This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

› › ›

Prebuilt rules

edit

Prebuilt rules

edit

The prepackaged endpoint is for retrieving rule statuses and loading Elastic prebuilt detection rules.

Load prebuilt rules

edit

Loads and updates Elastic prebuilt rules.

By default, all loaded prebuilt rules are disabled.

Request URL

edit

PUT <kibana host>:<port>/api/detection_engine/rules/prepackaged

Example request

edit

PUT api/detection_engine/rules/prepackaged

Response code

edit

200: Indicates a successful call.

Response payload

edit

A JSON object listing the number of loaded and updated prebuilt rules.

Example response:

{
  "rules_installed": 112,
  "rules_updated": 0
}

Get rule status

edit

Returns rule statuses.

Request URL

edit

GET <kibana host>:<port>/api/detection_engine/rules/prepackaged/_status

Example request

edit

GET api/detection_engine/rules/prepackaged/_status

Response code

edit

200: Indicates a successful call.

Response payload

edit

A JSON object listing rule statuses.

Example response:

{
  "rules_custom_installed": 0,
  "rules_installed": 0,
  "rules_not_installed": 112,
  "rules_not_updated": 0
}

« Signals endpoint Exceptions API »