# Find Detection Rules — Elastic Security

> Find and list Elastic Security detection rules via GET /api/detection_engine/rules/_find, or fetch a single rule directly via GET /api/detection_engine/rules when id or ruleId is provided. Use this to search/browse rules, or to look up one…

- Key: `elastic_security-find-detection-rules`
- Type: Action (Read-only)
- Version: 0.0.1
- App: Elastic Security (`elastic_security`) — https://pipedream.com/apps/elastic-security.md
- This page (HTML): https://pipedream.com/apps/elastic-security/actions/find-detection-rules
- Hints: read-only · open-world
- Source: https://github.com/PipedreamHQ/pipedream/blob/master/components/elastic_security/actions/find-detection-rules/find-detection-rules.mjs

## Description

Find and list Elastic Security detection rules via GET /api/detection_engine/rules/_find, or fetch a single rule directly via GET /api/detection_engine/rules when `id` or `ruleId` is provided. Use this to search/browse rules, or to look up one rule's full definition once you have an ID. Run this first to obtain an `id`/`ruleId` before using **Create or Update Detection Rule**, **Run Detection Rule**, or **Delete Record**. Example: calling with `filter: 'alert.attributes.enabled: true'` returns `{ total: 3, data: [{ id: "7ac3...", name: "InGen Perimeter Query Rule", type: "query", enabled: true, ... }] }`; use `fields` to shrink each rule down to just the fields you need — rule objects carry many advanced fields (`exceptions_list`, `related_integrations`, `threat`, etc.) that are rarely relevant. [See the documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findrules)

## Props

| Prop | Type | Required | Description |
|---|---|---|---|
| `id` | `string` | No | Fetch a single rule directly by its Kibana internal UUID instead of searching. Provide either this or ruleId, not both. When set, all filter/sort/pagination parameters are ignored. |
| `ruleId` | `string` | No | Fetch a single rule directly by its user-defined rule_id instead of searching. Provide either this or id, not both. When set, all filter/sort/pagination parameters are ignored. |
| `filter` | `string` | No | KQL/Lucene filter over rule attributes using the alert.attributes.<field> syntax (e.g. alert.attributes.name: "My Rule" or alert.attributes.enabled: true). Ignored when id/ruleId is provided. |
| `sortField` | `string` | No | Field to sort by. One of: created_at, createdAt, enabled, name, risk_score, riskScore, severity, updated_at, updatedAt. Ignored when id/ruleId is provided. |
| `sortOrder` | `string` | No | Sort direction: asc or desc. Ignored when id/ruleId is provided. |
| `page` | `integer` | No | Page number of results to return, starting at 1. Defaults to 1. If the response's total field exceeds page × perPage, more results exist — call again with page incremented by 1 to fetch them. |
| `perPage` | `integer` | No | Number of results per page. Maximum 100. Defaults to 20. See Page for how to fetch additional pages. |
| `fields` | `string[]` | No | Only include these fields in each returned rule, to reduce response size. Omit to return the full rule object(s). Common fields: id, rule_id, name, description, type, enabled, risk_score, severity, tags, query, index, interval, created_at, updated_at. |

## Run it

**MCP**

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "elastic_security",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
  name: "elastic_security-find-detection-rules",
  arguments: {
    id: "Rule ID",
    ruleId: "Rule ID (User-defined)",
  },
})
```

**TypeScript**

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-find-detection-rules",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    id: "Rule ID",
    ruleId: "Rule ID (User-defined)",
  },
})

console.log(result)
```

**cURL**

```bash
curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "elastic_security-find-detection-rules",
    "configured_props": {
      "elastic_security": { "authProvisionId": "apn_xxxxxxx" },
      "id": "Rule ID",
      "ruleId": "Rule ID (User-defined)"
    }
  }'
```

---

- App: https://pipedream.com/apps/elastic-security.md · All apps: https://pipedream.com/apps