[Detection Engine] Cleanup codeowners

.github/CODEOWNERS

@@ -2829,7 +2829,6 @@ x-pack/platform/plugins/shared/actions/server/lib/token_tracking @elastic/securi
 /x-pack/solutions/security/plugins/security_solution/common/cti @elastic/security-detection-engine
 /x-pack/solutions/security/plugins/security_solution/common/field_maps @elastic/security-detection-engine
 /x-pack/solutions/security/test/fixtures/es_archives/entity/risks @elastic/security-detection-engine
-/x-pack/solutions/security/test/fixtures/es_archives/entity/host_risk @elastic/security-detection-engine
 /x-pack/solutions/security/plugins/security_solution/public/value_list @elastic/security-detection-engine
 /x-pack/solutions/security/plugins/security_solution/public/common/components/reference_error_modal @elastic/security-detection-engine
 /x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions @elastic/security-detection-engine

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/add_prepackaged_rules.sh

@@ -14,5 +14,6 @@ set -e
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X PUT ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/prepackaged | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/delete_bulk.sh

@@ -17,6 +17,7 @@ RULES=${1:-./rules/bulk/delete_by_rule_id.json}
 curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_delete \
   -d @${RULES} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/delete_rule_by_id.sh

@@ -13,5 +13,6 @@ set -e
 # Example: ./delete_rule_by_id.sh ${id}
 curl -s -k \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X DELETE ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules?id="$1" | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/delete_rule_by_rule_id.sh

@@ -13,5 +13,6 @@ set -e
 # Example: ./delete_rule_by_rule_id.sh ${rule_id}
 curl -s -k \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X DELETE ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules?rule_id="$1" | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/delete_rules_by_query.sh

@@ -21,6 +21,7 @@ QUERY=${1}
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_action \
  --data "{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/delete_signal_index.sh

@@ -13,5 +13,6 @@ set -e
 # Example: ./delete_signal_index.sh
 curl -s -k \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X DELETE ${KIBANA_URL}${SPACE_URL}/api/detection_engine/index | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/disable_rules_by_query.sh

@@ -21,6 +21,7 @@ QUERY=${1}
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_action \
  --data "{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/duplicate_rules_by_query.sh

@@ -21,6 +21,7 @@ QUERY=${1}
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_action \
  --data "{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/enable_rules_by_query.sh

@@ -21,6 +21,7 @@ QUERY=${1}
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_action \
  --data "{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/export_rules.sh

@@ -22,5 +22,6 @@ EXCLUDE_DETAILS=${1:-false}
 
 curl -s -k \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_export?exclude_export_details=${EXCLUDE_DETAILS}

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/export_rules_by_query.sh

@@ -21,6 +21,7 @@ QUERY=${1}
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_action \
  --data "{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/export_rules_by_rule_id.sh

@@ -25,6 +25,7 @@ EXCLUDE_DETAILS=${2:-false}
 curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_export?exclude_export_details=${EXCLUDE_DETAILS} \
   -d @${RULES}

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/export_rules_by_rule_id_to_file.sh

@@ -23,6 +23,7 @@ EXCLUDE_DETAILS=${3:-false}
 curl -s -k -OJ \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST "${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_export?exclude_export_details=${EXCLUDE_DETAILS}&file_name=${FILENAME}" \
   -d @${RULES}

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/export_rules_to_file.sh

@@ -20,5 +20,6 @@ EXCLUDE_DETAILS=${2:-false}
 # ./export_rules_to_file.sh test.ndjson false
 curl -s -k -OJ \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST "${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_export?exclude_export_details=${EXCLUDE_DETAILS}&file_name=${FILENAME}"

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/find_rule_by_filter.sh

@@ -34,5 +34,6 @@ FILTER=${1:-'alert.attributes.enabled:%20true'}
 # Example get all non pre-packaged rules and a tag_1
 # ./find_rule_by_filter.sh "alert.attributes.params.immutable:%20false%20AND%20alert.attributes.tags:tag_1"
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_find?filter=$FILTER | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/find_rules_sort.sh

@@ -15,6 +15,7 @@ ORDER=${2:-'asc'}
 
 # Example: ./find_rules_sort.sh enabled asc
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET "${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_find?sort_field=$SORT&sort_order=$ORDER" \
  | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/get_prepackaged_rules_status.sh

