Find and/or aggregate detection alerts Base URL https://{kibana_url} POST /api/detection_engine/signals/search Auth Find and/or aggregate detection alerts that match the given query. Expand all Request body { } Search and/or aggregation query _source union boolean | string | string[] aggs object fields string[] query object runtime_mappings object size integer · min: 0 sort union oneOf One of: (string | object)[] or string | object track_total_hits boolean Responses 200 Successful response application/json Response Type: object 400 Invalid input data response application/json One of: Platform Siem Platform Siem − Hide 3 properties error string required message string required statusCode integer required − Hide 2 properties message string required status_code integer required 401 Unsuccessful authentication response application/json error string required message string required statusCode integer required 500 Internal server error response application/json message string required status_code integer required