Prebuilt rules

edit

The prepackaged endpoint is for retrieving rule statuses and loading Elastic prebuilt detection rules.

The Kibana Console supports only Elasticsearch APIs. You cannot interact with the Kibana APIs with the Console and must use curl or another HTTP tool instead. For more information, refer to Console.

Load prebuilt rules

edit

Loads and updates Elastic prebuilt rules.

By default, all loaded prebuilt rules are disabled.

Request URL

edit

PUT <kibana host>:<port>/api/detection_engine/rules/prepackaged

Example request
edit
PUT api/detection_engine/rules/prepackaged

Response code

edit
200
Indicates a successful call.
Response payload
edit

A JSON object listing the number of loaded and updated prebuilt rules.

Example response:

{
  "rules_installed": 112,
  "rules_updated": 0
}

Get rule status

edit

Returns rule statuses.

Request URL

edit

GET <kibana host>:<port>/api/detection_engine/rules/prepackaged/_status

Example request
edit
GET api/detection_engine/rules/prepackaged/_status

Response code

edit
200
Indicates a successful call.
Response payload
edit

A JSON object listing rule statuses.

Example response:

{
  "rules_custom_installed": 0,
  "rules_installed": 0,
  "rules_not_installed": 112,
  "rules_not_updated": 0
}