I am trying to update a detections config in ES via API with a bash script. All of the below is working and updating the parameters other than updating action.notable and action.email which i cant seem to be able to , i have tried all the values i can think of in there eg 1, true, "1" but none are working, is this something that anyone has seen before? curl -k -u "$USERNAME:$PASSWORD" \
"https://essplunk.company.org:8029/servicesNS/nobody/<APP>/saved/searches/Threat%20-%20DetectionName%20-%20Rule" \
-X POST \
-d disabled=true \
-d search=index="search" \
-d description="Updated search for bad events" \
-d action.email=0 \
-d action.notable=0 \
-d action.email.subject="hello" \
-d action.email.message.alert="hello"\
-d action.email.to=email@company.com \
-d action.email.useNSSubject=1\
-d action.email._command_backup="whatever" \
-d action.email.use_ssl=true \
-d action.nbtstat.param.verbose="1"
... View more