# Automating Rule Creation for Kibana **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [June 17, 2024, 9:36pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603 "2024-06-17T21:36:19Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [June 17, 2024, 9:36pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/1 "2024-06-17T21:36:19Z")
I am trying to automate rule creation, updating and deletion via a Python script. I have tried both using curl and Python I use curl to create the rule: `curl -k -X POST "https://192.168.10.131:5601/api/detection_engine/rules/_bulk_action" -d"{"rule_id":"process_started_by_ms_office_program_possible_payload","risk_score":50,"description":"Process started by MS Office program","interval":"5m","name":"MS Office child process","severity":"low","tags":["child process","ms office"],"type":"query","from":"now-6m","query":"process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE","language":"kuery","filters":[{"query":{"match":{"event.action":{"query":"Process Create (rule: ProcessCreate)","type":"phrase"}}}}],"enabled":false},{"name":"Second bulk rule","description":"Query with a rule_id for referencing an external id","rule_id":"query-rule-id-2","risk_score":2,"severity":"low","type":"query","from":"now-6m","query":"user.name: root or user.name: admin"}" -H "Authorization: ApiKey ZXkzRElwQUJnYW9Td2d5emFZVkQ6a0w3N1BXdVlUQTZHakRmU2RRVXBYdw==" -H "kbn-xsrf: true" ` I get the following error: {"statusCode":400,"error":"Bad Request","message":"[request body]: action: Invalid literal value, expected "delete", action: Invalid literal value, expected "disable", action: Invalid literal value, expected "enable", action: Invalid literal value, expected "export", action: Invalid literal value, expected "duplicate", and 2 more"} ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [June 19, 2024, 8:44am UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/2 "2024-06-19T08:44:32Z")
Hi @Emin, Welcome to the community! It looks like you're sending a malformed request: > [@Emin](#): > > {"statusCode":400,"error":"Bad Request","message":"[request body]: action: Invalid literal value, expected "delete", action: Invalid literal value, expected "disable", action: Invalid literal value, expected "enable", action: Invalid literal value, expected "export", action: Invalid literal value, expected "duplicate", and 2 more"} The above error suggests your have an invalid value for the `action` options, which should match one of the options specified [in the request body documentation](https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#_request_body_6). Can you try using one of those values? Let us know if that resolves your issue. ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [June 20, 2024, 6:56pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/3 "2024-06-20T18:56:47Z")
Hi Carly. Thank you for your response. I did find it helpful. I have managed to run the following code, without any errors. ```auto rule_data = { "action": "enable", "rules": [ { "rule_id": "test_rule_id", "name": "Test Rule", "description": "This is a test rule", "risk_score": 50, "severity": "low", "type": "eql", "from": "now-6m", "query": "process.parent.name:EXCEL.EXE", "language": "kuery", #"enabled": false } ] } def create_rule(json_parsed_data, token): # API endpoint for rule creation url = "https://192.168.10.131:5601/api/detection_engine/rules/_bulk_action" #url = "https://192.168.10.131:5601/api/detection_engine/rules" headers = { "Authorization": f"ApiKey {token}", "kbn-xsrf": "true", # This header is often set to 'true' or '1' "Content-Type": "application/json" } # Make POST request to create a new rule response = requests.post(url, json=json_parsed_data, headers=headers, verify=False) try: response = requests.post(url, headers=headers, data=json.dumps(json_parsed_data), verify=False) response.raise_for_status() print("Rule created successfully") except requests.exceptions.HTTPError as err: print(f"Failed to create rule: {response.json()}") ``` However, I am still having trouble creating a rule. I mean how do you generate the rule? When I pass enable, the code runs without any errors, but when I try to pass edit as action I get this error: ```auto Failed to create rule: {'statusCode': 400, 'error': 'Bad Request', 'message': '[request body]: action: Invalid literal value, expected "delete", action: Invalid literal value, expected "disable", action: Invalid literal value, expected "enable", action: Invalid literal value, expected "export", action: Invalid literal value, expected "duplicate", and 1 more'} ``` I would be very grateful, if you could be so kind, as to help me to resolve this matter and begin automatically generating and updating rules with this script. Thank you once again. ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [June 21, 2024, 9:15am UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/4 "2024-06-21T09:15:40Z")
Hi @Emin, It looks like you are sending a malformed request to the edit request. Can you share the request you are sending that fails? Looking at [example 2 in the documentation](https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#_example_requests_2) there is an edit example that you can try to replicate. Hope that helps! ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [June 21, 2024, 2:51pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/5 "2024-06-21T14:51:16Z")
Hi Carly. The request I am sending, which generates the error in my previous reply is below. Thanks you for your help so far. ```auto rule_data = { "action": "edit", "rules": [ { "rule_id": "test_rule_id", "name": "Test Rule", "description": "This is a test rule", "risk_score": 50, "severity": "low", "type": "eql", "from": "now-6m", "query": "process.parent.name:EXCEL.EXE", "language": "kuery", #"enabled": false } ] } ``` ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [June 25, 2024, 9:48am UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/6 "2024-06-25T09:48:16Z")
