Elastic Stack

Elastic Stack (ELK Stack) Security Detections API

Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged. This API supports both key-based authentication and basic authentication. To use key-based authentication, create an API key, then specify the key in the header of your API calls. To use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges. In both cases, the API key is subsequently used for authorization when the rule runs. > warn > If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change. > If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running. To create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 29

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/detection_engine/attacks/assignees Assign users to attack discovery alerts · Assign and unassign users from attack discovery alerts #
Ask an LLM
“How do I assign an analyst to an attack discovery?”
“Can assigning an attack discovery also assign its related detection alerts?”
Tell an agent
Assign {assignees} to attack discovery alerts {ids}.
Update assignees on attacks {ids} to {assignees} and cascade to their related alerts {update_related_alerts}.
POST /api/detection_engine/attacks/search Search and aggregate attack discoveries · Find and/or aggregate attack discovery alerts #
Ask an LLM
“Which attack discoveries in this space match my query?”
“Can I aggregate attack discovery alerts, for example counting them by status?”
Tell an agent
Search attack discovery alerts matching {query}.
Aggregate attack discoveries using {aggs} and return {size} hits.
POST /api/detection_engine/attacks/status Change the workflow status of attack discoveries · Set attack discovery alerts workflow status #
Ask an LLM
“How do I mark an attack discovery as acknowledged or closed?”
“Can closing an attack discovery also close the detection alerts behind it?”
Tell an agent
Close the attack discovery alerts I've finished investigating.
Mark these attack discoveries as acknowledged and cascade the status to their related alerts.
POST /api/detection_engine/attacks/tags Tag or untag attack discoveries · Add and remove attack discovery alert tags #
Ask an LLM
“Can I add and remove tags on attack discoveries in a single request?”
“Will tagging an attack discovery also tag its related detection alerts?”
Tell an agent
Apply tag changes {tags} to attack discoveries {ids}.
Tag attacks {ids} with {tags} and propagate to related alerts {update_related_alerts}.
DELETE /api/detection_engine/index Delete the security alerts index · Delete an alerts index #
Ask an LLM
“What happens to stored alerts if I delete the alerts backing index?”
“Can I wipe the detection alerts index for one space?”
Tell an agent destructive · confirm first
Delete the security alerts backing index and all alerts in it.
Permanently remove this space's detection alerts index.
GET /api/detection_engine/index Check the security alerts index · Reads the alert index name if it exists #
Ask an LLM
“Which Elasticsearch index backs Elastic Security detection alerts in my space?”
“Is my alerts index mapping outdated?”
Tell an agent
Show the name of the detection alerts index in this space.
Check whether the security alerts index exists and if its mapping is out of date.
POST /api/detection_engine/index Create the security alerts index · Create an alerts index #
Ask an LLM
“Do I need to create an alerts index before detection rules can generate alerts?”
“How do I provision the Elastic Security alerts index for a space?”
Tell an agent
Create the Elastic Security alerts index for this space.
Provision the detection alerts backing index now.
GET /api/detection_engine/privileges Check my security detection privileges · Returns user privileges for the Kibana space #
Ask an LLM
“Do I have the index privileges needed to create the security alerts index?”
“What Kibana space and index privileges does my user have for detections?”
Tell an agent
Show my authentication status and detection engine privileges.
Check whether I can create the alerts index in this space.
DELETE /api/detection_engine/rules Delete a detection rule · Delete a detection rule #
Ask an LLM
“Can I remove a detection rule using its rule_id instead of its id?”
“What happens when I delete a detection rule?”
Tell an agent destructive · confirm first
Delete the detection rule with rule_id {rule_id}.
Remove detection rule {id}.
GET /api/detection_engine/rules Get a detection rule · Retrieve a detection rule #
Ask an LLM
“How do I look up one detection rule by its rule_id?”
“What's the difference between a rule's id and rule_id when fetching it?”
Tell an agent
Get detection rule with rule_id {rule_id}.
Fetch the detection rule whose id is {id}.
PATCH /api/detection_engine/rules Change specific fields of a detection rule · Patch a detection rule #
Ask an LLM
“Can I change just a rule's severity without resending the whole rule?”
“What's the way to partially update a detection rule?”
Tell an agent
Patch only the severity and risk score of an existing detection rule.
Disable one detection rule by changing just its enabled field.
POST /api/detection_engine/rules Create a detection rule · Create a detection rule #
Ask an LLM
“How do I create a new custom detection rule in Elastic Security?”
“Does creating a rule with an API key tie that key to the rule?”
Tell an agent
Create a new query detection rule for suspicious PowerShell activity.
Add a new detection rule from this definition.
PUT /api/detection_engine/rules Replace a detection rule · Update a detection rule #
Ask an LLM
“Does a full rule update delete the fields I leave out?”
“Can I overwrite an entire detection rule definition in one call?”
Tell an agent
Replace the whole definition of an existing detection rule with my new version.
Overwrite this detection rule completely, dropping any fields I don't specify.
POST /api/detection_engine/rules/_bulk_action Bulk edit, duplicate or delete detection rules · Apply a bulk action to detection rules #
Ask an LLM
“Can I enable, duplicate or delete many detection rules at once?”
“Is there a dry run to see which rules a bulk action would affect?”
Tell an agent destructive · confirm first
Apply a bulk edit to all detection rules matching my query.
Dry-run a bulk delete of these rules first ({dry_run}).
