Find and/or aggregate detection alerts

POST /api/detection_engine/signals/search

Find and/or aggregate detection alerts that match the given query.

application/json; Elastic-Api-Version=2023-10-31

Body Required

Elasticsearch query and aggregation request

_source boolean | string | array[string]

One of:
boolean-1 boolean string-2 string array-3 array[string]
aggs object
Hide aggs attribute Show aggs attribute object
- Additional properties are allowed
fields array[string]
query object
Hide query attribute Show query attribute object
- Additional properties are allowed
runtime_mappings object
Hide runtime_mappings attribute Show runtime_mappings attribute object
- Additional properties are allowed
size integer

Minimum value is 0.
sort string | object | array[string | object]
One of:
string-1 string object-2 object array-2 array[string | object]
Hide attribute Show attribute

Additional properties are allowed
Any of:
string-1 string object-2 object
track_total_hits boolean

Responses

200 application/json; Elastic-Api-Version=2023-10-31

Successful response
Hide response attribute Show response attribute object
Elasticsearch search response
- Additional properties are allowed
400 application/json; Elastic-Api-Version=2023-10-31

Invalid input data response
One of:
Security_Solution_Detections_API_PlatformErrorResponse object Security_Solution_Detections_API_SiemErrorResponse object
Hide attributes Show attributes

error string Required

message string Required

statusCode integer Required
Hide attributes Show attributes

message string Required

status_code integer Required
401 application/json; Elastic-Api-Version=2023-10-31

Unsuccessful authentication response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode integer Required
500 application/json; Elastic-Api-Version=2023-10-31

Internal server error response
Hide response attributes Show response attributes object
- message string Required
- status_code integer Required

POST /api/detection_engine/signals/search

curl \
 -X POST http://KIBANA_HOST:5601/api/detection_engine/signals/search \
 -H "Content-Type: application/json; Elastic-Api-Version=2023-10-31"

Request examples

{
  "_source": true,
  "aggs": {},
  "fields": [
    "string"
  ],
  "query": {},
  "runtime_mappings": {},
  "size": 42,
  "sort": "string",
  "track_total_hits": true
}

Response examples (200)

{}

Response examples (400)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

{
  "message": "string",
  "status_code": 42
}

Response examples (401)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

Response examples (500)

{
  "message": "string",
  "status_code": 42
}

Find and/or aggregate detection alerts

Body Required

_source boolean | string | array[string]

sort string | object | array[string | object]

Responses