# SIEM Alert Actions not updating

**URL:** <https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968>\
**Category:** SIEM\
**Created:** [May 29, 2020, 6:22pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968 "2020-05-29T18:22:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mercwri](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@Mercwri](https://discuss.elastic.co/u/Mercwri)\
**Post date:** [May 29, 2020, 6:22pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/1 "2020-05-29T18:22:42Z")

</div>

I've gone through a few iterations of alert actions, checking both the API and the UI the SIEM app shows my current version of the actions, but when an alert is sent it uses a previous version of the actions. I've restarted the deployment and Kibana on it's own.

---

<div class="post-metadata">

**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\
**Post date:** [May 29, 2020, 7:53pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/2 "2020-05-29T19:53:30Z")

</div>

Hi @Mercwri, welcome to the community!

I'd love to help, let's start with some refining questions:

1. Which version of kibana are you running?
2. Which actions are you using?
3. How are you creating these actions?
4. When you refer to " version," are you referring to the alert variable `{{context.rule.version}}` or to something else?
5. When an alert is sent, is it always the same (original) version, or is it e.g. one version behind the expected version?

If you could share some of those API/UI checks that you referenced, I'm sure that would also help!

I look forward to your response,

--  
Ryland

---

<div class="post-metadata">

**Author:** ![Mercwri](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@Mercwri](https://discuss.elastic.co/u/Mercwri)\
**Post date:** [May 29, 2020, 8:21pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/3 "2020-05-29T20:21:26Z")

</div>

1. 7.7.0
2. Webhook and Email
3. UI and making requests to /api/detection\_engine/rules
4. I'm referring to changes to the actions fields.
5. It is atleast one if not more than that behind.

For checking it, in the UI if I go to SIEM/Detection Rules/Rule/Manage Rule/Actions the most recent change will show.

For the API I wrote a simple bit of python to poll the API for all my current rules and then check the actions field and update if the actions are different.

```auto
import requests, json, yaml

from requests.auth import HTTPBasicAuth

with open("config.yaml","r") as yml:

    config = yaml.load(yml)

base_url = config["base_url"]

headers = {'kbn-xsrf':'true'}

user = config["user"]

password = config["password"]

rules = requests.get(base_url+"/api/detection_engine/rules/_find?page=1&per_page=200",auth=HTTPBasicAuth(user,password),headers=headers)

rules = json.loads(rules.content)

rules = rules["data"]

actions = #My Actions Redacted

for rule in rules:

    print "[=]Checking rule "+rule["id"]

    check = requests.get(base_url+"/api/detection_engine/rules?id="+rule["id"],auth=HTTPBasicAuth(user,password),headers=headers)

    if json.dumps(json.loads(check.content)["actions"]) == actions:

        print "[+]Rule Up to Date"

    else:

        print "[-]Rule Out of Spec"

        payload = {"id":rule["id"],"actions":actions,"throttle":"rule"}

        apply = requests.patch(base_url+"/api/detection_engine/rules",auth=HTTPBasicAuth(user,password),headers=headers,data=payload)

        check_2 = requests.get(base_url+"/api/detection_engine/rules?id="+rule["id"],auth=HTTPBasicAuth(user,password),headers=headers)

        if json.dumps(json.loads(check_2.content)["actions"]) == actions:

            print "[+]Rule Updated"

        else:

            print "[-]Rule Failed to Update"

            print apply.content

```

I can apply the changes by updating my action, running the script, then confirming by check the UI on a random rule to see if it did correctly update.

For example if I modify my action to change the JSON sent on the webhook, the old JSON will be sent on the webhook, same as the body when I update the body on the email.

---

<div class="post-metadata">

**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\
**Post date:** [May 30, 2020, 2:13am UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/4 "2020-05-30T02:13:35Z")

</div>

@Mercwri, thank you for the comprehensive response, it was incredibly helpful!

The bad news: it looks like you've uncovered a bug with our PATCH endpoint.  
The good news: we have some workarounds, and we'll be fixing this as soon as possible.

I've created [this issue](https://github.com/elastic/kibana/issues/67815) to track the bug and its resolution; please follow along there for updates.

In the meantime, let's get you up and running again. I mention the workarounds in that issue, but for your specific use case I would recommend modifying your script to use the PUT endpoint instead of PATCH. This will require two changes on your end:

1. removing fields from the GET response that aren't allowed in the PUT response
2. sending this new whitelisted payload to the PUT endpoint instead of PATCH

Please give that a shot and let me know if you encounter any issues; I'm happy to help troubleshoot further.

Thanks again for your post. The SIEM app and our community are both better for it!

---

<div class="post-metadata">

**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\
**Post date:** [June 2, 2020, 7:24pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/5 "2020-06-02T19:24:36Z")

</div>

@Mercwri just a quick update: the fix has been merged, and should be available in the upcoming 7.8.0 release.

---

<div class="post-metadata">

**Author:** ![Mercwri](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@Mercwri](https://discuss.elastic.co/u/Mercwri)\
**Post date:** [June 2, 2020, 7:40pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/6 "2020-06-02T19:40:06Z")

</div>

Thanks, the work-around has been working for me so far.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2020, 7:40pm UTC](https://discuss.elastic.co/t/siem-alert-actions-not-updating/234968/7 "2020-06-30T19:40:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.