Create a detection rule

POST /api/detection_engine/rules
Api key auth

Create a new detection rule.

When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

You can create the following types of rules:

  • Custom query: Searches the defined indices and creates an alert when a document matches the rule's KQL query.
  • Event correlation: Searches the defined indices and creates an alert when results match an Event Query Language (EQL) query.
  • Threshold: Searches the defined indices and creates an alert when the number of times the specified field's value meets the threshold during a single execution. When there are multiple values that meet the threshold, an alert is generated for each value. For example, if the threshold field is source.ip and its value is 10, an alert is generated for every source IP address that appears in at least 10 of the rule's search results. If you're interested, see Terms Aggregation for more information.
  • Indicator match: Creates an alert when fields match values defined in the specified Elasticsearch index. For example, you can create an index for IP addresses and use this index to create an alert whenever an event's destination.ip equals a value in the index. The index's field mappings should be ECS-compliant.
  • New terms: Generates an alert for each new term detected in source documents within a specified time range.
  • ES|QL: Uses Elasticsearch Query Language (ES|QL) to find events and aggregate search results.
  • Machine learning rules: Creates an alert when a machine learning job discovers an anomaly above the defined threshold.

To create machine learning rules, you must have the appropriate license or use a cloud deployment. Additionally, for the machine learning rule to function correctly, the associated machine learning job must be running.

To retrieve machine learning job IDs, which are required to create machine learning jobs, call the Elasticsearch Get jobs API. Machine learning jobs that contain siem in the groups field can be used to create rules:

...
"job_id": "linux_anomalous_network_activity_ecs",
"job_type": "anomaly_detector",
"job_version": "7.7.0",
"groups": [
  "auditbeat",
  "process",
  "siem"
],
...

Additionally, you can set up notifications for when rules create alerts. The notifications use the Alerting and Actions framework. Each action type requires a connector. Connectors store the information required to send notifications via external systems. The following connector types are supported for rule notifications:

  • Slack
  • Email
  • PagerDuty
  • Webhook
  • Microsoft Teams
  • IBM Resilient
  • Jira
  • ServiceNow ITSM

For more information on PagerDuty fields, see Send a v2 Event.

To retrieve connector IDs, which are required to configure rule notifications, call the Find objects API with "type": "action" in the request payload.

For detailed information on Kibana actions and alerting, and additional API calls, see:

application/json

Body object Required

Any of:
Security_Detections_API_EqlRuleCreateFields object Security_Detections_API_QueryRuleCreateFields object Security_Detections_API_SavedQueryRuleCreateFields object Security_Detections_API_ThresholdRuleCreateFields object Security_Detections_API_ThreatMatchRuleCreateFields object Security_Detections_API_MachineLearningRuleCreateFields object Security_Detections_API_NewTermsRuleCreateFields object Security_Detections_API_EsqlRuleCreateFields object

Responses

  • 200 application/json

    Indicates a successful call.

