Skip to content

[SIEM][Detection Engine] Create REST API endpoint for KQL signals  #47013

@FrankHassanabad

Description

@FrankHassanabad

Create the REST API endpoints for the Kibana UI to consume with regards to the KQL signals.

These API's should allow the the common abstractions expected for a KQL signal which is:

  • Create an alert with a KQL -> boolean filter that operates similar to the events timeline
  • Deleting an existing signal generator given a signal id
  • Querying for progress of the signal.
  • Query all the signals

Metadata

Metadata

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions