Defines a period that limits whether the action runs.
queryobject
dslstring
A filter written in Elasticsearch Query Domain Specific Language (DSL).
filtersobject[]required
A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the kbn-es-query package.
$stateobject
storeenumrequired
A filter that can be applied to a specific application context or applied globally.
Values:appStateglobalState
metamapstring to objectrequired
querymapstring to object
kqlstringrequired
A filter written in Kibana Query Language (KQL).
timeframeobject
daysenum[]required
Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
Values:1234567
hoursobjectrequired
endstringrequired
The end of the time frame, in 24-hour notation (hh:mm).
startstringrequired
The start of the time frame, in 24-hour notation (hh:mm).
timezonestringrequired
The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in support for daylight savings time and are not recommended.
connector_type_idstringrequired
The type of connector. This property appears in responses but cannot be set in requests.
frequencyobject
notify_whenenumrequired
Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.
The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when 'notify_when' is set to 'onThrottleInterval'. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
groupstring
The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to default.
idstringrequired
The identifier for the connector saved object.
paramsmapstring to objectrequired
The parameters for the action, which are sent to the connector. The params are handled as Mustache templates and passed a default set of context.
use_alert_data_for_templateboolean
Indicates whether to use alert data as a template.
uuidstring
A universally unique identifier (UUID) for the action.
alert_delayobject
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
activenumberrequired
The number of consecutive runs that must meet the rule conditions.
api_key_created_by_userbooleannullable
Indicates whether the API key that is associated with the rule was created by the user.
api_key_ownerstring · default: nullnullable
The owner of the API key that is associated with the rule and used to run background tasks.
artifactsobject
dashboardsobject[]
idstringrequired
investigation_guideobject
blobstringrequired
User-created content that describes alert causes and remediation.
consumerstringrequired
The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
created_atstringrequired
The date and time that the rule was created.
created_bystring · default: nullnullable
The identifier for the user that created the rule.
enabledbooleanrequired
Indicates whether you want the rule to run on an interval basis after it is created.
Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.
The interval is specified in seconds, minutes, hours, or days.
scheduled_task_idstring
Identifier of the scheduled task.
tagsstring[]required
throttlestringnullabledeprecated
Deprecated in 8.13.0. Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
updated_atstringrequired
The date and time of the latest updates to the rule.
updated_bystring · default: nullnullable
The identifier for the user who was the last to update the rule.
400
Indicates an invalid schema or parameters.
403
Indicates that this call is forbidden.
404
Indicates a rule with the given ID does not exist.