Hi @Emin, Can you explain in simple terms what edit you're trying to make to the above rule? Comparing your example to the one in the documentation, I don't think it's formatted correctly. [Example 2 in the documentation](https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#bulk-actions-rules-api-action) has id, action and edit as the top level attributes: ```auto POST api/detection_engine/rules/_bulk_action { "ids":[ "8bc7dad0-9320-11ec-9265-8b772383a08d", "8e5c1a40-9320-11ec-9265-8b772383a08d" ], "action": "edit", "edit": [{ "type": "add_tags", "value":["tag-1", "tag-2"] }] } ``` ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [June 25, 2024, 4:24pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/7 "2024-06-25T16:24:26Z")
Hi Carly. In simple terms, I am trying to create a brand new rule. Would you please help me to write a script that will automatically create a rule? I am just not sure which command to use to create a rule, whether in bulk or one by one, does not matter. Thank you. ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [June 28, 2024, 1:43pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/8 "2024-06-28T13:43:45Z")
Hello Carly. Would you please confirm whether it is possible to create rules with this API? Or if its possible to automatically create single rules with some other API? Thank you kindly. ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [July 1, 2024, 8:41am UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/9 "2024-07-01T08:41:02Z")
Hi @Emin, Thanks for following up. It should be possible to create a rule using bulk actions. But for creating a single rule I would recommend using the create API: > **[Create rule | Elastic Security Solution \[8.14\] | Elastic](https://www.elastic.co/guide/en/security/current/rules-api-create.html)** There are some examples in the above documentation that should help. ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [July 24, 2024, 5:09am UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/10 "2024-07-24T05:09:54Z")
Hi Carly. Thank you very much for your help and support. I have managed to create a Python function, which creates single rules. However, I am having trouble with the function to delete any given rule found/returned by running a query to find all the rules. I am including evidence of the successful creation of the rules and the errors when I try to delete any rule: ```auto Response Status Code: 200 Response Headers: {'elastic-api-version': '2023-10-31', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'permissions-policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'cross-origin-opener-policy': 'same-origin', 'content-security-policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'content-security-policy-report-only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'content-length': '794', 'Date': 'Thu, 18 Jul 2024 15:52:58 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120'} Response Text: {"name":"Test Custom Query Rule","description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","version":1,"tags":[],"enabled":true,"risk_score_mapping":[],"severity_mapping":[],"interval":"5m","from":"now-6m","to":"now","actions":[],"exceptions_list":[],"author":[],"false_positives":[],"references":[],"max_signals":100,"threat":[],"setup":"","id":"637615b9-2e4a-4fb1-8a5b-6db01a83c064","rule_id":"04972245-a681-406b-9432-43abce22701e","immutable":false,"updated_at":"2024-07-18T15:52:57.257Z","updated_by":"elastic","created_at":"2024-07-18T15:52:57.257Z","created_by":"elastic","revision":0,"related_integrations":[],"required_fields":[],"type":"query","index":["logs-*"],"query":"process.name: \"malicious.exe\"","language":"kuery"} Response Status Code: 200 Response Headers: {'elastic-api-version': '2023-10-31', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'permissions-policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'cross-origin-opener-policy': 'same-origin', 'content-security-policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'content-security-policy-report-only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'vary': 'accept-encoding', 'content-encoding': 'gzip', 'Date': 'Thu, 18 Jul 2024 15:52:58 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120', 'Transfer-Encoding': 'chunked'} Response Text: {"page":1,"perPage":20,"total":15,"data":[{"id":"43ea88e7-6f69-4d4e-917c-d91d952f6caa","updated_at":"2024-07-17T16:00:46.621Z","updated_by":"elastic","created_at":"2024-07-12T21:03:07.357Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":false,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"33bf4870-0091-4548-a46d-ac5dac913557","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-17T15:56:36.851Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":71197}}}},{"id":"790af310-94e3-4996-916d-6c5b2c3e4c4e","updated_at":"2024-07-17T16:06:21.746Z","updated_by":"elastic","created_at":"2024-07-17T16:06:21.003Z","created_by":"elastic","name":"Test Custom Query Rule [Duplicate]","tags":[],"interval":"5m","enabled":false,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"397c6715-53bf-47ba-abc4-bcbf5562f55f","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[]},{"id":"bda76709-d0f8-4461-b5b6-b88518f74daf","updated_at":"2024-07-17T15:55:41.721Z","updated_by":"elastic","created_at":"2024-07-17T15:55:41.721Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"cde491da-154e-4bb4-a948-0f44f42b30e5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.883Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34963}}}},{"id":"2a4714de-f6b2-497f-b000-8a5f8fa4a7e5","updated_at":"2024-07-12T20:34:55.170Z","updated_by":"elastic","created_at":"2024-07-12T20:34:55.170Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"08a4a98c-f3b9-4e39-8464-cb736325c78a","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.885Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"cdfd0434-f633-4c58-86f2-1fb1764ca423","updated_at":"2024-07-11T21:09:35.371Z","updated_by":"elastic","created_at":"2024-07-11T21:09:35.371Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"713ff16f-fcca-4ffb-8a84-c8b88179adf3","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.882Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"d34e284c-0914-44c8-b7b2-659797aa1b0f","updated_at":"2024-07-12T20:33:10.014Z","updated_by":"elastic","created_at":"2024-07-12T20:33:10.014Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"0f3eaa19-03e3-462e-831d-71b58d231444","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.886Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"7a4c2f24-20ac-4ead-90ed-7d09324a2596","updated_at":"2024-07-11T20:54:57.717Z","updated_by":"elastic","created_at":"2024-07-11T20:54:57.717Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f2af7829-1fd8-4dfe-bdf0-e74316f12526","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.881Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"9c3e97ab-c4bb-4d98-a7a8-df5528da73a5","updated_at":"2024-07-11T21:08:57.119Z","updated_by":"elastic","created_at":"2024-07-11T21:08:57.119Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"62995514-34fe-4a29-8a04-585b12ff209e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.893Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"0bd477ae-e1f7-4893-b6e4-88048c6ce8c6","updated_at":"2024-07-17T15:52:40.162Z","updated_by":"elastic","created_at":"2024-07-17T15:52:40.162Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"d9fee890-9d78-4fe1-a323-056ddfec5c91","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.894Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34843}}}},{"id":"fcc1c99c-1e0e-4998-896e-541cd0b855c6","updated_at":"2024-07-11T20:57:50.811Z","updated_by":"elastic","created_at":"2024-07-11T20:57:50.811Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f652c302-673c-4b74-a220-4621ad3e4da5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.895Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"c5d0f760-a299-40f4-ba00-f0448dc6f1ef","updated_at":"2024-07-14T08:52:15.140Z","updated_by":"elastic","created_at":"2024-07-14T08:52:15.140Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"67550e19-7d41-4e67-b53d-6a8066d9fad5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.897Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"d8e6c0a8-3142-4715-b180-982bc79cf523","updated_at":"2024-07-17T15:59:28.052Z","updated_by":"elastic","created_at":"2024-07-17T15:59:28.052Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"4ebb2130-6e77-4f66-b35e-d2aa87370d37","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.895Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34738}}}},{"id":"11bc109e-094d-436c-9142-a442c35cf20a","updated_at":"2024-07-14T08:13:15.517Z","updated_by":"elastic","created_at":"2024-07-14T08:13:15.517Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"71c32e3c-40b5-446d-b638-fefcd82e9478","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.898Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"2dac9f24-f623-4697-8e72-60f463893e8d","updated_at":"2024-07-12T20:36:41.508Z","updated_by":"elastic","created_at":"2024-07-12T20:36:41.508Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"b3516ea6-c785-461b-ad3b-6b91aa017d83","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.896Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"637615b9-2e4a-4fb1-8a5b-6db01a83c064","updated_at":"2024-07-18T15:52:57.257Z","updated_by":"elastic","created_at":"2024-07-18T15:52:57.257Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"04972245-a681-406b-9432-43abce22701e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[]}]} All Rules Before Deletion: ``` As you can see, the function creates the rule without any problems. The issues I am facing now, is with the deletion of any rule returned by the query (shown below) The rule deletion attempt ```auto Attempting to delete rule with ID: 11bc109e-094d-436c-9142-a442c35cf20a Response Status Code: 404 Response Headers: {'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'strict-origin-when-cross-origin', 'Permissions-Policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'Cross-Origin-Opener-Policy': 'same-origin', 'Content-Security-Policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'Content-Security-Policy-Report-Only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'content-length': '60', 'Date': 'Thu, 18 Jul 2024 15:52:58 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120'} Response Text: {"statusCode":404,"error":"Not Found","message":"Not Found"} Failed to delete rule with ID: 11bc109e-094d-436c-9142-a442c35cf20a, verifying existence... Response Status Code: 200 Response Headers: {'elastic-api-version': '2023-10-31', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'permissions-policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'cross-origin-opener-policy': 'same-origin', 'content-security-policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'content-security-policy-report-only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'vary': 'accept-encoding', 'content-encoding': 'gzip', 'Date': 'Thu, 18 Jul 2024 15:52:58 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120', 'Transfer-Encoding': 'chunked'} Response Text: {"page":1,"perPage":20,"total":15,"data":[{"id":"43ea88e7-6f69-4d4e-917c-d91d952f6caa","updated_at":"2024-07-17T16:00:46.621Z","updated_by":"elastic","created_at":"2024-07-12T21:03:07.357Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":false,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"33bf4870-0091-4548-a46d-ac5dac913557","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-17T15:56:36.851Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":71197}}}},{"id":"790af310-94e3-4996-916d-6c5b2c3e4c4e","updated_at":"2024-07-17T16:06:21.746Z","updated_by":"elastic","created_at":"2024-07-17T16:06:21.003Z","created_by":"elastic","name":"Test