# Run detection rule manually

**URL:** <https://discuss.elastic.co/t/run-detection-rule-manually/249780>\
**Category:** Elastic Security\
**Created:** [September 24, 2020, 9:01am UTC](https://discuss.elastic.co/t/run-detection-rule-manually/249780 "2020-09-24T09:01:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [September 24, 2020, 9:01am UTC](https://discuss.elastic.co/t/run-detection-rule-manually/249780/1 "2020-09-24T09:01:14Z")

</div>

Hi all  
How to run the detection rule manually,  
I have some rule that have query time of about few hour each, and i want to have a quick test of the rule to make quick change.  
Is there some curl or something to do that?

Thanks for your time

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [September 29, 2020, 8:23pm UTC](https://discuss.elastic.co/t/run-detection-rule-manually/249780/2 "2020-09-29T20:23:07Z")

</div>

Hey there @lusynda, thanks for the enhancement request!

Currently it's not possible to run a rule manually, however [here is the issue](https://github.com/elastic/kibana/issues/50215) for tracking this feature. If you'd like to take a moment and comment with your use case that helps us prioritize these efforts.

In the meantime, the quickest/easiest way to get a preview (without exceptions), would be to save your query, and then load it in Timeline.

##### Save Query from KQL Bar

 ![Detections_-_Kibana](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f42fac195278ac619d05ab447cd8340347cc082c.png)

##### Save Query with Name + Filters

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/3/9399f3e77a377288df3a9ad9ce9051f7edd477b0.png)

##### Open Timeline and Load Saved Query

 ![Detections_-_Kibana](https://us1.discourse-cdn.com/elastic/original/3X/5/8/589952d8caa36907209d64060f42c7d7c33331c7.png)

Note: Updating a Rule to run on a saved query will result in that Rule querying for the latest version of that saved query each time it executes, so you may just want to back out of editing the Rule (instead of saving) if this is not your desired behavior.

Hope this helps! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:13am UTC](https://discuss.elastic.co/t/run-detection-rule-manually/249780/3 "2022-11-04T08:13:54Z")

</div>


