v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Detections

Manage Detections in Bulk

Enables, disables, or deletes multiple detections asynchronously.

post/connect/detection/bulk/{newStatus}

newStatus'enable' | 'disable' | 'delete' required

The new status of the detection

idsstring[]

The list of detection IDs to bulk update when a specific query is not provided

querystring

The query string to use for matching detections, or leave empty if providing a list of internal detection IDs"

{
  "ids": [
    "zC73PJABrNRFAsnEYkqy",
    "XgaI6o8B-vS4HfrbYcce"
  ],
  "query": "severity: low AND ruleset: ETOPEN"
}

Returns the bulk operation response

countinteger

The count of detections that were submitted to be updated or deleted in bulk

{
  "count": 120
}