Custom Query Rule [Duplicate]","tags":[],"interval":"5m","enabled":false,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"397c6715-53bf-47ba-abc4-bcbf5562f55f","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[]},{"id":"bda76709-d0f8-4461-b5b6-b88518f74daf","updated_at":"2024-07-17T15:55:41.721Z","updated_by":"elastic","created_at":"2024-07-17T15:55:41.721Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"cde491da-154e-4bb4-a948-0f44f42b30e5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.883Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34963}}}},{"id":"2a4714de-f6b2-497f-b000-8a5f8fa4a7e5","updated_at":"2024-07-12T20:34:55.170Z","updated_by":"elastic","created_at":"2024-07-12T20:34:55.170Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"08a4a98c-f3b9-4e39-8464-cb736325c78a","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.885Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"cdfd0434-f633-4c58-86f2-1fb1764ca423","updated_at":"2024-07-11T21:09:35.371Z","updated_by":"elastic","created_at":"2024-07-11T21:09:35.371Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"713ff16f-fcca-4ffb-8a84-c8b88179adf3","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.882Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"d34e284c-0914-44c8-b7b2-659797aa1b0f","updated_at":"2024-07-12T20:33:10.014Z","updated_by":"elastic","created_at":"2024-07-12T20:33:10.014Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"0f3eaa19-03e3-462e-831d-71b58d231444","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.886Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"7a4c2f24-20ac-4ead-90ed-7d09324a2596","updated_at":"2024-07-11T20:54:57.717Z","updated_by":"elastic","created_at":"2024-07-11T20:54:57.717Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f2af7829-1fd8-4dfe-bdf0-e74316f12526","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:35.881Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"9c3e97ab-c4bb-4d98-a7a8-df5528da73a5","updated_at":"2024-07-11T21:08:57.119Z","updated_by":"elastic","created_at":"2024-07-11T21:08:57.119Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"62995514-34fe-4a29-8a04-585b12ff209e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.893Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"0bd477ae-e1f7-4893-b6e4-88048c6ce8c6","updated_at":"2024-07-17T15:52:40.162Z","updated_by":"elastic","created_at":"2024-07-17T15:52:40.162Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"d9fee890-9d78-4fe1-a323-056ddfec5c91","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.894Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34843}}}},{"id":"fcc1c99c-1e0e-4998-896e-541cd0b855c6","updated_at":"2024-07-11T20:57:50.811Z","updated_by":"elastic","created_at":"2024-07-11T20:57:50.811Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f652c302-673c-4b74-a220-4621ad3e4da5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.895Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"c5d0f760-a299-40f4-ba00-f0448dc6f1ef","updated_at":"2024-07-14T08:52:15.140Z","updated_by":"elastic","created_at":"2024-07-14T08:52:15.140Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"67550e19-7d41-4e67-b53d-6a8066d9fad5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.897Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34909}}}},{"id":"d8e6c0a8-3142-4715-b180-982bc79cf523","updated_at":"2024-07-17T15:59:28.052Z","updated_by":"elastic","created_at":"2024-07-17T15:59:28.052Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"4ebb2130-6e77-4f66-b35e-d2aa87370d37","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.895Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34738}}}},{"id":"11bc109e-094d-436c-9142-a442c35cf20a","updated_at":"2024-07-14T08:13:15.517Z","updated_by":"elastic","created_at":"2024-07-14T08:13:15.517Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"71c32e3c-40b5-446d-b638-fefcd82e9478","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.898Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"2dac9f24-f623-4697-8e72-60f463893e8d","updated_at":"2024-07-12T20:36:41.508Z","updated_by":"elastic","created_at":"2024-07-12T20:36:41.508Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"b3516ea6-c785-461b-ad3b-6b91aa017d83","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-18T15:52:38.896Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":34912}}}},{"id":"637615b9-2e4a-4fb1-8a5b-6db01a83c064","updated_at":"2024-07-18T15:52:57.257Z","updated_by":"elastic","created_at":"2024-07-18T15:52:57.257Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"04972245-a681-406b-9432-43abce22701e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[]}]} Attempting to delete rule with ID: 2a4714de-f6b2-497f-b000-8a5f8fa4a7e5 Response Status Code: 404 Response Headers: {'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'strict-origin-when-cross-origin', 'Permissions-Policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'Cross-Origin-Opener-Policy': 'same-origin', 'Content-Security-Policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'Content-Security-Policy-Report-Only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'content-length': '60', 'Date': 'Thu, 18 Jul 2024 15:52:58 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120'} Response Text: {"statusCode":404,"error":"Not Found","message":"Not Found"} Failed to delete rule with ID: 2a4714de-f6b2-497f-b000-8a5f8fa4a7e5, verifying existence... ``` I would really appreciate it, if you could be so kind to help me resolve this problem. Thank you. ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [July 24, 2024, 9:16am UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/11 "2024-07-24T09:16:02Z")
