stack kb security-detections-api rule-preview cli command

elastic stack kb security-detections-api rule-preview \
  --description <description> \
  --name <name> \
  --risk-score <risk-score> \
  --severity <severity> \
  --type <type> \
  --invocation-count <invocation-count> \
  --timeframe-end <timeframe-end> \
  [options]

Preview rule alerts generated on specified time range

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--description string required

--name string required

--risk-score number required

--severity enum required

Values: low, medium, high, critical

--type enum required

Rule type

Values: esql

--invocation-count number required

--timeframe-end string required

--enable-logged-requests

Enables logging and returning in response ES queries, performed during rule execution

--actions string[]

Array defining the automated actions (notifications) taken when alerts are generated.

Repeatable: pass --actions multiple times to supply more than one value

--alias-purpose enum

Values: savedObjectConversion, savedObjectImport

--alias-target-id string

--author string[]

Repeatable: pass --author multiple times to supply more than one value

--building-block-type string

--enabled

--exceptions-list string[]

Repeatable: pass --exceptions-list multiple times to supply more than one value

--false-positives string[]

Repeatable: pass --false-positives multiple times to supply more than one value

--from string

--interval string

--investigation-fields string

--license string

--max-signals number

--meta string

--namespace string

--note string

--outcome enum

Values: exactMatch, aliasMatch, conflict

--output-index string

--references string[]

Repeatable: pass --references multiple times to supply more than one value

--related-integrations string[]

Repeatable: pass --related-integrations multiple times to supply more than one value

--required-fields string[]

Elasticsearch fields and their types that need to be present for the rule to function.

info The value of required_fields does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use required_fields as an informational property to document the fields that the rule expects to be present in the data.

Repeatable: pass --required-fields multiple times to supply more than one value

--response-actions string[]

Repeatable: pass --response-actions multiple times to supply more than one value

--risk-score-mapping string[]

Repeatable: pass --risk-score-mapping multiple times to supply more than one value

--rule-id string

--rule-name-override string

--setup string

--severity-mapping string[]

Repeatable: pass --severity-mapping multiple times to supply more than one value

--tags string[]

Repeatable: pass --tags multiple times to supply more than one value

--threat string[]

Repeatable: pass --threat multiple times to supply more than one value

--throttle string

--timeline-id string

--timeline-title string

--timestamp-override string

--timestamp-override-fallback-disabled

--to string

--version number

--language enum

Values: esql

--query string

--alert-suppression string

--data-view-id string

--event-category-override string

--filters string[]

Repeatable: pass --filters multiple times to supply more than one value

--index string[]

Repeatable: pass --index multiple times to supply more than one value

--tiebreaker-field string

--timestamp-field string

--saved-id string

--threshold string

--threat-index string[]

Repeatable: pass --threat-index multiple times to supply more than one value

--threat-mapping string[]

Repeatable: pass --threat-mapping multiple times to supply more than one value

--threat-query string

--concurrent-searches number

--items-per-search number

--threat-filters string[]

Repeatable: pass --threat-filters multiple times to supply more than one value

--threat-indicator-path string

--threat-language enum

Values: kuery, lucene

--anomaly-threshold number

--machine-learning-job-id string

Repeatable: pass --machine-learning-job-id multiple times to supply more than one value

--history-window-start string

--new-terms-fields string[]

Repeatable: pass --new-terms-fields multiple times to supply more than one value

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON