` syntax.\n"
schema:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
default: [ ]
- name: namespace_type
in: query
description: "Determines whether the returned containers are Kibana associated with a Kibana space\nor available in all spaces (`agnostic` or `single`)\n"
schema:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
default:
- single
- name: search
in: query
schema:
type: string
- name: page
in: query
description: The page number to return
schema:
minimum: 0
type: integer
- name: per_page
in: query
description: The number of exception list items to return per page
schema:
minimum: 0
type: integer
- name: sort_field
in: query
description: Determines which field is used to sort the results
schema:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
- name: sort_order
in: query
description: 'Determines the sort order, which can be `desc` or `asc`'
schema:
enum:
- desc
- asc
type: string
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- data
- page
- per_page
- total
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
page:
minimum: 1
type: integer
per_page:
minimum: 1
type: integer
pit:
type: string
total:
minimum: 0
type: integer
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
'404':
description: Exception list not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
/api/exception_lists/summary:
get:
tags:
- Security Exceptions API
summary: Get an exception list summary
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/exception_lists/summary
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a summary of the specified exception list."
operationId: ReadExceptionListSummary
parameters:
- name: id
in: query
description: Exception list's identifier generated upon creation
schema:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
- name: list_id
in: query
description: Exception list's human readable identifier
schema:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
- name: namespace_type
in: query
schema:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
- name: filter
in: query
description: Search filter clause
schema:
type: string
responses:
'200':
description: Successful response
content:
application/json:
schema:
type: object
properties:
linux:
minimum: 0
type: integer
macos:
minimum: 0
type: integer
total:
minimum: 0
type: integer
windows:
minimum: 0
type: integer
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
'404':
description: Exception list not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
/api/exceptions/shared:
post:
tags:
- Security Exceptions API
summary: Create a shared exception list
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/exceptions/shared
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAn exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.\n> info\n> All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.\n"
operationId: CreateSharedExceptionList
requestBody:
content:
application/json:
schema:
required:
- name
- description
type: object
properties:
description:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
name:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
'409':
description: Exception list already exists response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
/api/fleet/agent_download_sources:
get:
tags:
- Elastic Agent binary download sources
summary: List agent binary download sources
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_download_sources
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-download-sources
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_download_sources'
page:
type: integer
perPage:
type: integer
total:
type: integer
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Elastic Agent binary download sources
summary: Create agent binary download source
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agent_download_sources
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: post-download-sources
requestBody:
content:
application/json:
schema:
required:
- name
- host
- is_default
type: object
properties:
host:
type: string
id:
type: string
is_default:
type: boolean
name:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_download_sources'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/agent_download_sources/{sourceId}':
delete:
tags:
- Elastic Agent binary download sources
summary: Delete agent binary download source by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/agent_download_sources/{sourceId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-download-source
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- id
type: object
properties:
id:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Elastic Agent binary download sources
summary: Get agent binary download source by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_download_sources/{sourceId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-one-download-source
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_download_sources'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Elastic Agent binary download sources
summary: Update agent binary download source by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/agent_download_sources/{sourceId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-download-source
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- name
- is_default
- host
type: object
properties:
host:
type: string
is_default:
type: boolean
name:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_download_sources'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: sourceId
in: path
required: true
schema:
type: string
/api/fleet/agent_policies:
get:
tags:
- Elastic Agent policies
summary: List agent policies
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: agent-policy-list
parameters:
- $ref: '#/components/parameters/Fleet_page_size'
- $ref: '#/components/parameters/Fleet_page_index'
- $ref: '#/components/parameters/Fleet_kuery'
- $ref: '#/components/parameters/Fleet_format'
- name: full
in: query
description: 'When set to true, retrieve the related package policies for each agent policy.'
schema:
type: boolean
- name: noAgentCount
in: query
description: 'When set to true, do not count how many agents are in the agent policy, this can improve performance if you are searching over a large number of agent policies. The "agents" property will always be 0 if set to true.'
schema:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
- total
- page
- perPage
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_agent_policy'
page:
type: number
perPage:
type: number
total:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Elastic Agent policies
summary: Create agent policy
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agent_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: create-agent-policy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_agent_policy_create_request'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent_policy'
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agent_policies/_bulk_get:
post:
tags:
- Elastic Agent policies
summary: Bulk get agent policies
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agent_policies/_bulk_get
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-get-agent-policies
parameters:
- $ref: '#/components/parameters/Fleet_format'
requestBody:
content:
application/json:
schema:
required:
- ids
type: object
properties:
full:
type: boolean
description: get full policies with package policies populated
ids:
type: array
items:
type: string
description: list of agent policy ids
ignoreMissing:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_agent_policy'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/agent_policies/{agentPolicyId}':
get:
tags:
- Elastic Agent policies
summary: Get agent policy by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet one agent policy"
operationId: agent-policy-info
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent_policy'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Elastic Agent policies
summary: Update agent policy by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-agent-policy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_agent_policy_update_request'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent_policy'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentPolicyId
in: path
required: true
schema:
type: string
- $ref: '#/components/parameters/Fleet_format'
'/api/fleet/agent_policies/{agentPolicyId}/copy':
post:
tags:
- Elastic Agent policies
summary: Copy agent policy by ID
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: agent-policy-copy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
description: ''
content:
application/json:
schema:
required:
- name
type: object
properties:
description:
type: string
name:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent_policy'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentPolicyId
in: path
required: true
schema:
type: string
- $ref: '#/components/parameters/Fleet_format'
'/api/fleet/agent_policies/{agentPolicyId}/download':
get:
tags:
- Elastic Agent policies
summary: Download agent policy by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/download
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: agent-policy-download
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentPolicyId
in: path
required: true
schema:
type: string
- name: download
in: query
schema:
type: string
- name: standalone
in: query
schema:
type: string
- name: kubernetes
in: query
schema:
type: string
'/api/fleet/agent_policies/{agentPolicyId}/full':
get:
tags:
- Elastic Agent policies
summary: Get full agent policy by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/full
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: agent-policy-full
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
oneOf:
- type: string
- $ref: '#/components/schemas/Fleet_agent_policy_full'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentPolicyId
in: path
required: true
schema:
type: string
- name: download
in: query
schema:
type: string
- name: standalone
in: query
schema:
type: string
- name: kubernetes
in: query
schema:
type: string
/api/fleet/agent_policies/delete:
post:
tags:
- Elastic Agent policies
summary: Delete agent policy by ID
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agent_policies/delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-agent-policy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- agentPolicyId
type: object
properties:
agentPolicyId:
type: string
force:
type: boolean
description: bypass validation checks that can prevent agent policy deletion
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- id
- success
type: object
properties:
id:
type: string
success:
type: boolean
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agent_status:
get:
tags:
- Elastic Agent status
summary: Get agent status summary
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agent-status
parameters:
- name: policyId
in: query
schema:
type: string
- name: kuery
in: query
deprecated: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- active
- all
- error
- events
- inactive
- offline
- online
- other
- total
- updating
type: object
properties:
active:
type: integer
all:
type: integer
error:
type: integer
events:
type: integer
inactive:
type: integer
offline:
type: integer
online:
type: integer
other:
type: integer
total:
type: integer
deprecated: true
unenrolled:
type: integer
updating:
type: integer
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agent_status/data:
get:
tags:
- Elastic Agent status
summary: Get incoming agent data
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent_status/data
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agent-data
parameters:
- name: agentsIds
in: query
required: true
schema:
type: array
items:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
additionalProperties:
type: object
properties:
data:
type: boolean
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agent-status:
get:
tags:
- Elastic Agent status
summary: Get agent status summary
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agent-status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agent-status-deprecated
parameters:
- name: policyId
in: query
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- error
- events
- inactive
- offline
- online
- other
- total
- updating
type: object
properties:
error:
type: integer
events:
type: integer
inactive:
type: integer
offline:
type: integer
online:
type: integer
other:
type: integer
total:
type: integer
updating:
type: integer
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
/api/fleet/agents:
get:
tags:
- Elastic Agents
summary: List agents
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agents
parameters:
- $ref: '#/components/parameters/Fleet_page_size'
- $ref: '#/components/parameters/Fleet_page_index'
- $ref: '#/components/parameters/Fleet_kuery'
- $ref: '#/components/parameters/Fleet_show_inactive'
- $ref: '#/components/parameters/Fleet_show_upgradeable'
- $ref: '#/components/parameters/Fleet_sort_field'
- $ref: '#/components/parameters/Fleet_sort_order'
- $ref: '#/components/parameters/Fleet_with_metrics'
- name: getStatusSummary
in: query
schema:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_get_agents_response'
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Elastic Agents
summary: List agents by action ids
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agents-by-actions
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- policy_id
type: object
properties:
actionIds:
type: array
items:
type: string
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_agent_get_by_actions'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/agents/{agentId}':
delete:
tags:
- Elastic Agents
summary: Delete agent by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/agents/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-agent
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- action
type: object
properties:
action:
enum:
- deleted
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Elastic Agents
summary: Get agent by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agent
parameters:
- $ref: '#/components/parameters/Fleet_with_metrics'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Elastic Agents
summary: Update agent by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/agents/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-agent
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
tags:
type: array
items:
type: string
user_provided_metadata:
type: object
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentId
in: path
required: true
schema:
type: string
'/api/fleet/agents/{agentId}/actions':
post:
tags:
- Elastic Agent actions
summary: Create agent action
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/{agentId}/actions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: new-agent-action
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
action:
$ref: '#/components/schemas/Fleet_agent_action'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
body:
type: array
items:
type: number
headers:
type: string
statusCode:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentId
in: path
required: true
schema:
type: string
'/api/fleet/agents/{agentId}/reassign':
post:
tags:
- Elastic Agents
summary: Reassign agent
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/{agentId}/reassign
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: reassign-agent
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- policy_id
type: object
properties:
policy_id:
type: string
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Elastic Agents
summary: Reassign agent
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/agents/{agentId}/reassign
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: reassign-agent-deprecated
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- policy_id
type: object
properties:
policy_id:
type: string
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
parameters:
- name: agentId
in: path
required: true
schema:
type: string
'/api/fleet/agents/{agentId}/request_diagnostics':
post:
tags:
- Elastic Agents
summary: Request agent diagnostics
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/{agentId}/request_diagnostics
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: request-diagnostics-agent
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
additional_metrics:
type: array
items:
oneOf:
- enum:
- CPU
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
actionId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentId
in: path
required: true
schema:
type: string
'/api/fleet/agents/{agentId}/unenroll':
post:
tags:
- Elastic Agents
summary: Unenroll agent
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/{agentId}/unenroll
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: unenroll-agent
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
force:
type: boolean
revoke:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
'400':
description: BAD REQUEST
content:
application/json:
schema:
type: object
properties:
error:
type: string
message:
type: string
statusCode:
enum:
- 400
type: number
parameters:
- name: agentId
in: path
required: true
schema:
type: string
'/api/fleet/agents/{agentId}/upgrade':
post:
tags:
- Elastic Agents
summary: Upgrade agent
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/{agentId}/upgrade
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: upgrade-agent
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_upgrade_agent'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_upgrade_agent'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentId
in: path
required: true
schema:
type: string
'/api/fleet/agents/{agentId}/uploads':
get:
tags:
- Elastic Agents
summary: List agent uploads
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents/{agentId}/uploads
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: list-agent-uploads
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
body:
type: object
properties:
item:
type: array
items:
$ref: '#/components/schemas/Fleet_agent_diagnostics'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: agentId
in: path
required: true
schema:
type: string
/api/fleet/agents/action_status:
get:
tags:
- Elastic Agent actions
summary: Get agent action status
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents/action_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: agents-action-status
parameters:
- $ref: '#/components/parameters/Fleet_page_size'
- $ref: '#/components/parameters/Fleet_page_index'
- name: errorSize
in: query
schema:
type: integer
default: 5
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
required:
- actionId
- complete
- nbAgentsActioned
- nbAgentsActionCreated
- nbAgentsAck
- nbAgentsFailed
- status
- creationTime
- type
type: object
properties:
actionId:
type: string
cancellationTime:
type: string
completionTime:
type: string
creationTime:
type: string
description: creation time of action
expiration:
type: string
latestErrors:
type: array
items:
type: object
properties:
agentId:
type: string
error:
type: string
timestamp:
type: string
description: latest errors that happened when the agents executed the action
nbAgentsAck:
type: number
description: number of agents that acknowledged the action
nbAgentsActionCreated:
type: number
description: number of agents included in action from kibana
nbAgentsActioned:
type: number
description: number of agents actioned
nbAgentsFailed:
type: number
description: number of agents that failed to execute the action
newPolicyId:
type: string
description: new policy id (POLICY_REASSIGN action)
policyId:
type: string
description: policy id (POLICY_CHANGE action)
revision:
type: string
description: new policy revision (POLICY_CHANGE action)
startTime:
type: string
description: start time of action (scheduled actions)
status:
enum:
- COMPLETE
- EXPIRED
- CANCELLED
- FAILED
- IN_PROGRESS
- ROLLOUT_PASSED
type: string
type:
enum:
- POLICY_REASSIGN
- UPGRADE
- UNENROLL
- FORCE_UNENROLL
- UPDATE_TAGS
- CANCEL
- REQUEST_DIAGNOSTICS
- SETTINGS
- POLICY_CHANGE
- INPUT_ACTION
type: string
version:
type: string
description: agent version number (UPGRADE action)
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/agents/actions/{actionId}/cancel':
post:
tags:
- Elastic Agent actions
summary: Cancel agent action
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/actions/{actionId}/cancel
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: agent-action-cancel
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_agent_action'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: actionId
in: path
required: true
schema:
type: string
/api/fleet/agents/bulk_reassign:
post:
tags:
- Elastic Agents
summary: Bulk reassign agents
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/bulk_reassign
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-reassign-agents
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- policy_id
- agents
type: object
properties:
agents:
oneOf:
- maxLength: 500000
type: string
description: 'KQL query string, leave empty to action all agents'
- type: array
items:
maxLength: 512
type: string
description: list of agent IDs
policy_id:
type: string
description: new agent policy id
example:
agents: 'fleet-agents.policy_id : ("policy1" or "policy2")'
policy_id: policy_id
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
actionId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agents/bulk_request_diagnostics:
post:
tags:
- Elastic Agents
summary: Bulk request diagnostics from agents
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/bulk_request_diagnostics
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-request-diagnostics
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- agents
type: object
properties:
additional_metrics:
type: array
items:
oneOf:
- enum:
- CPU
type: string
agents:
oneOf:
- maxLength: 500000
type: string
description: 'KQL query string, leave empty to action all agents'
- type: array
items:
maxLength: 512
type: string
description: list of agent IDs
batchSize:
type: number
example:
agents: 'fleet-agents.policy_id : ("policy1" or "policy2")'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
actionId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agents/bulk_unenroll:
post:
tags:
- Elastic Agents
summary: Bulk unenroll agents
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/bulk_unenroll
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-unenroll-agents
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- agents
type: object
properties:
agents:
oneOf:
- maxLength: 500000
type: string
description: 'KQL query string, leave empty to action all agents'
- type: array
items:
maxLength: 512
type: string
description: list of agent IDs
force:
type: boolean
description: Unenrolls hosted agents too
includeInactive:
type: boolean
description: 'When passing agents by KQL query, unenrolls inactive agents too'
revoke:
type: boolean
description: Revokes API keys of agents
example:
agents:
- agent1
- agent2
force: false
revoke: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
actionId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agents/bulk_update_agent_tags:
post:
tags:
- Elastic Agents
summary: Bulk update agent tags
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/bulk_update_agent_tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-update-agent-tags
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- agents
type: object
properties:
agents:
oneOf:
- maxLength: 500000
type: string
description: 'KQL query string, leave empty to action all agents'
- type: array
items:
maxLength: 512
type: string
description: list of agent IDs
batchSize:
type: number
tagsToAdd:
type: array
items:
type: string
tagsToRemove:
type: array
items:
type: string
example:
agents:
- agent1
- agent2
tagsToAdd:
- newTag
tagsToRemove:
- existingTag
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
actionId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agents/bulk_upgrade:
post:
tags:
- Elastic Agents
summary: Bulk upgrade agents
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/bulk_upgrade
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-upgrade-agents
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_bulk_upgrade_agents'
example:
agents:
- agent1
- agent2
rollout_duration_seconds: 3600
source_uri: https://artifacts.elastic.co/downloads/beats/elastic-agent
start_time: '2022-08-03T14:00:00.000Z'
version: '8.4.0'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
actionId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/agents/files/{fileId}':
delete:
tags:
- Elastic Agents
summary: Delete file uploaded by agent
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/agents/files/{fileId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-agent-upload-file
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
body:
type: object
properties:
deleted:
type: boolean
id:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: fileId
in: path
required: true
schema:
type: string
'/api/fleet/agents/files/{fileId}/{fileName}':
get:
tags:
- Elastic Agents
summary: Get file uploaded by agent
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents/files/{fileId}/{fileName}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agent-upload-file
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
body:
type: object
properties:
items:
type: object
properties:
body: { }
headers: { }
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: fileId
in: path
required: true
schema:
type: string
- name: fileName
in: path
required: true
schema:
type: string
/api/fleet/agents/setup:
get:
tags:
- Elastic Agents
summary: Get agent setup info
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents/setup
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agents-setup-status
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_fleet_status_response'
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Elastic Agents
summary: Initiate agent setup
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/agents/setup
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: setup-agents
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- admin_username
- admin_password
type: object
properties:
admin_password:
type: string
admin_username:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_fleet_setup_response'
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/agents/tags:
get:
tags:
- Elastic Agents
summary: List agent tags
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/agents/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-agent-tags
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_get_agent_tags_response'
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/data_streams:
get:
tags:
- Data streams
summary: List data streams
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/data_streams
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: data-streams-list
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data_streams:
type: array
items:
$ref: '#/components/schemas/Fleet_data_stream'
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/enrollment_api_keys:
get:
tags:
- Fleet enrollment API keys
summary: List enrollment API keys
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/enrollment_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-enrollment-api-keys
parameters:
- $ref: '#/components/parameters/Fleet_page_size'
- $ref: '#/components/parameters/Fleet_page_index'
- $ref: '#/components/parameters/Fleet_kuery'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
- page
- perPage
- total
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
list:
type: array
items:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
deprecated: true
page:
type: number
perPage:
type: number
total:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Fleet enrollment API keys
summary: Create enrollment API key
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/enrollment_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: create-enrollment-api-keys
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- policy_id
type: object
properties:
name:
type: string
description: The name of the enrollment API key. Must be unique.
policy_id:
type: string
description: The ID of the agent policy the Elastic Agent will be enrolled in.
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
action:
enum:
- created
type: string
item:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/enrollment_api_keys/{keyId}':
delete:
tags:
- Fleet enrollment API keys
summary: Revoke enrollment API key by ID by marking it as inactive
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/enrollment_api_keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-enrollment-api-key
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- action
type: object
properties:
action:
enum:
- deleted
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Fleet enrollment API keys
summary: Get enrollment API key by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/enrollment_api_keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-enrollment-api-key
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: keyId
in: path
required: true
schema:
type: string
/api/fleet/enrollment-api-keys:
get:
tags:
- Fleet enrollment API keys
summary: List enrollment API keys
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/enrollment-api-keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-enrollment-api-keys-deprecated
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
- page
- perPage
- total
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
list:
type: array
items:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
deprecated: true
page:
type: number
perPage:
type: number
total:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
post:
tags:
- Fleet enrollment API keys
summary: Create enrollment API key
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/enrollment-api-keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: create-enrollment-api-keys-deprecated
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
action:
enum:
- created
type: string
item:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
'/api/fleet/enrollment-api-keys/{keyId}':
delete:
tags:
- Fleet enrollment API keys
summary: Delete enrollment API key by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/enrollment-api-keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-enrollment-api-key-deprecated
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- action
type: object
properties:
action:
enum:
- deleted
type: string
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
get:
tags:
- Fleet enrollment API keys
summary: Get enrollment API key by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/enrollment-api-keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-enrollment-api-key-deprecated
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_enrollment_api_key'
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
parameters:
- name: keyId
in: path
required: true
schema:
type: string
/api/fleet/epm/bulk_assets:
post:
tags:
- Elastic Package Manager (EPM)
summary: Bulk get assets
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/epm/bulk_assets
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-get-assets
requestBody:
content:
application/json:
schema:
required:
- assetIds
type: object
properties:
assetIds:
type: array
items:
type: object
properties:
id:
type: string
type:
type: string
description: list of items necessary to fetch assets
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_get_bulk_assets_response'
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/epm/categories:
get:
tags:
- Elastic Package Manager (EPM)
summary: List package categories
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/categories
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-package-categories
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_get_categories_response'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: prerelease
in: query
description: 'Whether to include prerelease packages in categories count (e.g. beta, rc, preview)'
schema:
type: boolean
default: false
- name: experimental
in: query
deprecated: true
schema:
type: boolean
default: false
- name: include_policy_templates
in: query
schema:
type: boolean
default: false
/api/fleet/epm/packages:
get:
tags:
- Elastic Package Manager (EPM)
summary: List packages
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/packages
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: list-all-packages
parameters:
- name: excludeInstallStatus
in: query
description: 'Whether to exclude the install status of each package. Enabling this option will opt in to caching for the response via `cache-control` headers. If you don''t need up-to-date installation info for a package, and are querying for a list of available packages, providing this flag can improve performance substantially.'
