Preview a detection rule's alerts
One step with Elastic Stack. We can help you get access.
Look something up
Preview a detection rule's alerts
with Elastic Stack · Threat Detection & Response Management
Use Elastic Stack: its Kibana Security Detections API lets you preview a detection rule's alerts in a single step (POST /api/detection_engine/rules/preview). capabilities.work can help you get signed up and connected.
- Can I test a detection rule query to see what alerts it would produce without saving it?
- Is there a way to validate a rule over a short time window before creating it?
Say it to your AI assistant
- Preview the alerts this draft rule would generate over the last hour.
- Simulate this rule and include the logged Elasticsearch requests ({enable_logged_requests}).
For your developer
POST /api/detection_engine/rules/preview in Kibana Security Detections API. Full spec on APIs.io.