Retrieve a detection rule

GET /api/detection_engine/rules
Api key auth Basic auth

Retrieve a detection rule using the rule_id or id field.

The URL query must include one of the following:

  • id - GET /api/detection_engine/rules?id=<id>
  • rule_id - GET /api/detection_engine/rules?rule_id=<rule_id>

The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.

Query parameters

  • id string(uuid)

    The rule's id value.

  • rule_id string

    The rule's rule_id value.

Responses

  • 200 application/json

    Indicates a successful call.

    These fields are under development and their usage or schema may change: execution_summary.

    Any of:
    Security_Detections_API_EqlRuleResponseFields object Security_Detections_API_QueryRuleResponseFields object Security_Detections_API_SavedQueryRuleResponseFields object Security_Detections_API_ThresholdRuleResponseFields object Security_Detections_API_ThreatMatchRuleResponseFields object Security_Detections_API_MachineLearningRuleResponseFields object Security_Detections_API_NewTermsRuleResponseFields object Security_Detections_API_EsqlRuleResponseFields object
GET /api/detection_engine/rules 
curl \
  --request GET https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \
  --header "Content-Type: application/json; Elastic-Api-Version=2023-10-31"
Response examples (200) 
{
  "id": "c41d170b-8ba6-4de6-b8ec-76440a35ace3",
  "to": "now-300s",
  "from": "now-4200s",
  "name": "MS Office child process",
  "tags": [
    "child process",
    "ms office"
  ],
  "type": "query",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "setup": "",
  "threat": [
    {
      "tactic": {
        "id": "TA0001",
        "name": "Initial Access",
        "reference": "https://attack.mitre.org/tactics/TA0001"
      },
      "framework": "MITRE ATT&CK",
      "technique": [
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "reference": "https://attack.mitre.org/techniques/T1193"
        }
      ]
    }
  ],
  "enabled": false,
  "filters": [
    {
      "query": {
        "match": {
          "event.action": {
            "type": "phrase",
            "query": "Process Create (rule: ProcessCreate)"
          }
        }
      }
    }
  ],
  "rule_id": "process_started_by_ms_office_user_folder",
  "version": 1,
  "interval": "1h",
  "language": "kuery",
  "severity": "low",
  "immutable": false,
  "created_at": "2020-02-03T11:19:04.259Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 21,
  "updated_at": "2020-02-03T11:19:04.462Z",
  "updated_by": "elastic",
  "description": "Process started by MS Office program in user folder",
  "max_signals": 100,
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "process.name",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.parent.name",
      "type": "keyword"
    }
  ],
  "execution_summary": {
    "last_execution": {
      "date": "2022-03-23T16:06:12.787Z",
      "status": "partial failure",
      "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
      "metrics": {
        "execution_gap_duration_s": 0,
        "total_search_duration_ms": 135,
        "total_indexing_duration_ms": 15
      },
      "status_order": 20
    }
  },
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}