Skip to content

fix: Change bulk rule actions by updating deprecated rule_ids to ids#5711

Open
IOITI wants to merge 1 commit intoelastic:mainfrom
IOITI:patch-1
Open

fix: Change bulk rule actions by updating deprecated rule_ids to ids#5711
IOITI wants to merge 1 commit intoelastic:mainfrom
IOITI:patch-1

Conversation

@IOITI
Copy link

@IOITI IOITI commented Feb 10, 2026

Pull Request

Issue link(s): N/A

Summary - What I changed

Kibana’s bulk action API for detection rules has changed: the rule_ids field is no longer valid and has been replaced by ids.

Without this update, any bulk action request using rule IDs is interpreted as targeting all rules, which can unintentionally delete or disable the entire rule set instead of just the intended subset.

This update ensures bulk actions correctly apply only to the specified rule IDs.

How To Test

from kibana import RuleResource

custom_rules = list(RuleResource.find())
rule_ids = [
    rule["id"]
    for rule in custom_rules
    if rule.get("id")
]

kibana_ids_to_delete = rule_ids[:2]

RuleResource.bulk_delete(rule_ids=kibana_ids_to_delete)

Checklist

  • Automated testing was updated or added to match the most common scenarios --> N/A
  • Documentation and comments were added for features that require explanation --> N/A

Contributor checklist

Kibana’s bulk action API for detection rules has changed: the `rule_ids` field is no longer valid and has been replaced by `ids`.  

Without this update, any bulk action request using rule IDs is interpreted as targeting *all* rules, which can unintentionally delete or disable the entire rule set instead of just the intended subset.

This update ensures bulk actions correctly apply only to the specified rule IDs.
@eric-forte-elastic
Copy link
Contributor

I expect there will need to be more updates that just what is currently in the PR. We may also need to change the ndjson payload handling as well 🤔

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants