# Error using BulkEditAction\[\] object **URL:** \ **Category:** Endpoint Security\ **Created:** [June 5, 2023, 7:02pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252 "2023-06-05T19:02:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\ **Post date:** [June 5, 2023, 7:02pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/1 "2023-06-05T19:02:11Z")
Hi , I am using Elasticsearch - 8.7.1 and I am trying to update my security rules in EDR with a email action in bulk. I have tried the following -- ```auto PUT api/detection_engine/rules/_bulk_action { "action": "edit", "edit": [{ "type": "add_rule_actions", "value":{ "actions":[{"action_type_id":".email","params":{"to":"email-id","subject":"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}","message":"Rule {{context.rule.name}} generated {{state.signals_count}} alerts"}}] , "throttle": "rule" } }] } ``` However it says - ```auto { "error": "no handler found for uri [/api/detection_engine/rules/_bulk_action?pretty=true] and method [PUT]" } ``` Also tried curl - ```auto curl -X POST "https://url:9200/api/detection_engine/rules/_bulk_action?pretty" -H 'Content-Type: application/json' -d' { "action": "edit", "edit": [{ "type": "add_rule_actions", "value":{ "actions":[{"action_type_id":".email","params":{"to":"email-id","subject":"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}","message":"Rule {{context.rule.name}} generated {{state.signals_count}} alerts"}}] , "throttle": "rule" } }] } ' ``` Any idea what might be wrong in the approach? Also, I have tried POST instead of PUT with same error. ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [June 6, 2023, 5:51pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/2 "2023-06-06T17:51:15Z")
Hi @M_S , since this is a Kibana API, you need to add `kbn:` to the start of the API endpoint: ```auto PUT kbn:api/detection_engine/rules/_bulk_action { "action": "edit", "edit": [{ "type": "add_rule_actions", "value":{ "actions":[{"action_type_id":".email","params":{"to":"email-id","subject":"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}","message":"Rule {{context.rule.name}} generated {{state.signals_count}} alerts"}}] , "throttle": "rule" } }] } ``` And, for curl, use your Kibana URL, not Elasticsearch. ---
**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\ **Post date:** [June 6, 2023, 6:35pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/3 "2023-06-06T18:35:39Z")
> [@jamesspi](#): > > `kbn:api/detection_engine/rules/_bulk_action` Hi , thanks for replying. I tried the following curl now -- ```auto curl -u "user:password" -k -X PUT "https://url:5601/kbn:api/detection_engine/rules/_bulk_action" -H 'Content-Type: application/json' -d' { "action": "edit", "edit": [{ "type": "add_rule_actions", "value":{ "actions":[{"action_type_id":".email","params":{"to":"mail-id","subject":"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}","message":"Rule {{context.rule.name}} generated {{state.signals_count}} alerts"}}] , "throttle": "rule" } }] }' ``` But its giving me ```auto {"statusCode":404,"error":"Not Found","message":"Not Found"} ``` Also, tried the follwing request in Dev-tools kibana - ```auto PUT kbn:api/detection_engine/rules/_bulk_action { "action": "edit", "edit": [{ "type": "add_rule_actions", "value":{ "actions":[{"action_type_id":".email","params":{"to":"email-id","subject":"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}","message":"Rule {{context.rule.name}} generated {{state.signals_count}} alerts"}}] , "throttle": "rule" } }] } ``` Same error 404. Ok, one update - I browsed [https://url:5601/api/status](https://url:5601/api/status) . And detection\_engine api call was not listed in it. Is it because I am using version 8.7.1 ? ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [June 7, 2023, 11:57pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/4 "2023-06-07T23:57:06Z")
Hi @M_S , `kbn:` should only be used in dev tools, as it implies that you want to use Kibana APIs, not Elasticsearch. So, if using a client like cURL, you just need the Kibana URL. Additionally, you should be using `POST` , not `PUT`. Sorry, should have called this out in the first reply. James ---
**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\ **Post date:** [June 8, 2023, 7:22pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/5 "2023-06-08T19:22:03Z")
Ok. I used below lines in dev tools. ```auto POST kbn:api/detection_engine/rules/_bulk_action { "action": "edit", "edit": [{ "type": "add_rule_actions", "value":{ "actions":[{"action_type_id":".email","params":{"to":"email-id","subject":"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}","message":"Rule {{context.rule.name}} generated {{state.signals_count}} alerts"}}] , "throttle": "rule" } }] } ``` But its giving same error. ```auto "statusCode": 400, "error": "Bad Request", "message": "[request body]: Invalid value \"edit\" supplied to \"action\",Invalid value \"add_rule_actions\" supplied to \"edit,type\",Invalid value \"{\"actions\":[{\"action_type_id\":\".email\",\"params\":{\"to\":\"email@company.com\",\"subject\":\"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}\",\"message\":\"Rule {{context.rule.name}} generated {{state.signals_count}} alerts\"}}],\"throttle\":\"rule\"}\" supplied to \"edit,value\",Invalid value \"undefined\" supplied to \"edit,value,timeline_id\",Invalid value \"undefined\" supplied to \"edit,value,timeline_title\",Invalid value \"undefined\" supplied to \"edit,value,actions,group\",Invalid value \"undefined\" supplied to \"edit,value,actions,id\",Invalid value \"undefined\" supplied to \"edit,value,interval\",Invalid value \"undefined\" supplied to \"edit,value,lookback\"" } ``` However I see message body part of error has now changed a bit. ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [June 8, 2023, 8:59pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/6 "2023-06-08T20:59:19Z")
> [@M\_S](#): > > ```auto > supplied to \"action\",Invalid value \"add_rule_actions\" supplied to \"edit,type\",Invalid value \"{\"actions\":[{\"action_type_id\":\".email\",\"params\":{\"to\":\"email@company.com\",\"subject\":\"{{alert.actionGroup}}{{alert.actionSubgroup}}{{alert.actionGroupName}}\",\"message\":\"Rule {{context.rule.name}} generated {{state.signals_count}} alerts\"}}],\"throttle\":\"rule\"}\" supplied to \"edit,value\",Invalid value \"undefined\" supplied to \"edit,value,timeline_id\",Invalid value \"undefined\" supplied to \"edit,value,timeline_title\",Invalid value \"undefined\" supplied to \"edit,value,actions,group\",Invalid value \"undefined\" supplied to \"edit,value,actions,id\",Invalid value \"undefined\" supplied to \"edit,value,interval\",Invalid value \"undefined\" supplied to \"edit,value,lookback\"" > } > > ``` It's a different error 🙂 it's means your request isn't formatted properly. You're almost there! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2023, 8:59pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252/7 "2023-07-06T20:59:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.