schema:
type: boolean
default: false
- name: prerelease
in: query
description: 'Whether to return prerelease versions of packages (e.g. beta, rc, preview)'
schema:
type: boolean
default: false
- name: experimental
in: query
deprecated: true
schema:
type: boolean
default: false
- name: category
in: query
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_get_packages_response'
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Elastic Package Manager (EPM)
summary: Install by package by direct upload
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/epm/packages
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: install-package-by-upload
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- name: ignoreMappingUpdateErrors
in: query
description: avoid erroring out on unexpected mapping update errors
schema:
type: boolean
default: false
- name: skipDataStreamRollover
in: query
description: Skip data stream rollover during index template mapping or settings update
schema:
type: boolean
default: false
requestBody:
content:
application/gzip:
schema:
type: string
format: binary
application/zip:
schema:
type: string
format: binary
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
_meta:
type: object
properties:
install_source:
enum:
- upload
- registry
- bundled
type: string
items:
type: array
items:
required:
- id
- type
type: object
properties:
id:
type: string
type:
oneOf:
- $ref: '#/components/schemas/Fleet_kibana_saved_object_type'
- $ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
'400':
$ref: '#/components/responses/Fleet_error'
'429':
$ref: '#/components/responses/Fleet_error'
/api/fleet/epm/packages/_bulk:
post:
tags:
- Elastic Package Manager (EPM)
summary: Bulk install packages
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/epm/packages/_bulk
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-install-packages
parameters:
- name: prerelease
in: query
description: 'Whether to return prerelease versions of packages (e.g. beta, rc, preview)'
schema:
type: boolean
default: false
requestBody:
content:
application/json:
schema:
required:
- packages
type: object
properties:
force:
type: boolean
description: force install to ignore package verification errors
packages:
type: array
items:
oneOf:
- type: string
description: package name
- type: object
properties:
name:
type: string
description: package name
version:
type: string
description: package version
description: list of packages to install
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_bulk_install_packages_response'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/epm/packages/{pkgkey}':
delete:
tags:
- Elastic Package Manager (EPM)
summary: Delete ackage
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/epm/packages/{pkgkey}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-package-deprecated
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- name: pkgkey
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
force:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- response
type: object
properties:
response:
type: array
items:
required:
- id
- type
type: object
properties:
id:
type: string
type:
oneOf:
- $ref: '#/components/schemas/Fleet_kibana_saved_object_type'
- $ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
get:
tags:
- Elastic Package Manager (EPM)
summary: Get package
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/packages/{pkgkey}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-package-deprecated
parameters:
- name: pkgkey
in: path
required: true
schema:
type: string
- name: prerelease
in: query
description: 'Whether to return prerelease versions of packages (e.g. beta, rc, preview)'
schema:
type: boolean
default: false
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
allOf:
- properties:
response:
$ref: '#/components/schemas/Fleet_package_info'
- required:
- status
- savedObject
properties:
savedObject:
type: string
status:
enum:
- installed
- installing
- install_failed
- not_installed
type: string
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
post:
tags:
- Elastic Package Manager (EPM)
summary: Install package
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/epm/packages/{pkgkey}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: install-package-deprecated
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- name: pkgkey
in: path
required: true
schema:
type: string
- name: ignoreMappingUpdateErrors
in: query
description: avoid erroring out on unexpected mapping update errors
schema:
type: boolean
default: false
- name: skipDataStreamRollover
in: query
description: Skip data stream rollover during index template mapping or settings update
schema:
type: boolean
default: false
requestBody:
content:
application/json:
schema:
type: object
properties:
force:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- response
type: object
properties:
response:
type: array
items:
required:
- id
- type
type: object
properties:
id:
type: string
type:
oneOf:
- $ref: '#/components/schemas/Fleet_kibana_saved_object_type'
- $ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
'/api/fleet/epm/packages/{pkgName}/{pkgVersion}':
delete:
tags:
- Elastic Package Manager (EPM)
summary: Delete package
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-package
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- name: force
in: query
description: delete package even if policies used by agents
schema:
type: boolean
requestBody:
content:
application/json:
schema:
type: object
properties:
force:
type: boolean
deprecated: true
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
required:
- id
- type
type: object
properties:
id:
type: string
type:
oneOf:
- $ref: '#/components/schemas/Fleet_kibana_saved_object_type'
- $ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Elastic Package Manager (EPM)
summary: Get package
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-package
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
allOf:
- properties:
item:
$ref: '#/components/schemas/Fleet_package_info'
- required:
- status
- savedObject
properties:
keepPoliciesUpToDate:
type: boolean
latestVersion:
type: string
licensePath:
type: string
notice:
type: string
savedObject:
type: object
deprecated: true
status:
enum:
- installed
- installing
- install_failed
- not_installed
type: string
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Elastic Package Manager (EPM)
summary: Install package
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: install-package
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- name: ignoreMappingUpdateErrors
in: query
description: avoid erroring out on unexpected mapping update errors
schema:
type: boolean
default: false
- name: skipDataStreamRollover
in: query
description: Skip data stream rollover during index template mapping or settings update
schema:
type: boolean
default: false
requestBody:
content:
application/json:
schema:
type: object
properties:
force:
type: boolean
ignore_constraints:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
_meta:
type: object
properties:
install_source:
enum:
- registry
- upload
- bundled
type: string
items:
type: array
items:
required:
- id
- type
type: object
properties:
id:
type: string
type:
oneOf:
- $ref: '#/components/schemas/Fleet_kibana_saved_object_type'
- $ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Elastic Package Manager (EPM)
summary: Update package settings
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-package
requestBody:
content:
application/json:
schema:
type: object
properties:
keepPoliciesUpToDate:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
required:
- id
- type
type: object
properties:
id:
type: string
type:
oneOf:
- $ref: '#/components/schemas/Fleet_kibana_saved_object_type'
- $ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: pkgName
in: path
required: true
schema:
type: string
- name: pkgVersion
in: path
required: true
schema:
type: string
- name: ignoreUnverified
in: query
description: Ignore if the package is fails signature verification
schema:
type: boolean
- name: full
in: query
description: 'Return all fields from the package manifest, not just those supported by the Elastic Package Registry'
schema:
type: boolean
- name: prerelease
in: query
description: 'Whether to return prerelease versions of packages (e.g. beta, rc, preview)'
schema:
type: boolean
default: false
'/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}':
get:
tags:
- Elastic Package Manager (EPM)
summary: Get package file
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: packages-get-file
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
body:
type: object
headers:
type: object
statusCode:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: pkgName
in: path
required: true
schema:
type: string
- name: pkgVersion
in: path
required: true
schema:
type: string
- name: filePath
in: path
required: true
schema:
type: string
'/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize':
post:
tags:
- Elastic Package Manager (EPM)
summary: Authorize transforms
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: reauthorize-transforms
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- name: pkgName
in: path
required: true
schema:
type: string
- name: pkgVersion
in: path
required: true
schema:
type: string
- name: prerelease
in: query
description: 'Whether to include prerelease packages in categories count (e.g. beta, rc, preview)'
schema:
type: boolean
default: false
requestBody:
content:
application/json:
schema:
type: object
properties:
transforms:
type: array
items:
type: object
properties:
transformId:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
required:
- transformId
- error
type: object
properties:
error:
type: string
success:
type: boolean
transformId:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/epm/packages/{pkgName}/stats':
get:
tags:
- Elastic Package Manager (EPM)
summary: Get package stats
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/packages/{pkgName}/stats
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-package-stats
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- response
type: object
properties:
response:
$ref: '#/components/schemas/Fleet_package_usage_stats'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: pkgName
in: path
required: true
schema:
type: string
/api/fleet/epm/packages/limited:
get:
tags:
- Elastic Package Manager (EPM)
summary: Get limited package list
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/packages/limited
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: list-limited-packages
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs':
get:
tags:
- Elastic Package Manager (EPM)
summary: Get inputs template
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-inputs-template
responses:
'200':
description: OK
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: pkgName
in: path
required: true
schema:
type: string
- name: pkgVersion
in: path
required: true
schema:
type: string
- name: format
in: query
description: Format of response - json or yaml
schema:
enum:
- json
- yaml
- yml
type: string
- name: prerelease
in: query
description: Specify if version is prerelease
schema:
type: boolean
- name: ignoreUnverified
in: query
description: Ignore if the package is fails signature verification
schema:
type: boolean
/api/fleet/epm/verification_key_id:
get:
tags:
- Elastic Package Manager (EPM)
summary: Get package signature verification key ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/epm/verification_key_id
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: packages-get-verification-key-id
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
body:
type: object
properties:
id:
type:
- 'null'
- string
description: the key ID of the GPG key used to verify package signatures
headers:
type: object
statusCode:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/fleet_server_hosts:
get:
tags:
- Fleet Server hosts
summary: List Fleet Server hosts
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/fleet_server_hosts
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-fleet-server-hosts
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_fleet_server_host'
page:
type: integer
perPage:
type: integer
total:
type: integer
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Fleet Server hosts
summary: Create Fleet Server host
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/fleet_server_hosts
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: post-fleet-server-hosts
requestBody:
content:
application/json:
schema:
required:
- name
- host_urls
type: object
properties:
host_urls:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_internal:
type: boolean
name:
type: string
proxy_id:
type: string
description: The ID of the proxy to use for this fleet server host. See the proxies API for more information.
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_fleet_server_host'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/fleet_server_hosts/{itemId}':
delete:
tags:
- Fleet Server hosts
summary: Delete Fleet Server host by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/fleet_server_hosts/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-fleet-server-hosts
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- id
type: object
properties:
id:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Fleet Server hosts
summary: Get Fleet Server host by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/fleet_server_hosts/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-one-fleet-server-hosts
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_fleet_server_host'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Fleet Server hosts
summary: Update Fleet Server host by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/fleet_server_hosts/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-fleet-server-hosts
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
host_urls:
type: array
items:
type: string
is_default:
type: boolean
is_internal:
type: boolean
name:
type: string
proxy_id:
type:
- 'null'
- string
description: The ID of the proxy to use for this fleet server host. See the proxies API for more information.
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_fleet_server_host'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: itemId
in: path
required: true
schema:
type: string
/api/fleet/health_check:
post:
tags:
- Fleet internals
summary: Fleet Server health check
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/health_check
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: fleet-server-health-check
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- id
type: object
properties:
host:
type: string
deprecated: true
id:
type: string
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
host:
type: string
deprecated: true
id:
type: string
description: Fleet Server host id
status:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/kubernetes:
get:
tags:
- Fleet Kubernetes
summary: Get full K8s agent manifest
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/kubernetes
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-full-k8s-manifest
parameters:
- name: download
in: query
schema:
type: boolean
- name: fleetServer
in: query
schema:
type: string
- name: enrolToken
in: query
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/logstash_api_keys:
post:
tags:
- Fleet outputs
summary: Generate Logstash API key
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/logstash_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: generate-logstash-api-key
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
api_key:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/outputs:
get:
tags:
- Fleet outputs
summary: List outputs
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/outputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-outputs
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_output_create_request'
page:
type: integer
perPage:
type: integer
total:
type: integer
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Fleet outputs
summary: Create output
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/outputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: post-outputs
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_output_create_request'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_output_create_request'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/outputs/{outputId}':
delete:
tags:
- Fleet outputs
summary: Delete output by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/outputs/{outputId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-output
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- id
type: object
properties:
id:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Fleet outputs
summary: Get output by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/outputs/{outputId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-output
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_output_create_request'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Fleet outputs
summary: Update output by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/outputs/{outputId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-output
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_output_update_request'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_output_update_request'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: outputId
in: path
required: true
schema:
type: string
'/api/fleet/outputs/{outputId}/health':
get:
tags:
- Fleet outputs
summary: Get latest output health
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/outputs/{outputId}/health
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-output-health
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: long message if unhealthy
state:
type: string
description: 'state of output, HEALTHY or DEGRADED'
timestamp:
type: string
description: timestamp of reported state
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: outputId
in: path
required: true
schema:
type: string
/api/fleet/package_policies:
get:
tags:
- Fleet package policies
summary: List package policies
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/package_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-package-policies
parameters:
- $ref: '#/components/parameters/Fleet_page_size'
- $ref: '#/components/parameters/Fleet_page_index'
- $ref: '#/components/parameters/Fleet_kuery'
- $ref: '#/components/parameters/Fleet_format'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_package_policy'
page:
type: number
perPage:
type: number
total:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Fleet package policies
summary: Create package policy
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/package_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: create-package-policy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- $ref: '#/components/parameters/Fleet_format'
requestBody:
description: You should use inputs as an object and not use the deprecated inputs array.
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_package_policy_request'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_package_policy'
'400':
$ref: '#/components/responses/Fleet_error'
'409':
$ref: '#/components/responses/Fleet_error'
/api/fleet/package_policies/_bulk_get:
post:
tags:
- Fleet package policies
summary: Bulk get package policies
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/package_policies/_bulk_get
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulk-get-package-policies
parameters:
- $ref: '#/components/parameters/Fleet_format'
requestBody:
content:
application/json:
schema:
required:
- ids
type: object
properties:
ids:
type: array
items:
type: string
description: list of package policy ids
ignoreMissing:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_package_policy'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/package_policies/{packagePolicyId}':
delete:
tags:
- Fleet package policies
summary: Delete package policy by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/package_policies/{packagePolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-package-policy
parameters:
- name: force
in: query
schema:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- id
type: object
properties:
id:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Fleet package policies
summary: Get package policy by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/package_policies/{packagePolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-package-policy
parameters:
- $ref: '#/components/parameters/Fleet_format'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_package_policy'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Fleet package policies
summary: Update package policy by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/package_policies/{packagePolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-package-policy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
- $ref: '#/components/parameters/Fleet_format'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_package_policy_request'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_package_policy'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: packagePolicyId
in: path
required: true
schema:
type: string
/api/fleet/package_policies/delete:
post:
tags:
- Fleet package policies
summary: Delete package policy
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/package_policies/delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: post-delete-package-policy
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
required:
- packagePolicyIds
type: object
properties:
force:
type: boolean
packagePolicyIds:
type: array
items:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
required:
- id
- success
type: object
properties:
id:
type: string
name:
type: string
success:
type: boolean
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/package_policies/upgrade:
post:
tags:
- Fleet package policies
summary: Upgrade package policy to a newer package version
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/package_policies/upgrade
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: upgrade-package-policy
requestBody:
content:
application/json:
schema:
required:
- packagePolicyIds
type: object
properties:
packagePolicyIds:
type: array
items:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
required:
- id
- success
type: object
properties:
id:
type: string
name:
type: string
success:
type: boolean
'400':
$ref: '#/components/responses/Fleet_error'
'409':
$ref: '#/components/responses/Fleet_error'
/api/fleet/package_policies/upgrade/dryrun:
post:
tags:
- Fleet package policies
summary: Dry run package policy upgrade
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/package_policies/upgrade/dryrun
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: upgrade-package-policy-dry-run
requestBody:
content:
application/json:
schema:
required:
- packagePolicyIds
type: object
properties:
packagePolicyIds:
type: array
items:
type: string
packageVersion:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
required:
- hasErrors
type: object
properties:
agent_diff:
$ref: '#/components/schemas/Fleet_upgrade_agent_diff'
diff:
$ref: '#/components/schemas/Fleet_upgrade_diff'
hasErrors:
type: boolean
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/proxies:
get:
tags:
- Fleet proxies
summary: List proxies
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/proxies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-fleet-proxies
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_proxies'
page:
type: integer
perPage:
type: integer
total:
type: integer
'400':
$ref: '#/components/responses/Fleet_error'
post:
tags:
- Fleet proxies
summary: Create proxy
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/proxies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: post-fleet-proxies
requestBody:
content:
application/json:
schema:
required:
- name
- url
type: object
properties:
certificate:
type: string
certificate_authorities:
type: string
certificate_key:
type: string
id:
type: string
name:
type: string
proxy_headers:
type: object
url:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_proxies'
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/proxies/{itemId}':
delete:
tags:
- Fleet proxies
summary: Delete proxy by ID
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/fleet/proxies/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: delete-fleet-proxies
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- id
type: object
properties:
id:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
get:
tags:
- Fleet proxies
summary: Get proxy by ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/proxies/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-one-fleet-proxies
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_proxies'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Fleet proxies
summary: Update proxy by ID
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/proxies/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-fleet-proxies
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: string
certificate_key:
type: string
name:
type: string
proxy_headers:
type: object
url:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_proxies'
'400':
$ref: '#/components/responses/Fleet_error'
parameters:
- name: itemId
in: path
required: true
schema:
type: string
/api/fleet/service_tokens:
post:
tags:
- Fleet service tokens
summary: Create service token
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/service_tokens
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: generate-service-token
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
name:
type: string
value:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/service-tokens:
post:
tags:
- Fleet service tokens
summary: Create service token
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/service-tokens
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: generate-service-token-deprecated
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
name:
type: string
value:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
deprecated: true
/api/fleet/settings:
get:
tags:
- Fleet internals
summary: Get settings
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-settings
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_fleet_settings_response'
'400':
$ref: '#/components/responses/Fleet_error'
put:
tags:
- Fleet internals
summary: Update settings
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/fleet/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: update-settings
requestBody:
content:
application/json:
schema:
type: object
properties:
additional_yaml_config:
type: string
delete_unenrolled_agents:
type: object
properties:
enabled:
type: boolean
is_preconfigured:
type: boolean
fleet_server_hosts:
type: array
items:
type: string
description: Protocol and path must be the same for each URL
has_seen_add_data_notice:
type: boolean
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_fleet_settings_response'
'400':
$ref: '#/components/responses/Fleet_error'
/api/fleet/setup:
post:
tags:
- Fleet internals
summary: Initiate Fleet setup
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/fleet/setup
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: setup
parameters:
- $ref: '#/components/parameters/Fleet_kbn_xsrf'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Fleet_fleet_setup_response'
'400':
$ref: '#/components/responses/Fleet_error'
'500':
description: Internal Server Error
content:
application/json:
schema:
type: object
properties:
message:
type: string
/api/fleet/uninstall_tokens:
get:
tags:
- Fleet uninstall tokens
summary: List metadata for latest uninstall tokens per agent policy
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/uninstall_tokens
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-uninstall-tokens
parameters:
- name: perPage
in: query
description: The number of items to return
schema:
minimum: 5
type: integer
default: 20
- $ref: '#/components/parameters/Fleet_page_index'
- name: policyId
in: query
description: Partial match filtering for policy IDs
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- items
- total
- page
- perPage
type: object
properties:
items:
type: array
items:
required:
- id
- policy_id
- created_at
type: object
properties:
created_at:
type: string
id:
type: string
policy_id:
type: string
page:
type: number
perPage:
type: number
total:
type: number
'400':
$ref: '#/components/responses/Fleet_error'
'/api/fleet/uninstall_tokens/{uninstallTokenId}':
get:
tags:
- Fleet uninstall tokens
summary: Get one decrypted uninstall token by its ID
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/fleet/uninstall_tokens/{uninstallTokenId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-uninstall-token
parameters:
- name: uninstallTokenId
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
required:
- item
type: object
properties:
item:
required:
- id
- token
- policy_id
- created_at
type: object
properties:
created_at:
type: string
id:
type: string
policy_id:
type: string
token:
type: string
'400':
$ref: '#/components/responses/Fleet_error'
/api/lists:
delete:
tags:
- Security Lists API
summary: Delete a list
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a list using the list ID.\n> info\n> When you delete a list, all of its list items are also deleted.\n"
operationId: DeleteList
parameters:
- name: id
in: query
description: List's `id` value
required: true
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: deleteReferences
in: query
schema:
type: boolean
default: false
- name: ignoreReferences
in: query
schema:
type: boolean
default: false
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_List'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
get:
tags:
- Security Lists API
summary: Get list details
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a list using the list ID."
operationId: ReadList
parameters:
- name: id
in: query
description: List's `id` value
required: true
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_List'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
patch:
tags:
- Security Lists API
summary: Patch a list
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing list using the list ID."
operationId: PatchList
requestBody:
description: List's properties
content:
application/json:
schema:
required:
- id
type: object
properties:
_version:
type: string
description:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListMetadata'
name:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
version:
minimum: 1
type: integer
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_List'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
post:
tags:
- Security Lists API
summary: Create a list
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new list."
operationId: CreateList
requestBody:
description: List's properties
content:
application/json:
schema:
required:
- name
- description
- type
type: object
properties:
description:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListMetadata'
name:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
type:
$ref: '#/components/schemas/Security_Lists_API_ListType'
version:
minimum: 1
type: integer
default: 1
examples:
ip:
value:
description: This list describes bad internet ips
id: ip_list
name: Simple list with ips
type: ip
ip_range:
value:
description: This list has ip ranges
id: ip_range_list
name: Simple list with ip ranges
type: ip_range
keyword:
value:
description: This list describes bad host names
id: keyword_list
name: Simple list with a keyword
type: keyword
keyword_custom_format:
value:
description: This parses the first found ipv4 only
id: keyword_custom_format_list
name: Simple list with a keyword using a custom format
type: keyword
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_List'
examples:
ip:
value:
_version: WzAsMV0=
'@timestamp': '2025-01-08T04:47:34.273Z'
created_at: '2025-01-08T04:47:34.273Z'
created_by: elastic
description: This list describes bad internet ips
id: ip_list
immutable: false
name: Simple list with ips
tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
type: ip
updated_at: '2025-01-08T04:47:34.273Z'
updated_by: elastic
version: 1
ip_range:
value:
_version: WzAsMV0=
'@timestamp': '2025-01-09T18:23:52.241Z'
created_at: '2025-01-09T18:23:52.241Z'
created_by: elastic
description: This list has ip ranges
id: ip_range_list
immutable: false
name: Simple list with ip ranges
tie_breaker_id: 74aebdaf-601f-4940-b351-155728ff7003
type: ip_range
updated_at: '2025-01-09T18:23:52.241Z'
updated_by: elastic
version: 1
keyword:
value:
_version: WzEsMV0=
'@timestamp': '2025-01-09T18:24:55.786Z'
created_at: '2025-01-09T18:24:55.786Z'
created_by: elastic
description: This list describes bad host names
id: keyword_list
immutable: false
name: Simple list with a keyword
tie_breaker_id: f7e7dbaa-daf7-4c9a-a3dc-56643923ef68
type: keyword
updated_at: '2025-01-09T18:24:55.786Z'
updated_by: elastic
version: 1
keyword_custom_format:
value:
_version: WzIsMV0=
'@timestamp': '2025-01-09T18:25:39.604Z'
created_at: '2025-01-09T18:25:39.604Z'
created_by: elastic
description: This parses the first found ipv4 only
id: keyword_custom_format_list
immutable: false
name: Simple list with a keyword using a custom format
tie_breaker_id: 8247ae63-b780-47b8-9a89-948b643e9ec2
type: keyword
updated_at: '2025-01-09T18:25:39.604Z'
updated_by: elastic
version: 1
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'409':
description: List already exists response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
put:
tags:
- Security Lists API
summary: Update a list
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a list using the list ID. The original list is replaced, and all unspecified fields are deleted.\n> info\n> You cannot modify the `id` value.\n"
operationId: UpdateList
requestBody:
description: List's properties
content:
application/json:
schema:
required:
- id
- name
- description
type: object
properties:
_version:
type: string
description:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListMetadata'
name:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
version:
minimum: 1
type: integer
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_List'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/_find:
get:
tags:
- Security Lists API
summary: Get lists
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/lists/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a paginated subset of lists. By default, the first page is returned, with 20 results per page."
operationId: FindLists
parameters:
- name: page
in: query
description: The page number to return
schema:
type: integer
- name: per_page
in: query
description: The number of lists to return per page
schema:
type: integer
- name: sort_field
in: query
description: Determines which field is used to sort the results
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: sort_order
in: query
description: 'Determines the sort order, which can be `desc` or `asc`'
schema:
enum:
- desc
- asc
type: string
- name: cursor
in: query
description: "Returns the list that come after the last list returned in the previous call\n(use the cursor value returned in the previous call). This parameter uses\nthe `tie_breaker_id` field to ensure all lists are sorted and returned correctly.\n"
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: filter
in: query
description: "Filters the returned results according to the value of the specified field,\nusing the : syntax.\n"
schema:
$ref: '#/components/schemas/Security_Lists_API_FindListsFilter'
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- data
- page
- per_page
- total
- cursor
type: object
properties:
cursor:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
data:
type: array
items:
$ref: '#/components/schemas/Security_Lists_API_List'
page:
minimum: 0
type: integer
per_page:
minimum: 0
type: integer
total:
minimum: 0
type: integer
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/index:
delete:
tags:
- Security Lists API
summary: Delete list data streams
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/lists/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete the `.lists` and `.items` data streams."
operationId: DeleteListIndex
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- acknowledged
type: object
properties:
acknowledged:
type: boolean
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List data stream not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
get:
tags:
- Security Lists API
summary: Get status of list data streams
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/lists/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nVerify that `.lists` and `.items` data streams exist."
operationId: ReadListIndex
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- list_index
- list_item_index
type: object
properties:
list_index:
type: boolean
list_item_index:
type: boolean
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List data stream(s) not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
post:
tags:
- Security Lists API
summary: Create list data streams
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/lists/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate `.lists` and `.items` data streams in the relevant space."
operationId: CreateListIndex
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- acknowledged
type: object
properties:
acknowledged:
type: boolean
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'409':
description: List data stream exists response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/items:
delete:
tags:
- Security Lists API
summary: Delete a list item
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a list item using its `id`, or its `list_id` and `value` fields."
operationId: DeleteListItem
parameters:
- name: id
in: query
description: Required if `list_id` and `value` are not specified
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: list_id
in: query
description: Required if `id` is not specified
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: value
in: query
description: Required if `id` is not specified
schema:
type: string
- name: refresh
in: query
description: Determines when changes made by the request are made visible to search
schema:
enum:
- 'true'
- 'false'
- wait_for
type: string
default: 'false'
responses:
'200':
description: Successful response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_ListItem'
- type: array
items:
$ref: '#/components/schemas/Security_Lists_API_ListItem'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List item not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
get:
tags:
- Security Lists API
summary: Get a list item
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a list item."
operationId: ReadListItem
parameters:
- name: id
in: query
description: Required if `list_id` and `value` are not specified
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: list_id
in: query
description: Required if `id` is not specified
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: value
in: query
description: Required if `id` is not specified
schema:
type: string
responses:
'200':
description: Successful response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_ListItem'
- type: array
items:
$ref: '#/components/schemas/Security_Lists_API_ListItem'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List item not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
patch:
tags:
- Security Lists API
summary: Patch a list item
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing list item using the list item ID."
operationId: PatchListItem
requestBody:
description: List item's properties
content:
application/json:
schema:
required:
- id
type: object
properties:
_version:
type: string
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
refresh:
enum:
- 'true'
- 'false'
- wait_for
type: string
description: Determines when changes made by the request are made visible to search
value:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_ListItem'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List item not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
post:
tags:
- Security Lists API
summary: Create a list item
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a list item and associate it with the specified list.\n\nAll list items in the same list must be the same type. For example, each list item in an `ip` list must define a specific IP address.\n> info\n> Before creating a list item, you must create a list.\n"
operationId: CreateListItem
requestBody:
description: List item's properties
content:
application/json:
schema:
required:
- list_id
- value
type: object
properties:
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
list_id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
refresh:
enum:
- 'true'
- 'false'
- wait_for
type: string
description: Determines when changes made by the request are made visible to search
value:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_ListItem'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'409':
description: List item already exists response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
put:
tags:
- Security Lists API
summary: Update a list item
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted.\n> info\n> You cannot modify the `id` value.\n"
operationId: UpdateListItem
requestBody:
description: List item's properties
content:
application/json:
schema:
required:
- id
- value
type: object
properties:
_version:
type: string
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
value:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_ListItem'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List item not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/items/_export:
post:
tags:
- Security Lists API
summary: Export list items
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/lists/items/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport list item values from the specified list."
operationId: ExportListItems
parameters:
- name: list_id
in: query
description: List's id to export
required: true
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
responses:
'200':
description: Successful response
content:
application/ndjson:
schema:
type: string
description: A `.txt` file containing list items from the specified list
format: binary
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'404':
description: List not found response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/items/_find:
get:
tags:
- Security Lists API
summary: Get list items
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/lists/items/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet all list items in the specified list."
operationId: FindListItems
parameters:
- name: list_id
in: query
description: List's id
required: true
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: page
in: query
description: The page number to return
schema:
type: integer
- name: per_page
in: query
description: The number of list items to return per page
schema:
type: integer
- name: sort_field
in: query
description: Determines which field is used to sort the results
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: sort_order
in: query
description: 'Determines the sort order, which can be `desc` or `asc`'
schema:
enum:
- desc
- asc
type: string
- name: cursor
in: query
description: "Returns the list that come after the last list returned in the previous call\n(use the cursor value returned in the previous call). This parameter uses\nthe `tie_breaker_id` field to ensure all lists are sorted and returned correctly.\n"
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: filter
in: query
description: "Filters the returned results according to the value of the specified field,\nusing the : syntax.\n"
schema:
$ref: '#/components/schemas/Security_Lists_API_FindListItemsFilter'
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- data
- page
- per_page
- total
- cursor
type: object
properties:
cursor:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
data:
type: array
items:
$ref: '#/components/schemas/Security_Lists_API_ListItem'
page:
minimum: 0
type: integer
per_page:
minimum: 0
type: integer
total:
minimum: 0
type: integer
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/items/_import:
post:
tags:
- Security Lists API
summary: Import list items
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/lists/items/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport list items from a TXT or CSV file. The maximum file size is 9 million bytes.\n\nYou can import items to a new or existing list.\n"
operationId: ImportListItems
parameters:
- name: list_id
in: query
description: "List's id.\n\nRequired when importing to an existing list.\n"
schema:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
- name: type
in: query
description: "Type of the importing list.\n\nRequired when importing a new list that is `list_id` is not specified.\n"
schema:
$ref: '#/components/schemas/Security_Lists_API_ListType'
examples:
ip:
value: ip
- name: refresh
in: query
description: Determines when changes made by the request are made visible to search
schema:
enum:
- 'true'
- 'false'
- wait_for
type: string
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
file:
type: string
description: A `.txt` or `.csv` file containing newline separated list items
format: binary
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_List'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'409':
description: List with specified list_id does not exist response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
/api/lists/privileges:
get:
tags:
- Security Lists API
summary: Get list privileges
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/lists/privileges
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: ReadListPrivileges
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- lists
- listItems
- is_authenticated
type: object
properties:
is_authenticated:
type: boolean
listItems:
$ref: '#/components/schemas/Security_Lists_API_ListItemPrivileges'
lists:
$ref: '#/components/schemas/Security_Lists_API_ListPrivileges'
'400':
description: Invalid input data response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
- $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'401':
description: Unsuccessful authentication response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'403':
description: Not enough privileges response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
'500':
description: Internal server error response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
'/api/logstash/pipeline/{id}':
delete:
tags:
- logstash
summary: Delete a Logstash pipeline
description: "Delete a centrally-managed Logstash pipeline.\nIf your Elasticsearch cluster is protected with basic authentication, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.\n"
externalDocs:
description: Secure your connection
url: https://www.elastic.co/guide/en/logstash/current/ls-security.html
operationId: delete-logstash-pipeline
parameters:
- name: id
in: path
description: An identifier for the pipeline.
required: true
schema:
type: string
responses:
'204':
description: Indicates a successful call
x-state: Technical Preview
get:
tags:
- logstash
summary: Get a Logstash pipeline
description: "Get information for a centrally-managed Logstash pipeline.\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.\n"
externalDocs:
description: Secure your connection
url: https://www.elastic.co/guide/en/logstash/current/ls-security.html
operationId: get-logstash-pipeline
parameters:
- name: id
in: path
description: An identifier for the pipeline.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
type: object
examples:
getLogstashPipelineResponseExample1:
value: "{\n \"id\": \"hello-world\",\n \"description\": \"Just a simple pipeline\",\n \"username\": \"elastic\",\n \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n \"settings\": {\n \"queue.type\": \"persistent\"\n }\n}"
x-state: Technical Preview
put:
tags:
- logstash
summary: Create or update a Logstash pipeline
description: "Create a centrally-managed Logstash pipeline or update a pipeline.\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.\n"
externalDocs:
description: Secure your connection
url: https://www.elastic.co/guide/en/logstash/current/ls-security.html
operationId: put-logstash-pipeline
parameters:
- name: id
in: path
description: "An identifier for the pipeline. Pipeline ID must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.\n"
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
required:
- pipeline
type: object
properties:
description:
type: string
description: A description of the pipeline.
pipeline:
type: string
description: A definition for the pipeline.
settings:
type: object
description: "Supported settings, represented as object keys, include the following:\n\n- `pipeline.workers`\n- `pipeline.batch.size`\n- `pipeline.batch.delay`\n- `pipeline.ecs_compatibility`\n- `pipeline.ordered`\n- `queue.type`\n- `queue.max_bytes`\n- `queue.checkpoint.writes`\n"
examples:
putLogstashPipelineRequestExample1:
value: "{\n \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n \"settings\": {\n \"queue.type\": \"persisted\"\n }\n}"
responses:
'204':
description: Indicates a successful call
x-state: Technical Preview
/api/logstash/pipelines:
get:
tags:
- logstash
summary: Get all Logstash pipelines
description: "Get a list of all centrally-managed Logstash pipelines.\n\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.\n> info\n> Limit the number of pipelines to 10,000 or fewer. As the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana.\n\nThe `username` property appears in the response when security is enabled and depends on when the pipeline was created or last updated.\n"
externalDocs:
description: Secure your connection
url: https://www.elastic.co/guide/en/logstash/current/ls-security.html
operationId: get-logstash-pipelines
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
type: object
examples:
getLogstashPipelinesResponseExample1:
value: "{\n \"pipelines\": [\n {\n \"id\": \"hello-world\",\n \"description\": \"Just a simple pipeline\",\n \"last_modified\": \"2018-04-14T12:23:29.772Z\",\n \"username\": \"elastic\" \n },\n {\n \"id\": \"sleepy-pipeline\",\n \"description\": \"\",\n \"last_modified\": \"2018-03-24T03:41:30.554Z\"\n }\n ]\n}"
x-state: Technical Preview
/api/maintenance_window:
post:
tags:
- maintenance-window
summary: Create a maintenance window.
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/maintenance_window
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window."
operationId: post-maintenance-window
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- title
- schedule
type: object
properties:
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
minimum: 1
type: number
description: The total number of recurrences of the schedule.
onMonth:
minItems: 1
type: array
items:
maximum: 12
minimum: 1
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
minItems: 1
type: array
items:
maximum: 31
minimum: 1
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
minItems: 1
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL). Only alerts matching this query will be supressed by the maintenance window.
additionalProperties: false
additionalProperties: false
additionalProperties: false
title:
type: string
description: 'The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.'
additionalProperties: false
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
required:
- id
- title
- enabled
- created_by
- updated_by
- created_at
- updated_at
- status
- schedule
type: object
properties:
created_at:
type: string
description: The date and time when the maintenance window was created.
created_by:
type:
- 'null'
- string
description: The identifier for the user that created the maintenance window.
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
id:
type: string
description: The identifier for the maintenance window.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
type: number
description: The total number of recurrences of the schedule.
onMonth:
type: array
items:
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
type: array
items:
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL).
additionalProperties: false
additionalProperties: false
additionalProperties: false
status:
enum:
- running
- upcoming
- finished
- archived
type: string
description: The current status of the maintenance window.
title:
type: string
description: The name of the maintenance window.
updated_at:
type: string
description: The date and time when the maintenance window was last updated.
updated_by:
type:
- 'null'
- string
description: The identifier for the user that last updated this maintenance window.
additionalProperties: false
'400':
description: Indicates an invalid schema or parameters.
'403':
description: Indicates that this call is forbidden.
'/api/maintenance_window/{id}':
delete:
tags:
- maintenance-window
summary: Delete a maintenance window.
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/maintenance_window/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window."
operationId: delete-maintenance-window-id
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: id
in: path
description: The identifier for the maintenance window to be deleted.
required: true
schema:
type: string
responses:
'204':
description: Indicates a successful call.
'400':
description: Indicates an invalid schema or parameters.
'403':
description: Indicates that this call is forbidden.
'404':
description: Indicates a maintenance window with the given ID does not exist.
get:
tags:
- maintenance-window
summary: Get maintenance window details.
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/maintenance_window/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: read-maintenance-window."
operationId: get-maintenance-window-id
parameters:
- name: id
in: path
description: The identifier for the maintenance window.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
required:
- id
- title
- enabled
- created_by
- updated_by
- created_at
- updated_at
- status
- schedule
type: object
properties:
created_at:
type: string
description: The date and time when the maintenance window was created.
created_by:
type:
- 'null'
- string
description: The identifier for the user that created the maintenance window.
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
id:
type: string
description: The identifier for the maintenance window.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
type: number
description: The total number of recurrences of the schedule.
onMonth:
type: array
items:
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
type: array
items:
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL).
additionalProperties: false
additionalProperties: false
additionalProperties: false
status:
enum:
- running
- upcoming
- finished
- archived
type: string
description: The current status of the maintenance window.
title:
type: string
description: The name of the maintenance window.
updated_at:
type: string
description: The date and time when the maintenance window was last updated.
updated_by:
type:
- 'null'
- string
description: The identifier for the user that last updated this maintenance window.
additionalProperties: false
'400':
description: Indicates an invalid schema or parameters.
'403':
description: Indicates that this call is forbidden.
'404':
description: Indicates a maintenance window with the given ID does not exist.
patch:
tags:
- maintenance-window
summary: Update a maintenance window.
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/maintenance_window/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window."
operationId: patch-maintenance-window-id
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: id
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
minimum: 1
type: number
description: The total number of recurrences of the schedule.
onMonth:
minItems: 1
type: array
items:
maximum: 12
minimum: 1
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
minItems: 1
type: array
items:
maximum: 31
minimum: 1
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
minItems: 1
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL). Only alerts matching this query will be supressed by the maintenance window.
additionalProperties: false
additionalProperties: false
additionalProperties: false
title:
type: string
description: 'The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.'
additionalProperties: false
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
required:
- id
- title
- enabled
- created_by
- updated_by
- created_at
- updated_at
- status
- schedule
type: object
properties:
created_at:
type: string
description: The date and time when the maintenance window was created.
created_by:
type:
- 'null'
- string
description: The identifier for the user that created the maintenance window.
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
id:
type: string
description: The identifier for the maintenance window.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
type: number
description: The total number of recurrences of the schedule.
onMonth:
type: array
items:
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
type: array
items:
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL).
additionalProperties: false
additionalProperties: false
additionalProperties: false
status:
enum:
- running
- upcoming
- finished
- archived
type: string
description: The current status of the maintenance window.
title:
type: string
description: The name of the maintenance window.
updated_at:
type: string
description: The date and time when the maintenance window was last updated.
updated_by:
type:
- 'null'
- string
description: The identifier for the user that last updated this maintenance window.
additionalProperties: false
'400':
description: Indicates an invalid schema or parameters.
'403':
description: Indicates that this call is forbidden.
'404':
description: Indicates a maintenance window with the given ID does not exist.
'409':
description: Indicates that the maintenance window has already been updated by another user.
'/api/maintenance_window/{id}/_archive':
post:
tags:
- maintenance-window
summary: Archive a maintenance window.
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/maintenance_window/{id}/_archive
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window."
operationId: post-maintenance-window-id-archive
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: id
in: path
description: The identifier for the maintenance window to be archived.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
required:
- id
- title
- enabled
- created_by
- updated_by
- created_at
- updated_at
- status
- schedule
type: object
properties:
created_at:
type: string
description: The date and time when the maintenance window was created.
created_by:
type:
- 'null'
- string
description: The identifier for the user that created the maintenance window.
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
id:
type: string
description: The identifier for the maintenance window.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
type: number
description: The total number of recurrences of the schedule.
onMonth:
type: array
items:
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
type: array
items:
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL).
additionalProperties: false
additionalProperties: false
additionalProperties: false
status:
enum:
- running
- upcoming
- finished
- archived
type: string
description: The current status of the maintenance window.
title:
type: string
description: The name of the maintenance window.
updated_at:
type: string
description: The date and time when the maintenance window was last updated.
updated_by:
type:
- 'null'
- string
description: The identifier for the user that last updated this maintenance window.
additionalProperties: false
'400':
description: Indicates an invalid schema or parameters.
'403':
description: Indicates that this call is forbidden.
'404':
description: Indicates a maintenance window with the given ID does not exist.
'/api/maintenance_window/{id}/_unarchive':
post:
tags:
- maintenance-window
summary: Unarchive a maintenance window.
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/maintenance_window/{id}/_unarchive
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window."
operationId: post-maintenance-window-id-unarchive
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: id
in: path
description: The identifier for the maintenance window to be unarchived.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
required:
- id
- title
- enabled
- created_by
- updated_by
- created_at
- updated_at
- status
- schedule
type: object
properties:
created_at:
type: string
description: The date and time when the maintenance window was created.
created_by:
type:
- 'null'
- string
description: The identifier for the user that created the maintenance window.
enabled:
type: boolean
description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
id:
type: string
description: The identifier for the maintenance window.
schedule:
required:
- custom
type: object
properties:
custom:
required:
- start
- duration
type: object
properties:
duration:
type: string
description: 'The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
recurring:
type: object
properties:
end:
type: string
description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
every:
type: string
description: 'The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
occurrences:
type: number
description: The total number of recurrences of the schedule.
onMonth:
type: array
items:
type: number
description: The specific months for a recurring schedule. Valid values are 1-12.
onMonthDay:
type: array
items:
type: number
description: The specific days of the month for a recurring schedule. Valid values are 1-31.
onWeekDay:
type: array
items:
type: string
description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
additionalProperties: false
start:
type: string
description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
timezone:
type: string
description: The timezone of the schedule. The default timezone is UTC.
additionalProperties: false
additionalProperties: false
scope:
required:
- alerting
type: object
properties:
alerting:
required:
- query
type: object
properties:
query:
required:
- kql
type: object
properties:
kql:
type: string
description: A filter written in Kibana Query Language (KQL).
additionalProperties: false
additionalProperties: false
additionalProperties: false
status:
enum:
- running
- upcoming
- finished
- archived
type: string
description: The current status of the maintenance window.
title:
type: string
description: The name of the maintenance window.
updated_at:
type: string
description: The date and time when the maintenance window was last updated.
updated_by:
type:
- 'null'
- string
description: The identifier for the user that last updated this maintenance window.
additionalProperties: false
'400':
description: Indicates an invalid schema or parameters.
'403':
description: Indicates that this call is forbidden.
'404':
description: Indicates a maintenance window with the given ID does not exist.
/api/ml/saved_objects/sync:
get:
tags:
- ml
summary: Sync saved objects in the default space
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/ml/saved_objects/sync
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSynchronizes Kibana saved objects for machine learning jobs and trained models in the default space. You must have `all` privileges for the **Machine Learning** feature in the **Analytics** section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.\n"
operationId: mlSync
parameters:
- $ref: '#/components/parameters/Machine_learning_APIs_simulateParam'
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
$ref: '#/components/schemas/Machine_learning_APIs_mlSync200Response'
examples:
syncExample:
$ref: '#/components/examples/Machine_learning_APIs_mlSyncExample'
'401':
description: Authorization information is missing or invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Machine_learning_APIs_mlSync4xxResponse'
/api/note:
delete:
tags:
- Security Timeline API
summary: Delete a note
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a note from a Timeline using the note ID."
operationId: DeleteNote
requestBody:
description: The ID of the note to delete.
content:
application/json:
schema:
oneOf:
- required:
- noteId
type:
- 'null'
- object
properties:
noteId:
type: string
- required:
- noteIds
type:
- 'null'
- object
properties:
noteIds:
type:
- 'null'
- array
items:
type: string
required: true
responses:
'200':
description: Indicates the note was successfully deleted.
content:
application/json:
schema:
type: object
properties:
data:
type: object
get:
tags:
- Security Timeline API
summary: Get notes
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet all notes for a given document."
operationId: GetNotes
parameters:
- name: documentIds
in: query
schema:
$ref: '#/components/schemas/Security_Timeline_API_DocumentIds'
- name: savedObjectIds
in: query
schema:
$ref: '#/components/schemas/Security_Timeline_API_SavedObjectIds'
- name: page
in: query
schema:
type:
- 'null'
- string
- name: perPage
in: query
schema:
type:
- 'null'
- string
- name: search
in: query
schema:
type:
- 'null'
- string
- name: sortField
in: query
schema:
type:
- 'null'
- string
- name: sortOrder
in: query
schema:
type:
- 'null'
- string
- name: filter
in: query
schema:
type:
- 'null'
- string
- name: createdByFilter
in: query
schema:
type:
- 'null'
- string
- name: associatedFilter
in: query
schema:
$ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
responses:
'200':
description: Indicates the requested notes were returned.
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Security_Timeline_API_GetNotesResult'
- type: object
patch:
tags:
- Security Timeline API
summary: Add or update a note
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd a note to a Timeline or update an existing note."
operationId: PersistNoteRoute
requestBody:
description: 'The note to add or update, along with additional metadata.'
content:
application/json:
schema:
required:
- note
type: object
properties:
note:
$ref: '#/components/schemas/Security_Timeline_API_BareNote'
noteId:
type:
- 'null'
- string
description: The `savedObjectId` of the note
example: 709f99c6-89b6-4953-9160-35945c8e174e
version:
type:
- 'null'
- string
description: The version of the note
example: WzQ2LDFd
required: true
responses:
'200':
description: Indicates the note was successfully created.
content:
application/json:
schema:
required:
- data
type: object
properties:
data:
required:
- persistNote
type: object
properties:
persistNote:
$ref: '#/components/schemas/Security_Timeline_API_ResponseNote'
/api/osquery/live_queries:
get:
tags:
- Security Osquery API
summary: Get live queries
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all live queries."
operationId: OsqueryFindLiveQueries
parameters:
- name: kuery
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
- name: page
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- name: pageSize
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- name: sort
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- name: sortOrder
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryResponse'
post:
tags:
- Security Osquery API
summary: Create a live query
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and run a live query."
operationId: OsqueryCreateLiveQuery
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse'
'/api/osquery/live_queries/{id}':
get:
tags:
- Security Osquery API
summary: Get live query details
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/live_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a live query using the query ID."
operationId: OsqueryGetLiveQueryDetails
parameters:
- name: id
in: path
required: true
schema:
type: string
description: The ID of the live query result you want to retrieve.
example: 3c42c847-eb30-4452-80e0-728584042334
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse'
'/api/osquery/live_queries/{id}/results/{actionId}':
get:
tags:
- Security Osquery API
summary: Get live query results
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the results of a live query using the query action ID."
operationId: OsqueryGetLiveQueryResults
parameters:
- name: id
in: path
required: true
schema:
type: string
description: The ID of the live query result you want to retrieve.
example: 3c42c847-eb30-4452-80e0-728584042334
- name: actionId
in: path
required: true
schema:
type: string
description: The ID of the query action that generated the live query results.
example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
- name: kuery
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
- name: page
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- name: pageSize
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- name: sort
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- name: sortOrder
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse'
/api/osquery/packs:
get:
tags:
- Security Osquery API
summary: Get packs
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all query packs."
operationId: OsqueryFindPacks
parameters:
- name: page
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- name: pageSize
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- name: sort
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- name: sortOrder
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindPacksResponse'
post:
tags:
- Security Osquery API
summary: Create a pack
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a query pack."
operationId: OsqueryCreatePacks
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreatePacksRequestBody'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreatePacksResponse'
'/api/osquery/packs/{id}':
delete:
tags:
- Security Osquery API
summary: Delete a pack
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a query pack using the pack ID."
operationId: OsqueryDeletePacks
parameters:
- name: id
in: path
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
get:
tags:
- Security Osquery API
summary: Get pack details
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a query pack using the pack ID."
operationId: OsqueryGetPacksDetails
parameters:
- name: id
in: path
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindPackResponse'
put:
tags:
- Security Osquery API
summary: Update a pack
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a query pack using the pack ID.\n> info\n> You cannot update a prebuilt pack.\n"
operationId: OsqueryUpdatePacks
parameters:
- name: id
in: path
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_UpdatePacksRequestBody'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_UpdatePacksResponse'
/api/osquery/saved_queries:
get:
tags:
- Security Osquery API
summary: Get saved queries
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/saved_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all saved queries."
operationId: OsqueryFindSavedQueries
parameters:
- name: page
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- name: pageSize
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- name: sort
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- name: sortOrder
in: query
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryResponse'
post:
tags:
- Security Osquery API
summary: Create a saved query
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/saved_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and run a saved query."
operationId: OsqueryCreateSavedQuery
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryRequestBody'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryResponse'
'/api/osquery/saved_queries/{id}':
delete:
tags:
- Security Osquery API
summary: Delete a saved query
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a saved query using the query ID."
operationId: OsqueryDeleteSavedQuery
parameters:
- name: id
in: path
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_DefaultSuccessResponse'
get:
tags:
- Security Osquery API
summary: Get saved query details
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a saved query using the query ID."
operationId: OsqueryGetSavedQueryDetails
parameters:
- name: id
in: path
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryDetailResponse'
put:
tags:
- Security Osquery API
summary: Update a saved query
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a saved query using the query ID.\n> info\n> You cannot update a prebuilt saved query.\n"
operationId: OsqueryUpdateSavedQuery
parameters:
- name: id
in: path
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryRequestBody'
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryResponse'
/api/pinned_event:
patch:
tags:
- Security Timeline API
summary: Pin/unpin an event
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/pinned_event
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPin/unpin an event to/from an existing Timeline."
operationId: PersistPinnedEventRoute
requestBody:
description: 'The pinned event to add or unpin, along with additional metadata.'
content:
application/json:
schema:
required:
- eventId
- timelineId
type: object
properties:
eventId:
type: string
description: The `_id` of the associated event for this pinned event.
example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
pinnedEventId:
type:
- 'null'
- string
description: The `savedObjectId` of the pinned event you want to unpin.
example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
timelineId:
type: string
description: The `savedObjectId` of the timeline that you want this pinned event unpinned from.
example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
required: true
responses:
'200':
description: Indicates the event was successfully pinned to or unpinned from the Timeline.
content:
application/json:
schema:
required:
- data
type: object
properties:
data:
required:
- persistPinnedEventOnTimeline
type: object
properties:
persistPinnedEventOnTimeline:
$ref: '#/components/schemas/Security_Timeline_API_PersistPinnedEventResponse'
/api/risk_score/engine/dangerously_delete_data:
delete:
tags:
- Security Entity Analytics API
summary: Cleanup the Risk Engine
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/risk_score/engine/dangerously_delete_data
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCleaning up the the Risk Engine by removing the indices, mapping and transforms"
operationId: CleanUpRiskEngine
responses:
'200':
description: Successful response
content:
application/json:
schema:
type: object
properties:
cleanup_successful:
type: boolean
'400':
description: Task manager is unavailable
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
default:
description: Unexpected error
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse'
/api/risk_score/engine/saved_object/configure:
patch:
tags:
- Security Entity Analytics API
summary: Configure the Risk Engine Saved Object
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/risk_score/engine/saved_object/configure
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nConfiguring the Risk Engine Saved Object"
operationId: ConfigureRiskEngineSavedObject
requestBody:
content:
application/json:
schema:
type: object
properties:
exclude_alert_statuses:
type: array
items:
type: string
exclude_alert_tags:
type: array
items:
type: string
range:
type: object
properties:
end:
type: string
start:
type: string
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
type: object
properties:
risk_engine_saved_object_configured:
type: boolean
'400':
description: Task manager is unavailable
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
default:
description: Unexpected error
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse'
/api/risk_score/engine/schedule_now:
post:
tags:
- Security Entity Analytics API
summary: Run the risk scoring engine
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/risk_score/engine/schedule_now
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSchedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality."
operationId: ScheduleRiskEngineNow
requestBody:
content:
application/json: { }
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowResponse'
'400':
description: Task manager is unavailable
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
default:
description: Unexpected error
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse'
/api/saved_objects/_bulk_create:
post:
tags:
- saved objects
summary: Create saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_bulk_create
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulkCreateSavedObjects
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- name: overwrite
in: query
description: 'When true, overwrites the document with the same identifier.'
schema:
type: boolean
requestBody:
content:
application/json:
schema:
type: array
items:
type: object
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/saved_objects/_bulk_delete:
post:
tags:
- saved objects
summary: Delete saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: When you delete a saved object, it cannot be recovered.\n"
operationId: bulkDeleteSavedObjects
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- name: force
in: query
description: "When true, force delete objects that exist in multiple namespaces. Note that the option applies to the whole request. Use the delete object API to specify per-object deletion behavior. TIP: Use this if you attempted to delete objects and received an HTTP 400 error with the following message: \"Unable to delete saved object that exists in multiple namespaces, use the force option to delete it anyway\". WARNING: When you bulk delete objects that exist in multiple namespaces, the API also deletes legacy url aliases that reference the object. These requests are batched to minimise the impact but they can place a heavy load on Kibana. Make sure you limit the number of objects that exist in multiple namespaces in a single bulk delete operation.\n"
schema:
type: boolean
requestBody:
content:
application/json:
schema:
type: array
items:
type: object
required: true
responses:
'200':
description: "Indicates a successful call. NOTE: This HTTP response code indicates that the bulk operation succeeded. Errors pertaining to individual objects will be returned in the response body.\n"
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/saved_objects/_bulk_get:
post:
tags:
- saved objects
summary: Get saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_bulk_get
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: bulkGetSavedObjects
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: array
items:
type: object
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/saved_objects/_bulk_resolve:
post:
tags:
- saved objects
summary: Resolve saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_bulk_resolve
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve multiple Kibana saved objects by identifier using any legacy URL aliases if they exist. Under certain circumstances when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved by the bulk resolve API using either its new ID or its old ID.\n"
operationId: bulkResolveSavedObjects
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: array
items:
type: object
required: true
responses:
'200':
description: "Indicates a successful call. NOTE: This HTTP response code indicates that the bulk operation succeeded. Errors pertaining to individual objects will be returned in the response body. \n"
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/saved_objects/_bulk_update:
post:
tags:
- saved objects
summary: Update saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_bulk_update
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the attributes for multiple Kibana saved objects."
