Security Detections API
Preview rule alerts generated on specified time range
Spaces method and path for this operation:
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules/preview</span></div>Refer to Spaces for more information.
Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short time window, without persisting a rule or writing alerts. Use the response to validate queries, see sample matching documents, and inspect execution logs. Pair invocationCount and timeframeEnd to cap run time.
post/api/detection_engine/rules/preview
Query parameters
enable_logged_requestsboolean
Enables logging and returning in response ES queries, performed during rule execution
Request body
Example request
{
"actions": [
{
"frequency": {
"throttle": "1h"
}
}
],
"description": "Detects anomalous Windows process creation events.",
"name": "Anomalous Windows Process Creation",
"related_integrations": [
{
"integration": "activitylogs",
"package": "azure",
"version": "~1.1.6"
}
],
"response_actions": [
{
"params": {
"config": {
"linux": {
"timeout": 60
},
"macos": {
"timeout": 60
},
"windows": {
"timeout": 60
}
}
}
}
],
"throttle": "1h"
}Response
Successful response