Module security 

Security detection rules. These are distinct from generic Kibana alerting rules.

QueryRule creates KQL or Lucene rules; other rule types can use JSON with Security::create_rule. Use RuleSelector to distinguish a saved-object ID from the stable rule ID. Imports can succeed for rules while failing for their dependencies; inspect RuleImportResult before treating the import as complete.

Structs

CreateAlertsIndex

POST /api/detection_engine/index

CreateRule

POST /api/detection_engine/rules

DeleteRule

DELETE /api/detection_engine/rules

DetectionRule

A detection rule returned by Kibana. Type-specific fields are retained in extra.

ExportRules

POST /api/detection_engine/rules/_export

FindRules

GET /api/detection_engine/rules/_find

GetPrivileges

GET /api/detection_engine/privileges

GetRule

GET /api/detection_engine/rules

ImportRules

POST /api/detection_engine/rules/_import

PatchRule

PATCH /api/detection_engine/rules

QueryRule

A KQL or Lucene query rule. Rules start disabled unless explicitly enabled.

RiskScore

A detection rule’s risk score, from 0 to 100.

RuleExecution

The latest execution health. A successful execution need not have produced alerts.

RuleExecutionSummary

RuleImportResult

HTTP 200 can contain failed imports. success covers only rules; inspect exception and connector outcomes separately.

RulePage

RuleSchedule

When a rule runs and how far back each run searches.

Security

Enums

QueryLanguage

RuleSelector

Selects a rule by saved-object id or by its stable rule_id.

Severity