    Any of:
    Security_Detections_API_EqlRuleResponseFields object Security_Detections_API_QueryRuleResponseFields object Security_Detections_API_SavedQueryRuleResponseFields object Security_Detections_API_ThresholdRuleResponseFields object Security_Detections_API_ThreatMatchRuleResponseFields object Security_Detections_API_MachineLearningRuleResponseFields object Security_Detections_API_NewTermsRuleResponseFields object Security_Detections_API_EsqlRuleResponseFields object
POST /api/detection_engine/rules 
curl \
 --request POST 'https://<KIBANA_URL>/api/detection_engine/rules' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"from":"now-70m","name":"MS Office child process","tags":["child process","ms office"],"type":"query","query":"process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE","enabled":false,"filters":[{"query":{"match":{"event.action":{"type":"phrase","query":"Process Create (rule: ProcessCreate)"}}}}],"rule_id":"process_started_by_ms_office_program","interval":"1h","language":"kuery","severity":"low","risk_score":50,"description":"Process started by MS Office program - possible payload","required_fields":[{"name":"process.parent.name","type":"keyword"}],"related_integrations":[{"package":"o365","version":"^2.3.2"}]}'
Request examples
Query rule that searches for processes started by MS Office 
{
  "from": "now-70m",
  "name": "MS Office child process",
  "tags": [
    "child process",
    "ms office"
  ],
  "type": "query",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "enabled": false,
  "filters": [
    {
      "query": {
        "match": {
          "event.action": {
            "type": "phrase",
            "query": "Process Create (rule: ProcessCreate)"
          }
        }
      }
    }
  ],
  "rule_id": "process_started_by_ms_office_program",
  "interval": "1h",
  "language": "kuery",
  "severity": "low",
  "risk_score": 50,
  "description": "Process started by MS Office program - possible payload",
  "required_fields": [
    {
      "name": "process.parent.name",
      "type": "keyword"
    }
  ],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}
Threshold rule that detects multiple failed login attempts to a Windows host from the same external source IP address 
{
  "from": "now-180s",
  "name": "Windows server prml-19",
  "tags": [
    "Brute force"
  ],
  "type": "threshold",
  "index": [
    "winlogbeat-*"
  ],
  "query": "host.name:prml-19 and event.category:authentication and event.outcome:failure",
  "enabled": true,
  "rule_id": "liv-win-ser-logins",
  "interval": "2m",
  "severity": "low",
  "threshold": {
    "field": "source.ip",
    "value": 20
  },
  "risk_score": 30,
  "description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.",
  "exceptions_list": [
    {
      "id": "int-ips",
      "type": "detection",
      "namespace_type": "single"
    }
  ],
  "required_fields": [
    {
      "name": "source.ip",
      "type": "ip"
    }
  ],
  "severity_mapping": [
    {
      "field": "source.geo.city_name",
      "value": "Manchester",
      "operator": "equals",
      "severity": "low"
    },
    {
      "field": "source.geo.city_name",
      "value": "London",
      "operator": "equals",
      "severity": "medium"
    },
    {
      "field": "source.geo.city_name",
      "value": "Birmingham",
      "operator": "equals",
      "severity": "high"
    },
    {
      "field": "source.geo.city_name",
      "value": "Wallingford",
      "operator": "equals",
      "severity": "critical"
    }
  ]
}
Machine learning rule that creates alerts, and sends Slack notifications, when the linux_anomalous_network_activity_ecs machine learning job discovers anomalies with a threshold of 70 or above. 
{
  "from": "now-6m",
  "name": "Anomalous Linux network activity",
  "note": "Shut down the internet.",
  "tags": [
    "machine learning",
    "Linux"
  ],
  "type": "machine_learning",
  "setup": "This rule requires data coming in from Elastic Defend.",
  "actions": [
    {
      "id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5",
      "group": "default",
      "params": {
        "message": "Urgent: {{context.rule.description}}"
      },
      "action_type_id": ".slack"
    }
  ],
  "enabled": true,
  "rule_id": "ml_linux_network_high_threshold",
  "interval": "5m",
  "severity": "high",
  "risk_score": 70,
  "description": "Generates alerts when the job discovers anomalies over 70",
  "anomaly_threshold": 70,
  "machine_learning_job_id": "linux_anomalous_network_activity_ecs"
}
Event correlation rule that creates alerts when the Windows rundll32.exe process makes unusual network connections 
{
  "name": "rundll32.exe network connection",
  "tags": [
    "EQL",
    "Windows",
    "rundll32.exe"
  ],
  "type": "eql",
  "query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]",
  "rule_id": "eql-outbound-rundll32-connections",
  "language": "eql",
  "severity": "low",
  "risk_score": 21,
  "description": "Unusual rundll32.exe network connection",
  "required_fields": [
    {
      "name": "event.type",
      "type": "keyword"
    },
    {
      "name": "process.args",
      "type": "keyword"
    },
    {
      "name": "process.args_count",
      "type": "long"
    },
    {
      "name": "process.entity_id",
      "type": "keyword"
    },
    {
      "name": "process.name",
      "type": "keyword"
    },
    {
      "name": "process.pe.original_file_name",
      "type": "keyword"
    }
  ]
}
Indicator match rule that creates an alert when one of the following is true: The event's destination IP address and port number matches destination IP and port values in the threat_index index; The event's source IP address matches a host IP address value in the threat_index index. 
{
  "name": "Bad IP threat match",
  "type": "threat_match",
  "index": [
    "packetbeat-*"
  ],
  "query": "destination.ip:* or host.ip:*",
  "actions": [],
  "severity": "medium",
  "risk_score": 50,
  "description": "Checks for bad IP addresses listed in the ip-threat-list index",
  "threat_index": [
    "ip-threat-list"
  ],
  "threat_query": "*:*",
  "threat_mapping": [
    {
      "entries": [
        {
          "type": "mapping",
          "field": "destination.ip",
          "value": "destination.ip"
        },
        {
          "type": "mapping",
          "field": "destination.port",
          "value": "destination.port"
        }
      ]
    },
    {
      "entries": [
        {
          "type": "mapping",
          "field": "source.ip",
          "value": "host.ip"
        }
      ]
    }
  ],
  "required_fields": [
    {
      "name": "destination.ip",
      "type": "ip"
    },
    {
      "name": "destination.port",
      "type": "long"
    },
    {
      "name": "host.ip",
      "type": "ip"
    }
  ]
}
New terms rule that creates alerts a new IP address is detected for a user 
{
  "name": "New User IP Detected",
  "type": "new_terms",
  "index": [
    "auditbeat*"
  ],
  "query": "*",
  "language": "kuery",
  "severity": "medium",
  "risk_score": 21,
  "description": "Detects a user associated with a new IP address",
  "required_fields": [
    {
      "name": "user.id",
      "type": "keyword"
    },
    {
      "name": "source.ip",
      "type": "ip"
    }
  ],
  "new_terms_fields": [
    "user.id",
    "source.ip"
  ],
  "history_window_start": "now-30d"
}
esql rule that creates alerts from events that match an Excel parent process 
{
  "to": "now",
  "from": "now-360s",
  "name": "Find Excel events",
  "tags": [],
  "type": "esql",
  "query": "from auditbeat-8.10.2 METADATA _id, _version, _index | where process.parent.name == \"EXCEL.EXE\"",
  "enabled": false,
  "interval": "5m",
  "language": "esql",
  "severity": "low",
  "risk_score": 21,
  "description": "Find Excel events",
  "required_fields": [
    {
      "name": "process.parent.name",
      "type": "keyword"
    }
  ]
}
Query rule that searches for processes started by MS Office and suppresses alerts by the process.parent.name field within a 5-hour time period 
{
  "from": "now-70m",
  "name": "MS Office child process",
  "tags": [
    "child process",
    "ms office"
  ],
  "type": "query",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "enabled": false,
  "filters": [
    {
      "query": {
        "match": {
          "event.action": {
            "type": "phrase",
            "query": "Process Create (rule: ProcessCreate)"
          }
        }
      }
    }
  ],
  "rule_id": "process_started_by_ms_office_program",
  "interval": "1h",
  "language": "kuery",
  "severity": "low",
  "risk_score": 50,
  "description": "Process started by MS Office program - possible payload",
  "alert_suppression": {
    "duration": {
      "unit": "h",
      "value": 5
    },
    "group_by": [
      "process.parent.name"
    ],
    "missing_fields_strategy": "suppress"
  }
}
Response examples (200)
Example response for a query rule 
{
  "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
  "to": "now",
  "from": "now-70m",
  "name": "MS Office child process",
  "tags": [
    "child process",
    "ms office"
  ],
  "type": "query",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "setup": "",
  "threat": [],
  "actions": [],
  "enabled": false,
  "filters": [
    {
      "query": {
        "match": {
          "event.action": {
            "type": "phrase",
            "query": "Process Create (rule: ProcessCreate)"
          }
        }
      }
    }
  ],
  "rule_id": "process_started_by_ms_office_program",
  "version": 1,
  "interval": "1h",
  "language": "kuery",
  "severity": "low",
  "immutable": false,
  "created_at": "2020-04-07T14:51:09.755Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 50,
  "updated_at": "2020-04-07T14:51:09.970Z",
  "updated_by": "elastic",
  "description": "Process started by MS Office program - possible payload",
  "max_signals": 100,
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "process.parent.name",
      "type": "keyword"
    }
  ],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    },
    {
      "package": "azure",
      "version": "^1.11.4",
      "integration": "graphactivitylogs"
    }
  ]
}
Example response for a machine learning job rule 
{
  "id": "83876f66-3a57-4a99-bf37-416494c80f3b",
  "to": "now",
  "from": "now-6m",
  "name": "Anomalous Linux network activity",
  "note": "Shut down the internet.",
  "tags": [
    "machine learning",
    "Linux"
  ],
  "type": "machine_learning",
  "setup": "",
  "status": "going to run",
  "threat": [],
  "actions": [
    {
      "id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5",
      "group": "default",
      "params": {
        "message": "Urgent: {{context.rule.description}}"
      },
      "frequency": {
        "summary": true,
        "throttle": null,
        "notifyWhen": "onActiveAlert"
      },
      "action_type_id": ".slack"
    }
  ],
  "enabled": true,
  "rule_id": "ml_linux_network_high_threshold",
  "version": 1,
  "interval": "5m",
  "severity": "high",
  "immutable": false,
  "created_at": "2020-04-07T14:45:15.679Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 70,
  "updated_at": "2020-04-07T14:45:15.892Z",
  "updated_by": "elastic",
  "description": "Generates alerts when the job discovers anomalies over 70",
  "max_signals": 100,
  "status_date": "2020-04-07T14:45:21.685Z",
  "false_positives": [],
  "required_fields": [],
  "anomaly_threshold": 70,
  "related_integrations": [],
  "machine_learning_job_id": "linux_anomalous_network_activity_ecs"
}
Example response for a threshold rule 
{
  "id": "15dbde26-b627-4d74-bb1f-a5e0ed9e4993",
  "to": "now",
  "from": "now-180s",
  "name": "Windows server prml-19",
  "tags": [
    "Brute force"
  ],
  "type": "threshold",
  "index": [
    "winlogbeat-*"
  ],
  "query": "host.name:prml-19 and event.category:authentication and event.outcome:failure",
  "setup": "",
  "author": [],
  "threat": [],
  "actions": [],
  "enabled": true,
  "rule_id": "liv-win-ser-logins",
  "version": 1,
  "interval": "2m",
  "language": "kuery",
  "severity": "low",
  "immutable": false,
  "threshold": {
    "field": "source.ip",
    "value": 20
  },
  "created_at": "2020-07-22T10:27:23.486Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 30,
  "updated_at": "2020-07-22T10:27:23.673Z",
  "updated_by": "elastic",
  "description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.",
  "max_signals": 100,
  "exceptions_list": [
    {
      "id": "int-ips",
      "type": "detection",
      "namespace_type": "single"
    }
  ],
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "source.ip",
      "type": "ip"
    }
  ],
  "severity_mapping": [
    {
      "field": "source.geo.city_name",
      "value": "Manchester",
      "operator": "equals",
      "severity": "low"
    },
    {
      "field": "source.geo.city_name",
      "value": "London",
      "operator": "equals",
      "severity": "medium"
    },
    {
      "field": "source.geo.city_name",
      "value": "Birmingham",
      "operator": "equals",
      "severity": "high"
    },
    {
      "field": "source.geo.city_name",
      "value": "Wallingford",
      "operator": "equals",
      "severity": "critical"
    }
  ],
  "risk_score_mapping": [],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}
Example response for an EQL rule 
{
  "id": "93808cae-b05b-4dc9-8479-73574b50f8b1",
  "to": "now",
  "from": "now-6m",
  "name": "rundll32.exe network connection",
  "tags": [
    "EQL",
    "Windows",
    "rundll32.exe"
  ],
  "type": "eql",
  "query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]",
  "setup": "",
  "author": [],
  "threat": [],
  "enabled": true,
  "rule_id": "eql-outbound-rundll32-connections",
  "version": 1,
  "interval": "5m",
  "language": "eql",
  "severity": "low",
  "throttle": "no_actions",
  "immutable": false,
  "created_at": "2020-10-05T09:06:16.392Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 21,
  "updated_at": "2020-10-05T09:06:16.403Z",
  "updated_by": "elastic",
  "description": "Unusual rundll32.exe network connection",
  "max_signals": 100,
  "exceptions_list": [],
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "event.type",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.args",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.args_count",
      "type": "long"
    },
    {
      "ecs": true,
      "name": "process.entity_id",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.name",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.pe.original_file_name",
      "type": "keyword"
    }
  ],
  "severity_mapping": [],
  "risk_score_mapping": [],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}
Example response for an indicator match rule 
{
  "id": "d5daa13f-81fb-4b13-be2f-31011e1d9ae1",
  "to": "now",
  "from": "now-6m",
  "name": "Bad IP threat match",
  "tags": [],
  "type": "threat_match",
  "index": [
    "packetbeat-*"
  ],
  "query": "destination.ip:* or host.ip:*",
  "setup": "",
  "author": [],
  "threat": [],
  "enabled": true,
  "rule_id": "608501e4-c768-4f64-9326-cec55b5d439b",
  "version": 1,
  "interval": "5m",
  "language": "kuery",
  "severity": "medium",
  "immutable": false,
  "created_at": "2020-10-06T07:07:58.227Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 50,
  "updated_at": "2020-10-06T07:07:58.237Z",
  "updated_by": "elastic",
  "description": "Checks for bad IP addresses listed in the ip-threat-list index",
  "max_signals": 100,
  "threat_index": [
    "ip-threat-list"
  ],
  "threat_query": "*:*",
  "threat_mapping": [
    {
      "entries": [
        {
          "type": "mapping",
          "field": "destination.ip",
          "value": "destination.ip"
        },
        {
          "type": "mapping",
          "field": "destination.port",
          "value": "destination.port"
        }
      ]
    },
    {
      "entries": [
        {
          "type": "mapping",
          "field": "source.ip",
          "value": "host.ip"
        }
      ]
    }
  ],
  "exceptions_list": [],
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "destination.ip",
      "type": "ip"
    },
    {
      "ecs": true,
      "name": "destination.port",
      "type": "long"
    },
    {
      "ecs": true,
      "name": "host.ip",
      "type": "ip"
    }
  ],
  "severity_mapping": [],
  "risk_score_mapping": [],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}
Example response for a new terms rule 
{
  "id": "eb7225c0-566b-11ee-8b4f-bbf3afdeb9f4",
  "to": "now",
  "from": "now-6m",
  "name": "New User IP Detected",
  "tags": [],
  "type": "new_terms",
  "index": [
    "auditbeat*"
  ],
  "query": "*",
  "setup": "",
  "author": [],
  "threat": [],
  "enabled": true,
  "rule_id": "c6f5d0bc-7be9-47d4-b2f3-073d22641e30",
  "version": 1,
  "interval": "5m",
  "language": "kuery",
  "severity": "medium",
  "immutable": false,
  "created_at": "2020-10-06T07:07:58.227Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 21,
  "updated_at": "2020-10-06T07:07:58.237Z",
  "updated_by": "elastic",
  "description": "Detects a user associated with a new IP address",
  "max_signals": 100,
  "exceptions_list": [],
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "user.id",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "source.ip",
      "type": "ip"
    }
  ],
  "new_terms_fields": [
    "user.id",
    "source.ip"
  ],
  "severity_mapping": [],
  "risk_score_mapping": [],
  "history_window_start": "now-30d",
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}
Example response for an Esql rule 
{
  "id": "d0f20490-6da4-11ee-b85e-09e9b661f2e2",
  "to": "now",
  "from": "now-360s",
  "name": "Find Excel events",
  "tags": [],
  "type": "esql",
  "query": "from auditbeat-8.10.2 METADATA _id | where process.parent.name == \"EXCEL.EXE\"",
  "setup": "",
  "author": [],
  "threat": [],
  "actions": [],
  "enabled": false,
  "rule_id": "e4b53a89-debd-4a0d-a3e3-20606952e589",
  "version": 1,
  "interval": "5m",
  "language": "esql",
  "revision": 0,
  "severity": "low",
  "immutable": false,
  "created_at": "2023-10-18T10:55:14.269Z",
  "created_by": "elastic",
  "references": [],
  "risk_score": 21,
  "updated_at": "2023-10-18T10:55:14.269Z",
  "updated_by": "elastic",
  "description": "Find Excel events",
  "max_signals": 100,
  "output_index": "",
  "exceptions_list": [],
  "false_positives": [],
  "required_fields": [
    {
      "ecs": true,
      "name": "process.parent.name",
      "type": "keyword"
    }
  ],
  "severity_mapping": [],
  "risk_score_mapping": [],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ]
}