--- title: "Apply a bulk action to detection rules" method: POST path: "/api/detection_engine/rules/_bulk_action" tags: ["Security Detections API"] --- # Apply a bulk action to detection rules `POST /api/detection_engine/rules/_bulk_action` **Spaces method and path for this operation:**
post /s/{space_id}/api/detection_engine/rules/_bulk_action
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs. The edit action allows you to add, delete, or set tags, index patterns, investigation fields, rule actions and schedules for multiple rules at once. The edit action is idempotent, meaning that if you add a tag to a rule that already has that tag, no changes are made. The same is true for other edit actions, for example removing an index pattern that is not specified in a rule will not result in any changes. The only exception is the `add_rule_actions` and `set_rule_actions` action, which is non-idempotent. This means that if you add or set a rule action to a rule that already has that action, a new action is created with a new unique ID. > warn > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running. > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change. ## Query parameters - `dry_run` boolean ## Request body - union - SecurityDetectionsAPIBulkDeleteRules - `action` 'delete', required - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - SecurityDetectionsAPIBulkDisableRules - `action` 'disable', required - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - SecurityDetectionsAPIBulkEnableRules - `action` 'enable', required - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - SecurityDetectionsAPIBulkExportRules - `action` 'export', required - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - SecurityDetectionsAPIBulkDuplicateRules - `action` 'duplicate', required - `duplicate` object — Duplicate object that describes applying an update action. - `include_exceptions` boolean, required — Whether to copy exceptions from the original rule - `include_expired_exceptions` boolean, required — Whether to copy expired exceptions from the original rule - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - SecurityDetectionsAPIBulkManualRuleRun - `action` 'run', required - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - `run` object, required — Object that describes applying a manual rule run action. - `end_date` string, required — End date of the manual rule run - `start_date` string, required — Start date of the manual rule run - SecurityDetectionsAPIBulkManualRuleFillGaps - `action` 'fill_gaps', required - `fill_gaps` object, required — Object that describes applying a manual gap fill action for the specified time range. - `end_date` string, required — End date of the manual gap fill - `start_date` string, required — Start date of the manual gap fill - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. - SecurityDetectionsAPIBulkEditRules - `action` 'edit', required - `edit` SecurityDetectionsAPIBulkActionEditPayload[], required — Array of objects containing the edit operations - union - SecurityDetectionsAPIBulkActionEditPayloadTags — Edits tags of rules. - `add_tags` adds tags to rules. If a tag already exists for a rule, no changes are made. - `delete_tags` removes tags from rules. If a tag does not exist for a rule, no changes are made. - `set_tags` sets tags for rules, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made. - `type` 'add_tags' | 'delete_tags' | 'set_tags', required - `value` string[], required — String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array. - SecurityDetectionsAPIBulkActionEditPayloadIndexPatterns — Edits index patterns of rulesClient. - `add_index_patterns` adds index patterns to rules. If an index pattern already exists for a rule, no changes are made. - `delete_index_patterns` removes index patterns from rules. If an index pattern does not exist for a rule, no changes are made. - `set_index_patterns` sets index patterns for rules, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made. - `overwrite_data_views` boolean — Resets the data view for the rule. - `type` 'add_index_patterns' | 'delete_index_patterns' | 'set_index_patterns', required - `value` string[], required — Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanced Settings → `securitySolution:defaultIndex`). > info > This field is not supported for ES|QL rules. - SecurityDetectionsAPIBulkActionEditPayloadInvestigationFields — Edits investigation fields of rules. - `add_investigation_fields` adds investigation fields to rules. If an investigation field already exists for a rule, no changes are made. - `delete_investigation_fields` removes investigation fields from rules. If an investigation field does not exist for a rule, no changes are made. - `set_investigation_fields` sets investigation fields for rules. If the set of investigation fields is the same as the existing investigation fields, no changes are made. - `type` 'add_investigation_fields' | 'delete_investigation_fields' | 'set_investigation_fields', required - `value` SecurityDetectionsAPIInvestigationFields, required — Schema for fields relating to investigation fields. These are user defined fields we use to highlight in various features in the UI such as alert details flyout and exceptions auto-population from alert. - `field_names` SecurityDetectionsAPINonEmptyString[], required - SecurityDetectionsAPIBulkActionEditPayloadTimeline — Edits timeline of rules. - `set_timeline` sets a timeline for rules. If the same timeline already exists for a rule, no changes are made. - `type` 'set_timeline', required - `value` object, required - `timeline_id` string, required — Timeline template ID - `timeline_title` string, required — Timeline template title - SecurityDetectionsAPIBulkActionEditPayloadRuleActions — Edits rule actions of rules. - `add_rule_actions` adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exists for a rule, it will be added again with a new unique ID. - `set_rule_actions` sets rule actions for rules. This action is non-idempotent, meaning that even if the same set of rule actions already exists for a rule, it will be set again and the actions will receive new unique IDs. - `type` 'add_rule_actions' | 'set_rule_actions', required - `value` object, required - `actions` SecurityDetectionsAPINormalizedRuleAction[], required - … - `throttle` 'rule' | '1h' | '1d' | '7d' — Defines the maximum interval in which a rule’s actions are executed. > info > The rule level `throttle` field is deprecated in Elastic Security 8.8 and will remain active for at least the next 12 months. > In Elastic Security 8.8 and later, you can use the `frequency` field to define frequencies for individual actions. Actions without frequencies will acquire a converted version of the rule’s `throttle` field. In the response, the converted `throttle` setting appears in the individual actions' `frequency` field. - SecurityDetectionsAPIBulkActionEditPayloadSchedule — Overwrites schedule of rules. - `set_schedule` sets a schedule for rules. If the same schedule already exists for a rule, no changes are made. Both `interval` and `lookback` have a format of "{integer}{time_unit}", where accepted time units are `s` for seconds, `m` for minutes, and `h` for hours. The integer must be positive and larger than 0. Examples: "45s", "30m", "6h" - `type` 'set_schedule', required - `value` object, required - `interval` string, required — Interval in which the rule runs. For example, `"1h"` means the rule runs every hour. - `lookback` string, required — Lookback time for the rules. Additional look-back time that the rule analyzes. For example, "10m" means the rule analyzes the last 10 minutes of data in addition to the frequency interval. - union - SecurityDetectionsAPIBulkActionEditPayloadSetAlertSuppression - `type` 'set_alert_suppression', required - `value` SecurityDetectionsAPIAlertSuppression, required — Defines alert suppression configuration. - … - SecurityDetectionsAPIBulkActionEditPayloadSetAlertSuppressionForThreshold - `type` 'set_alert_suppression_for_threshold', required - `value` SecurityDetectionsAPIThresholdAlertSuppression, required — Defines alert suppression configuration. - … - SecurityDetectionsAPIBulkActionEditPayloadDeleteAlertSuppression - `type` 'delete_alert_suppression', required - `gap_auto_fill_scheduler_id` string — Gap auto fill scheduler ID used to determine gap fill status for rules - `gap_fill_statuses` SecurityDetectionsAPIGapFillStatus[] — Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*). - `gaps_range_end` string — Gaps range end, valid only when query is provided - `gaps_range_start` string — Gaps range start, valid only when query is provided - `ids` string[] — Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here. Only valid when query property is undefined. - `query` string — Query to filter rules. ## Response `200` OK - union - SecurityDetectionsAPIBulkEditActionResponse - `attributes` object, required - `errors` SecurityDetectionsAPINormalizedRuleError[] - `err_code` 'IMMUTABLE' | 'PREBUILT_CUSTOMIZATION_LICENSE' | 'MACHINE_LEARNING_AUTH' | 'MACHINE_LEARNING_INDEX_PATTERN' | 'ESQL_INDEX_PATTERN' | 'MANUAL_RULE_RUN_FEATURE' | 'MANUAL_RULE_RUN_DISABLED_RULE' | 'THRESHOLD_RULE_TYPE_IN_SUPPRESSION' | 'UNSUPPORTED_RULE_IN_SUPPRESSION_FOR_THRESHOLD' | 'RULE_FILL_GAPS_DISABLED_RULE' | 'USER_INSUFFICIENT_RULE_PRIVILEGES' - `message` string, required - `rules` SecurityDetectionsAPIRuleDetailsInError[], required - `id` string, required - `name` string - `status_code` integer, required - `results` SecurityDetectionsAPIBulkEditActionResults, required - `created` SecurityDetectionsAPIRuleResponse[], required - union - SecurityDetectionsAPIEqlRule - … - SecurityDetectionsAPIQueryRule - … - SecurityDetectionsAPISavedQueryRule - … - SecurityDetectionsAPIThresholdRule - … - SecurityDetectionsAPIThreatMatchRule - … - SecurityDetectionsAPIMachineLearningRule - … - SecurityDetectionsAPINewTermsRule - … - SecurityDetectionsAPIEsqlRule - … - `deleted` SecurityDetectionsAPIRuleResponse[], required - union - SecurityDetectionsAPIEqlRule - … - SecurityDetectionsAPIQueryRule - … - SecurityDetectionsAPISavedQueryRule - … - SecurityDetectionsAPIThresholdRule - … - SecurityDetectionsAPIThreatMatchRule - … - SecurityDetectionsAPIMachineLearningRule - … - SecurityDetectionsAPINewTermsRule - … - SecurityDetectionsAPIEsqlRule - … - `skipped` SecurityDetectionsAPIBulkActionSkipResult[], required - `id` string, required - `name` string - `skip_reason` union, required - 'RULE_NOT_MODIFIED' - 'NO_GAPS_TO_FILL' - `updated` SecurityDetectionsAPIRuleResponse[], required - union - SecurityDetectionsAPIEqlRule - … - SecurityDetectionsAPIQueryRule - … - SecurityDetectionsAPISavedQueryRule - … - SecurityDetectionsAPIThresholdRule - … - SecurityDetectionsAPIThreatMatchRule - … - SecurityDetectionsAPIMachineLearningRule - … - SecurityDetectionsAPINewTermsRule - … - SecurityDetectionsAPIEsqlRule - … - `summary` SecurityDetectionsAPIBulkEditActionSummary, required — A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the `edit` action is used to add a tag to a rule that already has that tag, or to delete an index pattern that is not specified in a rule. Objects returned in `attributes.results.skipped` will only include rules' `id`, `name`, and `skip_reason`. - `failed` integer, required - `skipped` integer, required - `succeeded` integer, required - `total` integer, required - `message` string - `rules_count` integer - `status_code` integer - `success` boolean - string --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)