operationId: bulkUpdateSavedObjects
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: array
items:
type: object
required: true
responses:
'200':
description: "Indicates a successful call. NOTE: This HTTP response code indicates that the bulk operation succeeded. Errors pertaining to individual objects will be returned in the response body. \n"
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/saved_objects/_export:
post:
tags:
- saved objects
summary: Export saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve sets of saved objects that you want to import into Kibana.\nYou must include `type` or `objects` in the request body.\n\nExported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n\nNOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be exported.\n"
operationId: exportSavedObjectsDefault
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
requestBody:
content:
application/json:
schema:
type: object
properties:
excludeExportDetails:
type: boolean
description: Do not add export details entry at the end of the stream.
default: false
includeReferencesDeep:
type: boolean
description: Includes all of the referenced objects in the exported objects.
objects:
type: array
items:
type: object
description: A list of objects to export.
type:
oneOf:
- type: string
- type: array
items:
type: string
description: The saved object types to include in the export. Use `*` to export all the types.
examples:
exportSavedObjectsRequest:
$ref: '#/components/examples/Saved_objects_export_objects_request'
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/x-ndjson:
schema:
type: object
examples:
exportSavedObjectsResponse:
$ref: '#/components/examples/Saved_objects_export_objects_response'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
/api/saved_objects/_find:
get:
tags:
- saved objects
summary: Search for saved objects
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/saved_objects/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated set of Kibana saved objects."
operationId: findSavedObjects
parameters:
- name: aggs
in: query
description: "An aggregation structure, serialized as a string. The field format is similar to filter, meaning that to use a saved object type attribute in the aggregation, the `savedObjectType.attributes.title: \"myTitle\"` format must be used. For root fields, the syntax is `savedObjectType.rootField`. NOTE: As objects change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.\n"
schema:
type: string
- name: default_search_operator
in: query
description: The default operator to use for the `simple_query_string`.
schema:
type: string
- name: fields
in: query
description: The fields to return in the attributes key of the response.
schema:
type:
- string
- array
- name: filter
in: query
description: "The filter is a KQL string with the caveat that if you filter with an attribute from your saved object type, it should look like that: `savedObjectType.attributes.title: \"myTitle\"`. However, if you use a root attribute of a saved object such as `updated_at`, you will have to define your filter like that: `savedObjectType.updated_at > 2018-12-22`.\n"
schema:
type: string
- name: has_no_reference
in: query
description: Filters to objects that do not have a relationship with the type and identifier combination.
schema:
type: object
- name: has_no_reference_operator
in: query
description: The operator to use for the `has_no_reference` parameter. Either `OR` or `AND`. Defaults to `OR`.
schema:
type: string
- name: has_reference
in: query
description: Filters to objects that have a relationship with the type and ID combination.
schema:
type: object
- name: has_reference_operator
in: query
description: The operator to use for the `has_reference` parameter. Either `OR` or `AND`. Defaults to `OR`.
schema:
type: string
- name: page
in: query
description: The page of objects to return.
schema:
type: integer
- name: per_page
in: query
description: The number of objects to return per page.
schema:
type: integer
- name: search
in: query
description: An Elasticsearch `simple_query_string` query that filters the objects in the response.
schema:
type: string
- name: search_fields
in: query
description: The fields to perform the `simple_query_string` parsed query against.
schema:
type:
- string
- array
- name: sort_field
in: query
description: "Sorts the response. Includes \"root\" and \"type\" fields. \"root\" fields exist for all saved objects, such as \"updated_at\". \"type\" fields are specific to an object type, such as fields returned in the attributes key of the response. When a single type is defined in the type parameter, the \"root\" and \"type\" fields are allowed, and validity checks are made in that order. When multiple types are defined in the type parameter, only \"root\" fields are allowed.\n"
schema:
type: string
- name: type
in: query
description: The saved object types to include.
required: true
schema:
type:
- string
- array
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/saved_objects/_import:
post:
tags:
- saved objects
summary: Import saved objects
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate sets of Kibana saved objects from a file created by the export API.\nSaved objects can be imported only into the same version, a newer minor on the same major, or the next major. Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n"
operationId: importSavedObjectsDefault
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- name: createNewCopies
in: query
description: "Creates copies of saved objects, regenerates each object ID, and resets the origin. When used, potential conflict errors are avoided. NOTE: This option cannot be used with the `overwrite` and `compatibilityMode` options.\n"
schema:
type: boolean
- name: overwrite
in: query
description: "Overwrites saved objects when they already exist. When used, potential conflict errors are automatically resolved by overwriting the destination object. NOTE: This option cannot be used with the `createNewCopies` option.\n"
schema:
type: boolean
- name: compatibilityMode
in: query
description: "Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with imported saved objects. NOTE: This option cannot be used with the `createNewCopies` option.\n"
schema:
type: boolean
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
file:
description: "A file exported using the export API. Changing the contents of the exported file in any way before importing it can cause errors, crashes or data loss. NOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be included in this file. Similarly, the `savedObjects.maxImportPayloadBytes` setting limits the overall size of the file that can be imported.\n"
examples:
importObjectsRequest:
$ref: '#/components/examples/Saved_objects_import_objects_request'
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
errors:
type: array
items:
type: object
description: "Indicates the import was unsuccessful and specifies the objects that failed to import.\n\nNOTE: One object may result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and conflict error.\n"
success:
type: boolean
description: "Indicates when the import was successfully completed. When set to false, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties.\n"
successCount:
type: integer
description: Indicates the number of successfully imported records.
successResults:
type: array
items:
type: object
description: "Indicates the objects that are successfully imported, with any metadata if applicable.\n\nNOTE: Objects are created only when all resolvable errors are addressed, including conflicts and missing references. If objects are created as new copies, each entry in the `successResults` array includes a `destinationId` attribute.\n"
examples:
importObjectsResponse:
$ref: '#/components/examples/Saved_objects_import_objects_response'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
x-codeSamples:
- label: Import with createNewCopies
lang: cURL
source: "curl \\\n -X POST api/saved_objects/_import?createNewCopies=true\n -H \"kbn-xsrf: true\"\n --form file=@file.ndjson\n"
/api/saved_objects/_resolve_import_errors:
post:
tags:
- saved objects
summary: Resolve import errors
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/_resolve_import_errors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nTo resolve errors from the Import objects API, you can:\n\n* Retry certain saved objects\n* Overwrite specific saved objects\n* Change references to different saved objects\n"
operationId: resolveImportErrors
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- name: compatibilityMode
in: query
description: "Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. When enabled during the initial import, also enable when resolving import errors. This option cannot be used with the `createNewCopies` option.\n"
schema:
type: boolean
- name: createNewCopies
in: query
description: "Creates copies of the saved objects, regenerates each object ID, and resets the origin. When enabled during the initial import, also enable when resolving import errors.\n"
schema:
type: boolean
requestBody:
content:
multipart/form-data:
schema:
required:
- retries
type: object
properties:
file:
type: string
description: The same file given to the import API.
format: binary
retries:
type: array
items:
required:
- type
- id
type: object
properties:
destinationId:
type: string
description: 'Specifies the destination ID that the imported object should have, if different from the current ID.'
id:
type: string
description: The saved object ID.
ignoreMissingReferences:
type: boolean
description: 'When set to `true`, ignores missing reference errors. When set to `false`, does nothing.'
overwrite:
type: boolean
description: 'When set to `true`, the source object overwrites the conflicting destination object. When set to `false`, does nothing.'
replaceReferences:
type: array
items:
type: object
properties:
from:
type: string
to:
type: string
type:
type: string
description: 'A list of `type`, `from`, and `to` used to change the object references.'
type:
type: string
description: The saved object type.
description: 'The retry operations, which can specify how to resolve different types of errors.'
examples:
resolveImportErrorsRequest:
$ref: '#/components/examples/Saved_objects_resolve_missing_reference_request'
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
errors:
type: array
items:
type: object
description: "Specifies the objects that failed to resolve.\n\nNOTE: One object can result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and a `conflict` error.\n"
success:
type: boolean
description: "Indicates a successful import. When set to `false`, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties.\n"
successCount:
type: number
description: "Indicates the number of successfully resolved records.\n"
successResults:
type: array
items:
type: object
description: "Indicates the objects that are successfully imported, with any metadata if applicable.\n\nNOTE: Objects are only created when all resolvable errors are addressed, including conflict and missing references.\n"
examples:
resolveImportErrorsResponse:
$ref: '#/components/examples/Saved_objects_resolve_missing_reference_response'
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
'/api/saved_objects/{type}':
post:
tags:
- saved objects
summary: Create a saved object
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/{type}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Kibana saved object with a randomly generated identifier."
operationId: createSavedObject
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- $ref: '#/components/parameters/Saved_objects_saved_object_type'
- name: overwrite
in: query
description: 'If true, overwrites the document with the same identifier.'
schema:
type: boolean
requestBody:
content:
application/json:
schema:
required:
- attributes
type: object
properties:
attributes:
$ref: '#/components/schemas/Saved_objects_attributes'
initialNamespaces:
$ref: '#/components/schemas/Saved_objects_initial_namespaces'
references:
$ref: '#/components/schemas/Saved_objects_references'
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'409':
description: Indicates a conflict error.
content:
application/json:
schema:
type: object
deprecated: true
'/api/saved_objects/{type}/{id}':
get:
tags:
- saved objects
summary: Get a saved object
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/saved_objects/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a single Kibana saved object by identifier."
operationId: getSavedObject
parameters:
- $ref: '#/components/parameters/Saved_objects_saved_object_id'
- $ref: '#/components/parameters/Saved_objects_saved_object_type'
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
post:
tags:
- saved objects
summary: Create a saved object
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/saved_objects/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Kibana saved object and specify its identifier instead of using a randomly generated ID."
operationId: createSavedObjectId
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- $ref: '#/components/parameters/Saved_objects_saved_object_id'
- $ref: '#/components/parameters/Saved_objects_saved_object_type'
- name: overwrite
in: query
description: 'If true, overwrites the document with the same identifier.'
schema:
type: boolean
requestBody:
content:
application/json:
schema:
required:
- attributes
type: object
properties:
attributes:
$ref: '#/components/schemas/Saved_objects_attributes'
initialNamespaces:
$ref: '#/components/schemas/Saved_objects_initial_namespaces'
references:
$ref: '#/components/schemas/Saved_objects_initial_namespaces'
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'409':
description: Indicates a conflict error.
content:
application/json:
schema:
type: object
deprecated: true
put:
tags:
- saved objects
summary: Update a saved object
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/saved_objects/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the attributes for Kibana saved objects."
operationId: updateSavedObject
parameters:
- $ref: '#/components/parameters/Saved_objects_kbn_xsrf'
- $ref: '#/components/parameters/Saved_objects_saved_object_id'
- $ref: '#/components/parameters/Saved_objects_saved_object_type'
requestBody:
content:
application/json:
schema:
type: object
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'404':
description: Indicates the object was not found.
content:
application/json:
schema:
type: object
'409':
description: Indicates a conflict error.
content:
application/json:
schema:
type: object
deprecated: true
'/api/saved_objects/resolve/{type}/{id}':
get:
tags:
- saved objects
summary: Resolve a saved object
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/saved_objects/resolve/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a single Kibana saved object by identifier using any legacy URL alias if it exists. Under certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved using either its new ID or its old ID.\n"
operationId: resolveSavedObject
parameters:
- $ref: '#/components/parameters/Saved_objects_saved_object_id'
- $ref: '#/components/parameters/Saved_objects_saved_object_type'
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
'400':
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/Saved_objects_400_response'
deprecated: true
/api/security_ai_assistant/anonymization_fields/_bulk_action:
post:
tags:
- Security AI Assistant API
summary: Apply a bulk action to anonymization fields
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/anonymization_fields/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs."
operationId: PerformAnonymizationFieldsBulkAction
requestBody:
content:
application/json:
schema:
type: object
properties:
create:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldCreateProps'
description: Array of anonymization fields to create.
delete:
type: object
properties:
ids:
minItems: 1
type: array
items:
type: string
description: Array of IDs to apply the action to.
example:
- '1234'
- '5678'
query:
type: string
description: Query to filter the bulk action.
example: 'status: ''inactive'''
description: Object containing the query to filter anonymization fields and/or an array of anonymization field IDs to delete.
update:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldUpdateProps'
description: Array of anonymization fields to update.
example:
create:
- allowed: true
anonymized: false
field: host.name
- allowed: false
anonymized: true
field: user.name
delete:
ids:
- field5
- field6
query: 'field: host.name'
update:
- allowed: true
anonymized: false
id: field8
- allowed: false
anonymized: true
id: field9
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse'
example:
anonymization_fields_count: 5
attributes:
results:
created:
- allowed: false
anonymized: true
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: host.name
id: field2
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
deleted:
- field3
skipped:
- id: field4
name: user.name
skip_reason: ANONYMIZATION_FIELD_NOT_MODIFIED
updated:
- allowed: true
anonymized: false
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: url.domain
id: field8
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
summary:
failed: 1
skipped: 1
succeeded: 2
total: 5
message: Bulk action completed successfully
status_code: 200
success: true
'400':
description: Generic Error
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: Error type or name.
message:
type: string
description: Detailed error message.
statusCode:
type: number
description: Status code of the response.
example:
error: Bad Request
message: Invalid request body
statusCode: 400
/api/security_ai_assistant/anonymization_fields/_find:
get:
tags:
- Security AI Assistant API
summary: Get anonymization fields
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/anonymization_fields/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all anonymization fields."
operationId: FindAnonymizationFields
parameters:
- name: fields
in: query
description: Fields to return
schema:
type: array
items:
type: string
example:
- id
- field
- anonymized
- allowed
- name: filter
in: query
description: Search query
schema:
type: string
example: 'field: "user.name"'
- name: sort_field
in: query
description: Field to sort by
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindAnonymizationFieldsSortField'
example: created_at
- name: sort_order
in: query
description: Sort order
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
example: asc
- name: page
in: query
description: Page number
schema:
minimum: 1
type: integer
default: 1
example: 1
- name: per_page
in: query
description: AnonymizationFields per page
schema:
minimum: 0
type: integer
default: 20
example: 20
- name: all_data
in: query
description: 'If true, additionally fetch all anonymization fields, otherwise fetch only the provided page'
schema:
type: boolean
responses:
'200':
description: Successful response
content:
application/json:
schema:
required:
- page
- perPage
- total
- data
type: object
properties:
aggregations:
type: object
properties:
field_status:
type: object
properties:
buckets:
type: object
properties:
allowed:
type: object
properties:
doc_count:
type: integer
default: 0
anonymized:
type: object
properties:
doc_count:
type: integer
default: 0
denied:
type: object
properties:
doc_count:
type: integer
default: 0
all:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
data:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
page:
type: integer
perPage:
type: integer
total:
type: integer
example:
aggregations:
anonymized:
buckets:
allowed:
doc_count: 1
anonymized:
doc_count: 1
denied:
doc_count: 1
all:
- allowed: true
anonymized: true
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: user.name
id: '1'
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
data:
- allowed: true
anonymized: true
createdAt: '2023-10-31T12:00:00Z'
createdBy: user1
field: user.name
id: '1'
namespace: default
timestamp: '2023-10-31T12:00:00Z'
updatedAt: '2023-10-31T12:00:00Z'
updatedBy: user1
page: 1
perPage: 20
total: 100
'400':
description: Generic Error
content:
application/json:
schema:
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: number
example:
error: Bad Request
message: Invalid request parameters
statusCode: 400
/api/security_ai_assistant/chat/complete:
post:
tags:
- Security AI Assistant API
summary: Create a model response
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/chat/complete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a model response for the given chat conversation."
operationId: ChatComplete
parameters:
- name: content_references_disabled
in: query
description: 'If true, the response will not include content references.'
schema:
type: boolean
default: false
example: false
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatCompleteProps'
example:
connectorId: conn-001
conversationId: abc123
isStream: true
langSmithApiKey: sk-abc123
langSmithProject: security_ai_project
messages:
- content: What are some common phishing techniques?
data:
user_id: user_789
fields_to_anonymize:
- user.name
- source.ip
role: user
model: gpt-4
persist: true
promptId: prompt_456
responseLanguage: en
required: true
responses:
'200':
description: Indicates a successful model response call.
content:
application/octet-stream:
schema:
type: string
format: binary
'400':
description: Generic Error
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: Error type.
example: Bad Request
message:
type: string
description: Human-readable error message.
example: Invalid request payload.
statusCode:
type: number
description: HTTP status code.
example: 400
/api/security_ai_assistant/current_user/conversations:
delete:
tags:
- Security AI Assistant API
summary: Delete conversations
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/security_ai_assistant/current_user/conversations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nThis endpoint allows users to permanently delete all conversations."
operationId: DeleteAllConversations
requestBody:
content:
application/json:
schema:
type: object
properties:
excludedIds:
type: array
items:
type: string
description: Optional list of conversation IDs to delete.
example:
- abc123
- def456
responses:
'200':
description: Indicates a successful call. The conversations were deleted successfully.
content:
application/json:
schema:
type: object
properties:
failures:
type: array
items:
type: string
success:
type: boolean
example: true
totalDeleted:
type: number
example: 10
example:
success: true
'400':
description: Generic Error. This response indicates an issue with the request.
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: Invalid conversation ID
statusCode:
type: number
example: 400
post:
tags:
- Security AI Assistant API
summary: Create a conversation
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/current_user/conversations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters."
operationId: CreateConversation
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCreateProps'
example:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
excludeFromLastConversationStorage: false
messages:
- content: 'Hello, how can I assist you today?'
role: system
timestamp: '2023-10-31T12:00:00Z'
replacements: { }
title: Security Discussion
required: true
responses:
'200':
description: Indicates a successful call. The conversation was created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
example:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: 'Hello, how can I assist you today?'
role: system
timestamp: '2023-10-31T12:00:00Z'
replacements: { }
title: Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
'400':
description: 'Generic Error. This response indicates an issue with the request, such as missing required parameters or incorrect data.'
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: 'Missing required parameter: title'
statusCode:
type: number
example: 400
/api/security_ai_assistant/current_user/conversations/_find:
get:
tags:
- Security AI Assistant API
summary: Get conversations
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/current_user/conversations/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations."
operationId: FindConversations
parameters:
- name: fields
in: query
description: 'A list of fields to include in the response. If omitted, all fields are returned.'
schema:
type: array
items:
type: string
example:
- id
- title
- createdAt
- name: filter
in: query
description: 'A search query to filter the conversations. Can match against titles, messages, or other conversation attributes.'
schema:
type: string
example: Security Issue
- name: sort_field
in: query
description: 'The field by which to sort the results. Valid fields are `created_at`, `title`, and `updated_at`.'
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindConversationsSortField'
- name: sort_order
in: query
description: The order in which to sort the results. Can be either `asc` for ascending or `desc` for descending.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
- name: page
in: query
description: The page number of the results to retrieve. Default is 1.
schema:
minimum: 1
type: integer
default: 1
example: 1
- name: per_page
in: query
description: The number of conversations to return per page. Default is 20.
schema:
minimum: 0
type: integer
default: 20
example: 20
responses:
'200':
description: 'Successful response, returns a paginated list of conversations matching the specified criteria.'
content:
application/json:
schema:
required:
- page
- perPage
- total
- data
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
description: A list of conversations.
page:
type: integer
description: The current page of the results.
example: 1
perPage:
type: integer
description: The number of results returned per page.
example: 20
total:
type: integer
description: The total number of conversations matching the filter criteria.
example: 100
'400':
description: Generic Error. The request could not be processed due to an invalid query parameter or other issue.
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: Invalid filter query parameter
statusCode:
type: number
example: 400
'/api/security_ai_assistant/current_user/conversations/{id}':
delete:
tags:
- Security AI Assistant API
summary: Delete a conversation
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an existing conversation using the conversation ID. This endpoint allows users to permanently delete a conversation."
operationId: DeleteConversation
parameters:
- name: id
in: path
description: The conversation's `id` value.
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
example: abc123
responses:
'200':
description: Indicates a successful call. The conversation was deleted successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
example:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: The conversation has been deleted.
role: system
timestamp: '2023-10-31T12:35:00Z'
replacements: { }
title: Deleted Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
'400':
description: Generic Error. This response indicates an issue with the request.
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: Invalid conversation ID
statusCode:
type: number
example: 400
get:
tags:
- Security AI Assistant API
summary: Get a conversation
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an existing conversation using the conversation ID. This allows users to fetch the specific conversation data by its unique ID."
operationId: ReadConversation
parameters:
- name: id
in: path
description: 'The conversation''s `id` value, a unique identifier for the conversation.'
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
example: abc123
responses:
'200':
description: Indicates a successful call. The conversation details are returned.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
example:
apiConfig:
actionTypeId: '67890'
connectorId: '12345'
category: assistant
createdAt: '2023-10-31T12:01:00Z'
excludeFromLastConversationStorage: false
id: abc123
messages:
- content: 'Hello, how can I assist you today?'
role: system
timestamp: '2023-10-31T12:00:00Z'
replacements: { }
title: Security Discussion
updatedAt: '2023-10-31T12:01:00Z'
users:
- id: user1
name: John Doe
'400':
description: Generic Error. The request could not be processed due to an error.
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: Invalid conversation ID
statusCode:
type: number
example: 400
put:
tags:
- Security AI Assistant API
summary: Update a conversation
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing conversation using the conversation ID. This endpoint allows users to modify the details of an existing conversation."
operationId: UpdateConversation
parameters:
- name: id
in: path
description: The conversation's `id` value.
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
example: abc123
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationUpdateProps'
example:
apiConfig:
actionTypeId: '09876'
connectorId: '54321'
category: insights
excludeFromLastConversationStorage: true
messages:
- content: The issue was resolved.
role: assistant
timestamp: '2023-10-31T12:30:00Z'
replacements: { }
title: Updated Security Discussion
required: true
responses:
'200':
description: Indicates a successful call. The conversation was updated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
example:
apiConfig:
actionTypeId: '09876'
connectorId: '54321'
category: insights
createdAt: '2023-10-31T12:01:00Z'
excludeFromLastConversationStorage: true
id: abc123
messages:
- content: The issue was resolved.
role: assistant
timestamp: '2023-10-31T12:30:00Z'
replacements: { }
title: Updated Security Discussion
updatedAt: '2023-10-31T12:31:00Z'
users:
- id: user1
name: John Doe
'400':
description: 'Generic Error. This response indicates an issue with the request, such as missing required parameters or incorrect data.'
content:
application/json:
schema:
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: 'Missing required field: title'
statusCode:
type: number
example: 400
'/api/security_ai_assistant/knowledge_base/{resource}':
get:
tags:
- Security AI Assistant API
summary: Read a KnowledgeBase
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRead a single KB"
operationId: ReadKnowledgeBase
parameters:
- name: resource
in: path
description: The KnowledgeBase `resource` value.
required: true
schema:
type: string
example: kb12345
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
elser_exists:
type: boolean
description: Indicates if the ELSER model exists for the KnowledgeBase.
example: true
is_setup_available:
type: boolean
description: Indicates if the setup process is available for the KnowledgeBase.
example: true
is_setup_in_progress:
type: boolean
description: Indicates if the setup process is currently in progress.
example: false
product_documentation_status:
type: string
description: The status of the product documentation in the KnowledgeBase.
example: complete
security_labs_exists:
type: boolean
description: Indicates if Security Labs documentation exists in the KnowledgeBase.
example: true
user_data_exists:
type: boolean
description: Indicates if user data exists in the KnowledgeBase.
example: false
'400':
description: Generic Error
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: A short description of the error.
example: Bad Request
message:
type: string
description: A detailed error message.
example: Invalid resource ID provided.
statusCode:
type: number
description: The HTTP status code of the error.
example: 400
post:
tags:
- Security AI Assistant API
summary: Create a KnowledgeBase
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a KnowledgeBase"
operationId: CreateKnowledgeBase
parameters:
- name: resource
in: path
description: The KnowledgeBase `resource` value.
required: true
schema:
type: string
example: kb12345
- name: modelId
in: query
description: 'ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.'
schema:
type: string
example: elser-model-001
- name: ignoreSecurityLabs
in: query
description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
schema:
type: boolean
default: false
example: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
'400':
description: Generic Error
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: A short description of the error.
example: Bad Request
message:
type: string
description: A detailed error message.
example: Invalid resource ID provided.
statusCode:
type: number
description: The HTTP status code of the error.
example: 400
/api/security_ai_assistant/knowledge_base/entries:
post:
tags:
- Security AI Assistant API
summary: Create a Knowledge Base Entry
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/knowledge_base/entries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Knowledge Base Entry"
operationId: CreateKnowledgeBaseEntry
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
example:
content: 'To reset your password, go to the settings page and click ''Reset Password''.'
tags:
- password
- reset
- help
title: How to reset a password
required: true
responses:
'200':
description: Successful request returning Knowledge Base Entries
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
example:
content: 'To reset your password, go to the settings page and click ''Reset Password''.'
id: '12345'
tags:
- password
- reset
- help
title: How to reset a password
'400':
description: 'A generic error occurred, such as invalid input or missing required fields.'
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
example:
error: Invalid input
message: The 'title' field is required.
