# Elastic Stack (ELK Stack) Security Detections API

**Canonical:** https://apis.io/apis/elk-stack/elk-stack-security-detections-api-api/  
**Provider:** Elastic Stack (ELK Stack) — https://apis.io/providers/elk-stack/  
**Base URL:** https://{elasticsearch_endpoint}  
**Documentation:** https://www.elastic.co/docs/api/doc/elasticsearch/

Elastic Stack (ELK Stack) Security Detections API is one of 132 APIs that [Elastic Stack (ELK Stack)](https://apis.io/providers/elk-stack/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Security Detections API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged. This API supports both key-based authentication and basic authentication. To use key-based authentication, create an API key, then specify the key in the header of your API calls. To use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges. In both cases, the API key is subsequently used for authorization when the rule runs. > warn > If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change. > If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running. To create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.

## Operations (29)

| Method | Path | Summary |
|---|---|---|
| POST | `/api/detection_engine/attacks/assignees` | Assign and unassign users from attack discovery alerts |
| POST | `/api/detection_engine/attacks/search` | Find and/or aggregate attack discovery alerts |
| POST | `/api/detection_engine/attacks/status` | Set attack discovery alerts workflow status |
| POST | `/api/detection_engine/attacks/tags` | Add and remove attack discovery alert tags |
| DELETE | `/api/detection_engine/index` | Delete an alerts index |
| GET | `/api/detection_engine/index` | Reads the alert index name if it exists |
| POST | `/api/detection_engine/index` | Create an alerts index |
| GET | `/api/detection_engine/privileges` | Returns user privileges for the Kibana space |
| DELETE | `/api/detection_engine/rules` | Delete a detection rule |
| GET | `/api/detection_engine/rules` | Retrieve a detection rule |
| PATCH | `/api/detection_engine/rules` | Patch a detection rule |
| POST | `/api/detection_engine/rules` | Create a detection rule |
| PUT | `/api/detection_engine/rules` | Update a detection rule |
| POST | `/api/detection_engine/rules/_bulk_action` | Apply a bulk action to detection rules |
| POST | `/api/detection_engine/rules/_export` | Export detection rules |
| GET | `/api/detection_engine/rules/_find` | List all detection rules |
| POST | `/api/detection_engine/rules/_import` | Import detection rules |
| PUT | `/api/detection_engine/rules/prepackaged` | Install prebuilt detection rules and Timelines |
| GET | `/api/detection_engine/rules/prepackaged/_status` | Retrieve the status of prebuilt detection rules and Timelines |
| POST | `/api/detection_engine/rules/preview` | Preview rule alerts generated on specified time range |
| POST | `/api/detection_engine/signals/assignees` | Assign and unassign users from detection alerts |
| POST | `/api/detection_engine/signals/finalize_migration` | Finalize detection alert migrations |
| DELETE | `/api/detection_engine/signals/migration` | Clean up detection alert migrations |
| POST | `/api/detection_engine/signals/migration` | Initiate a detection alert migration |
| GET | `/api/detection_engine/signals/migration_status` | Retrieve the status of detection alert migrations |
| POST | `/api/detection_engine/signals/search` | Find and/or aggregate detection alerts |
| POST | `/api/detection_engine/signals/status` | Set a detection alert status |
| POST | `/api/detection_engine/signals/tags` | Add and remove detection alert tags |
| GET | `/api/detection_engine/tags` | List all detection rule tags |

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-detections-api-api-openapi.yml
- **Documentation** — https://www.elastic.co/docs/reference/elasticsearch
- **APIReference** — https://www.elastic.co/docs/api/doc/elasticsearch/
- **SourceCode** — https://github.com/elastic/elasticsearch-specification
- **Documentation** — https://www.elastic.co/docs/reference/kibana
- **APIReference** — https://www.elastic.co/docs/api/doc/kibana/
- **SourceCode** — https://github.com/elastic/kibana
- **ToolCrosswalk** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

## Other Elastic Stack (ELK Stack) APIs (12)

- [Elastic Cloud API](https://apis.io/apis/elk-stack/elastic-cloud-api/)
- [Elastic Stack (ELK Stack) Accounts API](https://apis.io/apis/elk-stack/elk-stack-accounts-api/)
- [Elastic Stack (ELK Stack) Actions API](https://apis.io/apis/elk-stack/elk-stack-actions-api/)
- [Elastic Stack (ELK Stack) agent builder API](https://apis.io/apis/elk-stack/elk-stack-agent-builder-api/)
- [Elastic Stack (ELK Stack) Alerting API](https://apis.io/apis/elk-stack/elk-stack-alerting-api/)
- [Elastic Stack (ELK Stack) Alerting V2 API](https://apis.io/apis/elk-stack/elk-stack-alerting-v2-api/)
- [Elastic Stack (ELK Stack) Analytics API](https://apis.io/apis/elk-stack/elk-stack-analytics-api/)
- [Elastic Stack (ELK Stack) APM agent configuration API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-configuration-api/)
- [Elastic Stack (ELK Stack) APM agent keys API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-keys-api/)
- [Elastic Stack (ELK Stack) APM annotations API](https://apis.io/apis/elk-stack/elk-stack-apm-annotations-api/)
- [Elastic Stack (ELK Stack) APM server schema API](https://apis.io/apis/elk-stack/elk-stack-apm-server-schema-api/)
- [Elastic Stack (ELK Stack) APM sourcemaps API](https://apis.io/apis/elk-stack/elk-stack-apm-sourcemaps-api/)

## Tags

Security Detections API

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/elk-stack/elk-stack-security-detections-api-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/elk-stack/.