Update a detection rule

PUT /api/detection_engine/rules
Api key auth Basic auth

Update a detection rule using the rule_id or id field. The original rule is replaced, and all unspecified fields are deleted.

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

application/json

Body object Required


All unspecified fields are deleted. You cannot modify the id or rule_id values.

Any of:
Security_Detections_API_EqlRuleCreateFields object Security_Detections_API_QueryRuleCreateFields object Security_Detections_API_SavedQueryRuleCreateFields object Security_Detections_API_ThresholdRuleCreateFields object Security_Detections_API_ThreatMatchRuleCreateFields object Security_Detections_API_MachineLearningRuleCreateFields object Security_Detections_API_NewTermsRuleCreateFields object Security_Detections_API_EsqlRuleCreateFields object

Responses

  • 200 application/json

    Indicates a successful call.

    Any of:
    Security_Detections_API_EqlRuleResponseFields object Security_Detections_API_QueryRuleResponseFields object Security_Detections_API_SavedQueryRuleResponseFields object Security_Detections_API_ThresholdRuleResponseFields object Security_Detections_API_ThreatMatchRuleResponseFields object Security_Detections_API_MachineLearningRuleResponseFields object Security_Detections_API_NewTermsRuleResponseFields object Security_Detections_API_EsqlRuleResponseFields object
PUT /api/detection_engine/rules 
curl \
 --request PUT 'https://localhost:5601/api/detection_engine/rules' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"id":"14b7b513-3d8d-4b22-b7da-a7ae632f7e76","name":"A new name for the rule","type":"query","severity":"medium","risk_score":22,"description":"A new description"}'
Request examples 
{
  "id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76",
  "name": "A new name for the rule",
  "type": "query",
  "severity": "medium",
  "risk_score": 22,
  "description": "A new description"
}
{
  "id": "9b684efb-acf9-4323-9bff-8335b3867d14",
  "name": "New name for EQL rule",
  "type": "eql",
  "index": [
    "apm-*-transaction*"
  ],
  "query": "process where process.name == \"regsvr32.exe\"",
  "language": "eql",
  "severity": "low",
  "risk_score": 21,
  "description": "eql rule test"
}
{
  "id": "005d2c4f-51ca-493d-a2bd-20ef076339b1",
  "name": "New name for threat rule",
  "tags": [
    "new_tag"
  ],
  "type": "threshold",
  "query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"",
  "language": "kuery",
  "severity": "low",
  "threshold": {
    "field": [],
    "value": 400,
    "cardinality": []
  },
  "risk_score": 21,
  "description": "Description of threat rule test"
}
{
  "id": "569aac91-40dc-4807-a8ae-a2c8698089c4",
  "name": "New terms rule name",
  "type": "new_terms",
  "query": "agent.version : \"9.1.0\"",
  "interval": "5m",
  "severity": "low",
  "risk_score": 21,
  "description": "New description",
  "new_terms_fields": [
    "Endpoint.policy.applied.artifacts.global.identifiers.name"
  ],
  "history_window_start": "now-7d"
}
{
  "id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd",
  "name": "New name for esql rule",
  "type": "esql",
  "query": "FROM logs*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */\n| KEEP event_rate\n",
  "language": "esql",
  "severity": "low",
  "risk_score": 21,
  "description": "New description for esql rule"
}
{
  "id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd",
  "name": "New name for Indicator Match rule",
  "type": "threat_match",
  "query": "source.ip:* or destination.ip:*\\n",
  "severity": "critical",
  "risk_score": 99,
  "description": "New description",
  "threat_index": [
    "filebeat-*",
    "logs-ti_*"
  ],
  "threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"",
  "threat_mapping": [
    {
      "entries": [
        {
          "type": "mapping",
          "field": "source.ip",
          "value": "threat.indicator.ip"
        }
      ]
    },
    {
      "entries": [
        {
          "type": "mapping",
          "field": "destination.ip",
          "value": "threat.indicator.ip"
        }
      ]
    }
  ]
}
{
  "id": "60b13926-289b-41b1-a537-197ef1fa5059",
  "name": "New name of ml rule",
  "type": "machine_learning",
  "severity": "low",
  "risk_score": 21,
  "description": "New description of ml rule",
  "anomaly_threshold": 50,
  "machine_learning_job_id": [
    "auth_high_count_logon_events"
  ]
}
Response examples (200) 
{
  "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
  "to": "now",
  "from": "now-70m",
  "name": "Updated Rule Name",
  "tags": [
    "child process",
    "ms office"
  ],
  "type": "query",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "setup": "",
  "threat": [],
  "actions": [],
  "enabled": false,
  "filters": [
    {
      "query": null
    }
  ],
  "rule_id": "process_started_by_ms_office_program",
  "version": 2,
  "interval": "1h",
  "language": "kuery",
  "severity": "low",
  "immutable": false,
  "created_at": "2020-04-07T14:51:09.755Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 50,
  "updated_at": "2020-04-07T14:51:09.970Z",
  "updated_by": "elastic",
  "description": "Updated description for the rule.",
  "max_signals": 100,
  "false_positives": [],
  "required_fields": [
    {
      "name": "process.parent.name"
    }
  ],
  "related_integrations": [
    {
      "package": "o365"
    }
  ]
}