Updating the alerting for all rules with the API

Elastic Security
1

Since the ability to bulk edit rules and assign an action does not exist, how can I do this with the API? I've tried a few methods via the Kibana console under dev tools but cannot get any of the GET's to return data (like GET /api/detection_engine/rules)

What I'm trying to accomplish is set the action for all 600+ rules to be Microsoft Teams with a specific format:

{{#context.alerts}}
{{signal.rule.name}}
{{signal.rule.severity}} - {{signal.reason}}

{{signal.rule.description}}
{{/context.alerts}}

2 Likes
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.