@@ -14,5 +14,6 @@ set -e
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/prepackaged/_status | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/get_privileges.sh

@@ -12,5 +12,6 @@ set -e
 
 # Example: ./get_privileges.sh
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/privileges | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/get_rule_by_id.sh

@@ -12,5 +12,6 @@ set -e
 
 # Example: ./get_rule_by_id.sh {rule_id}
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules?id="$1" | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/get_rule_by_rule_id.sh

@@ -12,5 +12,6 @@ set -e
 
 # Example: ./get_rule_by_rule_id.sh {rule_id}
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules?rule_id="$1" | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/get_signal_index.sh

@@ -12,5 +12,6 @@ set -e
 
 # Example: ./get_signal_index.sh
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/index | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/get_tags.sh

@@ -12,5 +12,6 @@ set -e
 
 # Example: ./get_tags.sh
 curl -s -k \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/tags | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/import_rules.sh

@@ -21,6 +21,7 @@ OVERWRITE=${2:-true}
 # ./import_rules.sh ./rules/import/multiple_ruleid_queries.ndjson false
 curl -s -k \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST "${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_import?overwrite=${OVERWRITE}" \
   --form file=@${RULES} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/import_rules_no_overwrite.sh

@@ -16,6 +16,7 @@ RULES=${1:-./rules/import/multiple_ruleid_queries.ndjson}
 # Example: ./import_rules_no_overwrite.sh
 curl -s -k \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_import \
   --form file=@${RULES} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/patch_rule.sh

@@ -22,6 +22,7 @@ do {
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X PATCH ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules \
   -d @${RULE} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/patch_rule_bulk.sh

@@ -17,6 +17,7 @@ RULES=${1:-./rules/bulk/patch_names.json}
 curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X PATCH ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_update \
   -d @${RULES} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/post_rule_bulk.sh

@@ -17,6 +17,7 @@ RULES=${1:-./rules/bulk/multiple_ruleid_queries.json}
 curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_create \
   -d @${RULES} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/post_rule_preview.sh

@@ -22,6 +22,7 @@ do {
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/preview \
    -d @${RULE} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/post_signal_index.sh

@@ -14,5 +14,6 @@ set -e
 curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/index | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/post_x_rules.sh

@@ -20,6 +20,7 @@ do {
   curl -s -k \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: 123' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules \
   --data "{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signal_index_exists.sh

@@ -13,5 +13,6 @@ set -e
 # Example: ./signal_index_exists.sh
 curl -s -k -f \
  -H 'Content-Type: application/json' \
+ -H 'elastic-api-version: 2023-10-31' \
  -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
  ${KIBANA_URL}${SPACE_URL}/api/detection_engine/index > /dev/null

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/aggs_signals.sh

@@ -14,6 +14,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/search \
   -d '{"aggs": {"statuses": {"terms": {"field": "kibana.alert.workflow_status", "size": 10 }}}}' \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/create_signals_migration.sh

@@ -14,6 +14,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/migration \
   -d "{\"index\": [\"$1\"]}" \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/delete_signals_migration.sh

@@ -14,6 +14,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X DELETE ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/migration \
   -d "{\"migration_ids\": [\"$1\"]}" \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/finalize_signals_migration.sh

@@ -14,6 +14,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/finalize_migration \
   -d "{\"migration_ids\": [\"$1\"]}" \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/get_migration_status.sh

@@ -14,6 +14,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X GET ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/migration_status?from=now-300d \
   | jq .

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/query_signals.sh

@@ -14,6 +14,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/search \
   -d '{ "query": { "match_all": {} } } ' \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/set_status_with_id.sh

@@ -15,6 +15,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/status \
   -d '{"signal_ids": ["45562a28e0dFakeSignalId"], "status": "'$1'"}' \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/signals/set_status_with_query.sh

@@ -15,6 +15,7 @@ set -e
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/signals/status \
   -d '{

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/update_rule.sh

@@ -22,6 +22,7 @@ do {
   curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X PUT ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules \
   -d @${RULE} \

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/update_rule_bulk.sh

@@ -17,6 +17,7 @@ RULES=${1:-./rules/bulk/multiple_simplest_queries.json}
 curl -s -k \
   -H 'Content-Type: application/json' \
   -H 'kbn-xsrf: 123' \
+  -H 'elastic-api-version: 2023-10-31' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
   -X PUT ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_update \
   -d @${RULES} \