Delete a detection rule
Spaces method and path for this operation:
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>Refer to Spaces for more information.
Delete a detection rule using the rule_id or id field.
The URL query must include one of the following:
- id - DELETE /api/detection_engine/rules?id=<id>
- rule_id- DELETE /api/detection_engine/rules?rule_id=<rule_id>
The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.
Query parameters
A universally unique identifier
The rule's id value.
A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same rule_ids.
The rule's rule_id value.
Response
Indicates a successful call.
Example response
{
"actions": [
{
"frequency": {
"throttle": "1h"
}
}
],
"description": "Detects anomalous Windows process creation events.",
"name": "Anomalous Windows Process Creation",
"related_integrations": [
{
"integration": "activitylogs",
"package": "azure",
"version": "~1.1.6"
}
],
"response_actions": [
{
"params": {
"config": {
"linux": {
"timeout": 60
},
"macos": {
"timeout": 60
},
"windows": {
"timeout": 60
}
}
}
}
],
"throttle": "1h"
}