# Update field on all SIEM detection Rules in one go **URL:** \ **Category:** SIEM\ **Created:** [March 16, 2022, 1:31pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862 "2022-03-16T13:31:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Post date:** [March 16, 2022, 1:31pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/1 "2022-03-16T13:31:58Z")
Hello all, We have created almost 400 + security rule under SIEM tab in Kibana. Now the new requirement come like they need to update one common field present in all the 400 rules. Can any one guide me how to achieve this rather than doing this manually one by by ---
**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Post date:** [March 16, 2022, 2:18pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/2 "2022-03-16T14:18:20Z")
Using the API you will have to create a script which retrieves all detections and uses the patch method to update them. ---
**Author:** ![madi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madi/32/75699_2.png) [@madi](https://discuss.elastic.co/u/madi)\ **Post date:** [March 16, 2022, 2:23pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/3 "2022-03-16T14:23:06Z")
Thank you for your question, @mangeshmj1992 . As @sholzhauer pointed out, you can use the bulk\_update API to perform these updates. Here is the documentation for the latest version of this API: [Bulk rule actions | Elastic Security Solution [8.1] | Elastic](https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#bulk-actions-rules-api-update) ... you should be able to find equivalent documentation for the version that you're using. ---
**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\ **Post date:** [March 16, 2022, 2:46pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/4 "2022-03-16T14:46:37Z")
Just hopping on this 🥳 thread to mention that we've started surfacing Bulk Edit Actions in the UI starting in 8.1 ([release notes on it](https://www.elastic.co/guide/en/security/current/whats-new.html#features-8.1)). We're working through the remaining fields (like actions, risk score/severity, etc) in upcoming releases, but for now you can at least bulk edit `Index Patterns` and `Tags` from the UI ala: ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a0fe07faff0f8184c1f162d5bd2b650eeb73ec6.png) ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [March 21, 2022, 8:26pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/5 "2022-03-21T20:26:54Z")
@spong Bulk action in 8.x ... You just made my day. Tx to everyone making this possible, as rule mgmt on a large scale is very difficult currently. ---
**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\ **Post date:** [March 21, 2022, 10:10pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/6 "2022-03-21T22:10:29Z")
Awesome @willemdh! We appreciate it, thank you! 😀 And we 100% understand the current difficulties around large scale rule management -- the upcoming releases should do quite a bit to start addressing these though 🙂 . Wish we could've started addressing these sooner for you all, but there've been some underlying dependencies we've had to get in place before we could start executing on all these enhancements. With most of those in place now though, you're going to start seeing improvements around Rule Searching/Filtering, the Rule Upgrade Flow, Rule/Exceptions/Actions Import & Export, and waaay better Rule Monitoring as well! Thank you for your patience here, and of course for all the feedback you provide throughout the forums. We :elasticheart: you all in the community here and it just makes my day to be able to be building Elastic Security out in the open together! Cheers! Garrett ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 18, 2022, 10:11pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862/7 "2022-04-18T22:11:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.