# Run Detection Rule — Elastic Security

> Manually run one or more Elastic Security detection rules over a time range via POST /api/detection_engine/rules/_bulk_action (bulk action run). Use this to test a rule immediately instead of waiting for its next scheduled interval, or to…

- Key: `elastic_security-run-detection-rule`
- Type: Action (Write)
- Version: 0.0.1
- App: Elastic Security (`elastic_security`) — https://pipedream.com/apps/elastic-security.md
- This page (HTML): https://pipedream.com/apps/elastic-security/actions/run-detection-rule
- Hints: open-world
- Source: https://github.com/PipedreamHQ/pipedream/blob/master/components/elastic_security/actions/run-detection-rule/run-detection-rule.mjs

## Description

Manually run one or more Elastic Security detection rules over a time range via POST /api/detection_engine/rules/_bulk_action (bulk action `run`). Use this to test a rule immediately instead of waiting for its next scheduled interval, or to backfill detections over a past window. Provide the rule ids to execute. Run **Find Detection Rules** first to obtain valid ids. Defaults to roughly the last hour if not specified: `endDate` defaults to one minute ago (a small buffer so clock skew/latency can't push it into the future, which Kibana rejects), and `startDate` defaults to one hour before that. Note: Kibana rejects manual runs against disabled rules — the rule must have `enabled: true` (see **Create or Update Detection Rule**). Example: calling with `ids: ["7ac3..."]` and no dates returns `{ attributes: { results: { created: [{ id: "7ac3...", name: "..." }] }, summary: { succeeded: 1, failed: 0 } } }`. [See the documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-performrulesbulkaction)

## Props

| Prop | Type | Required | Description |
|---|---|---|---|
| `ids` | `string[]` | Yes | Kibana rule UUIDs to run. At least one required. Run Find Detection Rules first to obtain valid IDs. |
| `startDate` | `string` | No | Start of the manual run time range as an ISO 8601 timestamp (e.g. 2026-08-27T00:00:00.000Z). If omitted, defaults to one hour before the resolved endDate (i.e. one hour and one minute before now, when endDate is also omitted). |
| `endDate` | `string` | No | End of the manual run time range as an ISO 8601 timestamp (e.g. 2026-08-27T01:00:00.000Z). Defaults to one minute ago, not the exact current time — this buffer keeps the request from landing in the future on Kibana's server clock. |

## Run it

**MCP**

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "elastic_security",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
  name: "elastic_security-run-detection-rule",
  arguments: {
    ids: ["Rule IDs"],
    startDate: "Start Date",
  },
})
```

**TypeScript**

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-run-detection-rule",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    ids: ["Rule IDs"],
    startDate: "Start Date",
  },
})

console.log(result)
```

**cURL**

```bash
curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "elastic_security-run-detection-rule",
    "configured_props": {
      "elastic_security": { "authProvisionId": "apn_xxxxxxx" },
      "ids": ["Rule IDs"],
      "startDate": "Start Date"
    }
  }'
```

---

- App: https://pipedream.com/apps/elastic-security.md · All apps: https://pipedream.com/apps