i see that we have an index with the name .kibana_security_solution* that the prebuilt and default detection rules are in this index
but i couldn't find the index that store the data of the custom detection rules that we create in the kibana
i see that we have an index with the name .kibana_security_solution* that the prebuilt and default detection rules are in this index
but i couldn't find the index that store the data of the custom detection rules that we create in the kibana
I asked the Elastic agent, and this is what he told me. See if it helps.
I understand your question. It's an excellent observation that prebuilt and default detection rules are located in
.kibana_security_solution*.Custom detection rules in Kibana, unlike prebuilt ones which might have a specific index for their internal management, are generally stored as saved objects within the main Kibana index, which is
.kibana.The
.kibanaindex is where Kibana stores all its configuration, dashboards, visualizations, saved searches, and in this case, your custom detection rules. You shouldn't expect to find a separate index like.kibana_custom_detection_rules*.To view or manage these rules, you would typically do so through the Kibana user interface, in the Security section, where you can create, edit, and delete your custom rules.
If you need to access them programmatically, you would interact with Kibana's Saved Objects API, searching for objects of type
detection-ruleor similar, depending on your Kibana version and how they are implemented internally.In summary, look for your custom rules in the
.kibanaindex as "saved objects".
thank you ![]()
we can access the custom rules with api or in the Security/Detection Rules in the kibana.
but there is no way to access the documents that store detection rules in the kibana, i see the .kibana index and search in it and there is no custom detection rule in this index
You should use the API to get the rules, not making queries in a system indices.
There is no documentation on where or how they are stored in Kibana because it is expected that you use the Detection Rules API to get information and make changes on the rules.
Is there any specific issue you are having with using the API?
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.