Get the rule types

Base URL: https://{kibana_url}

GET /api/alerting/rule_types

Auth

If you have read privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, and Security features. To get rule types associated with the Stack Monitoring feature, use the monitoring_user built-in role.

Responses

Indicates a successful call.

application/json

<array> object[]

Authorization information is missing or invalid.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/alerting/rule_types

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/alerting/rule_types" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

[
  {
    "action_groups": [
      {
        "id": "anomaly_score_match",
        "name": "Anomaly score matched the condition"
      },
      {
        "id": "recovered",
        "name": "Recovered"
      }
    ],
    "action_variables": {
      "context": [
        {
          "description": "The bucket timestamp of the anomaly",
          "name": "timestamp"
        },
        {
          "description": "The bucket time of the anomaly in ISO8601 format",
          "name": "timestampIso8601"
        },
        {
          "description": "List of job IDs that triggered the alert",
          "name": "jobIds"
        },
        {
          "description": "Alert info message",
          "name": "message"
        },
        {
          "description": "Indicate if top hits contain interim results",
          "name": "isInterim"
        },
        {
          "description": "Anomaly score at the time of the notification action",
          "name": "score"
        },
        {
          "description": "Top records",
          "name": "topRecords"
        },
        {
          "description": "Top influencers",
          "name": "topInfluencers"
        },
        {
          "description": "URL to open in the Anomaly Explorer",
          "name": "anomalyExplorerUrl",
          "useWithTripleBracesInTemplates": true
        }
      ],
      "params": [],
      "state": []
    },
    "alerts": {
      "context": "ml.anomaly-detection",
      "mappings": {
        "fieldMap": {
          "kibana.alert.anomaly_score": {
            "array": false,
            "type": "double",
            "required": false
          },
          "kibana.alert.anomaly_timestamp": {
            "array": false,
            "type": "date",
            "required": false
          },
          "kibana.alert.is_interim": {
            "array": false,
            "type": "boolean",
            "required": false
          },
          "kibana.alert.job_id": {
            "array": false,
            "type": "keyword",
            "required": true
          },
          "kibana.alert.top_influencers": {
            "array": true,
            "dynamic": false,
            "type": "object",
            "properties": {
              "influencer_field_name": {
                "type": "keyword"
              },
              "influencer_field_value": {
                "type": "keyword"
              },
              "influencer_score": {
                "type": "double"
              },
              "initial_influencer_score": {
                "type": "double"
              },
              "is_interim": {
                "type": "boolean"
              },
              "job_id": {
                "type": "keyword"
              },
              "timestamp": {
                "type": "date"
              }
            },
            "required": false
          },
          "kibana.alert.top_records": {
            "array": true,
            "dynamic": false,
            "type": "object",
            "properties": {
              "actual": {
                "type": "double"
              },
              "by_field_name": {
                "type": "keyword"
              },
              "by_field_value": {
                "type": "keyword"
              },
              "detector_index": {
                "type": "integer"
              },
              "field_name": {
                "type": "keyword"
              },
              "function": {
                "type": "keyword"
              },
              "initial_record_score": {
                "type": "double"
              },
              "is_interim": {
                "type": "boolean"
              },
              "job_id": {
                "type": "keyword"
              },
              "over_field_name": {
                "type": "keyword"
              },
              "over_field_value": {
                "type": "keyword"
              },
              "partition_field_name": {
                "type": "keyword"
              },
              "partition_field_value": {
                "type": "keyword"
              },
              "record_score": {
                "type": "double"
              },
              "timestamp": {
                "type": "date"
              },
              "typical": {
                "type": "double"
              }
            },
            "required": false
          }
        }
      },
      "shouldWrite": true
    },
    "authorized_consumers": {
      "alerts": {
        "all": true,
        "read": true
      },
      "apm": {
        "all": true,
        "read": true
      },
      "discover": {
        "all": true,
        "read": true
      },
      "infrastructure": {
        "all": true,
        "read": true
      },
      "logs": {
        "all": true,
        "read": true
      },
      "ml": {
        "all": true,
        "read": true
      },
      "monitoring": {
        "all": true,
        "read": true
      },
      "siem": {
        "all": true,
        "read": true
      },
      "slo": {
        "all": true,
        "read": true
      },
      "stackAlerts": {
        "all": true,
        "read": true
      },
      "uptime": {
        "all": true,
        "read": true
      }
    },
    "category": "management",
    "default_action_group_id": "anomaly_score_match",
    "does_set_recovery_context": true,
    "enabled_in_license": true,
    "has_alerts_mappings": true,
    "has_fields_for_a_a_d": true,
    "id": "xpack.ml.anomaly_detection_alert",
    "is_exportable": true,
    "minimum_license_required": "platinum",
    "name": "Anomaly detection alert",
    "producer": "ml",
    "recovery_action_group": {
      "id": "recovered",
      "name": "Recovered"
    },
    "rule_task_timeout": "5m"
  },
  {
    "action_groups": [
      {
        "id": "anomaly_detection_realtime_issue",
        "name": "Issue detected"
      },
      {
        "id": "recovered",
        "name": "Recovered"
      }
    ],
    "action_variables": {
      "context": [
        {
          "description": "Results of the rule execution",
          "name": "results"
        },
        {
          "description": "Alert info message",
          "name": "message"
        }
      ],
      "params": [],
      "state": []
    },
    "authorized_consumers": {
      "alerts": {
        "all": true,
        "read": true
      },
      "apm": {
        "all": true,
        "read": true
      },
      "discover": {
        "all": true,
        "read": true
      },
      "infrastructure": {
        "all": true,
        "read": true
      },
      "logs": {
        "all": true,
        "read": true
      },
      "ml": {
        "all": true,
        "read": true
      },
      "monitoring": {
        "all": true,
        "read": true
      },
      "siem": {
        "all": true,
        "read": true
      },
      "slo": {
        "all": true,
        "read": true
      },
      "stackAlerts": {
        "all": true,
        "read": true
      },
      "uptime": {
        "all": true,
        "read": true
      }
    },
    "category": "management",
    "default_action_group_id": "anomaly_detection_realtime_issue",
    "does_set_recovery_context": true,
    "enabled_in_license": true,
    "has_alerts_mappings": false,
    "has_fields_for_a_a_d": false,
    "id": "xpack.ml.anomaly_detection_jobs_health",
    "is_exportable": true,
    "minimum_license_required": "platinum",
    "name": "Anomaly detection jobs health",
    "producer": "ml",
    "recovery_action_group": {
      "id": "recovered",
      "name": "Recovered"
    },
    "rule_task_timeout": "5m"
  }
]

{
  "error": "Unauthorized",
  "message": "[security_exception] missing authentication credentials for REST request",
  "statusCode": 401
}