Reads the alert index name if it exists

Base URL: https://{kibana_url}

GET /api/detection_engine/index

Auth

Returns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and whether its mapping is outdated. Use this to verify that an alert index is provisioned before creating or running rules that write alerts to it.

Responses

Successful response

application/json

index_mapping_outdated boolean required nullable
name string required

Unsuccessful authentication response

application/json

Not enough permissions response

application/json

Not found

application/json

Internal server error response

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/detection_engine/index

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/detection_engine/index" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "index_mapping_outdated": false,
  "name": ".alerts-security.alerts-default"
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "API [GET /api/detection_engine/index] is unauthorized for the current user. Check Security and Kibana feature privileges (detection engine / alerts) for the space.",
  "status_code": 403
}

{
  "message": "Elastic Security alert index is not found for the current space.",
  "status_code": 404
}

{
  "message": "Internal Server Error",
  "status_code": 500
}