/api/security_ai_assistant/knowledge_base/entries/_bulk_action:
post:
tags:
- Security AI Assistant API
summary: Applies a bulk action to multiple Knowledge Base Entries
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nThe bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs."
operationId: PerformKnowledgeBaseEntryBulkAction
requestBody:
content:
application/json:
schema:
type: object
properties:
create:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
description: List of Knowledge Base Entries to create.
example:
- content: This is the content of the new entry.
title: New Entry
delete:
type: object
properties:
ids:
minItems: 1
type: array
items:
type: string
description: Array of Knowledge Base Entry IDs.
example:
- '123'
- '456'
- '789'
query:
type: string
description: Query to filter Knowledge Base Entries.
example: status:active AND category:technology
update:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
description: List of Knowledge Base Entries to update.
example:
- content: Updated content.
id: '123'
title: Updated Entry
responses:
'200':
description: Successful bulk operation request
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse'
'400':
description: Generic Error
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
/api/security_ai_assistant/knowledge_base/entries/_find:
get:
tags:
- Security AI Assistant API
summary: Finds Knowledge Base Entries that match the given query.
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFinds Knowledge Base Entries that match the given query."
operationId: FindKnowledgeBaseEntries
parameters:
- name: fields
in: query
description: 'A list of fields to include in the response. If not provided, all fields will be included.'
schema:
type: array
items:
type: string
example:
- title
- created_at
- name: filter
in: query
description: Search query to filter Knowledge Base Entries by specific criteria.
schema:
type: string
example: error handling
- name: sort_field
in: query
description: Field to sort the Knowledge Base Entries by.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField'
- name: sort_order
in: query
description: 'Sort order for the results, either asc or desc.'
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
- name: page
in: query
description: Page number for paginated results. Defaults to 1.
schema:
minimum: 1
type: integer
default: 1
example: 2
- name: per_page
in: query
description: Number of Knowledge Base Entries to return per page. Defaults to 20.
schema:
minimum: 0
type: integer
default: 20
example: 10
responses:
'200':
description: Successful response containing the paginated Knowledge Base Entries.
content:
application/json:
schema:
required:
- page
- perPage
- total
- data
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
description: The list of Knowledge Base Entries for the current page.
page:
type: integer
description: The current page number.
example: 1
perPage:
type: integer
description: The number of Knowledge Base Entries returned per page.
example: 20
total:
type: integer
description: The total number of Knowledge Base Entries available.
example: 100
'400':
description: Generic Error indicating an issue with the request.
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: A short description of the error.
example: Bad Request
message:
type: string
description: A detailed message explaining the error.
example: 'Invalid query parameter: sort_order'
statusCode:
type: number
description: The HTTP status code of the error.
example: 400
'/api/security_ai_assistant/knowledge_base/entries/{id}':
delete:
tags:
- Security AI Assistant API
summary: Deletes a single Knowledge Base Entry using the `id` field
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a Knowledge Base Entry by its unique `id`."
operationId: DeleteKnowledgeBaseEntry
parameters:
- name: id
in: path
description: The unique identifier (`id`) of the Knowledge Base Entry to delete.
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
example: '12345'
responses:
'200':
description: Successful request returning the `id` of the deleted Knowledge Base Entry.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields'
example:
id: '12345'
message: Knowledge Base Entry successfully deleted.
'400':
description: 'A generic error occurred, such as an invalid `id` or the entry not being found.'
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
example:
error: Not Found
message: No Knowledge Base Entry found with the provided `id`.
get:
tags:
- Security AI Assistant API
summary: Read a Knowledge Base Entry
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a Knowledge Base Entry by its unique `id`."
operationId: ReadKnowledgeBaseEntry
parameters:
- name: id
in: path
description: The unique identifier (`id`) of the Knowledge Base Entry to retrieve.
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
example: '12345'
responses:
'200':
description: Successful request returning the requested Knowledge Base Entry.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
example:
content: 'To reset your password, go to the settings page and click ''Reset Password''.'
id: '12345'
tags:
- password
- reset
- help
title: How to reset a password
'400':
description: 'A generic error occurred, such as an invalid `id` or the entry not being found.'
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
example:
error: Not Found
message: No Knowledge Base Entry found with the provided `id`.
put:
tags:
- Security AI Assistant API
summary: Update a Knowledge Base Entry
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing Knowledge Base Entry by its unique `id`."
operationId: UpdateKnowledgeBaseEntry
parameters:
- name: id
in: path
description: The unique identifier (`id`) of the Knowledge Base Entry to update.
required: true
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
example: '12345'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps'
example:
content: 'To reset your password, go to the settings page, click ''Reset Password'', and follow the instructions.'
tags:
- password
- reset
- help
- update
title: How to reset a password (updated)
required: true
responses:
'200':
description: Successful request returning the updated Knowledge Base Entry.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
example:
content: 'To reset your password, go to the settings page, click ''Reset Password'', and follow the instructions.'
id: '12345'
tags:
- password
- reset
- help
- update
title: How to reset a password (updated)
'400':
description: 'A generic error occurred, such as invalid input or the entry not being found.'
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
example:
error: Invalid input
message: The 'content' field cannot be empty.
/api/security_ai_assistant/prompts/_bulk_action:
post:
tags:
- Security AI Assistant API
summary: Apply a bulk action to prompts
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/security_ai_assistant/prompts/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs. This action allows for bulk create, update, or delete operations."
operationId: PerformPromptsBulkAction
requestBody:
content:
application/json:
schema:
type: object
properties:
create:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptCreateProps'
description: List of prompts to be created.
delete:
type: object
properties:
ids:
minItems: 1
type: array
items:
type: string
description: Array of IDs to apply the action to.
example:
- '1234'
- '5678'
query:
type: string
description: Query to filter the bulk action.
example: 'status: ''inactive'''
description: Criteria for deleting prompts in bulk.
update:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptUpdateProps'
description: List of prompts to be updated.
example:
create:
- content: Please verify the security settings.
name: New Security Prompt
promptType: system
delete:
ids:
- prompt1
- prompt2
update:
- content: Updated content for security prompt.
id: prompt123
responses:
'200':
description: Indicates a successful call with the results of the bulk action.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResponse'
examples:
success:
value:
attributes:
errors: [ ]
results:
created:
- content: Please verify the security settings.
id: prompt6
name: New Security Prompt
promptType: system
deleted:
- prompt2
- prompt3
skipped:
- id: prompt4
name: Security Prompt
skip_reason: PROMPT_FIELD_NOT_MODIFIED
updated:
- content: Updated security settings prompt
id: prompt1
name: Security Prompt
promptType: system
summary:
failed: 0
skipped: 1
succeeded: 4
total: 5
message: Bulk action completed successfully.
prompts_count: 5
status_code: 200
success: true
'400':
description: Indicates a generic error due to a bad request.
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: A short error message.
example: Bad Request
message:
type: string
description: A detailed error message.
example: Invalid prompt ID or missing required fields.
statusCode:
type: number
description: The HTTP status code for the error.
example: 400
/api/security_ai_assistant/prompts/_find:
get:
tags:
- Security AI Assistant API
summary: Get prompts
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/security_ai_assistant/prompts/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all prompts based on optional filters, sorting, and pagination."
operationId: FindPrompts
parameters:
- name: fields
in: query
description: List of specific fields to include in each returned prompt.
schema:
type: array
items:
type: string
example:
- id
- name
- content
- name: filter
in: query
description: Search query string to filter prompts by matching fields.
schema:
type: string
example: error handling
- name: sort_field
in: query
description: Field to sort prompts by.
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_FindPromptsSortField'
- name: sort_order
in: query
description: 'Sort order, either asc or desc.'
schema:
$ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
- name: page
in: query
description: Page number for pagination.
schema:
minimum: 1
type: integer
default: 1
example: 1
- name: per_page
in: query
description: Number of prompts per page.
schema:
minimum: 0
type: integer
default: 20
example: 20
responses:
'200':
description: Successful response containing a list of prompts.
content:
application/json:
schema:
required:
- page
- perPage
- total
- data
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
description: 'The list of prompts returned based on the search query, sorting, and pagination.'
page:
type: integer
description: Current page number.
example: 1
perPage:
type: integer
description: Number of prompts per page.
example: 20
total:
type: integer
description: Total number of prompts matching the query.
example: 142
example:
data:
- categories:
- troubleshooting
- logging
color: '#FF5733'
consumer: security
content: 'If you encounter an error, check the logs and retry.'
createdAt: '2025-04-20T21:00:00Z'
createdBy: jdoe
id: prompt-123
isDefault: true
isNewConversationDefault: false
name: Error Troubleshooting Prompt
namespace: default
promptType: standard
timestamp: '2025-04-30T22:30:00Z'
updatedAt: '2025-04-30T22:45:00Z'
updatedBy: jdoe
users:
- full_name: John Doe
username: jdoe
page: 1
perPage: 20
total: 142
'400':
description: Bad request due to invalid parameters or malformed query.
content:
application/json:
schema:
type: object
properties:
error:
type: string
description: Short error message.
example: Bad Request
message:
type: string
description: Detailed description of the error.
example: Invalid sort order value provided.
statusCode:
type: number
description: HTTP status code for the error.
example: 400
/api/security/role:
get:
tags:
- roles
summary: Get all roles
operationId: get-security-role
parameters:
- name: replaceDeprecatedPrivileges
in: query
description: 'If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.'
schema:
type: boolean
responses:
'200':
description: Indicates a successful call.
content:
application/json:
examples:
getRolesResponse1:
$ref: '#/components/examples/get_roles_response1'
/api/security/role/_query:
post:
summary: Query roles
operationId: post-security-role-query
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
type: object
properties:
filters:
type: object
properties:
showReservedRoles:
type: boolean
additionalProperties: false
from:
type: number
query:
type: string
size:
type: number
sort:
required:
- field
- direction
type: object
properties:
direction:
enum:
- asc
- desc
type: string
field:
type: string
additionalProperties: false
additionalProperties: false
responses:
'200':
description: Indicates a successful call.
'/api/security/role/{name}':
delete:
tags:
- roles
summary: Delete a role
operationId: delete-security-role-name
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: name
in: path
required: true
schema:
minLength: 1
type: string
responses:
'204':
description: Indicates a successful call.
get:
tags:
- roles
summary: Get a role
operationId: get-security-role-name
parameters:
- name: name
in: path
description: The role name.
required: true
schema:
minLength: 1
type: string
- name: replaceDeprecatedPrivileges
in: query
description: 'If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.'
schema:
type: boolean
responses:
'200':
description: Indicates a successful call.
content:
application/json:
examples:
getRoleResponse1:
$ref: '#/components/examples/get_role_response1'
put:
tags:
- roles
summary: Create or update a role
description: Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.
operationId: put-security-role-name
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: name
in: path
description: The role name.
required: true
schema:
maxLength: 1024
minLength: 1
type: string
- name: createOnly
in: query
description: 'When true, a role is not overwritten if it already exists.'
schema:
type: boolean
default: false
requestBody:
content:
application/json:
schema:
required:
- elasticsearch
type: object
properties:
description:
maxLength: 2048
type: string
description: A description for the role.
elasticsearch:
type: object
properties:
cluster:
type: array
items:
type: string
description: Cluster privileges that define the cluster level actions that users can perform.
indices:
type: array
items:
required:
- names
- privileges
type: object
properties:
allow_restricted_indices:
type: boolean
description: 'Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too.'
field_security:
type: object
additionalProperties:
type: array
items:
type: string
description: The document fields that the role members have read access to.
names:
minItems: 1
type: array
items:
type: string
description: 'The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*).'
privileges:
minItems: 1
type: array
items:
type: string
description: The index level privileges that the role members have for the data streams and indices.
query:
type: string
description: A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
additionalProperties: false
remote_cluster:
type: array
items:
required:
- privileges
- clusters
type: object
properties:
clusters:
minItems: 1
type: array
items:
type: string
description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions.
privileges:
minItems: 1
type: array
items:
type: string
description: The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges.
additionalProperties: false
remote_indices:
type: array
items:
required:
- clusters
- names
- privileges
type: object
properties:
allow_restricted_indices:
type: boolean
description: 'Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too.'
clusters:
minItems: 1
type: array
items:
type: string
description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions.
field_security:
type: object
additionalProperties:
type: array
items:
type: string
description: The document fields that the role members have read access to.
names:
minItems: 1
type: array
items:
type: string
description: 'A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*).'
privileges:
minItems: 1
type: array
items:
type: string
description: The index level privileges that role members have for the specified indices.
query:
type: string
description: 'A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. '
additionalProperties: false
run_as:
type: array
items:
type: string
description: A user name that the role member can impersonate.
additionalProperties: false
kibana:
maxItems: 1000
type: array
items:
required:
- base
type: object
properties:
base:
anyOf:
- type: array
items: { }
- type: boolean
- type: number
- type: object
- type: string
oneOf:
- type: array
items:
type: string
description: A base privilege that grants applies to all spaces.
- type: array
items:
type: string
description: A base privilege that applies to specific spaces.
feature:
type: object
additionalProperties:
type: array
items:
type: string
description: The privileges that the role member has for the feature.
spaces:
anyOf:
- maxItems: 1
minItems: 1
type: array
items:
enum:
- '*'
type: string
- type: array
items:
type: string
description: A space that the privilege applies to.
default:
- '*'
additionalProperties: false
metadata:
type: object
additionalProperties: { }
additionalProperties: false
examples:
createRoleRequest1:
$ref: '#/components/examples/create_role_request1'
createRoleRequest2:
$ref: '#/components/examples/create_role_request2'
createRoleRequest3:
$ref: '#/components/examples/create_role_request3'
createRoleRequest4:
$ref: '#/components/examples/create_role_request4'
responses:
'204':
description: Indicates a successful call.
/api/security/roles:
post:
tags:
- roles
summary: Create or update roles
operationId: post-security-roles
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- roles
type: object
properties:
roles:
type: object
additionalProperties:
required:
- elasticsearch
type: object
properties:
description:
maxLength: 2048
type: string
description: A description for the role.
elasticsearch:
type: object
properties:
cluster:
type: array
items:
type: string
description: Cluster privileges that define the cluster level actions that users can perform.
indices:
type: array
items:
required:
- names
- privileges
type: object
properties:
allow_restricted_indices:
type: boolean
description: 'Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too.'
field_security:
type: object
additionalProperties:
type: array
items:
type: string
description: The document fields that the role members have read access to.
names:
minItems: 1
type: array
items:
type: string
description: 'The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*).'
privileges:
minItems: 1
type: array
items:
type: string
description: The index level privileges that the role members have for the data streams and indices.
query:
type: string
description: A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
additionalProperties: false
remote_cluster:
type: array
items:
required:
- privileges
- clusters
type: object
properties:
clusters:
minItems: 1
type: array
items:
type: string
description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions.
privileges:
minItems: 1
type: array
items:
type: string
description: The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges.
additionalProperties: false
remote_indices:
type: array
items:
required:
- clusters
- names
- privileges
type: object
properties:
allow_restricted_indices:
type: boolean
description: 'Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too.'
clusters:
minItems: 1
type: array
items:
type: string
description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions.
field_security:
type: object
additionalProperties:
type: array
items:
type: string
description: The document fields that the role members have read access to.
names:
minItems: 1
type: array
items:
type: string
description: 'A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*).'
privileges:
minItems: 1
type: array
items:
type: string
description: The index level privileges that role members have for the specified indices.
query:
type: string
description: 'A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. '
additionalProperties: false
run_as:
type: array
items:
type: string
description: A user name that the role member can impersonate.
additionalProperties: false
kibana:
maxItems: 1000
type: array
items:
required:
- base
type: object
properties:
base:
anyOf:
- type: array
items: { }
- type: boolean
- type: number
- type: object
- type: string
oneOf:
- type: array
items:
type: string
description: A base privilege that grants applies to all spaces.
- type: array
items:
type: string
description: A base privilege that applies to specific spaces.
feature:
type: object
additionalProperties:
type: array
items:
type: string
description: The privileges that the role member has for the feature.
spaces:
anyOf:
- maxItems: 1
minItems: 1
type: array
items:
enum:
- '*'
type: string
- type: array
items:
type: string
description: A space that the privilege applies to.
default:
- '*'
additionalProperties: false
metadata:
type: object
additionalProperties: { }
additionalProperties: false
additionalProperties: false
responses:
'200':
description: Indicates a successful call.
/api/security/session/_invalidate:
post:
tags:
- user session
summary: Invalidate user sessions
description: "Invalidate user sessions that match a query. To use this API, you must be a superuser.\n"
operationId: post-security-session-invalidate
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- match
type: object
properties:
match:
enum:
- all
- query
type: string
description: "The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.\n"
query:
required:
- provider
type: object
properties:
provider:
required:
- type
type: object
properties:
name:
type: string
description: The authentication provider name.
type:
type: string
description: "The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.\n"
description: The authentication providers that will have their user sessions invalidated.
username:
type: string
description: The username that will have its sessions invalidated.
description: "The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.\n"
examples:
invalidateRequestExample1:
summary: Invalidate all sessions
description: Run `POST api/security/session/_invalidate` to invalidate all existing sessions.
value: "{\n \"match\" : \"all\"\n}"
invalidateRequestExample2:
summary: Invalidate all SAML sessions
description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any SAML authentication provider.
value: "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"saml\" }\n }\n}"
invalidateRequestExample3:
summary: Invalidate sessions for a provider
description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by the SAML authentication provider named `saml1`.
value: "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"saml\", \"name\": \"saml1\" }\n }\n}"
invalidateRequestExample4:
summary: Invalidate sessions for a user
description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any OpenID Connect authentication provider for the user with the username `user@my-oidc-sso.com`.
value: "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"oidc\" },\n \"username\": \"user@my-oidc-sso.com\"\n }\n}"
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
type: object
properties:
total:
type: integer
description: The number of sessions that were successfully invalidated.
'403':
description: Indicates that the user may not be authorized to invalidate sessions for other users.
/api/short_url:
post:
tags:
- short url
summary: Create a short URL
description: "Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share.\nShort URLs are created by specifying the locator ID and locator parameters. When a short URL is resolved, the locator ID and locator parameters are used to redirect user to the right Kibana page.\n"
operationId: post-url
requestBody:
content:
application/json:
schema:
required:
- locatorId
- params
type: object
properties:
humanReadableSlug:
type: boolean
description: "When the `slug` parameter is omitted, the API will generate a random human-readable slug if `humanReadableSlug` is set to true.\n"
locatorId:
type: string
description: The identifier for the locator.
params:
type: object
description: "An object which contains all necessary parameters for the given locator to resolve to a Kibana location.\n> warn\n> When you create a short URL, locator params are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.\n"
slug:
type: string
description: "A custom short URL slug. The slug is the part of the short URL that identifies it. You can provide a custom slug which consists of latin alphabet letters, numbers, and `-._` characters. The slug must be at least 3 characters long, but no longer than 255 characters.\n"
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
$ref: '#/components/schemas/Short_URL_APIs_urlResponse'
x-state: Technical Preview
'/api/short_url/_slug/{slug}':
get:
tags:
- short url
summary: Resolve a short URL
description: "Resolve a Kibana short URL by its slug.\n"
operationId: resolve-url
parameters:
- name: slug
in: path
description: The slug of the short URL.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
$ref: '#/components/schemas/Short_URL_APIs_urlResponse'
x-state: Technical Preview
'/api/short_url/{id}':
delete:
tags:
- short url
summary: Delete a short URL
description: "Delete a Kibana short URL.\n"
operationId: delete-url
parameters:
- $ref: '#/components/parameters/Short_URL_APIs_idParam'
responses:
'200':
description: Indicates a successful call.
x-state: Technical Preview
get:
tags:
- short url
summary: Get a short URL
description: "Get a single Kibana short URL.\n"
operationId: get-url
parameters:
- $ref: '#/components/parameters/Short_URL_APIs_idParam'
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
$ref: '#/components/schemas/Short_URL_APIs_urlResponse'
x-state: Technical Preview
/api/spaces/_copy_saved_objects:
post:
tags:
- spaces
summary: Copy saved objects between spaces
description: 'It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required. You can request to overwrite any objects that already exist in the target space if they share an identifier or you can use the resolve copy saved objects conflicts API to do this on a per-object basis.
[Required authorization] Route required privileges: copySavedObjectsToSpaces.'
operationId: post-spaces-copy-saved-objects
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- spaces
- objects
type: object
properties:
compatibilityMode:
type: boolean
description: Apply various adjustments to the saved objects that are being copied to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with copied saved objects. This option cannot be used with the `createNewCopies` option.
default: false
createNewCopies:
type: boolean
description: 'Create new copies of saved objects, regenerate each object identifier, and reset the origin. When used, potential conflict errors are avoided. This option cannot be used with the `overwrite` and `compatibilityMode` options.'
default: true
includeReferences:
type: boolean
description: 'When set to true, all saved objects related to the specified saved objects will also be copied into the target spaces.'
default: false
objects:
type: array
items:
required:
- type
- id
type: object
properties:
id:
type: string
description: The identifier of the saved object to copy.
type:
type: string
description: The type of the saved object to copy.
additionalProperties: false
overwrite:
type: boolean
description: 'When set to true, all conflicts are automatically overridden. When a saved object with a matching type and identifier exists in the target space, that version is replaced with the version from the source space. This option cannot be used with the `createNewCopies` option.'
default: false
spaces:
type: array
items:
type: string
description: The identifiers of the spaces where you want to copy the specified objects.
additionalProperties: false
examples:
copySavedObjectsRequestExample1:
$ref: '#/components/examples/copy_saved_objects_request1'
copySavedObjectsRequestExample2:
$ref: '#/components/examples/copy_saved_objects_request2'
responses:
'200':
description: 'OK: A successful request.'
content:
application/json:
examples:
copySavedObjectsResponseExample1:
$ref: '#/components/examples/copy_saved_objects_response1'
copySavedObjectsResponseExample2:
$ref: '#/components/examples/copy_saved_objects_response2'
copySavedObjectsResponseExample3:
$ref: '#/components/examples/copy_saved_objects_response3'
copySavedObjectsResponseExample4:
$ref: '#/components/examples/copy_saved_objects_response4'
/api/spaces/_disable_legacy_url_aliases:
post:
tags:
- spaces
summary: Disable legacy URL aliases
operationId: post-spaces-disable-legacy-url-aliases
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- aliases
type: object
properties:
aliases:
type: array
items:
required:
- targetSpace
- targetType
- sourceId
type: object
properties:
sourceId:
type: string
description: The alias source object identifier. This is the legacy object identifier.
targetSpace:
type: string
description: The space where the alias target object exists.
targetType:
type: string
description: 'The type of alias target object. '
additionalProperties: false
additionalProperties: false
examples:
disableLegacyURLRequestExample1:
$ref: '#/components/examples/disable_legacy_url_request1'
responses:
'204':
description: Indicates a successful call.
/api/spaces/_get_shareable_references:
post:
tags:
- spaces
summary: Get shareable references
description: Collect references and space contexts for saved objects.
operationId: post-spaces-get-shareable-references
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- objects
type: object
properties:
objects:
type: array
items:
required:
- type
- id
type: object
properties:
id:
type: string
type:
type: string
additionalProperties: false
additionalProperties: false
responses:
'200':
description: Indicates a successful call.
/api/spaces/_resolve_copy_saved_objects_errors:
post:
summary: Resolve conflicts copying saved objects
description: 'Overwrite saved objects that are returned as errors from the copy saved objects to space API.
[Required authorization] Route required privileges: copySavedObjectsToSpaces.'
operationId: post-spaces-resolve-copy-saved-objects-errors
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- retries
- objects
type: object
properties:
compatibilityMode:
type: boolean
default: false
createNewCopies:
type: boolean
default: true
includeReferences:
type: boolean
default: false
objects:
type: array
items:
required:
- type
- id
type: object
properties:
id:
type: string
type:
type: string
additionalProperties: false
retries:
type: object
additionalProperties:
type: array
items:
required:
- type
- id
type: object
properties:
createNewCopy:
type: boolean
description: 'Creates new copies of the saved objects, regenerates each object ID, and resets the origin.'
destinationId:
type: string
description: 'Specifies the destination identifier that the copied object should have, if different from the current identifier.'
id:
type: string
description: The saved object identifier.
ignoreMissingReferences:
type: boolean
description: 'When set to true, any missing references errors are ignored.'
overwrite:
type: boolean
description: 'When set to true, the saved object from the source space overwrites the conflicting object in the destination space.'
default: false
type:
type: string
description: The saved object type.
additionalProperties: false
additionalProperties: false
examples:
resolveCopySavedObjectsRequestExample1:
$ref: '#/components/examples/resolve_copy_saved_objects_request1'
resolveCopySavedObjectsRequestExample2:
$ref: '#/components/examples/resolve_copy_saved_objects_request2'
responses:
'200':
description: 'OK: A successful request.'
content:
application/json:
examples:
resolveCopySavedObjectsResponseExample1:
$ref: '#/components/examples/copy_saved_objects_response1'
resolveCopySavedObjectsResponseExample2:
$ref: '#/components/examples/copy_saved_objects_response2'
/api/spaces/_update_objects_spaces:
post:
tags:
- spaces
summary: Update saved objects in spaces
description: Update one or more saved objects to add or remove them from some spaces.
operationId: post-spaces-update-objects-spaces
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- objects
- spacesToAdd
- spacesToRemove
type: object
properties:
objects:
type: array
items:
required:
- type
- id
type: object
properties:
id:
type: string
description: The identifier of the saved object to update.
type:
type: string
description: The type of the saved object to update.
additionalProperties: false
spacesToAdd:
type: array
items:
type: string
description: The identifiers of the spaces the saved objects should be added to or removed from.
spacesToRemove:
type: array
items:
type: string
description: The identifiers of the spaces the saved objects should be added to or removed from.
additionalProperties: false
examples:
updateObjectSpacesRequestExample1:
$ref: '#/components/examples/update_saved_objects_spaces_request1'
responses:
'200':
description: 'OK: A successful request.'
content:
application/json:
examples:
updateObjectSpacesResponseExample1:
$ref: '#/components/examples/update_saved_objects_spaces_response1'
/api/spaces/space:
get:
tags:
- spaces
summary: Get all spaces
operationId: get-spaces-space
parameters:
- name: purpose
in: query
description: Specifies which authorization checks are applied to the API call. The default value is `any`.
schema:
enum:
- any
- copySavedObjectsIntoSpace
- shareSavedObjectsIntoSpace
type: string
- name: include_authorized_purposes
in: query
description: 'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.'
required: true
schema:
anyOf:
- type: array
items: { }
- type: boolean
- type: number
- type: object
- type: string
oneOf:
- enum:
- false
type: boolean
x-oas-optional: true
- type: boolean
x-oas-optional: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
examples:
getSpacesResponseExample1:
$ref: '#/components/examples/get_spaces_response1'
getSpacesResponseExample2:
$ref: '#/components/examples/get_spaces_response2'
post:
tags:
- spaces
summary: Create a space
operationId: post-spaces-space
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
requestBody:
content:
application/json:
schema:
required:
- id
- name
type: object
properties:
_reserved:
type: boolean
color:
type: string
description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
description:
type: string
description: A description for the space.
disabledFeatures:
type: array
items:
type: string
description: The list of features that are turned off in the space.
default: [ ]
id:
type: string
description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
imageUrl:
type: string
description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
initials:
maxLength: 2
type: string
description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
name:
minLength: 1
type: string
description: 'The display name for the space. '
solution:
enum:
- security
- oblt
- es
- classic
type: string
additionalProperties: false
examples:
createSpaceRequest:
$ref: '#/components/examples/create_space_request'
responses:
'200':
description: Indicates a successful call.
'/api/spaces/space/{id}':
delete:
tags:
- spaces
summary: Delete a space
description: 'When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone.'
operationId: delete-spaces-space-id
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: id
in: path
description: The space identifier.
required: true
schema:
type: string
responses:
'204':
description: Indicates a successful call.
'404':
description: Indicates that the request failed.
get:
tags:
- spaces
summary: Get a space
operationId: get-spaces-space-id
parameters:
- name: id
in: path
description: The space identifier.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
examples:
getSpaceResponseExample:
$ref: '#/components/examples/get_space_response'
put:
tags:
- spaces
summary: Update a space
operationId: put-spaces-space-id
parameters:
- name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
- name: id
in: path
description: The space identifier. You are unable to change the ID with the update operation.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
required:
- id
- name
type: object
properties:
_reserved:
type: boolean
color:
type: string
description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
description:
type: string
description: A description for the space.
disabledFeatures:
type: array
items:
type: string
description: The list of features that are turned off in the space.
default: [ ]
id:
type: string
description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
imageUrl:
type: string
description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
initials:
maxLength: 2
type: string
description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
name:
minLength: 1
type: string
description: 'The display name for the space. '
solution:
enum:
- security
- oblt
- es
- classic
type: string
additionalProperties: false
examples:
updateSpaceRequest:
$ref: '#/components/examples/update_space_request'
responses:
'200':
description: Indicates a successful call.
/api/status:
get:
tags:
- system
summary: Get Kibana's current status
operationId: get-status
parameters:
- name: v7format
in: query
description: Set to "true" to get the response in v7 format.
schema:
type: boolean
- name: v8format
in: query
description: Set to "true" to get the response in v8 format.
schema:
type: boolean
responses:
'200':
description: Overall status is OK and Kibana should be functioning normally.
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_response'
- $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse'
description: Kibana's operational status. A minimal response is sent for unauthorized users.
'503':
description: Kibana or some of it's essential services are unavailable. Kibana may be degraded or unavailable.
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_response'
- $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse'
description: Kibana's operational status. A minimal response is sent for unauthorized users.
/api/synthetics/monitors:
get:
tags:
- synthetics
summary: Get monitors
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/synthetics/monitors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of monitors.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: get-synthetic-monitors
parameters:
- name: filter
in: query
description: Additional filtering criteria.
schema:
type: string
- name: locations
in: query
description: The locations to filter by.
schema:
type:
- string
- array
- name: monitorTypes
in: query
description: The monitor types to filter.
schema:
oneOf:
- enum:
- browser
- http
- icmp
- tcp
type: string
- type: array
- name: page
in: query
description: The page number for paginated results.
schema:
type: integer
- name: per_page
in: query
description: The number of items to return per page.
schema:
type: integer
- name: projects
in: query
description: The projects to filter by.
schema:
type:
- string
- array
- name: query
in: query
description: A free-text query string.
schema:
type: string
- name: schedules
in: query
description: The schedules to filter by.
schema:
type:
- string
- array
- name: sortField
in: query
description: The field to sort the results by.
schema:
enum:
- name
- createdAt
- updatedAt
- status
type: string
- name: sortOrder
in: query
description: The sort order.
schema:
enum:
- asc
- desc
type: string
- name: status
in: query
description: The status to filter by.
schema:
type:
- string
- array
- name: tags
in: query
description: Tags to filter monitors.
schema:
type:
- string
- array
- name: useLogicalAndFor
in: query
description: "Specifies whether to apply logical AND filtering for specific fields. Accepts either a string with values \"tags\" or \"locations\" or an array containing both.\n"
schema:
oneOf:
- enum:
- tags
- locations
type: string
- type: array
items:
enum:
- tags
- locations
type: string
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: object
examples:
getSyntheticMonitorsResponseExample1:
description: A successful response from `GET /api/synthetics/monitors?tags=prod&monitorTypes=http&locations=us-east-1&projects=project1&status=up`.
value: "{\n \"page\": 1,\n \"total\": 24,\n \"monitors\": [\n {\n \"type\": \"icmp\",\n \"enabled\": false,\n \"alert\": {\n \"status\": {\n \"enabled\": true\n },\n \"tls\": {\n \"enabled\": true\n }\n },\n \"schedule\": {\n \"number\": \"3\",\n \"unit\": \"m\"\n },\n \"config_id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n \"timeout\": \"16\",\n \"name\": \"8.8.8.8:80\",\n \"locations\": [\n {\n \"id\": \"us_central\",\n \"label\": \"North America - US Central\",\n \"geo\": {\n \"lat\": 41.25,\n \"lon\": -95.86\n },\n \"isServiceManaged\": true\n }\n ],\n \"namespace\": \"default\",\n \"origin\": \"ui\",\n \"id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n \"max_attempts\": 2,\n \"wait\": \"7\",\n \"revision\": 3,\n \"mode\": \"all\",\n \"ipv4\": true,\n \"ipv6\": true,\n \"created_at\": \"2023-11-07T09:57:04.152Z\",\n \"updated_at\": \"2023-12-04T19:19:34.039Z\",\n \"host\": \"8.8.8.8:80\"\n }\n ],\n \"absoluteTotal\": 24,\n \"perPage\": 10,\n}"
post:
tags:
- synthetics
summary: Create a monitor
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/synthetics/monitors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new monitor with the specified attributes. A monitor can be one of the following types: HTTP, TCP, ICMP, or Browser. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: post-synthetic-monitors
requestBody:
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Synthetics_browserMonitorFields'
- $ref: '#/components/schemas/Synthetics_httpMonitorFields'
- $ref: '#/components/schemas/Synthetics_icmpMonitorFields'
- $ref: '#/components/schemas/Synthetics_tcpMonitorFields'
description: "The request body should contain the attributes of the monitor you want to create. The required and default fields differ depending on the monitor type.\n"
discriminator:
propertyName: type
examples:
postSyntheticMonitorsRequestExample1:
summary: HTTP monitor
description: Create an HTTP monitor to check a website's availability.
value: "{\n \"type\": \"http\",\n \"name\": \"Website Availability\",\n \"url\": \"https://example.com\",\n \"tags\": [\"website\", \"availability\"],\n \"locations\": [\"united_kingdom\"]\n}"
postSyntheticMonitorsRequestExample2:
summary: TCP monitor
description: Create a TCP monitor to monitor a server's availability.
value: "{\n \"type\": \"tcp\",\n \"name\": \"Server Availability\",\n \"host\": \"example.com\",\n \"private_locations\": [\"my_private_location\"]\n}"
postSyntheticMonitorsRequestExample3:
summary: ICMP monitor
description: Create an ICMP monitor to perform ping checks.
value: "{\n \"type\": \"icmp\",\n \"name\": \"Ping Test\",\n \"host\": \"example.com\",\n \"locations\": [\"united_kingdom\"]\n}"
postSyntheticMonitorsRequestExample4:
summary: Browser monitor
description: Create a browser monitor to check a website.
value: "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n \"locations\": [\"united_kingdom\"]\n}"
required: true
responses:
'200':
description: A successful response.
/api/synthetics/monitors/_bulk_delete:
post:
tags:
- synthetics
summary: Delete monitors
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/synthetics/monitors/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete multiple monitors by sending a list of config IDs.\n"
operationId: delete-synthetic-monitors
requestBody:
content:
application/json:
schema:
required:
- ids
type: object
properties:
ids:
type: array
items:
type: string
description: An array of monitor IDs to delete.
examples:
bulkDeleteRequestExample1:
description: Run `POST /api/synthetics/monitors/_bulk_delete` to delete a list of monitors.
value: "{\n \"ids\": [\n \"monitor1-id\",\n \"monitor2-id\"\n ]\n}"
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: array
items:
type: object
properties:
deleted:
type: boolean
description: "If it is `true`, the monitor was successfully deleted If it is `false`, the monitor was not deleted.\n"
ids:
type: string
description: The unique identifier of the deleted monitor.
description: The API response includes information about the deleted monitors.
examples:
deleteMonitorsResponseExample1:
description: A response from successfully deleting multiple monitors.
value: "[\n {\n \"id\": \"monitor1-id\",\n \"deleted\": true\n },\n {\n \"id\": \"monitor2-id\",\n \"deleted\": true\n }\n]"
'/api/synthetics/monitors/{id}':
delete:
tags:
- synthetics
summary: Delete a monitor
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a monitor from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: delete-synthetic-monitor
parameters:
- name: id
in: path
description: The identifier for the monitor that you want to delete.
required: true
schema:
type: string
responses:
'200':
description: OK
get:
tags:
- synthetics
summary: Get a monitor
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: get-synthetic-monitor
parameters:
- name: id
in: path
description: The ID of the monitor.
required: true
schema:
type: string
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: object
examples:
getSyntheticMonitorResponseExample1:
description: A successful response from `GET /api/synthetics/monitors/`.
value: "{\n \"type\": \"http\",\n \"enabled\": true,\n \"alert\": {\n \"status\": {\n \"enabled\": true\n },\n \"tls\": {\n \"enabled\": true\n }\n },\n \"schedule\": {\n \"number\": \"3\",\n \"unit\": \"m\"\n },\n \"config_id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n \"timeout\": \"16\",\n \"name\": \"am i something\",\n \"locations\": [\n {\n \"id\": \"us_central\",\n \"label\": \"North America - US Central\",\n \"geo\": {\n \"lat\": 41.25,\n \"lon\": -95.86\n },\n \"isServiceManaged\": true\n }\n ],\n \"namespace\": \"default\",\n \"origin\": \"ui\",\n \"id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n \"max_attempts\": 2,\n \"__ui\": {\n \"is_tls_enabled\": false\n },\n \"max_redirects\": \"0\",\n \"response.include_body\": \"on_error\",\n \"response.include_headers\": true,\n \"check.request.method\": \"GET\",\n \"mode\": \"any\",\n \"response.include_body_max_bytes\": \"1024\",\n \"ipv4\": true,\n \"ipv6\": true,\n \"ssl.verification_mode\": \"full\",\n \"ssl.supported_protocols\": [\n \"TLSv1.1\",\n \"TLSv1.2\",\n \"TLSv1.3\"\n ],\n \"revision\": 13,\n \"created_at\": \"2023-11-08T08:45:29.334Z\",\n \"updated_at\": \"2023-12-18T20:31:44.770Z\",\n \"url\": \"https://fast.com\"\n}"
'404':
description: 'If the monitor is not found, the API returns a 404 error.'
put:
tags:
- synthetics
summary: Update a monitor
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a monitor with the specified attributes. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\nYou can also partially update a monitor. This will only update the fields that are specified in the request body. All other fields are left unchanged. The specified fields should conform to the monitor type. For example, you can't update the `inline_scipt` field of a HTTP monitor.\n"
operationId: put-synthetic-monitor
parameters:
- name: id
in: path
description: The identifier for the monitor that you want to update.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
oneOf:
- $ref: '#/components/schemas/Synthetics_browserMonitorFields'
- $ref: '#/components/schemas/Synthetics_httpMonitorFields'
- $ref: '#/components/schemas/Synthetics_icmpMonitorFields'
- $ref: '#/components/schemas/Synthetics_tcpMonitorFields'
description: "The request body should contain the attributes of the monitor you want to update. The required and default fields differ depending on the monitor type.\n"
discriminator:
propertyName: type
examples:
putSyntheticMonitorsRequestExample1:
summary: HTTP monitor
description: Update an HTTP monitor that checks a website's availability.
value: "{\n \"type\": \"http\",\n \"name\": \"Website Availability\",\n \"url\": \"https://example.com\",\n \"tags\": [\"website\", \"availability\"],\n \"locations\": [\"united_kingdom\"]\n}"
putSyntheticMonitorsRequestExample2:
summary: TCP monitor
description: Update a TCP monitor that monitors a server's availability.
value: "{\n \"type\": \"tcp\",\n \"name\": \"Server Availability\",\n \"host\": \"example.com\",\n \"private_locations\": [\"my_private_location\"]\n}"
putSyntheticMonitorsRequestExample3:
summary: ICMP monitor
description: Update an ICMP monitor that performs ping checks.
value: "{\n \"type\": \"icmp\",\n \"name\": \"Ping Test\",\n \"host\": \"example.com\",\n \"locations\": [\"united_kingdom\"]\n}"
putSyntheticMonitorsRequestExample4:
summary: Browser monitor
description: Update a browser monitor that checks a website.
value: "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n \"locations\": [\"united_kingdom\"]\n}"
required: true
responses:
'200':
description: OK
/api/synthetics/params:
get:
tags:
- synthetics
summary: Get parameters
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/synthetics/params
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all parameters. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: get-parameters
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Synthetics_getParameterResponse'
examples:
getParametersResponseExample1:
summary: Read access
description: A successful response for a user with read-only permissions to get a list of parameters.
value: "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"description\": \"Description for param1\",\n \"tags\": [\"tag1\", \"tag2\"],\n \"namespaces\": [\"namespace1\"]\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"description\": \"Description for param2\",\n \"tags\": [\"tag3\"],\n \"namespaces\": [\"namespace2\"]\n }\n]"
getParametersResponseExample2:
summary: Write access
description: A successful response for a user with write permissions to get a list of parameters.
value: "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"description\": \"Description for param1\",\n \"tags\": [\"tag1\", \"tag2\"],\n \"namespaces\": [\"namespace1\"],\n \"value\": \"value1\"\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"description\": \"Description for param2\",\n \"tags\": [\"tag3\"],\n \"namespaces\": [\"namespace2\"],\n \"value\": \"value2\"\n }\n]"
post:
tags:
- synthetics
summary: Add parameters
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/synthetics/params
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd one or more parameters to the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: post-parameters
requestBody:
description: The request body can contain either a single parameter object or an array of parameter objects.
content:
application/json:
schema:
oneOf:
- type: array
items:
$ref: '#/components/schemas/Synthetics_parameterRequest'
- $ref: '#/components/schemas/Synthetics_parameterRequest'
examples:
postParametersRequestExample1:
summary: Single parameter
description: Add a single parameter.
value: "{\n \"key\": \"your-key-name\",\n \"value\": \"your-parameter-value\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"share_across_spaces\": true\n}"
postParametersRequestExample2:
summary: Multiple parameters
description: Add multiple parameters.
value: "[\n {\n \"key\": \"param1\",\n \"value\": \"value1\"\n },\n {\n \"key\": \"param2\",\n \"value\": \"value2\"\n }\n]"
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
oneOf:
- type: array
items:
$ref: '#/components/schemas/Synthetics_postParameterResponse'
- $ref: '#/components/schemas/Synthetics_postParameterResponse'
examples:
postParametersResponseExample1:
summary: Single parameter
description: A successful response for a single added parameter.
value: "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-key-name\",\n \"value\": \"your-param-value\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"share_across_spaces\": true\n}"
postParametersResponseExample2:
summary: Multiple parameters
description: A successful response for multiple added parameters.
value: "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"value\": \"value1\"\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"value\": \"value2\"\n }\n]"
/api/synthetics/params/_bulk_delete:
post:
tags:
- synthetics
summary: Delete parameters
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/synthetics/params/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete parameters from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: delete-parameters
requestBody:
content:
application/json:
schema:
type: object
properties:
ids:
type: array
items:
type: string
description: An array of parameter IDs to delete.
examples:
deleteParametersRequestExample1:
description: Run `POST /api/synthetics/params/_bulk_delete` to delete multiple parameters.
value: "{\n \"ids\": [\"param1-id\", \"param2-id\"]\n}"
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: array
items:
type: object
properties:
deleted:
type: boolean
description: "Indicates whether the parameter was successfully deleted. It is `true` if it was deleted. It is `false` if it was not deleted.\n"
id:
type: string
description: The unique identifier for the deleted parameter.
examples:
deleteParametersResponseExample1:
value: "[\n {\n \"id\": \"param1-id\",\n \"deleted\": true\n }\n]"
'/api/synthetics/params/{id}':
delete:
tags:
- synthetics
summary: Delete a parameter
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a parameter from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: delete-parameter
parameters:
- name: id
in: path
description: The ID for the parameter to delete.
required: true
schema:
type: string
responses:
'200':
description: OK
get:
tags:
- synthetics
summary: Get a parameter
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a parameter from the Synthetics app.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: get-parameter
parameters:
- name: id
in: path
description: The unique identifier for the parameter.
required: true
schema:
type: string
responses:
'200':
description: A successful response.
content:
application/json:
schema:
$ref: '#/components/schemas/Synthetics_getParameterResponse'
examples:
getParameterResponseExample1:
summary: Read access
description: A successful response for a user with read-only permissions to get a single parameter.
value: "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-api-key\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"namespaces\": [\"namespace1\", \"namespace2\"]\n}"
getParameterResponseExample2:
summary: Write access
description: A successful response for a user with write permissions to get a single parameter.
value: "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-param-key\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"namespaces\": [\"namespace1\", \"namespace2\"],\n \"value\": \"your-param-value\"\n}"
put:
tags:
- synthetics
summary: Update a parameter
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a parameter in the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
operationId: put-parameter
parameters:
- name: id
in: path
description: The unique identifier for the parameter.
required: true
schema:
type: string
requestBody:
description: The request body cannot be empty; at least one attribute is required.
content:
application/json:
schema:
type: object
properties:
description:
type: string
description: The updated description of the parameter.
key:
type: string
description: The key of the parameter.
tags:
type: array
items:
type: string
description: An array of updated tags to categorize the parameter.
value:
type: string
description: The updated value associated with the parameter.
examples:
putParameterRequestExample1:
value: "{\n \"key\": \"updated_param_key\",\n \"value\": \"updated-param-value\",\n \"description\": \"Updated Param to be used in browser monitor\",\n \"tags\": [\"authentication\", \"security\", \"updated\"]\n}"
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: object
examples:
putParameterResponseExample1:
value: "{\n \"id\": \"param_id1\",\n \"key\": \"updated_param_key\",\n \"value\": \"updated-param-value\",\n \"description\": \"Updated Param to be used in browser monitor\",\n \"tags\": [\"authentication\", \"security\", \"updated\"]\n}"
/api/synthetics/private_locations:
get:
tags:
- synthetics
summary: Get private locations
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/synthetics/private_locations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of private locations.\nYou must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n"
operationId: get-private-locations
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Synthetics_getPrivateLocation'
examples:
getPrivateLocationsResponseExample1:
value: "[\n {\n \"label\": \"Test private location\",\n \"id\": \"fleet-server-policy\",\n \"agentPolicyId\": \"fleet-server-policy\",\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"default\"\n },\n {\n \"label\": \"Test private location 2\",\n \"id\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n \"agentPolicyId\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"test\"\n }\n]"
post:
tags:
- synthetics
summary: Create a private location
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/synthetics/private_locations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges."
operationId: post-private-location
requestBody:
content:
application/json:
schema:
required:
- agentPolicyId
- label
type: object
properties:
agentPolicyId:
type: string
description: The ID of the agent policy associated with the private location.
geo:
required:
- lat
- lon
type: object
properties:
lat:
type: number
description: The latitude of the location.
lon:
type: number
description: The longitude of the location.
description: Geographic coordinates (WGS84) for the location.
label:
type: string
description: A label for the private location.
spaces:
type: array
items:
type: string
description: "An array of space IDs where the private location is available. If it is not provided, the private location is available in all spaces.\n"
tags:
type: array
items:
type: string
description: An array of tags to categorize the private location.
examples:
postPrivateLocationRequestExample1:
description: Run `POST /api/private_locations` to create a private location.
value: "{\n \"label\": \"Private Location 1\",\n \"agentPolicyId\": \"abcd1234\",\n \"tags\": [\"private\", \"testing\"],\n \"geo\": {\n \"lat\": 40.7128,\n \"lon\": -74.0060\n }\n \"spaces\": [\"default\"]\n}"
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
type: object
examples:
postPrivateLocationResponseExample1:
value: "{\n \"id\": \"abcd1234\",\n \"label\": \"Private Location 1\",\n \"agentPolicyId\": \"abcd1234\",\n \"tags\": [\"private\", \"testing\"],\n \"geo\": {\n \"lat\": 40.7128,\n \"lon\": -74.0060\n }\n}"
'400':
description: 'If the `agentPolicyId` is already used by an existing private location or if the `label` already exists, the API will return a 400 Bad Request response with a corresponding error message.'
'/api/synthetics/private_locations/{id}':
delete:
tags:
- synthetics
summary: Delete a private location
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/synthetics/private_locations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nThe API does not return a response body for deletion, but it will return an appropriate status code upon successful deletion.\nA location cannot be deleted if it has associated monitors in use. You must delete all monitors associated with the location before deleting the location.\n"
operationId: delete-private-location
parameters:
- name: id
in: path
description: The unique identifier of the private location to be deleted.
required: true
schema:
maxLength: 1024
minLength: 1
type: string
responses:
'200':
description: OK
get:
tags:
- synthetics
summary: Get a private location
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/synthetics/private_locations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n"
operationId: get-private-location
parameters:
- name: id
in: path
description: A private location identifier or label.
required: true
schema:
type: string
responses:
'200':
description: A successful response.
content:
application/json:
schema:
$ref: '#/components/schemas/Synthetics_getPrivateLocation'
examples:
getPrivateLocationResponseExample1:
value: "{\n \"label\": \"Test private location\",\n \"id\": \"test-private-location-id\",\n \"agentPolicyId\": \"test-private-location-id\",\n \"isServiceManaged\": false,\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"default\"\n}"
put:
tags:
- synthetics
summary: Update a private location
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/synthetics/private_locations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing private location's label.\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nWhen a private location's label is updated, all monitors using this location will also be updated to maintain data consistency.\n"
operationId: put-private-location
parameters:
- name: id
in: path
description: The unique identifier of the private location to be updated.
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
required:
- label
type: object
properties:
label:
minLength: 1
type: string
description: A new label for the private location. Must be at least 1 character long.
examples:
putPrivateLocationRequestExample1:
description: Update a private location's label.
value: "{\n \"label\": \"Updated Private Location Name\"\n}"
required: true
responses:
'200':
description: A successful response.
content:
application/json:
schema:
$ref: '#/components/schemas/Synthetics_getPrivateLocation'
examples:
putPrivateLocationResponseExample1:
value: "{\n \"label\": \"Updated Private Location Name\",\n \"id\": \"test-private-location-id\",\n \"agentPolicyId\": \"test-private-location-id\",\n \"isServiceManaged\": false,\n \"isInvalid\": false,\n \"tags\": [\"private\", \"testing\", \"updated\"],\n \"geo\": {\n \"lat\": 37.7749,\n \"lon\": -122.4194\n },\n \"spaces\": [\"*\"]\n}"
'400':
description: If the `label` is shorter than 1 character the API will return a 400 Bad Request response with a corresponding error message.
'404':
description: 'If the private location with the specified ID does not exist, the API will return a 404 Not Found response.'
/api/task_manager/_health:
get:
tags:
- task manager
summary: Get the task manager health
description: "Get the health status of the Kibana task manager.\n"
operationId: task-manager-health
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
$ref: '#/components/schemas/Task_manager_health_APIs_health_response'
examples:
taskManagerHealthResponse1:
$ref: '#/components/examples/Task_manager_health_APIs_health_200response'
/api/timeline:
delete:
tags:
- Security Timeline API
summary: Delete Timelines or Timeline templates
description: "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete one or more Timelines or Timeline templates."
operationId: DeleteTimelines
requestBody:
description: The IDs of the Timelines or Timeline templates to delete.
content:
application/json:
schema:
required:
- savedObjectIds
type: object
properties:
savedObjectIds:
maxItems: 100
type: array
items:
type: string
description: The list of IDs of the Timelines or Timeline templates to delete
example:
- 15c1929b-0af7-42bd-85a8-56e234cc7c4e
searchIds:
maxItems: 100
type: array
items:
type: string
description: Saved search IDs that should be deleted alongside the timelines
example:
- 23f3-43g34g322-e5g5hrh6h-45454
- 6ce1b592-84e3-4b4a-9552-f189d4b82075
required: true
responses:
'200':
description: Indicates the Timeline was successfully deleted.
content:
application/json:
schema:
required:
- data
type: object
properties:
data:
required:
- deleteTimeline
type: object
properties:
deleteTimeline:
type: boolean
get:
tags:
- Security Timeline API
summary: Get Timeline or Timeline template details
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an existing saved Timeline or Timeline template."
operationId: GetTimeline
parameters:
- name: template_timeline_id
in: query
description: The `savedObjectId` of the template timeline to retrieve
schema:
type: string
- name: id
in: query
description: The `savedObjectId` of the Timeline to retrieve.
schema:
type: string
responses:
'200':
description: Indicates that the (template) Timeline was found and returned.
content:
application/json:
schema:
oneOf:
- required:
- data
type: object
properties:
data:
required:
- getOneTimeline
type: object
properties:
getOneTimeline:
$ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
- type: object
additionalProperties: false
patch:
tags:
- Security Timeline API
summary: Update a Timeline
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing Timeline. You can update the title, description, date range, pinned events, pinned queries, and/or pinned saved queries of an existing Timeline."
operationId: PatchTimeline
requestBody:
description: 'The Timeline updates, along with the Timeline ID and version.'
content:
application/json:
schema:
required:
- timelineId
- version
- timeline
type: object
properties:
timeline:
$ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
timelineId:
type:
- 'null'
- string
description: The `savedObjectId` of the Timeline or Timeline template that you’re updating.
example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
version:
type:
- 'null'
- string
description: The version of the Timeline or Timeline template that you’re updating.
example: WzE0LDFd
required: true
responses:
'200':
description: Indicates that the Timeline was successfully updated.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_PersistTimelineResponse'
'405':
description: Indicates that the user does not have the required access to create a Timeline.
content:
application/json:
schema:
type: object
properties:
body:
type: string
description: The error message
example: update timeline error
statusCode:
type: number
example: 405
post:
tags:
- Security Timeline API
summary: Create a Timeline or Timeline template
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new Timeline or Timeline template."
operationId: CreateTimelines
requestBody:
description: 'The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.'
content:
application/json:
schema:
required:
- timeline
type: object
properties:
status:
$ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
templateTimelineId:
type:
- 'null'
- string
description: A unique identifier for the Timeline template.
example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
templateTimelineVersion:
type:
- 'null'
- number
description: Timeline template version number.
example: 12
timeline:
$ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
timelineId:
type:
- 'null'
- string
description: A unique identifier for the Timeline.
example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
timelineType:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
version:
type:
- 'null'
- string
required: true
responses:
'200':
description: Indicates the Timeline was successfully created.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_PersistTimelineResponse'
'405':
description: Indicates that there was an error in the Timeline creation.
content:
application/json:
schema:
type: object
properties:
body:
type: string
description: The error message
example: update timeline error
statusCode:
type: number
example: 405
/api/timeline/_copy:
get:
tags:
- Security Timeline API
summary: Copies timeline or timeline template
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/timeline/_copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCopies and returns a timeline or timeline template.\n"
operationId: CopyTimeline
requestBody:
content:
application/json:
schema:
required:
- timeline
- timelineIdToCopy
type: object
properties:
timeline:
$ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
timelineIdToCopy:
type: string
required: true
responses:
'200':
description: Indicates that the timeline has been successfully copied.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_PersistTimelineResponse'
/api/timeline/_draft:
get:
tags:
- Security Timeline API
summary: Get draft Timeline or Timeline template details
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/timeline/_draft
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned."
operationId: GetDraftTimelines
parameters:
- name: timelineType
in: query
required: true
schema:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
responses:
'200':
description: Indicates that the draft Timeline was successfully retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_PersistTimelineResponse'
'403':
description: 'If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.'
content:
application/json:
schema:
type: object
properties:
message:
type: string
status_code:
type: number
'409':
description: 'This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given `timelineId`.'
content:
application/json:
schema:
type: object
properties:
message:
type: string
status_code:
type: number
post:
tags:
- Security Timeline API
summary: Create a clean draft Timeline or Timeline template
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/timeline/_draft
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a clean draft Timeline or Timeline template for the current user.\n> info\n> If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.\n"
operationId: CleanDraftTimelines
requestBody:
description: The type of Timeline to create. Valid values are `default` and `template`.
content:
application/json:
schema:
required:
- timelineType
type: object
properties:
timelineType:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
required: true
responses:
'200':
description: 'Indicates that the draft Timeline was successfully created. In the event the user already has a draft Timeline, the existing draft Timeline is cleared and returned.'
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_PersistTimelineResponse'
'403':
description: Indicates that the user does not have the required permissions to create a draft Timeline.
content:
application/json:
schema:
type: object
properties:
message:
type: string
status_code:
type: number
'409':
description: Indicates that there is already a draft Timeline with the given `timelineId`.
content:
application/json:
schema:
type: object
properties:
message:
type: string
status_code:
type: number
/api/timeline/_export:
post:
tags:
- Security Timeline API
summary: Export Timelines
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/timeline/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport Timelines as an NDJSON file."
operationId: ExportTimelines
parameters:
- name: file_name
in: query
description: The name of the file to export
required: true
schema:
type: string
requestBody:
description: The IDs of the Timelines to export.
content:
application/json:
schema:
type: object
properties:
ids:
maxItems: 1000
minItems: 1
type:
- 'null'
- array
items:
type: string
required: true
responses:
'200':
description: Indicates the Timelines were successfully exported.
content:
application/ndjson:
schema:
type: string
description: NDJSON of the exported Timelines
'400':
description: Indicates that the export size limit was exceeded.
content:
application/ndjson:
schema:
type: object
properties:
body:
type: string
statusCode:
type: number
/api/timeline/_favorite:
patch:
tags:
- Security Timeline API
summary: Favorite a Timeline or Timeline template
description: "**Spaces method and path for this operation:**\n\npatch /s/{space_id}/api/timeline/_favorite
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFavorite a Timeline or Timeline template for the current user."
operationId: PersistFavoriteRoute
requestBody:
description: The required fields used to favorite a (template) Timeline.
content:
application/json:
schema:
required:
- timelineId
- templateTimelineId
- templateTimelineVersion
- timelineType
type: object
properties:
templateTimelineId:
type:
- 'null'
- string
templateTimelineVersion:
type:
- 'null'
- number
timelineId:
type:
- 'null'
- string
timelineType:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
required: true
responses:
'200':
description: Indicates the favorite status was successfully updated.
content:
application/json:
schema:
required:
- data
type: object
properties:
data:
required:
- persistFavorite
type: object
properties:
persistFavorite:
$ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResponse'
'403':
description: Indicates the user does not have the required permissions to persist the favorite status.
content:
application/json:
schema:
type: object
properties:
body:
type: string
statusCode:
type: number
/api/timeline/_import:
post:
tags:
- Security Timeline API
summary: Import Timelines
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/timeline/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport Timelines."
operationId: ImportTimelines
requestBody:
description: The Timelines to import as a readable stream.
content:
application/json:
schema:
required:
- file
type: object
properties:
file: { }
isImmutable:
enum:
- 'true'
- 'false'
type: string
description: Whether the Timeline should be immutable
required: true
responses:
'200':
description: Indicates the import of Timelines was successful.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_ImportTimelineResult'
'400':
description: Indicates the import of Timelines was unsuccessful because of an invalid file extension.
content:
application/json:
schema:
type: object
properties:
body:
type: string
description: The error message
example: Invalid file extension
statusCode:
type: number
example: 400
'404':
description: Indicates that we were unable to locate the saved object client necessary to handle the import.
content:
application/json:
schema:
type: object
properties:
body:
type: string
description: The error message
example: Unable to find saved object client
statusCode:
type: number
example: 404
'409':
description: Indicates the import of Timelines was unsuccessful.
content:
application/json:
schema:
type: object
properties:
body:
type: string
description: The error message
example: Could not import timelines
statusCode:
type: number
example: 409
/api/timeline/_prepackaged:
post:
tags:
- Security Timeline API
summary: Install prepackaged Timelines
description: "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/timeline/_prepackaged
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall or update prepackaged Timelines."
operationId: InstallPrepackedTimelines
requestBody:
description: The Timelines to install or update.
content:
application/json:
schema:
required:
- timelinesToInstall
- timelinesToUpdate
- prepackagedTimelines
type: object
properties:
prepackagedTimelines:
type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject'
timelinesToInstall:
type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_ImportTimelines'
timelinesToUpdate:
type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_ImportTimelines'
required: true
responses:
'200':
description: Indicates the installation of prepackaged Timelines was successful.
content:
application/json:
schema:
$ref: '#/components/schemas/Security_Timeline_API_ImportTimelineResult'
'500':
description: Indicates the installation of prepackaged Timelines was unsuccessful.
content:
application/json:
schema:
type: object
properties:
body:
type: string
statusCode:
type: number
/api/timeline/resolve:
get:
tags:
- Security Timeline API
summary: Get an existing saved Timeline or Timeline template
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/timeline/resolve
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information."
operationId: ResolveTimeline
parameters:
- name: template_timeline_id
in: query
description: The ID of the template timeline to resolve
schema:
type: string
- name: id
in: query
description: The ID of the timeline to resolve
schema:
type: string
responses:
'200':
description: The (template) Timeline has been found
content:
application/json:
schema:
oneOf:
- required:
- data
type: object
properties:
data:
$ref: '#/components/schemas/Security_Timeline_API_ResolvedTimeline'
- type: object
additionalProperties: false
'400':
description: The request is missing parameters
'404':
description: The (template) Timeline was not found
/api/timelines:
get:
tags:
- Security Timeline API
summary: Get Timelines or Timeline templates
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/timelines
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all saved Timelines or Timeline templates."
operationId: GetTimelines
parameters:
- name: only_user_favorite
in: query
description: 'If true, only timelines that are marked as favorites by the user are returned.'
schema:
enum:
- 'true'
- 'false'
type:
- 'null'
- string
- name: timeline_type
in: query
schema:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
- name: sort_field
in: query
schema:
$ref: '#/components/schemas/Security_Timeline_API_SortFieldTimeline'
- name: sort_order
in: query
description: Whether to sort the results `ascending` or `descending`
schema:
enum:
- asc
- desc
type: string
- name: page_size
in: query
description: How many results should returned at once
schema:
type:
- 'null'
- string
- name: page_index
in: query
description: How many pages should be skipped
schema:
type:
- 'null'
- string
- name: search
in: query
description: Allows to search for timelines by their title
schema:
type:
- 'null'
- string
- name: status
in: query
schema:
$ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
responses:
'200':
description: Indicates that the (template) Timelines were found and returned.
content:
application/json:
schema:
required:
- timeline
- totalCount
type: object
properties:
customTemplateTimelineCount:
type: number
description: The amount of custom Timeline templates in the results
example: 2
defaultTimelineCount:
type: number
description: The amount of `default` type Timelines in the results
example: 90
elasticTemplateTimelineCount:
type: number
description: The amount of Elastic's Timeline templates in the results
example: 8
favoriteCount:
type: number
description: The amount of favorited Timelines
example: 5
templateTimelineCount:
type: number
description: The amount of Timeline templates in the results
example: 10
timeline:
type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
totalCount:
type: number
description: The total amount of results
example: 100
'400':
description: Bad request. The user supplied invalid data.
content:
application/json:
schema:
type: object
properties:
body:
type: string
description: The error message
example: get timeline error
statusCode:
type: number
example: 405
'/api/upgrade_assistant/reindex/{index}':
get:
tags:
- upgrade
summary: Get the reindex status
description: "Check the status of the reindex task.\n"
operationId: get-upgrade-reindex
parameters:
- name: index
in: path
description: The name of the index that is reindexing.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
hasRequiredPrivileges:
type: boolean
description: "Specifies whether the user has sufficient privileges to reindex this index. When security is unavailable or disabled, it is `true`.\n"
reindexOp:
type: object
properties:
errorMessage:
$ref: '#/components/schemas/Upgrade_assistant_APIs_errorMessage'
indexName:
$ref: '#/components/schemas/Upgrade_assistant_APIs_indexName'
lastCompletedStep:
$ref: '#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep'
newIndexName:
$ref: '#/components/schemas/Upgrade_assistant_APIs_newIndexName'
reindexTaskId:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskId'
reindexTaskPercComplete:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete'
status:
$ref: '#/components/schemas/Upgrade_assistant_APIs_status'
warnings:
type: array
description: "An array of any warning codes that explain what changes are required for this reindex. For example:\n- `0` specifies to remove the `_all` meta field. - `1` specifies to convert any coerced boolean values in the source document. For example, `yes`, `1`, and `off`. - `2` specifies to convert documents to support Elastic Common Schema. Applies only to APM indices created in 6.x.\n"
examples:
getUpgradeReindexResponseExample1:
value: "{\n \"reindexOp\": {\n \"indexName\": \".ml-state\",\n \"newIndexName\": \".reindexed-v7-ml-state\", \n \"status\": 0, \n \"lastCompletedStep\": 40, \n \"reindexTaskId\": \"QprwvTMzRQ2MLWOW22oQ4Q:11819\", \n \"reindexTaskPercComplete\": 0.3, \n \"errorMessage\": null \n },\n \"warnings\": [], \n \"hasRequiredPrivileges\": true \n}"
x-state: Technical Preview
post:
tags:
- upgrade
summary: Start or resume reindexing
description: "Start a new reindex or resume a paused reindex.\nThe following steps are performed during a reindex task:\n\n1. Set the index to read-only.\n1. Create a new index.\n1. Reindex documents into the new index.\n1. Create an index alias for the new index.\n1. Delete the old index.\n"
operationId: start-upgrade-reindex
parameters:
- name: index
in: path
description: The name of the index to reindex.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
errorMessage:
$ref: '#/components/schemas/Upgrade_assistant_APIs_errorMessage'
indexName:
$ref: '#/components/schemas/Upgrade_assistant_APIs_indexName'
lastCompletedStep:
$ref: '#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep'
newIndexName:
$ref: '#/components/schemas/Upgrade_assistant_APIs_newIndexName'
reindexTaskId:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskId'
reindexTaskPercComplete:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete'
status:
$ref: '#/components/schemas/Upgrade_assistant_APIs_status'
examples:
startUpgradeReindexResponseExample1:
value: "{\n \"indexName\": \".ml-state\",\n \"newIndexName\": \".reindexed-v7-ml-state\", \n \"status\": 0, \n \"lastCompletedStep\": 0, \n \"reindexTaskId\": null, \n \"reindexTaskPercComplete\": null, \n \"errorMessage\": null \n}"
x-state: Technical Preview
'/api/upgrade_assistant/reindex/{index}/cancel':
post:
tags:
- upgrade
summary: Cancel reindexing
description: "Cancel reindexes that are waiting for the Elasticsearch reindex task to complete. For example, cancel reindexing if the `lastCompletedStep` has the value `40`.\n"
operationId: cancel-upgrade-reindex
parameters:
- name: index
in: path
description: The name of the index that was reindexing.
required: true
schema:
type: string
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
acknowledged:
type: boolean
examples:
cancelUpgradeReindexResponseExample1:
value: "{\n \"acknowledged\": true\n}"
x-state: Technical Preview
/api/upgrade_assistant/reindex/batch:
post:
tags:
- upgrade
summary: Batch start or resume reindexing
description: "Start or resume multiple reindexing tasks in one request. Additionally, reindexing tasks started or resumed via the batch endpoint will be placed on a queue and run one-by-one, which ensures that minimal cluster resources are consumed over time.\n"
operationId: batch-start-upgrade-reindex
requestBody:
content:
application/json:
schema:
required:
- indexNames
type: object
properties:
indexNames:
type: array
items:
type: string
description: "The list of index names to be reindexed. The order of the indices determines the order that the reindex tasks are run.\n"
required: true
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
enqueued:
type: array
items:
type: object
properties:
errorMessage:
$ref: '#/components/schemas/Upgrade_assistant_APIs_errorMessage'
indexName:
$ref: '#/components/schemas/Upgrade_assistant_APIs_indexName'
lastCompletedStep:
$ref: '#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep'
locked:
$ref: '#/components/schemas/Upgrade_assistant_APIs_locked'
reindexOptions:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexOptions'
reindexTaskId:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskId'
reindexTaskPercComplete:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete'
runningReindexCount:
$ref: '#/components/schemas/Upgrade_assistant_APIs_runningReindexCount'
description: "A list of reindex tasks created. The order in the array indicates the order in which tasks will be run.\n"
errors:
type: array
items:
type: object
description: "A list of errors that may have occurred preventing the reindex task from being created.\n"
examples:
batchStartUpgradeReindexResponseExample1:
value: "{\n \"enqueued\": [ \n {\n \"indexName\": \"index1\",\n \"newIndexName\": \"reindexed-v8-index1\",\n \"status\": 3,\n \"lastCompletedStep\": 0,\n \"locked\": null,\n \"reindexTaskId\": null,\n \"reindexTaskPercComplete\": null,\n \"errorMessage\": null,\n \"runningReindexCount\": null,\n \"reindexOptions\": { \n \"queueSettings\": {\n \"queuedAt\": 1583406985489 \n }\n }\n }\n ],\n \"errors\": [ \n {\n \"indexName\": \"index2\",\n \"message\": \"Something went wrong!\"\n }\n ]\n}"
x-state: Technical Preview
/api/upgrade_assistant/reindex/batch/queue:
get:
tags:
- upgrade
summary: Get the batch reindex queue
description: "Check the current reindex batch queue.\n"
operationId: get-batch-upgrade-reindex
responses:
'200':
description: Indicates a successful call.
content:
application/json:
schema:
type: object
properties:
queue:
type: array
items:
type: object
properties:
errorMessage:
$ref: '#/components/schemas/Upgrade_assistant_APIs_errorMessage'
indexName:
$ref: '#/components/schemas/Upgrade_assistant_APIs_indexName'
lastCompletedStep:
$ref: '#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep'
locked:
$ref: '#/components/schemas/Upgrade_assistant_APIs_locked'
reindexOptions:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexOptions'
reindexTaskId:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskId'
reindexTaskPercComplete:
$ref: '#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete'
runningReindexCount:
$ref: '#/components/schemas/Upgrade_assistant_APIs_runningReindexCount'
description: "Items in this array indicate reindex tasks at a given point in time and the order in which they will be run.\n"
examples:
getBatchUpgradeReindexResponseExample1:
value: "{\n \"queue\": [ \n {\n \"indexName\": \"index1\",\n \"newIndexName\": \"reindexed-v8-index2\",\n \"status\": 3,\n \"lastCompletedStep\": 0,\n \"locked\": null,\n \"reindexTaskId\": null,\n \"reindexTaskPercComplete\": null,\n \"errorMessage\": null,\n \"runningReindexCount\": null,\n \"reindexOptions\": {\n \"queueSettings\": {\n \"queuedAt\": 1583406985489\n }\n }\n },\n {\n \"indexName\": \"index2\",\n \"newIndexName\": \"reindexed-v8-index2\",\n \"status\": 3,\n \"lastCompletedStep\": 0,\n \"locked\": null,\n \"reindexTaskId\": null,\n \"reindexTaskPercComplete\": null,\n \"errorMessage\": null,\n \"runningReindexCount\": null,\n \"reindexOptions\": {\n \"queueSettings\": {\n \"queuedAt\": 1583406987334\n }\n }\n }\n ]\n}"
x-state: Technical Preview
/api/upgrade_assistant/status:
get:
tags:
- upgrade
summary: Get the upgrade readiness status
description: Check the status of your cluster.
operationId: get-upgrade-status
responses:
'200':
description: Indicates a successful call.
content:
application/json:
examples:
getUpgradeStatusResponseExample1:
value: "{\n \"readyForUpgrade\": false,\n \"cluster\": [\n {\n \"message\": \"Cluster deprecated issue\",\n \"details\":\"You have 2 system indices that must be migrated and 5 Elasticsearch deprecation issues and 0 Kibana deprecation issues that must be resolved before upgrading.\"\n }\n ]\n}"
x-state: Technical Preview
/api/uptime/settings:
get:
tags:
- uptime
summary: Get uptime settings
description: "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/uptime/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the uptime feature in the Observability section of the Kibana feature privileges.\n"
operationId: get-uptime-settings
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
type: object
examples:
getUptimeSettingsResponseExample1:
value: "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}"
put:
tags:
- uptime
summary: Update uptime settings
description: "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/uptime/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate uptime setting attributes like `heartbeatIndices`, `certExpirationThreshold`, `certAgeThreshold`, `defaultConnectors`, or `defaultEmail`. You must have `all` privileges for the uptime feature in the Observability section of the Kibana feature privileges. A partial update is supported, provided settings keys will be merged with existing settings.\n"
operationId: put-uptime-settings
requestBody:
content:
application/json:
schema:
type: object
properties:
certAgeThreshold:
type: number
description: The number of days after a certificate is created to trigger an alert.
default: 730
certExpirationThreshold:
type: number
description: The number of days before a certificate expires to trigger an alert.
default: 30
defaultConnectors:
type: array
description: A list of connector IDs to be used as default connectors for new alerts.
default: [ ]
defaultEmail:
type: object
properties:
bcc:
type: array
items:
type: string
default: [ ]
cc:
type: array
items:
type: string
default: [ ]
to:
type: array
items:
type: string
default: [ ]
description: "The default email configuration for new alerts.\n"
heartbeatIndices:
type: string
description: "An index pattern string to be used within the Uptime app and alerts to query Heartbeat data. \n"
default: heartbeat-*
examples:
putUptimeSettingsRequestExample1:
summary: Update multiple settings
description: Run `PUT api/uptime/settings` to update multiple Uptime settings.
value: "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}"
putUptimeSettingsRequestExample2:
summary: Update a setting
description: Run `PUT api/uptime/settings` to update a single Uptime setting.
value: "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n}"
responses:
'200':
description: Indicates a successful call
content:
application/json:
schema:
type: object
examples:
putUptimeSettingsResponseExample1:
description: A successful response from `PUT api/uptime/settings`.
value: "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}"
'/s/{spaceId}/api/observability/slos':
get:
tags:
- slo
summary: Get a paginated list of SLOs
description: "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: findSlosOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- name: kqlQuery
in: query
description: A valid kql query to filter the SLO with
schema:
type: string
example: 'slo.name:latency* and slo.tags : "prod"'
- name: size
in: query
description: 'The page size to use for cursor-based pagination, must be greater or equal than 1'
schema:
type: integer
default: 1
example: 1
- name: searchAfter
in: query
description: 'The cursor to use for fetching the results from, when using a cursor-base pagination.'
schema:
type: array
items:
type: string
- name: page
in: query
description: 'The page to use for pagination, must be greater or equal than 1'
schema:
type: integer
default: 1
example: 1
- name: perPage
in: query
description: Number of SLOs returned by page
schema:
maximum: 5000
type: integer
default: 25
example: 25
- name: sortBy
in: query
description: Sort by field
schema:
enum:
- sli_value
- status
- error_budget_consumed
- error_budget_remaining
type: string
default: status
example: status
- name: sortDirection
in: query
description: Sort order
schema:
enum:
- asc
- desc
type: string
default: asc
example: asc
- name: hideStale
in: query
description: Hide stale SLOs from the list as defined by stale SLO threshold in SLO settings
schema:
type: boolean
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_find_slo_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
post:
tags:
- slo
summary: Create an SLO
description: "You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: createSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_create_slo_request'
required: true
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_create_slo_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'409':
description: Conflict - The SLO id already exists
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_409_response'
'/s/{spaceId}/api/observability/slos/_bulk_delete':
post:
tags:
- slo
summary: Bulk delete SLO definitions and their associated summary and rollup data.
