# Automating Rule Creation for Kibana

**URL:** <https://forum.opensearch.org/t/automating-rule-creation-for-kibana/19904>\
**Category:** Open Source Elasticsearch and Kibana\
**Tags:** configure, feature-request, alerting\
**Created:** [June 19, 2024, 3:43pm UTC](https://forum.opensearch.org/t/automating-rule-creation-for-kibana/19904 "2024-06-19T15:43:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![emin](https://avatars.discourse-cdn.com/v4/letter/e/c57346/32.png) [@emin](https://forum.opensearch.org/u/emin)\
**Post date:** [June 19, 2024, 3:43pm UTC](https://forum.opensearch.org/t/automating-rule-creation-for-kibana/19904/1 "2024-06-19T15:43:40Z")

</div>

I use curl to create the rule: `curl -k -X POST "https://192.168.10.131:5601/api/detection_engine/rules/_bulk_action" -d"{"rule_id":"process_started_by_ms_office_program_possible_payload","risk_score":50,"description":"Process started by MS Office program","interval":"5m","name":"MS Office child process","severity":"low","tags":["child process","ms office"],"type":"query","from":"now-6m","query":"process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE","language":"kuery","filters":[{"query":{"match":{"event.action":{"query":"Process Create (rule: ProcessCreate)","type":"phrase"}}}}],"enabled":false},{"name":"Second bulk rule","description":"Query with a rule_id for referencing an external id","rule_id":"query-rule-id-2","risk_score":2,"severity":"low","type":"query","from":"now-6m","query":"user.name: root or user.name: admin"}" -H "Authorization: ApiKey ZXkzRElwQUJnYW9Td2d5emFZVkQ6a0w3N1BXdVlUQTZHakRmU2RRVXBYdw==" -H "kbn-xsrf: true" `

I get the following error: {“statusCode”:400,“error”:“Bad Request”,“message”:“[request body]: action: Invalid literal value, expected “delete”, action: Invalid literal value, expected “disable”, action: Invalid literal value, expected “enable”, action: Invalid literal value, expected “export”, action: Invalid literal value, expected “duplicate”, and 2 more”}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [August 18, 2024, 3:44pm UTC](https://forum.opensearch.org/t/automating-rule-creation-for-kibana/19904/2 "2024-08-18T15:44:36Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.