kibana_wip2 API documentation

Mar 28, 2025

Change #01d5bcbb

2023-10-31

Breaking

Compare

8 structure changes including:

8 Modifications

Modified 8 Breaking

DELETE /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules/_find

Response
200 response Modified
- application/json content type Modified
  - data property Modified
    - EqlRuleResponseFields, QueryRuleResponseFields, SavedQueryRuleResponseFields, ThresholdRuleResponseFields, ThreatMatchRuleResponseFields, MachineLearningRuleResponseFields, NewTermsRuleResponseFields, EsqlRuleResponseFields alternatives Modified

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- QueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- SavedQueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThresholdRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThreatMatchRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- MachineLearningRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- NewTermsRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- EsqlRulePatchProps alternative Modified
  - actions property Modified
    - alerts_filter property Modified
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules/_bulk_action

Body
application/json content type Modified
- BulkEditRules alternative Modified
  - edit property Modified
    - BulkActionEditPayloadRuleActions alternative Modified
Response
200 response Modified
- application/json content type Modified
  - BulkEditActionResponse alternative Modified
    - attributes property Modified

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Modified
    - Properties are no longer required
  - data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - query, language properties Modified
    - Properties are no longer required
  - saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

Mar 27, 2025

Change #7fbdf8aa

2023-10-31

Breaking

Compare

8 structure changes including:

8 Modifications

Modified 8 Breaking

DELETE /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules/_find

Response
200 response Modified
- application/json content type Modified
  - data property Modified
    - EqlRuleResponseFields, QueryRuleResponseFields, SavedQueryRuleResponseFields, ThresholdRuleResponseFields, ThreatMatchRuleResponseFields, MachineLearningRuleResponseFields, NewTermsRuleResponseFields, EsqlRuleResponseFields alternatives Modified

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- QueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- SavedQueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- ThresholdRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- ThreatMatchRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- MachineLearningRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- NewTermsRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- EsqlRulePatchProps alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules/_bulk_action

Body
application/json content type Modified
- BulkEditRules alternative Modified
  - edit property Modified
    - BulkActionEditPayloadRuleActions alternative Modified
Response
200 response Modified
- application/json content type Modified
  - BulkEditActionResponse alternative Modified
    - attributes property Modified

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version, data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Modified
    - Properties are no longer required
  - version, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - query, language properties Modified
    - Properties are no longer required
  - version, saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - version, threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - version, threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - version, anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - version, history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

Mar 26, 2025

Change #a92891c9

2023-10-31

Breaking

Compare

4 structure changes including:

4 Modifications

Modified 4 Breaking

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- QueryRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- SavedQueryRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThresholdRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThreatMatchRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- MachineLearningRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- NewTermsRulePatchFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- EsqlRulePatchProps alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- QueryRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- SavedQueryRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThresholdRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThreatMatchRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- MachineLearningRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- NewTermsRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- EsqlRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - language, query properties Modified
    - Properties are no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - query, language properties Modified
    - Properties are no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - language property Modified
    - Property is no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - version, language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - language property Modified
    - Property is no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- QueryRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- SavedQueryRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThresholdRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThreatMatchRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- MachineLearningRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- NewTermsRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- EsqlRuleCreateFields alternative Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking

Mar 26, 2025

Change #50b00b20

2023-10-31

Breaking

Compare

4 structure changes including:

4 Modifications

Modified 4 Breaking

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - version property Added
- QueryRulePatchFields alternative Modified
  - version property Added
- SavedQueryRulePatchFields alternative Modified
  - version property Added
- ThresholdRulePatchFields alternative Modified
  - version property Added
- ThreatMatchRulePatchFields alternative Modified
  - version property Added
- MachineLearningRulePatchFields alternative Modified
  - version property Added
- NewTermsRulePatchFields alternative Modified
  - version property Added
- EsqlRulePatchProps alternative Modified
  - version property Added

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - version property Added
- QueryRuleCreateFields alternative Modified
  - version property Added
- SavedQueryRuleCreateFields alternative Modified
  - version property Added
- ThresholdRuleCreateFields alternative Modified
  - version property Added
- ThreatMatchRuleCreateFields alternative Modified
  - version property Added
- MachineLearningRuleCreateFields alternative Modified
  - version property Added
- NewTermsRuleCreateFields alternative Modified
  - version property Added
- EsqlRuleCreateFields alternative Modified
  - version property Added

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - version, data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - language, query properties Modified
    - Properties are no longer required
  - version, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - query, language properties Modified
    - Properties are no longer required
  - version, saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - version, threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - language property Modified
    - Property is no longer required
  - version, threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - version, anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - language property Modified
    - Property is no longer required
  - version, history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - version property Added

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - version property Added
- QueryRuleCreateFields alternative Modified
  - version property Added
- SavedQueryRuleCreateFields alternative Modified
  - version property Added
- ThresholdRuleCreateFields alternative Modified
  - version property Added
- ThreatMatchRuleCreateFields alternative Modified
  - version property Added
- MachineLearningRuleCreateFields alternative Modified
  - version property Added
- NewTermsRuleCreateFields alternative Modified
  - version property Added
- EsqlRuleCreateFields alternative Modified
  - version property Added

Mar 26, 2025

Change #9a30ae09

2023-10-31

Breaking

Compare

8 structure changes including:

8 Modifications

Modified 8 Breaking

DELETE /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules/_find

Response
200 response Modified
- application/json content type Modified
  - data property Modified
    - EqlRuleResponseFields, QueryRuleResponseFields, SavedQueryRuleResponseFields, ThresholdRuleResponseFields, ThreatMatchRuleResponseFields, MachineLearningRuleResponseFields, NewTermsRuleResponseFields, EsqlRuleResponseFields alternatives Modified

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- QueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- SavedQueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThresholdRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThreatMatchRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- MachineLearningRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- NewTermsRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- EsqlRulePatchProps alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules/_bulk_action

Body
application/json content type Modified
- BulkEditRules alternative Modified
  - edit property Modified
    - BulkActionEditPayloadRuleActions alternative Modified
Response
200 response Modified
- application/json content type Modified
  - BulkEditActionResponse alternative Modified
    - attributes property Modified

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Modified
    - Properties are no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - query, language properties Modified
    - Properties are no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version, language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - version property Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

Mar 25, 2025

Change #ef40efee

2023-10-31

Breaking

Compare

8 structure changes including:

8 Modifications

Modified 8 Breaking

DELETE /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules/_find

Response
200 response Modified
- application/json content type Modified
  - data property Modified
    - EqlRuleResponseFields, QueryRuleResponseFields, SavedQueryRuleResponseFields, ThresholdRuleResponseFields, ThreatMatchRuleResponseFields, MachineLearningRuleResponseFields, NewTermsRuleResponseFields, EsqlRuleResponseFields alternatives Modified

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- QueryRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- SavedQueryRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- ThresholdRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- ThreatMatchRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- MachineLearningRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- NewTermsRulePatchFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- EsqlRulePatchProps alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules/_bulk_action

Response
200 response Modified
- application/json content type Modified
  - BulkEditActionResponse alternative Modified
    - attributes property Modified

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - language, query properties Modified
    - Properties are no longer required
  - data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - query, language properties Modified
    - Properties are no longer required
  - saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - language property Modified
    - Property is no longer required
  - threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
  - language property Modified
    - Property is no longer required
  - history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - group_jacek property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

Mar 25, 2025

Change #aa9ab6f9

2023-10-31

Breaking

Compare

8 structure changes including:

8 Modifications

Modified 8 Breaking

DELETE /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules/_find

Response
200 response Modified
- application/json content type Modified
  - data property Modified
    - EqlRuleResponseFields, QueryRuleResponseFields, SavedQueryRuleResponseFields, ThresholdRuleResponseFields, ThreatMatchRuleResponseFields, MachineLearningRuleResponseFields, NewTermsRuleResponseFields, EsqlRuleResponseFields alternatives Modified

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- QueryRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- SavedQueryRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- ThresholdRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- ThreatMatchRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- MachineLearningRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- NewTermsRulePatchFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- EsqlRulePatchProps alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules/_bulk_action

Body
application/json content type Modified
- BulkEditRules alternative Modified
  - edit property Modified
    - BulkActionEditPayloadIndexPatterns alternative Modified
Response
200 response Modified
- application/json content type Modified
  - BulkEditActionResponse alternative Modified
    - attributes property Modified

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - language, query properties Modified
    - Properties are no longer required
  - data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - query, language properties Modified
    - Properties are no longer required
  - saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - language property Modified
    - Property is no longer required
  - threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
  - language property Modified
    - Property is no longer required
  - history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - group property Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
    - group_jacek property Added
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

Mar 25, 2025

Change #ac0c0a20

2023-10-31

Breaking

Compare

1 structure change including:

1 Modification

Modified 1

POST /api/detection_engine/rules/_bulk_action

Body
application/json content type Modified
- BulkEditRules alternative Modified
  - edit property Modified
    - BulkActionEditPayloadIndexPatterns alternative Modified

