Module rules 

Typed wrappers for the detection-engine API.

Functions use stable rule_id values, not volatile server-side id values.

Structs

BulkOutcome

PreviewHits

PreviewResult

RuleFilter

Enums

BulkAction

RuleSource

Which rules an operation acts on, grouped by source.

Constants

PREVIEW_ALERTS_INDEX_PREFIX

Where a preview’s alerts land. Kibana names the alias per space.

Functions

bulk_by_rule_ids

create

decode_bulk_outcome

Decode a _bulk_action response summary, refusing a malformed success body.

decode_find

Decode a _find response into rules and a total. Fixtures use this same path offline.

decode_preview_hits

Decode a preview-hits response, tolerating a malformed body as empty.

decode_preview_hits_checked

Decode a preview-hits response, refusing a malformed success body.

delete

existing_rule_ids

Which of these rule ids already exist on the stack.

export

Export every rule, or exactly the named ones.

find_all

Every rule matching the filter.

find_by_rule_ids

The rules carrying exactly these rule_ids.

find_page

get

import

patch

preview

Run a rule against historical data without writing alerts.

preview_hits

Read back what a preview matched.

update