stack kb security-detections-api perform-rules-bulk-action cli command

elastic stack kb security-detections-api perform-rules-bulk-action \
  --action <action> \
  [options]

Apply a bulk action to detection rules

--action enum required

Values: edit

--dry-run

Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter dry_run=true to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.

info Dry run mode is not supported for the export bulk action. A 400 error will be returned in the request response.

--gap-auto-fill-scheduler-id string

Gap auto fill scheduler ID used to determine gap fill status for rules

--gap-fill-statuses string[]

Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).

Repeatable: pass --gap-fill-statuses multiple times to supply more than one value

--gaps-range-end string

Gaps range end, valid only when query is provided

--gaps-range-start string

Gaps range start, valid only when query is provided

--ids string[]

Array of rule ids to which a bulk action will be applied. Do not use rule's rule_id here. Only valid when query property is undefined.

Repeatable: pass --ids multiple times to supply more than one value

--query string

Query to filter rules.

--duplicate string

Duplicate object that describes applying an update action.

--run string

Object that describes applying a manual rule run action.

--fill-gaps string

Object that describes applying a manual gap fill action for the specified time range.

--edit string[]

Array of objects containing the edit operations

Repeatable: pass --edit multiple times to supply more than one value

--input-file string

path to a JSON file to use as command input

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON