{
  "took" : 313,
  "timed_out" : false,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : ".kibana_1",
        "_type" : "_doc",
        "_id" : "new:alert:f3f3c2d5-4cd0-42bc-8720-a6b2cc797b25",
        "_score" : 1.0,
        "_source" : {
          "alert" : {
            "name" : "Space_Rule",
            "tags" : [
              "__internal_rule_id:de798d45-3755-4532-bd6c-c82d1a4003af",
              "__internal_immutable:false"
            ],
            "alertTypeId" : "siem.signals",
            "consumer" : "siem",
            "params" : {
              "description" : "Test",
              "ruleId" : "de798d45-3755-4532-bd6c-c82d1a4003af",
              "index" : [
                "apm-*-transaction*",
                "auditbeat-*",
                "endgame-*",
                "filebeat-*",
                "packetbeat-*",
                "winlogbeat-*"
              ],
              "falsePositives" : [ ],
              "from" : "now-65s",
              "immutable" : false,
              "query" : "host.name : * ",
              "language" : "kuery",
              "outputIndex" : ".siem-signals-new",
              "savedId" : null,
              "timelineId" : null,
              "timelineTitle" : null,
              "meta" : {
                "from" : "1m",
                "kibana_siem_app_url" : "https://aacbde9659b84b68a92b8df09b530957.europe-west1.gcp.cloud.es.io:9243/s/new/app/siem"
              },
              "filters" : [ ],
              "maxSignals" : 100,
              "riskScore" : 50,
              "severity" : "low",
              "threat" : [ ],
              "to" : "now",
              "type" : "query",
              "references" : [ ],
              "note" : null,
              "version" : 1
            },
            "schedule" : {
              "interval" : "5s"
            },
            "enabled" : true,
            "actions" : [ ],
            "throttle" : null,
            "apiKeyOwner" : "elastic",
            "apiKey" : "xsEIg280UqS7oxSlpaBAi1aY22dASI80ES5hKAU1xaMfNCsEvzs8E82XYyJqrwhoJP50HGzJbqMI5zRKSlArOowD0KXrMTunHizUTjvnMRiB4J/aV0edt+RWbDwtUCuVJFHaM1e2l6wZzt6vBbK9MH+zGv6dDiL3EY5cl9wVmiR0eVl5SiW/J+Ue60EEmiDDnTo+VuYqhgVxMg==",
            "createdBy" : "elastic",
            "updatedBy" : "elastic",
            "createdAt" : "2021-07-28T04:57:51.164Z",
            "muteAll" : false,
            "mutedInstanceIds" : [ ],
            "scheduledTaskId" : "e0474c80-ef60-11eb-94c9-670b3b3d88ea"
          },
          "type" : "alert",
          "references" : [ ],
          "namespace" : "new",
          "updated_at" : "2021-07-28T05:01:32.386Z"
        }
      }
    ]
  }
}