminology.
The API has these endpoints:
-
<kibana host>:<port>/api/detection_engine/rules- Detection rules CRUD functions -
<kibana host>:<port>/api/detection_engine/index- Signal index operations (used to store detection alerts) -
<kibana host>:<port>/api/detection_engine/tags- Aggregates and returns rule tags -
<kibana host>:<port>/api/detection_engine/_import- Imports rules from an.ndjsonfile -
<kibana host>:<port>/api/detection_engine/_export- Exports rules to an.ndjsonfile -
<kibana host>:<port>/api/detection_engine/privileges- Returns the user’s Kibana space and signal index permissions, and whether the user is authenticated -
<kibana host>:<port>/api/detection_engine/signals- Aggregates, queries, and returns alerts, and updates their statuses -
<kibana host>:<port>/api/detection_engine/prepackaged- Loads and retrieves the status of Elastic prebuilt rules
You can view and download a Detections API Postman collection here.
Kibana role requirements
editTo create and run rules, the user role for the Kibana space must have:
-
Kibana space
Allprivileges for theSecurityandSaved Objects Managementfeatures (see Feature access based on user privileges). -
readandwriteprivileges for the.siem-signals-*index (the system index used for storing detection alerts created from rules).
See Detections prerequisites and requirements for a complete list of requirements.