Mar 21, 2025

Change #7528a5f6

2023-10-31

Breaking

Compare

8 structure changes including:

8 Modifications

Modified 8 Breaking

DELETE /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules

Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

GET /api/detection_engine/rules/_find

Response
200 response Modified
- application/json content type Modified
  - data property Modified
    - EqlRuleResponseFields, QueryRuleResponseFields, SavedQueryRuleResponseFields, ThresholdRuleResponseFields, ThreatMatchRuleResponseFields, MachineLearningRuleResponseFields, NewTermsRuleResponseFields, EsqlRuleResponseFields alternatives Modified

PATCH /api/detection_engine/rules

Body
application/json content type Modified
- EqlRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- QueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- SavedQueryRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThresholdRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThreatMatchRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- MachineLearningRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- NewTermsRulePatchFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- EsqlRulePatchProps alternative Modified
  - actions property Modified
    - alerts_filter property Modified
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

POST /api/detection_engine/rules/_bulk_action

Body
application/json content type Modified
- BulkEditRules alternative Modified
  - edit property Modified
    - BulkActionEditPayloadRuleActions alternative Modified
Response
200 response Modified
- application/json content type Modified
  - BulkEditActionResponse alternative Modified
    - attributes property Modified

POST /api/detection_engine/rules/preview

Body
application/json content type Modified
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Modified
    - Properties are no longer required
  - data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - query, language properties Modified
    - Properties are no longer required
  - saved_id, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - alert_suppression property Modified
    - duration property Modified
      - Property is now required
        Breaking
    - group_by, missing_fields_strategy properties Removed
      - Removing a resource is always breaking unless it was deprecated before
        Breaking
  - language property Modified
    - Property is no longer required
  - threshold, data_view_id, filters, index, saved_id properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language, query properties Removed
    - Removing a resource is always breaking unless it was deprecated before
      Breaking
  - anomaly_threshold, array-2 properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified
  - language property Modified
    - Property is no longer required
  - history_window_start, new_terms_fields, data_view_id, filters, index properties Added
- RulePreviewParams alternative Modified
  - actions property Modified
    - alerts_filter property Modified

PUT /api/detection_engine/rules

Body
application/json content type Modified
- EqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- QueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- SavedQueryRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThresholdRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- ThreatMatchRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- MachineLearningRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- NewTermsRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
- EsqlRuleCreateFields alternative Modified
  - actions property Modified
    - alerts_filter property Modified
Response
200 response Modified
- application/json content type Modified
  - EqlRuleResponseFields alternative Modified
    - actions property Modified
  - QueryRuleResponseFields alternative Modified
    - actions property Modified
  - SavedQueryRuleResponseFields alternative Modified
    - actions property Modified
  - ThresholdRuleResponseFields alternative Modified
    - actions property Modified
  - ThreatMatchRuleResponseFields alternative Modified
    - actions property Modified
  - MachineLearningRuleResponseFields alternative Modified
    - actions property Modified
  - NewTermsRuleResponseFields alternative Modified
    - actions property Modified
  - EsqlRuleResponseFields alternative Modified
    - actions property Modified

Mar 11, 2025

Change #7e9d9075

2023-10-31

Compare

7 structure changes including:

2 Modifications

5 Removals

Modified 2

GET /api/detection_engine/signals/migration_status

Verb went from POST to GET (same operationId)

POST /api/detection_engine/signals/assignees

Response
200 response Modified
- application/ndjson content type Added

Removed 5

DELETE /api/detection_engine/rules/_bulk_delete

PATCH /api/detection_engine/rules/_bulk_update

POST /api/detection_engine/rules/_bulk_create

POST /api/detection_engine/rules/_bulk_delete

PUT /api/detection_engine/rules/_bulk_update

Mar 6, 2025

Change #4f8da7fc

2023-10-31

Breaking

Compare

7 structure changes including:

5 Additions

2 Modifications

Modified 2 Breaking

POST /api/detection_engine/signals/assignees

Response
200 response Modified
- application/ndjson content type Removed
  - Removing a resource is always breaking unless it was deprecated before
    Breaking

POST /api/detection_engine/signals/migration_status

Verb went from GET to POST (same operationId)

Added 5

DELETE /api/detection_engine/rules/_bulk_delete

PATCH /api/detection_engine/rules/_bulk_update

POST /api/detection_engine/rules/_bulk_create

POST /api/detection_engine/rules/_bulk_delete

PUT /api/detection_engine/rules/_bulk_update

Mar 3, 2025

Change #a2899822

2023-10-31

Compare

Do not miss any kibana_wip2 API changes, ever again

Changelog

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API structure has changed

API documentation has been created