check_rule_readiness
Verify whether an Elastic detection rule will work by checking source indices, data freshness, field mappings, and projected alert volume against the noise threshold without creating real alerts.
Instructions
Check whether a rule will work here: source indices exist, data is recent, required fields are populated, and the projected alert volume is below the noise threshold.
Volume is estimated with Kibana's rule preview, which writes only to an isolated
preview index and does not create real alerts.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| rule_id | Yes | ||
| lookback_hours | No | ||
| estimate_volume | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||