Hi @Emin, I assume you are using the [Delete Rule API](https://www.elastic.co/guide/en/kibana/current/delete-rule-api.html)? > [@Emin](#): > > `Response Status Code: 404` It looks like you are receiving 404 errors for a subset of the rules. Can you confirm that the IDs are correct, the rule with that ID existis, and that those rules have been created within the default Kibana space? [As covered in the documentation](https://www.elastic.co/guide/en/kibana/current/delete-rule-api.html#delete-rule-api-path-params) if the space is not specified it will assume the default space. Hope that helps! ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [July 24, 2024, 8:06pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/12 "2024-07-24T20:06:37Z")
Hi Carly. Thank you for your response. I am including the Python code which creates and attempts to delete rules. ```auto import requests import json import urllib3 from collections import defaultdict urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) base_url = "https://192.168.10.131:5601" def create_rule(rule_data, token): url = f"{base_url}/api/detection_engine/rules" headers = { "Authorization": f"ApiKey {token}", "kbn-xsrf": "true", "Content-Type": "application/json" } response = requests.post(url, json=rule_data, headers=headers, verify=False) print_response(response) return response.json()["id"] def fetch_all_rules(token): url = f"{base_url}/api/detection_engine/rules/_find" headers = { "Authorization": f"ApiKey {token}", "kbn-xsrf": "true", "Content-Type": "application/json" } response = requests.get(url, headers=headers, verify=False) print_response(response) return response.json()["data"] def delete_rule(rule_id, token): url = f"{base_url}/api/detection_engine/rules/{rule_id}" headers = { "Authorization": f"ApiKey {token}", "kbn-xsrf": "true", "Content-Type": "application/json" } response = requests.delete(url, headers=headers, verify=False) print_response(response) return response.status_code == 200 def print_response(response): print("Response Status Code:", response.status_code) print("Response Headers:", response.headers) print("Response Text:", response.text) token = "UXkzN0o1QUJnYW9Td2d5ejNJd3Q6dG1kTjhPSkpTN0N5RzRhOXloZkd2UQ==" rule_data = { "description": "This is a test rule to detect suspicious activity.", "name": "Test Custom Query Rule", "risk_score": 50, "severity": "high", "type": "query", "query": "process.name: \"malicious.exe\"", "interval": "5m", "from": "now-6m", "to": "now", "enabled": True, "index": ["logs-*"], "language": "kuery" } rule_id = create_rule(rule_data, token) all_rules = fetch_all_rules(token) print("All Rules Before Deletion:") for rule in all_rules: print(json.dumps(rule, indent=2)) rule_names = defaultdict(list) for rule in all_rules: rule_names[rule['name']].append(rule['id']) print("\nDuplicate Rules:") for name, ids in rule_names.items(): if len(ids) > 1: print(f"Rule Name: {name}") for rule_id in ids: print(f" - Rule ID: {rule_id}") for name, ids in rule_names.items(): if len(ids) > 1: ids_to_delete = sorted(ids)[:-1] for rule_id in ids_to_delete: print(f"Attempting to delete rule with ID: {rule_id}") if delete_rule(rule_id, token): print(f"Deleted rule with ID: {rule_id}") else: print(f"Failed to delete rule with ID: {rule_id}, verifying existence...") all_rules = fetch_all_rules(token) existing_ids = [rule['id'] for rule in all_rules] if rule_id not in existing_ids: print(f"Rule with ID: {rule_id} does not exist. Skipping...") all_rules_after_deletion = fetch_all_rules(token) print("\nAll Rules After Deletion:") for rule in all_rules_after_deletion: print(json.dumps(rule, indent=2)) ``` I am writing another reply to your last response, as the output of the code here want fit in this reply. ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [July 24, 2024, 8:18pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/13 "2024-07-24T20:18:36Z")
And this is part of the output I get when I run the code in the previous reply: ```auto Response Status Code: 200 Response Headers: {'elastic-api-version': '2023-10-31', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'permissions-policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'cross-origin-opener-policy': 'same-origin', 'content-security-policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'content-security-policy-report-only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'content-length': '794', 'Date': 'Wed, 24 Jul 2024 20:04:48 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120'} Response Text: {"name":"Test Custom Query Rule","description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","version":1,"tags":[],"enabled":true,"risk_score_mapping":[],"severity_mapping":[],"interval":"5m","from":"now-6m","to":"now","actions":[],"exceptions_list":[],"author":[],"false_positives":[],"references":[],"max_signals":100,"threat":[],"setup":"","id":"f289f429-94c2-41fa-9525-904159b94588","rule_id":"70690b3c-c4bc-4539-8edf-b6b555f38ca9","immutable":false,"updated_at":"2024-07-24T20:04:46.681Z","updated_by":"elastic","created_at":"2024-07-24T20:04:46.681Z","created_by":"elastic","revision":0,"related_integrations":[],"required_fields":[],"type":"query","index":["logs-*"],"query":"process.name: \"malicious.exe\"","language":"kuery"} Response Status Code: 200 Response Headers: {'elastic-api-version': '2023-10-31', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'permissions-policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'cross-origin-opener-policy': 'same-origin', 'content-security-policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'content-security-policy-report-only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'vary': 'accept-encoding', 'content-encoding': 'gzip', 'Date': 'Wed, 24 Jul 2024 20:04:48 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120', 'Transfer-Encoding': 'chunked'} Response Text: {"page":1,"perPage":20,"total":16,"data":[{"id":"790af310-94e3-4996-916d-6c5b2c3e4c4e","updated_at":"2024-07-19T13:51:51.491Z","updated_by":"elastic","created_at":"2024-07-17T16:06:21.003Z","created_by":"elastic","name":"Test Custom Query Rule [Duplicate]","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"397c6715-53bf-47ba-abc4-bcbf5562f55f","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.989Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"43ea88e7-6f69-4d4e-917c-d91d952f6caa","updated_at":"2024-07-19T13:51:48.853Z","updated_by":"elastic","created_at":"2024-07-12T21:03:07.357Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"33bf4870-0091-4548-a46d-ac5dac913557","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.989Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"cdfd0434-f633-4c58-86f2-1fb1764ca423","updated_at":"2024-07-11T21:09:35.371Z","updated_by":"elastic","created_at":"2024-07-11T21:09:35.371Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"713ff16f-fcca-4ffb-8a84-c8b88179adf3","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.990Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"7a4c2f24-20ac-4ead-90ed-7d09324a2596","updated_at":"2024-07-11T20:54:57.717Z","updated_by":"elastic","created_at":"2024-07-11T20:54:57.717Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f2af7829-1fd8-4dfe-bdf0-e74316f12526","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.988Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"fcc1c99c-1e0e-4998-896e-541cd0b855c6","updated_at":"2024-07-11T20:57:50.811Z","updated_by":"elastic","created_at":"2024-07-11T20:57:50.811Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f652c302-673c-4b74-a220-4621ad3e4da5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.986Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39708}}}},{"id":"d8e6c0a8-3142-4715-b180-982bc79cf523","updated_at":"2024-07-17T15:59:28.052Z","updated_by":"elastic","created_at":"2024-07-17T15:59:28.052Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"4ebb2130-6e77-4f66-b35e-d2aa87370d37","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.988Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"2a4714de-f6b2-497f-b000-8a5f8fa4a7e5","updated_at":"2024-07-12T20:34:55.170Z","updated_by":"elastic","created_at":"2024-07-12T20:34:55.170Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"08a4a98c-f3b9-4e39-8464-cb736325c78a","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.987Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"d34e284c-0914-44c8-b7b2-659797aa1b0f","updated_at":"2024-07-12T20:33:10.014Z","updated_by":"elastic","created_at":"2024-07-12T20:33:10.014Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"0f3eaa19-03e3-462e-831d-71b58d231444","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.991Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39708}}}},{"id":"9c3e97ab-c4bb-4d98-a7a8-df5528da73a5","updated_at":"2024-07-11T21:08:57.119Z","updated_by":"elastic","created_at":"2024-07-11T21:08:57.119Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"62995514-34fe-4a29-8a04-585b12ff209e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.986Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"11bc109e-094d-436c-9142-a442c35cf20a","updated_at":"2024-07-14T08:13:15.517Z","updated_by":"elastic","created_at":"2024-07-14T08:13:15.517Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"71c32e3c-40b5-446d-b638-fefcd82e9478","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.009Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"0bd477ae-e1f7-4893-b6e4-88048c6ce8c6","updated_at":"2024-07-17T15:52:40.162Z","updated_by":"elastic","created_at":"2024-07-17T15:52:40.162Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"d9fee890-9d78-4fe1-a323-056ddfec5c91","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.007Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"637615b9-2e4a-4fb1-8a5b-6db01a83c064","updated_at":"2024-07-18T15:52:57.257Z","updated_by":"elastic","created_at":"2024-07-18T15:52:57.257Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"04972245-a681-406b-9432-43abce22701e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.004Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"2dac9f24-f623-4697-8e72-60f463893e8d","updated_at":"2024-07-12T20:36:41.508Z","updated_by":"elastic","created_at":"2024-07-12T20:36:41.508Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"b3516ea6-c785-461b-ad3b-6b91aa017d83","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.009Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"c5d0f760-a299-40f4-ba00-f0448dc6f1ef","updated_at":"2024-07-14T08:52:15.140Z","updated_by":"elastic","created_at":"2024-07-14T08:52:15.140Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"67550e19-7d41-4e67-b53d-6a8066d9fad5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.010Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"bda76709-d0f8-4461-b5b6-b88518f74daf","updated_at":"2024-07-17T15:55:41.721Z","updated_by":"elastic","created_at":"2024-07-17T15:55:41.721Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"cde491da-154e-4bb4-a948-0f44f42b30e5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.010Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"f289f429-94c2-41fa-9525-904159b94588","updated_at":"2024-07-24T20:04:46.681Z","updated_by":"elastic","created_at":"2024-07-24T20:04:46.681Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"70690b3c-c4bc-4539-8edf-b6b555f38ca9","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[]}]} And then this: Attempting to delete rule with ID: 11bc109e-094d-436c-9142-a442c35cf20a Response Status Code: 404 Response Headers: {'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'strict-origin-when-cross-origin', 'Permissions-Policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'Cross-Origin-Opener-Policy': 'same-origin', 'Content-Security-Policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'Content-Security-Policy-Report-Only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'content-length': '60', 'Date': 'Wed, 24 Jul 2024 20:04:48 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120'} Response Text: {"statusCode":404,"error":"Not Found","message":"Not Found"} Failed to delete rule with ID: 11bc109e-094d-436c-9142-a442c35cf20a, verifying existence... Response Status Code: 200 Response Headers: {'elastic-api-version': '2023-10-31', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'permissions-policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'cross-origin-opener-policy': 'same-origin', 'content-security-policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'content-security-policy-report-only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'vary': 'accept-encoding', 'content-encoding': 'gzip', 'Date': 'Wed, 24 Jul 2024 20:04:49 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120', 'Transfer-Encoding': 'chunked'} Response Text: {"page":1,"perPage":20,"total":16,"data":[{"id":"790af310-94e3-4996-916d-6c5b2c3e4c4e","updated_at":"2024-07-19T13:51:51.491Z","updated_by":"elastic","created_at":"2024-07-17T16:06:21.003Z","created_by":"elastic","name":"Test Custom Query Rule [Duplicate]","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"397c6715-53bf-47ba-abc4-bcbf5562f55f","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.989Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"43ea88e7-6f69-4d4e-917c-d91d952f6caa","updated_at":"2024-07-19T13:51:48.853Z","updated_by":"elastic","created_at":"2024-07-12T21:03:07.357Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"33bf4870-0091-4548-a46d-ac5dac913557","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.989Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"cdfd0434-f633-4c58-86f2-1fb1764ca423","updated_at":"2024-07-11T21:09:35.371Z","updated_by":"elastic","created_at":"2024-07-11T21:09:35.371Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"713ff16f-fcca-4ffb-8a84-c8b88179adf3","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.990Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"7a4c2f24-20ac-4ead-90ed-7d09324a2596","updated_at":"2024-07-11T20:54:57.717Z","updated_by":"elastic","created_at":"2024-07-11T20:54:57.717Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f2af7829-1fd8-4dfe-bdf0-e74316f12526","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.988Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"fcc1c99c-1e0e-4998-896e-541cd0b855c6","updated_at":"2024-07-11T20:57:50.811Z","updated_by":"elastic","created_at":"2024-07-11T20:57:50.811Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"f652c302-673c-4b74-a220-4621ad3e4da5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.986Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39708}}}},{"id":"d8e6c0a8-3142-4715-b180-982bc79cf523","updated_at":"2024-07-17T15:59:28.052Z","updated_by":"elastic","created_at":"2024-07-17T15:59:28.052Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"4ebb2130-6e77-4f66-b35e-d2aa87370d37","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.988Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"2a4714de-f6b2-497f-b000-8a5f8fa4a7e5","updated_at":"2024-07-12T20:34:55.170Z","updated_by":"elastic","created_at":"2024-07-12T20:34:55.170Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"08a4a98c-f3b9-4e39-8464-cb736325c78a","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.987Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"d34e284c-0914-44c8-b7b2-659797aa1b0f","updated_at":"2024-07-12T20:33:10.014Z","updated_by":"elastic","created_at":"2024-07-12T20:33:10.014Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"0f3eaa19-03e3-462e-831d-71b58d231444","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.991Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39708}}}},{"id":"9c3e97ab-c4bb-4d98-a7a8-df5528da73a5","updated_at":"2024-07-11T21:08:57.119Z","updated_by":"elastic","created_at":"2024-07-11T21:08:57.119Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"62995514-34fe-4a29-8a04-585b12ff209e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:36.986Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39711}}}},{"id":"11bc109e-094d-436c-9142-a442c35cf20a","updated_at":"2024-07-14T08:13:15.517Z","updated_by":"elastic","created_at":"2024-07-14T08:13:15.517Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"71c32e3c-40b5-446d-b638-fefcd82e9478","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.009Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"0bd477ae-e1f7-4893-b6e4-88048c6ce8c6","updated_at":"2024-07-17T15:52:40.162Z","updated_by":"elastic","created_at":"2024-07-17T15:52:40.162Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"d9fee890-9d78-4fe1-a323-056ddfec5c91","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.007Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"637615b9-2e4a-4fb1-8a5b-6db01a83c064","updated_at":"2024-07-18T15:52:57.257Z","updated_by":"elastic","created_at":"2024-07-18T15:52:57.257Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"04972245-a681-406b-9432-43abce22701e","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.004Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"2dac9f24-f623-4697-8e72-60f463893e8d","updated_at":"2024-07-12T20:36:41.508Z","updated_by":"elastic","created_at":"2024-07-12T20:36:41.508Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"b3516ea6-c785-461b-ad3b-6b91aa017d83","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.009Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"c5d0f760-a299-40f4-ba00-f0448dc6f1ef","updated_at":"2024-07-14T08:52:15.140Z","updated_by":"elastic","created_at":"2024-07-14T08:52:15.140Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"67550e19-7d41-4e67-b53d-6a8066d9fad5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.010Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"bda76709-d0f8-4461-b5b6-b88518f74daf","updated_at":"2024-07-17T15:55:41.721Z","updated_by":"elastic","created_at":"2024-07-17T15:55:41.721Z","created_by":"elastic","name":"Test