Updating the alerting for all rules with the API

Since the ability to bulk edit rules and assign an action does not exist, how can I do this with the API? I've tried a few methods via the Kibana console under dev tools but cannot get any of the GET's to return data (like GET /api/detection_engine/rules)

What I'm trying to accomplish is set the action for all 600+ rules to be Microsoft Teams with a specific format:

{{signal.rule.severity}} - {{signal.reason}}



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.