POST /api/detection_engine/rules/_export Export detection rules to NDJSON · Export detection rules #
Ask an LLM
“How do I back up detection rules to an .ndjson file?”
“Are exception lists and actions included when I export rules?”
Tell an agent
Export detection rules {objects} to an ndjson file.
Export rules {objects} as file {file_name} without export details.
GET /api/detection_engine/rules/_find List and filter detection rules · List all detection rules #
Ask an LLM
“Which detection rules do I have, 20 per page by default?”
“Can I filter detection rules by a KQL query and sort them?”
Tell an agent
List all my detection rules.
Find detection rules matching {filter}, sorted by {sort_field}.
POST /api/detection_engine/rules/_import Import detection rules from NDJSON · Import detection rules #
Ask an LLM
“Can I import detection rules from an .ndjson export file?”
“Will importing overwrite rules that already exist with the same rule_id?”
Tell an agent
Import detection rules from file {file}.
Import rules from {file} and overwrite existing ones ({overwrite}).
PUT /api/detection_engine/rules/prepackaged Install Elastic prebuilt rules and Timelines · Install prebuilt detection rules and Timelines #
Ask an LLM
“How do I install all of Elastic's prebuilt detection rules?”
“Does this also update prebuilt Timeline templates?”
Tell an agent
Install and update all Elastic prebuilt detection rules and Timelines.
Bring my prebuilt rules and Timeline templates up to date.
GET /api/detection_engine/rules/prepackaged/_status Check prebuilt rule and Timeline status · Retrieve the status of prebuilt detection rules and Timelines #
Ask an LLM
“How many prebuilt detection rules are installed versus available to update?”
“Are there any Elastic prebuilt Timelines I haven't installed yet?”
Tell an agent
Show the install status of Elastic prebuilt rules and Timelines.
Count my custom rules, installed prebuilt rules, and outdated prebuilt rules.
POST /api/detection_engine/rules/preview Preview a detection rule's alerts · Preview rule alerts generated on specified time range #
Ask an LLM
“Can I test a detection rule query to see what alerts it would produce without saving it?”
“Is there a way to validate a rule over a short time window before creating it?”
Tell an agent
Preview the alerts this draft rule would generate over the last hour.
Simulate this rule and include the logged Elasticsearch requests ({enable_logged_requests}).
POST /api/detection_engine/signals/assignees Assign users to detection alerts · Assign and unassign users from detection alerts #
Ask an LLM
“How do I assign a detection alert to someone on my team?”
“Can I add and remove the same assignee in one request?”
Tell an agent
Assign {assignees} to detection alerts {ids}.
Change the assigned users on alerts {ids} to {assignees}.
POST /api/detection_engine/signals/finalize_migration Finalize a legacy alert index migration · Finalize detection alert migrations #
Ask an LLM
“How do I complete a legacy .siem-signals migration once it has finished?”
“What does finalizing an alert migration do to the read aliases?”
Tell an agent destructive · confirm first
Finalize alert migrations {migration_ids}.
Swap read aliases to complete migrations {migration_ids}.
DELETE /api/detection_engine/signals/migration Clean up legacy alert migrations · Clean up detection alert migrations #
Ask an LLM
“How do I clean up old artifacts left from a signals index migration?”
“Does migration cleanup schedule the source index for deletion?”
Tell an agent destructive · confirm first
Clean up alert migrations {migration_ids}.
Schedule deletion of the source indices for migrations {migration_ids}.
POST /api/detection_engine/signals/migration Start a legacy alert index migration · Initiate a detection alert migration #
Ask an LLM
“Can I reindex an old .siem-signals alert index to the new mapping?”
“How do I throttle a legacy alert reindex with requests per second?”
Tell an agent
Start a migration of alert index {index}.
Migrate legacy alert indices {index} at {requests_per_second} requests per second.
GET /api/detection_engine/signals/migration_status Check legacy alert migration status · Retrieve the status of detection alert migrations #
Ask an LLM
“Which old .siem-signals indices still need migrating?”
“What's the status of alert index migrations since a given date?”
Tell an agent
Show alert migration status for indices with alerts since {from}.
Check which legacy signal indices are outdated starting from {from}.
POST /api/detection_engine/signals/search Search and aggregate detection alerts · Find and/or aggregate detection alerts #
Ask an LLM
“Which detection alerts match a query I write in Elasticsearch DSL?”
“Can I aggregate detection alerts by rule name or severity?”
Tell an agent
Search detection alerts matching {query}.
Aggregate detection alerts using {aggs}.
POST /api/detection_engine/signals/status Open, acknowledge or close detection alerts · Set a detection alert status #
Ask an LLM
“How do I close a batch of detection alerts?”
“Can I set detection alerts back to open after acknowledging them?”
Tell an agent
Close the detection alerts I've triaged.
Mark these detection alerts as acknowledged.
POST /api/detection_engine/signals/tags Tag or untag detection alerts · Add and remove detection alert tags #
Ask an LLM
“Can I add and remove tags on detection alerts in one call?”
“Is it possible to tag detection alerts that match a query instead of by id?”
Tell an agent
Update tags on detection alerts {ids} with {tags}.
Add and remove the tag changes {tags} on alerts {ids}.
GET /api/detection_engine/tags List detection rule tags · List all detection rule tags #
Ask an LLM
“What tags are in use across all my detection rules?”
“Can I get the unique list of rule tags?”
Tell an agent
List all unique detection rule tags.
Show every tag used by my detection rules.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-detections-api-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-detections-api-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-detections-api-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Security Detections API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (482 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-detections-api-api-openapi.yml