# Default alert action?

**URL:** https://discuss.elastic.co/t/default-alert-action/258805
**Category:** Elastic Security
**Created:** [December 16, 2020, 5:59am UTC](https://discuss.elastic.co/t/default-alert-action/258805 "2020-12-16T05:59:44Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)
#### Post date: [December 16, 2020, 5:59am UTC](https://discuss.elastic.co/t/default-alert-action/258805/1 "2020-12-16T05:59:44Z")

</div>

Is there a way to set a default action in Elastic Siem? Manually setting up an action on 300+ rules is pretty raw!

---

<div class="post-metadata">

### Author: ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)
#### Post date: [December 16, 2020, 10:03pm UTC](https://discuss.elastic.co/t/default-alert-action/258805/2 "2020-12-16T22:03:06Z")

</div>

Hey there @hilt86! 👋 While there isn't currently a way to set a default action on a selection of rules, we are looking into ways to make this a bit less cumbersome, whether that be bulk editing of Rules, or a default action that is applied to all Rules as you mention. I've created this [kibana issue](https://github.com/elastic/kibana/issues/86198) for tracking -- if you could stop by and 👍 it and add a bit about your use case that will help us prioritize these enhancements. 🙂

We're looking to enhance the overall Rule Management experience, but in the meantime, using the [API](https://www.elastic.co/guide/en/security/current/rules-api-create.html#actions-object-schema) is probably the best way to automate things here a bit.

Cheers!  
Garrett

---

<div class="post-metadata">

### Author: ![lamp123432](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lamp123432](https://discuss.elastic.co/u/lamp123432)
#### Post date: [October 17, 2022, 5:11pm UTC](https://discuss.elastic.co/t/default-alert-action/258805/3 "2022-10-17T17:11:28Z")

</div>

Any news on that? We're starting 2023 soon and still have to edit hundreds of rules at a time to give them a default action, otherwise there's alerts that we don't get notified for!!!

---

<div class="post-metadata">

### Author: ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)
#### Post date: [November 2, 2022, 6:13pm UTC](https://discuss.elastic.co/t/default-alert-action/258805/4 "2022-11-02T18:13:27Z")

</div>

Hey @lamp123432, [starting from 8.5](https://www.elastic.co/guide/en/security/current/whats-new.html#_detection_rules_enhancements) there is a possibility to bulk edit actions in rules:

> **[Manage detection rules | Elastic Security Solution \[8.5\] | Elastic](https://www.elastic.co/guide/en/security/8.5/rules-ui-management.html#edit-rules-settings)**

This feature would allow to set an action to all rules, with no need to edit rule one by one.

Thanks, Vitalii
