View as Markdown
Elastic Security icon

Elastic Security ACTION

Run Detection Rule

Manually run one or more Elastic Security detection rules over a time range via POST /api/detection_engine/rules/_bulk_action (bulk action run). Use this to test a rule immediately instead of waiting for its next scheduled interval, or to backfill detections over a past window. Provide the rule ids to execute. Run Find Detection Rules first to obtain valid ids. Defaults to roughly the last hour if not specified: endDate defaults to one minute ago (a small buffer so clock skew/latency can't push it into the future, which Kibana rejects), and startDate defaults to one hour before that. Note: Kibana rejects manual runs against disabled rules — the rule must have enabled: true (see Create or Update Detection Rule). Example: calling with ids: ["7ac3..."] and no dates returns { attributes: { results: { created: [{ id: "7ac3...", name: "..." }] }, summary: { succeeded: 1, failed: 0 } } }. See the documentation
  • Action
  • Writes data
  • API key
  • SDK
  • MCP

IMPLEMENTATION

Call this tool

Connect a user's Elastic Security account once, then configure and run Run Detection Rule from your backend or agent.

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-run-detection-rule",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    ids: ["Rule IDs"],
    startDate: "Start Date",
  },
})

console.log(result)

SCHEMA

Inputs

Pipedream supplies the connected account. Your application provides the operation-specific values below. Dynamic inputs are resolved against that user's account.

Run Detection Rule inputs
Property Type Description
ids Rule IDs string[]
Kibana rule UUIDs to run. At least one required. Run Find Detection Rules first to obtain valid IDs.
Required
startDate Start Date string
Start of the manual run time range as an ISO 8601 timestamp (e.g. 2026-08-27T00:00:00.000Z). If omitted, defaults to one hour before the resolved endDate (i.e. one hour and one minute before now, when endDate is also omitted).
Optional
endDate End Date string
End of the manual run time range as an ISO 8601 timestamp (e.g. 2026-08-27T01:00:00.000Z). Defaults to one minute ago, not the exact current time — this buffer keeps the request from landing in the future on Kibana's server clock.
Optional

REFERENCE

Tool details

Behavior hints are published with the component in the Pipedream registry and surface as MCP tool annotations, so an agent can reason about a tool before it calls it.

Registry key
elastic_security-run-detection-rule
Version
0.0.1
App
Elastic Security
Authentication
API key
Read-only
No
Destructive
No
Open world
Yes