Patch a detection rule

PATCH /api/detection_engine/rules
Api key auth

Update specific fields of an existing detection rule using the rule_id or id field.

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

application/json

Body object Required


You cannot modify the id or rule_id values.

Any of:
Security_Detections_API_EqlRulePatchFields object Security_Detections_API_QueryRulePatchFields object Security_Detections_API_SavedQueryRulePatchFields object Security_Detections_API_ThresholdRulePatchFields object Security_Detections_API_ThreatMatchRulePatchFields object Security_Detections_API_MachineLearningRulePatchFields object Security_Detections_API_NewTermsRulePatchFields object Security_Detections_API_EsqlRulePatchProps object

Responses

  • 200 application/json

    Indicates a successful call.

    Any of:
    Security_Detections_API_EqlRuleResponseFields object Security_Detections_API_QueryRuleResponseFields object Security_Detections_API_SavedQueryRuleResponseFields object Security_Detections_API_ThresholdRuleResponseFields object Security_Detections_API_ThreatMatchRuleResponseFields object Security_Detections_API_MachineLearningRuleResponseFields object Security_Detections_API_NewTermsRuleResponseFields object Security_Detections_API_EsqlRuleResponseFields object
PATCH /api/detection_engine/rules 
curl \
 --request PATCH 'http://localhost:5622/api/detection_engine/rules' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"id":"14b7b513-3d8d-4b22-b7da-a7ae632f7e76","name":"New name"}'
Request examples 
{
  "id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76",
  "name": "New name"
}
{
  "threat": [
    {
      "tactic": {
        "id": "TA0001",
        "name": "Initial Access",
        "reference": "https://attack.mitre.org/tactics/TA0001"
      },
      "framework": "MITRE ATT&CK",
      "technique": [
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "reference": "https://attack.mitre.org/techniques/T1193"
        }
      ]
    }
  ],
  "rule_id": "process_started_by_ms_office_program_possible_payload"
}
{
  "id": "005d2c4f-51ca-493d-a2bd-20ef076339b1",
  "query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"",
  "threshold": {
    "field": [],
    "value": 600,
    "cardinality": []
  }
}
{
  "id": "569aac91-40dc-4807-a8ae-a2c8698089c4",
  "new_terms_fields": [
    "Endpoint.policy.applied.artifacts.global.identifiers.name"
  ],
  "history_window_start": "now-3d"
}
{
  "id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd",
  "query": "FROM logs-abc*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp)\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) \n| KEEP event_rate\n"
}
{
  "id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd",
  "threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"false\""
}
{
  "id": "60b13926-289b-41b1-a537-197ef1fa5059",
  "anomaly_threshold": 50,
  "machine_learning_job_id": [
    "auth_high_count_logon_events"
  ]
}
Response examples (200) 
{
  "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
  "to": "now",
  "from": "now-70m",
  "name": "Updated Rule Name",
  "tags": [
    "child process",
    "ms office"
  ],
  "type": "query",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "setup": "",
  "threat": [],
  "actions": [],
  "enabled": false,
  "filters": [
    {
      "query": null
    }
  ],
  "rule_id": "process_started_by_ms_office_program",
  "version": 2,
  "interval": "1h",
  "language": "kuery",
  "severity": "low",
  "immutable": false,
  "created_at": "2020-04-07T14:51:09.755Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 50,
  "updated_at": "2020-04-07T14:51:09.970Z",
  "updated_by": "elastic",
  "description": "Updated description for the rule.",
  "max_signals": 100,
  "false_positives": [],
  "required_fields": [
    {
      "name": "process.parent.name"
    }
  ],
  "related_integrations": [
    {
      "package": "o365"
    }
  ]
}