stack kb security-detections-api find-rules cli command

elastic stack kb security-detections-api find-rules [options]

List all detection rules

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--fields string[]

List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or use comma-separated values when supported by your client.

Repeatable: pass --fields multiple times to supply more than one value

--filter string

Search query Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:

• name
• enabled
• tags
• createdBy
• interval
• updatedBy

info Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

--sort-field enum

Field to sort by

Values: created_at, createdAt, enabled, execution_summary.last_execution.date, execution_summary.last_execution.metrics.execution_gap_duration_s, execution_summary.last_execution.metrics.total_indexing_duration_ms, execution_summary.last_execution.metrics.total_search_duration_ms, execution_summary.last_execution.status, name, risk_score, riskScore, severity, updated_at, updatedAt

--sort-order enum

Sort order

Values: asc, desc

--page number

Page number

--per-page number

Rules per page

--gaps-range-start string

Gaps range start

--gaps-range-end string

Gaps range end

--gap-fill-statuses string[]

Gap fill statuses

Repeatable: pass --gap-fill-statuses multiple times to supply more than one value

--gap-auto-fill-scheduler-id string

Gap auto fill scheduler ID used to determine gap fill status for rules

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON