How do I import the rules into Kibana?

[avi8892]

Hi guys, I'm trying to import the rules into Kibana but I can't. Can anyone help me with that?

[jamesspi]

Hey @avi8892 - How are you trying to import the rules? Via the CLI?

Kibana requires a .ndjson file for UI based uploads. It you are trying to use detections from this repository, you will need to use the included CLI tool to import them via CLI, or covert them from toml to ndjson.

[avi8892]

Hey @avi8892 - How are you trying to import the rules? Via the CLI?

Kibana requires a .ndjson file for UI based uploads. It you are trying to use detections from this repository, you will need to use the included CLI tool to import them via CLI, or covert them from toml to ndjson.

Thanks man!, can you please send me the command that shows how to convert the rules from tmol to ndjson?

[jamesspi]

@avi8892 Here's the full CLI documentation - https://github.com/elastic/detection-rules/blob/main/CLI.md

[avi8892]

@avi8892 Here's the full CLI documentation - https://github.com/elastic/detection-rules/blob/main/CLI.md

Can you help me with it? no matter what I do it always asking for kibana url.

[brokensound77]

Hello @avi8892, there was a bug for a bit but has since been resolved. Ensure you are up to date with main and hopefully that resolves it

[V1D1AN]

Hi everybody,

I have the same error :( , like @avi8892

[avi8892]

@V1D1AN it is not fixed even I did what was recommended.

[brokensound77]

So it actually is likely not a bug at all but an issue with how you are calling the command. It may be a bit subtle, but if you see under https://github.com/elastic/detection-rules/blob/main/CLI.md#commands-using-elasticsearch-and-kibana-clients, it shows that for commands under the client groups (kibana and es), you need to pass client args immediately after the respective group, such as:

python -m detection-rules kibana -ku <username> -kp <password> upload-rule <...>

So just shift all of your client args to before upload-rule and you should be good to go

[V1D1AN]

Thanks for your help.
It works with the command:

python3 -m detection_rules kibana --kibana-url http://127.0.0.1:5601/kibana -ku elastic -kp elastic upload-rule

[avi8892]

Thanks for your help.
It works with the command:

python3 -m detection_rules kibana --kibana-url http://127.0.0.1:5601/kibana -ku elastic -kp elastic upload-rule

Why is it trying to access this URL? @brokensound77

[V1D1AN]

I have the same error with ELK 7.10.1 , not the version 7.9.2

[avi8892]

I have the same error with ELK 7.10.1 , not the version 7.9.2

I'm on 7.10 :(

[V1D1AN]

[avi8892]

@V1D1AN Sad, I have already installed winlogbeat and everything :/

[V1D1AN]

Someone has already succeeded in importing rules into kibana ? you need another license than the "BASIC" license.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.