API structure has changed
4 structure changes including:
4 Modifications
Modified
4
Breaking
PATCH /api/detection_engine/rules
- Body
-
application/json content type Modified
-
EqlRulePatchFields alternative Modified
- version property Added
-
QueryRulePatchFields alternative Modified
- version property Added
-
SavedQueryRulePatchFields alternative Modified
- version property Added
-
ThresholdRulePatchFields alternative Modified
- version property Added
-
ThreatMatchRulePatchFields alternative Modified
- version property Added
-
MachineLearningRulePatchFields alternative Modified
- version property Added
-
NewTermsRulePatchFields alternative Modified
- version property Added
-
EsqlRulePatchProps alternative Modified
- version property Added
-
EqlRulePatchFields alternative Modified
POST /api/detection_engine/rules
- Body
-
application/json content type Modified
-
EqlRuleCreateFields alternative Modified
- version property Added
-
QueryRuleCreateFields alternative Modified
- version property Added
-
SavedQueryRuleCreateFields alternative Modified
- version property Added
-
ThresholdRuleCreateFields alternative Modified
- version property Added
-
ThreatMatchRuleCreateFields alternative Modified
- version property Added
-
MachineLearningRuleCreateFields alternative Modified
- version property Added
-
NewTermsRuleCreateFields alternative Modified
- version property Added
-
EsqlRuleCreateFields alternative Modified
- version property Added
-
EqlRuleCreateFields alternative Modified
POST /api/detection_engine/rules/preview
- Body
-
application/json content type Modified
-
RulePreviewParams alternative Modified
- version, data_view_id, event_category_override, filters, index, tiebreaker_field, timestamp_field properties Added
-
RulePreviewParams alternative Modified
-
language, query properties Modified
- Properties are no longer required
- version, data_view_id, filters, index, saved_id properties Added
-
language, query properties Modified
-
RulePreviewParams alternative Modified
-
query, language properties Modified
- Properties are no longer required
- version, saved_id, data_view_id, filters, index properties Added
-
query, language properties Modified
-
RulePreviewParams alternative Modified
-
alert_suppression property Modified
-
duration property Modified
-
Property is now required Breaking
-
Property is now required
-
group_by, missing_fields_strategy properties Removed
-
Removing a resource is always breaking unless it was deprecated before Breaking
-
Removing a resource is always breaking unless it was deprecated before
-
duration property Modified
-
language property Modified
- Property is no longer required
- version, threshold, data_view_id, filters, index, saved_id properties Added
-
alert_suppression property Modified
-
RulePreviewParams alternative Modified
-
language property Modified
- Property is no longer required
- version, threat_index, threat_mapping, threat_query, concurrent_searches, data_view_id, filters, index, items_per_search, saved_id, threat_filters, threat_indicator_path, threat_language properties Added
-
language property Modified
-
RulePreviewParams alternative Modified
-
language, query properties Removed
-
Removing a resource is always breaking unless it was deprecated before Breaking
-
Removing a resource is always breaking unless it was deprecated before
- version, anomaly_threshold, array-2 properties Added
-
language, query properties Removed
-
RulePreviewParams alternative Modified
-
language property Modified
- Property is no longer required
- version, history_window_start, new_terms_fields, data_view_id, filters, index properties Added
-
language property Modified
-
RulePreviewParams alternative Modified
- version property Added
-
RulePreviewParams alternative Modified
PUT /api/detection_engine/rules
- Body
-
application/json content type Modified
-
EqlRuleCreateFields alternative Modified
- version property Added
-
QueryRuleCreateFields alternative Modified
- version property Added
-
SavedQueryRuleCreateFields alternative Modified
- version property Added
-
ThresholdRuleCreateFields alternative Modified
- version property Added
-
ThreatMatchRuleCreateFields alternative Modified
- version property Added
-
MachineLearningRuleCreateFields alternative Modified
- version property Added
-
NewTermsRuleCreateFields alternative Modified
- version property Added
-
EsqlRuleCreateFields alternative Modified
- version property Added
-
EqlRuleCreateFields alternative Modified