Custom Query Rule Two","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"cde491da-154e-4bb4-a948-0f44f42b30e5","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[],"execution_summary":{"last_execution":{"date":"2024-07-24T20:03:31.010Z","status":"partial failure","status_order":20,"message":"This rule is attempting to query data from Elasticsearch indices listed in the \"Index patterns\" section of the rule definition, however no index matching: [\"logs-*\"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.","metrics":{"execution_gap_duration_s":39710}}}},{"id":"f289f429-94c2-41fa-9525-904159b94588","updated_at":"2024-07-24T20:04:46.681Z","updated_by":"elastic","created_at":"2024-07-24T20:04:46.681Z","created_by":"elastic","name":"Test Custom Query Rule","tags":[],"interval":"5m","enabled":true,"revision":0,"description":"This is a test rule to detect suspicious activity.","risk_score":50,"severity":"high","output_index":"","author":[],"false_positives":[],"from":"now-6m","rule_id":"70690b3c-c4bc-4539-8edf-b6b555f38ca9","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["logs-*"],"query":"process.name: \"malicious.exe\"","actions":[]}]} Attempting to delete rule with ID: 2a4714de-f6b2-497f-b000-8a5f8fa4a7e5 Response Status Code: 404 ..... and so forth ``` ---
**Author:** ![Emin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emin/32/135313_2.png) [@Emin](https://discuss.elastic.co/u/Emin)\ **Post date:** [August 8, 2024, 8:56pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/14 "2024-08-08T20:56:27Z")
Hello Carly. Thank you once again for your help and support so far! I have managed to create a working delete function, which uses the delete API. However, I am now having problem with the Update API, well, not the API itself, but the function I have written. It uses the Update API, but when I run it, I get the following error: > Updating rule ID: e4e52120-6fff-4a30-9c28-29556435f053 > Response Status Code: 400 > Response Headers: {'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'strict-origin-when-cross-origin', 'Permissions-Policy': 'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()', 'Cross-Origin-Opener-Policy': 'same-origin', 'Content-Security-Policy': "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'", 'Content-Security-Policy-Report-Only': "form-action 'report-sample' 'self'", 'kbn-name': 'ELK', 'kbn-license-sig': '5ae299c31b5c858a983f4c0f88424dceb65af842a09815eed2126b7702005236', 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-cache, no-store, must-revalidate', 'content-length': '111', 'Date': 'Thu, 08 Aug 2024 20:49:03 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=120'} > Response Text: {"statusCode":400,"error":"Bad Request","message":"[request body.enabled]: definition for this key is missing"} > Failed to update rule with ID: e4e52120-6fff-4a30-9c28-29556435f053 This is the function code: ```auto def update_rules_on_criteria(rules, token): for rule in rules: if rule['severity'] == 'high' and rule['risk_score'] < 75: rule_details = fetch_rule(rule['id'], token) update_data = { "name": rule_details.get('name', ''), "tags": rule_details.get('tags', []), "enabled": rule_details.get('enabled', True), "params": rule_details.get('params', {}), "schedule": rule_details.get('schedule', {}), "actions": rule_details.get('actions', []), "throttle": rule_details.get('throttle', None), "notify_when": rule_details.get('notify_when', 'onActionGroupChange'), "risk_score": 75, # Update risk_score to 75 "description": rule_details.get('params', {}).get('description', ''), "from": rule_details.get('params', {}).get('from', 'now-6m'), "to": rule_details.get('params', {}).get('to', 'now'), "index": rule_details.get('params', {}).get('index', []), "language": rule_details.get('params', {}).get('language', 'kuery'), "query": rule_details.get('params', {}).get('query', '') } print(f"Updating rule ID: {rule['id']}") if update_rule(rule['id'], update_data, token): print(f"Updated rule with ID: {rule['id']}") else: print(f"Failed to update rule with ID: {rule['id']}") ``` Would you please be so kind, as to help me figure out what am I doing wrong? Thank you kindly. ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [August 12, 2024, 12:45pm UTC](https://discuss.elastic.co/t/automating-rule-creation-for-kibana/361603/15 "2024-08-12T12:45:23Z")
Hi @Emin, To confirm, it's the [detection rules update rule API](https://www.elastic.co/guide/en/security/current/rules-api-update.html) that you are using? Are you using the PUT or PATCH functionality? > [@Emin](#): > > Response Text: {"statusCode":400,"error":"Bad Request","message":"[request body.enabled]: definition for this key is missing"} It looks like it's an issue with the `enabled` field. Can you try removing that item from your code? [As per the documentation](https://www.elastic.co/guide/en/security/current/rules-api-update.html#_optional_fields_for_all_rule_types) it is an optional attribute that defaults to true, which form your code looks like what you need. As an aside, it appears that you are adding all fields to the update request? Are the values always different on update? If not I would recommend only updating what you need using the [`PATCH` protocol](https://www.elastic.co/guide/en/security/current/rules-api-update.html#_request_url_4) if you can. Hope that helps!