description: "Bulk delete SLO definitions and their associated summary and rollup data. This endpoint initiates a bulk deletion operation for SLOs, which may take some time to complete. The status of the operation can be checked using the `GET /api/slo/_bulk_delete/{taskId}` endpoint.\n"
operationId: bulkDeleteOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_bulk_delete_request'
required: true
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_bulk_delete_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'/s/{spaceId}/api/observability/slos/_bulk_delete/{taskId}':
get:
tags:
- slo
summary: Retrieve the status of the bulk deletion
description: "Retrieve the status of the bulk deletion operation for SLOs. This endpoint returns the status of the bulk deletion operation, including whether it is completed and the results of the operation.\n"
operationId: bulkDeleteStatusOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- name: taskId
in: path
description: The task id of the bulk delete operation
required: true
schema:
type: string
example: 8853df00-ae2e-11ed-90af-09bb6422b258
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_bulk_delete_status_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'/s/{spaceId}/api/observability/slos/_bulk_purge_rollup':
post:
tags:
- slo
summary: Batch delete rollup and summary data
description: "The deletion occurs for the specified list of `sloId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: deleteRollupDataOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_bulk_purge_rollup_request'
required: true
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_bulk_purge_rollup_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'/s/{spaceId}/api/observability/slos/_delete_instances':
post:
tags:
- slo
summary: Batch delete rollup and summary data
description: "The deletion occurs for the specified list of `sloId` and `instanceId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: deleteSloInstancesOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_delete_slo_instances_request'
required: true
responses:
'204':
description: Successful request
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'/s/{spaceId}/api/observability/slos/{sloId}':
delete:
tags:
- slo
summary: Delete an SLO
description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: deleteSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- $ref: '#/components/parameters/SLOs_slo_id'
responses:
'204':
description: Successful request
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
get:
tags:
- slo
summary: Get an SLO
description: "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: getSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- $ref: '#/components/parameters/SLOs_slo_id'
- name: instanceId
in: query
description: the specific instanceId used by the summary calculation
schema:
type: string
example: host-abcde
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_slo_with_summary_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
put:
tags:
- slo
summary: Update an SLO
description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: updateSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- $ref: '#/components/parameters/SLOs_slo_id'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_update_slo_request'
required: true
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_slo_definition_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
'/s/{spaceId}/api/observability/slos/{sloId}/_reset':
post:
tags:
- slo
summary: Reset an SLO
description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: resetSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- $ref: '#/components/parameters/SLOs_slo_id'
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_slo_definition_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
'/s/{spaceId}/api/observability/slos/{sloId}/disable':
post:
tags:
- slo
summary: Disable an SLO
description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: disableSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- $ref: '#/components/parameters/SLOs_slo_id'
responses:
'204':
description: Successful request
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
'/s/{spaceId}/api/observability/slos/{sloId}/enable':
post:
tags:
- slo
summary: Enable an SLO
description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: enableSloOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- $ref: '#/components/parameters/SLOs_slo_id'
responses:
'204':
description: Successful request
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
'404':
description: Not found response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_404_response'
'/s/{spaceId}/internal/observability/slos/_definitions':
get:
tags:
- slo
summary: Get the SLO definitions
description: "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
operationId: getDefinitionsOp
parameters:
- $ref: '#/components/parameters/SLOs_kbn_xsrf'
- $ref: '#/components/parameters/SLOs_space_id'
- name: includeOutdatedOnly
in: query
description: Indicates if the API returns only outdated SLO or all SLO definitions
schema:
type: boolean
example: true
- name: tags
in: query
description: Filters the SLOs by tag
schema:
type: string
- name: search
in: query
description: Filters the SLOs by name
schema:
type: string
example: my service availability
- name: page
in: query
description: 'The page to use for pagination, must be greater or equal than 1'
schema:
type: number
example: 1
- name: perPage
in: query
description: Number of SLOs returned by page
schema:
maximum: 1000
type: integer
default: 100
example: 100
responses:
'200':
description: Successful request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_find_slo_definitions_response'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_400_response'
'401':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_401_response'
'403':
description: Unauthorized response
content:
application/json:
schema:
$ref: '#/components/schemas/SLOs_403_response'
components:
schemas:
Alerting_401_response:
title: Unsuccessful rule API response
type: object
properties:
error:
enum:
- Unauthorized
type: string
example: Unauthorized
message:
type: string
statusCode:
enum:
- 401
type: integer
example: 401
Alerting_alert_response_properties:
title: Legacy alert response properties
type: object
properties:
actions:
type: array
items:
type: object
alertTypeId:
type: string
example: .index-threshold
apiKeyOwner:
type:
- 'null'
- string
example: elastic
createdAt:
type: string
description: The date and time that the alert was created.
format: date-time
example: '2022-12-05T23:36:58.284Z'
createdBy:
type: string
description: The identifier for the user that created the alert.
example: elastic
enabled:
type: boolean
description: Indicates whether the alert is currently enabled.
example: true
executionStatus:
type: object
properties:
lastExecutionDate:
type: string
format: date-time
example: '2022-12-06T00:13:43.890Z'
status:
type: string
example: ok
id:
type: string
description: The identifier for the alert.
example: b530fed0-74f5-11ed-9801-35303b735aef
muteAll:
type: boolean
example: false
mutedInstanceIds:
type:
- 'null'
- array
items:
type: string
name:
type: string
description: The name of the alert.
example: my alert
notifyWhen:
type: string
example: onActionGroupChange
params:
type: object
schedule:
type: object
properties:
interval:
type: string
scheduledTaskId:
type: string
example: b530fed0-74f5-11ed-9801-35303b735aef
tags:
type: array
items:
type: string
throttle:
type:
- 'null'
- string
updatedAt:
type: string
example: '2022-12-05T23:36:58.284Z'
updatedBy:
type:
- 'null'
- string
description: The identifier for the user that updated this alert most recently.
example: elastic
Alerting_fieldmap_properties:
title: Field map objects in the get rule types response
type: object
properties:
array:
type: boolean
description: Indicates whether the field is an array.
dynamic:
type: boolean
description: Indicates whether it is a dynamic field mapping.
format:
type: string
description: "Indicates the format of the field. For example, if the `type` is `date_range`, the `format` can be `epoch_millis||strict_date_optional_time`.\n"
ignore_above:
type: integer
description: Specifies the maximum length of a string field. Longer strings are not indexed or stored.
index:
type: boolean
description: Indicates whether field values are indexed.
path:
type: string
description: TBD
properties:
type: object
additionalProperties:
type: object
properties:
type:
type: string
description: The data type for each object property.
description: "Details about the object properties. This property is applicable when `type` is `object`.\n"
required:
type: boolean
description: Indicates whether the field is required.
scaling_factor:
type: integer
description: "The scaling factor to use when encoding values. This property is applicable when `type` is `scaled_float`. Values will be multiplied by this factor at index time and rounded to the closest long value. \n"
type:
type: string
description: Specifies the data type for the field.
example: scaled_float
APM_UI_400_response:
type: object
properties:
error:
type: string
description: Error type
example: Not Found
message:
type: string
description: Error message
example: Not Found
statusCode:
type: number
description: Error status code
example: 400
APM_UI_401_response:
type: object
properties:
error:
type: string
description: Error type
example: Unauthorized
message:
type: string
description: Error message
statusCode:
type: number
description: Error status code
example: 401
APM_UI_403_response:
type: object
properties:
error:
type: string
description: Error type
example: Forbidden
message:
type: string
description: Error message
statusCode:
type: number
description: Error status code
example: 403
APM_UI_404_response:
type: object
properties:
error:
type: string
description: Error type
example: Not Found
message:
type: string
description: Error message
example: Not Found
statusCode:
type: number
description: Error status code
example: 404
APM_UI_500_response:
type: object
properties:
error:
type: string
description: Error type
example: Internal Server Error
message:
type: string
description: Error message
statusCode:
type: number
description: Error status code
example: 500
APM_UI_501_response:
type: object
properties:
error:
type: string
description: Error type
example: Not Implemented
message:
type: string
description: Error message
example: Not Implemented
statusCode:
type: number
description: Error status code
example: 501
APM_UI_agent_configuration_intake_object:
required:
- service
- settings
type: object
properties:
agent_name:
type: string
description: Agent name
service:
$ref: '#/components/schemas/APM_UI_service_object'
settings:
$ref: '#/components/schemas/APM_UI_settings_object'
APM_UI_agent_configuration_object:
required:
- service
- settings
- '@timestamp'
- etag
type: object
properties:
'@timestamp':
type: number
description: Timestamp
example: 1730194190636
agent_name:
type: string
description: Agent name
applied_by_agent:
type: boolean
description: Applied by agent
example: true
etag:
type: string
description: Etag
example: 0bc3b5ebf18fba8163fe4c96f491e3767a358f85
service:
$ref: '#/components/schemas/APM_UI_service_object'
settings:
$ref: '#/components/schemas/APM_UI_settings_object'
description: Agent configuration
APM_UI_agent_configurations_response:
type: object
properties:
configurations:
type: array
items:
$ref: '#/components/schemas/APM_UI_agent_configuration_object'
description: Agent configuration
APM_UI_agent_keys_object:
required:
- name
- privileges
type: object
properties:
name:
type: string
description: Agent name
privileges:
type: array
items:
enum:
- event:write
- config_agent:read
type: string
description: Privileges configuration
APM_UI_agent_keys_response:
type: object
properties:
agentKey:
required:
- id
- name
- api_key
- encoded
type: object
properties:
api_key:
type: string
encoded:
type: string
expiration:
type: integer
format: int64
id:
type: string
name:
type: string
description: Agent key
APM_UI_annotation_search_response:
type: object
properties:
annotations:
type: array
items:
type: object
properties:
'@timestamp':
type: number
id:
type: string
text:
type: string
type:
enum:
- version
type: string
description: Annotations
APM_UI_base_source_map_object:
type: object
properties:
compressionAlgorithm:
type: string
description: Compression Algorithm
created:
type: string
description: Created date
decodedSha256:
type: string
description: Decoded SHA-256
decodedSize:
type: number
description: Decoded size
encodedSha256:
type: string
description: Encoded SHA-256
encodedSize:
type: number
description: Encoded size
encryptionAlgorithm:
type: string
description: Encryption Algorithm
id:
type: string
description: Identifier
identifier:
type: string
description: Identifier
packageName:
type: string
description: Package name
relative_url:
type: string
description: Relative URL
type:
type: string
description: Type
APM_UI_create_annotation_object:
required:
- '@timestamp'
- service
type: object
properties:
'@timestamp':
type: string
description: Timestamp
message:
type: string
description: Message
service:
required:
- version
type: object
properties:
environment:
type: string
version:
type: string
description: Service
tags:
type: array
items:
type: string
description: Tags
APM_UI_create_annotation_response:
type: object
properties:
_id:
type: string
description: Identifier
_index:
type: string
description: Index
_source:
type: object
properties:
'@timestamp':
type: string
annotation:
type: object
properties:
title:
type: string
type:
type: string
event:
type: object
properties:
created:
type: string
message:
type: string
service:
type: object
properties:
environment:
type: string
name:
type: string
version:
type: string
tags:
type: array
items:
type: string
description: Response
APM_UI_delete_agent_configurations_response:
type: object
properties:
result:
type: string
description: Result
APM_UI_search_agent_configuration_object:
required:
- service
type: object
properties:
etag:
type: string
description: If etags match then `applied_by_agent` field will be set to `true`
example: 0bc3b5ebf18fba8163fe4c96f491e3767a358f85
mark_as_applied_by_agent:
type: boolean
description: "`markAsAppliedByAgent=true` means \"force setting it to true regardless of etag\".\nThis is needed for Jaeger agent that doesn't have etags\n"
service:
$ref: '#/components/schemas/APM_UI_service_object'
APM_UI_search_agent_configuration_response:
type: object
properties:
_id:
type: string
description: Identifier
_index:
type: string
description: Index
_score:
type: number
description: Score
_source:
$ref: '#/components/schemas/APM_UI_agent_configuration_object'
APM_UI_service_agent_name_response:
type: object
properties:
agentName:
type: string
description: Agent name
example: nodejs
APM_UI_service_environment_object:
type: object
properties:
alreadyConfigured:
type: boolean
description: Already configured
name:
type: string
description: Service environment name
example: ALL_OPTION_VALUE
APM_UI_service_environments_response:
type: object
properties:
environments:
type: array
items:
$ref: '#/components/schemas/APM_UI_service_environment_object'
description: Service environment list
APM_UI_service_object:
type: object
properties:
environment:
type: string
description: Environment
example: prod
name:
type: string
description: Name
example: node
description: Service
APM_UI_settings_object:
type: object
additionalProperties:
type: string
description: Agent configuration settings
APM_UI_single_agent_configuration_response:
allOf:
- required:
- id
type: object
properties:
id:
type: string
- $ref: '#/components/schemas/APM_UI_agent_configuration_object'
APM_UI_source_maps_response:
type: object
properties:
artifacts:
type: array
items:
allOf:
- type: object
properties:
body:
type: object
properties:
bundleFilepath:
type: string
serviceName:
type: string
serviceVersion:
type: string
sourceMap:
type: object
properties:
file:
type: string
mappings:
type: string
sourceRoot:
type: string
sources:
type: array
items:
type: string
sourcesContent:
type: array
items:
type: string
version:
type: number
- $ref: '#/components/schemas/APM_UI_base_source_map_object'
description: Artifacts
APM_UI_upload_source_map_object:
required:
- service_name
- service_version
- bundle_filepath
- sourcemap
type: object
properties:
bundle_filepath:
type: string
description: The absolute path of the final bundle as used in the web application.
service_name:
type: string
description: The name of the service that the service map should apply to.
service_version:
type: string
description: The version of the service that the service map should apply to.
sourcemap:
type: string
description: "The source map. String or file upload. It must follow the\n[source map revision 3 proposal](https://docs.google.com/document/d/1U1RGAehQwRypUTovF1KRlpiOFze0b-_2gc6fAH0KY0k).\n"
format: binary
APM_UI_upload_source_maps_response:
allOf:
- type: object
properties:
body:
type: string
- $ref: '#/components/schemas/APM_UI_base_source_map_object'
Cases_4xx_response:
title: Unsuccessful cases API response
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
Cases_action_types:
enum:
- assignees
- create_case
- comment
- connector
- delete_case
- description
- pushed
- tags
- title
- status
- settings
- severity
type: string
description: The type of action.
example: create_case
Cases_actions:
enum:
- add
- create
- delete
- push_to_service
- update
type: string
example: create
Cases_add_alert_comment_request_properties:
title: Add case comment request properties for alerts
required:
- alertId
- index
- owner
- rule
- type
type: object
properties:
alertId:
$ref: '#/components/schemas/Cases_alert_identifiers'
index:
$ref: '#/components/schemas/Cases_alert_indices'
owner:
$ref: '#/components/schemas/Cases_owner'
rule:
$ref: '#/components/schemas/Cases_rule'
type:
enum:
- alert
type: string
description: The type of comment.
example: alert
description: Defines properties for case comment requests when type is alert.
Cases_add_case_comment_request:
title: Add case comment request
oneOf:
- $ref: '#/components/schemas/Cases_add_alert_comment_request_properties'
- $ref: '#/components/schemas/Cases_add_user_comment_request_properties'
description: The add comment to case API request body varies depending on whether you are adding an alert or a comment.
discriminator:
propertyName: type
mapping:
alert: '#/components/schemas/Cases_add_alert_comment_request_properties'
user: '#/components/schemas/Cases_add_user_comment_request_properties'
Cases_add_case_file_request:
title: Add case file request properties
required:
- file
type: object
properties:
file:
type: string
description: The file being attached to the case.
format: binary
filename:
type: string
description: 'The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**'
description: Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined.
Cases_add_user_comment_request_properties:
title: Add case comment request properties for user comments
required:
- comment
- owner
- type
type: object
properties:
comment:
maxLength: 30000
type: string
description: The new comment. It is required only when `type` is `user`.
example: A new comment.
owner:
$ref: '#/components/schemas/Cases_owner'
type:
enum:
- user
type: string
description: The type of comment.
example: user
description: Defines properties for case comment requests when type is user.
Cases_alert_comment_response_properties:
title: Add case comment response properties for alerts
required:
- type
type: object
properties:
alertId:
type: array
items:
type: string
example: a6e12ac4-7bce-457b-84f6-d7ce8deb8446
created_at:
type: string
format: date-time
example: '2023-11-06T19:29:38.424Z'
created_by:
required:
- email
- full_name
- username
type: object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
id:
type: string
example: 73362370-ab1a-11ec-985f-97e55adae8b9
index:
type: array
items:
type: string
example: .internal.alerts-security.alerts-default-000001
owner:
$ref: '#/components/schemas/Cases_owner'
pushed_at:
type:
- 'null'
- string
format: date-time
example: 'null'
pushed_by:
required:
- email
- full_name
- username
type:
- 'null'
- object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
rule:
type: object
properties:
id:
type: string
description: The rule identifier.
example: 94d80550-aaf4-11ec-985f-97e55adae8b9
name:
type: string
description: The rule name.
example: security_rule
type:
enum:
- alert
type: string
example: alert
updated_at:
type:
- 'null'
- string
format: date-time
updated_by:
required:
- email
- full_name
- username
type:
- 'null'
- object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
version:
type: string
example: WzMwNDgsMV0=
Cases_alert_identifiers:
title: Alert identifiers
oneOf:
- type: string
- maxItems: 1000
type: array
items:
type: string
description: "The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
x-state: Technical preview
Cases_alert_indices:
title: Alert indices
oneOf:
- type: string
- maxItems: 1000
type: array
items:
type: string
description: "The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
x-state: Technical preview
Cases_alert_response_properties:
type: object
properties:
attached_at:
type: string
format: date-time
id:
type: string
description: The alert identifier.
index:
type: string
description: The alert index.
Cases_assignees:
maxItems: 10
type:
- 'null'
- array
items:
required:
- uid
type: object
properties:
uid:
type: string
description: A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
example: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
description: An array containing users that are assigned to the case.
Cases_case_categories:
maxItems: 100
type: array
items:
$ref: '#/components/schemas/Cases_case_category'
Cases_case_category:
maxLength: 50
type: string
description: A word or phrase that categorizes the case.
Cases_case_description:
maxLength: 30000
type: string
description: The description for the case.
Cases_case_response_closed_by_properties:
title: Case response properties for closed_by
required:
- email
- full_name
- username
type:
- 'null'
- object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
Cases_case_response_created_by_properties:
title: Case response properties for created_by
required:
- email
- full_name
- username
type: object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
Cases_case_response_properties:
title: Case response properties
required:
- closed_at
- closed_by
- comments
- connector
- created_at
- created_by
- description
- duration
- external_service
- id
- owner
- settings
- severity
- status
- tags
- title
- totalAlerts
- totalComment
- updated_at
- updated_by
- version
type: object
properties:
assignees:
$ref: '#/components/schemas/Cases_assignees'
category:
type:
- 'null'
- string
description: The case category.
closed_at:
type:
- 'null'
- string
format: date-time
closed_by:
$ref: '#/components/schemas/Cases_case_response_closed_by_properties'
comments:
title: Case response properties for comments
maxItems: 10000
type: array
items:
oneOf:
- $ref: '#/components/schemas/Cases_alert_comment_response_properties'
- $ref: '#/components/schemas/Cases_user_comment_response_properties'
discriminator:
propertyName: type
mapping:
alert: '#/components/schemas/Cases_alert_comment_response_properties'
user: '#/components/schemas/Cases_user_comment_response_properties'
description: An array of comment objects for the case.
connector:
title: Case response properties for connectors
oneOf:
- $ref: '#/components/schemas/Cases_connector_properties_none'
- $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
- $ref: '#/components/schemas/Cases_connector_properties_jira'
- $ref: '#/components/schemas/Cases_connector_properties_resilient'
- $ref: '#/components/schemas/Cases_connector_properties_servicenow'
- $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
- $ref: '#/components/schemas/Cases_connector_properties_swimlane'
discriminator:
propertyName: type
mapping:
.cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
.jira: '#/components/schemas/Cases_connector_properties_jira'
.none: '#/components/schemas/Cases_connector_properties_none'
.resilient: '#/components/schemas/Cases_connector_properties_resilient'
.servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
.servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
.swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
created_at:
type: string
format: date-time
example: '2022-05-13T09:16:17.416Z'
created_by:
$ref: '#/components/schemas/Cases_case_response_created_by_properties'
customFields:
type: array
items:
type: object
properties:
key:
type: string
description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
type:
enum:
- text
- toggle
type: string
description: "The custom field type. It must match the type specified in the case configuration settings.\n"
value:
oneOf:
- maxLength: 160
minLength: 1
type:
- 'null'
- string
- type: boolean
description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
description: Custom field values for the case.
description:
type: string
example: A case description.
duration:
type:
- 'null'
- integer
description: "The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.\n"
example: 120
external_service:
$ref: '#/components/schemas/Cases_external_service'
id:
type: string
example: 66b9aa00-94fa-11ea-9f74-e7e108796192
owner:
$ref: '#/components/schemas/Cases_owner'
settings:
$ref: '#/components/schemas/Cases_settings'
severity:
$ref: '#/components/schemas/Cases_case_severity'
status:
$ref: '#/components/schemas/Cases_case_status'
tags:
type: array
items:
type: string
example:
- tag-1
title:
type: string
example: Case title 1
totalAlerts:
type: integer
example: 0
totalComment:
type: integer
example: 0
updated_at:
type:
- 'null'
- string
format: date-time
updated_by:
$ref: '#/components/schemas/Cases_case_response_updated_by_properties'
version:
type: string
example: WzUzMiwxXQ==
Cases_case_response_pushed_by_properties:
title: Case response properties for pushed_by
required:
- email
- full_name
- username
type:
- 'null'
- object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
Cases_case_response_updated_by_properties:
title: Case response properties for updated_by
required:
- email
- full_name
- username
type:
- 'null'
- object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
Cases_case_severity:
enum:
- critical
- high
- low
- medium
type: string
description: The severity of the case.
default: low
Cases_case_status:
enum:
- closed
- in-progress
- open
type: string
description: The status of the case.
Cases_case_tags:
maxItems: 200
type: array
items:
maxLength: 256
type: string
description: "The words and phrases that help categorize cases. It can be an empty array.\n"
Cases_case_title:
maxLength: 160
type: string
description: A title for the case.
Cases_closure_types:
enum:
- close-by-pushing
- close-by-user
type: string
description: Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
example: close-by-user
Cases_connector_properties_cases_webhook:
title: Create or upate case request properties for Cases Webhook connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
type:
- 'null'
- string
example: 'null'
id:
type: string
description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
name:
type: string
description: The name of the connector.
type:
enum:
- .cases-webhook
type: string
description: The type of connector.
example: .cases-webhook
description: Defines properties for connectors when type is `.cases-webhook`.
Cases_connector_properties_jira:
title: Create or update case request properties for a Jira connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
required:
- issueType
- parent
- priority
type: object
properties:
issueType:
type:
- 'null'
- string
description: The type of issue.
parent:
type:
- 'null'
- string
description: 'The key of the parent issue, when the issue type is sub-task.'
priority:
type:
- 'null'
- string
description: The priority of the issue.
description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
id:
type: string
description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
name:
type: string
description: The name of the connector.
type:
enum:
- .jira
type: string
description: The type of connector.
example: .jira
description: Defines properties for connectors when type is `.jira`.
Cases_connector_properties_none:
title: Create or update case request properties for no connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
type:
- 'null'
- string
description: 'An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.'
example: 'null'
id:
type: string
description: 'The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.'
example: none
name:
type: string
description: 'The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.'
example: none
type:
enum:
- .none
type: string
description: 'The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.'
example: .none
description: Defines properties for connectors when type is `.none`.
Cases_connector_properties_resilient:
title: Create case request properties for a IBM Resilient connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
required:
- issueTypes
- severityCode
type:
- 'null'
- object
properties:
issueTypes:
type: array
items:
type: string
description: The type of incident.
severityCode:
type: string
description: The severity code of the incident.
description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
id:
type: string
description: The identifier for the connector.
name:
type: string
description: The name of the connector.
type:
enum:
- .resilient
type: string
description: The type of connector.
example: .resilient
description: Defines properties for connectors when type is `.resilient`.
Cases_connector_properties_servicenow:
title: Create case request properties for a ServiceNow ITSM connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
required:
- category
- impact
- severity
- subcategory
- urgency
type: object
properties:
category:
type:
- 'null'
- string
description: The category of the incident.
impact:
type:
- 'null'
- string
description: The effect an incident had on business.
severity:
type:
- 'null'
- string
description: The severity of the incident.
subcategory:
type:
- 'null'
- string
description: The subcategory of the incident.
urgency:
type:
- 'null'
- string
description: The extent to which the incident resolution can be delayed.
description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
id:
type: string
description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
name:
type: string
description: The name of the connector.
type:
enum:
- .servicenow
type: string
description: The type of connector.
example: .servicenow
description: Defines properties for connectors when type is `.servicenow`.
Cases_connector_properties_servicenow_sir:
title: Create case request properties for a ServiceNow SecOps connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
required:
- category
- destIp
- malwareHash
- malwareUrl
- priority
- sourceIp
- subcategory
type: object
properties:
category:
type:
- 'null'
- string
description: The category of the incident.
destIp:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of destination IPs.
malwareHash:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of malware hashes.
malwareUrl:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of malware URLs.
priority:
type:
- 'null'
- string
description: The priority of the issue.
sourceIp:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of source IPs.
subcategory:
type:
- 'null'
- string
description: The subcategory of the incident.
description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
id:
type: string
description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
name:
type: string
description: The name of the connector.
type:
enum:
- .servicenow-sir
type: string
description: The type of connector.
example: .servicenow-sir
description: Defines properties for connectors when type is `.servicenow-sir`.
Cases_connector_properties_swimlane:
title: Create case request properties for a Swimlane connector
required:
- fields
- id
- name
- type
type: object
properties:
fields:
required:
- caseId
type: object
properties:
caseId:
type:
- 'null'
- string
description: The case identifier for Swimlane connectors.
description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
id:
type: string
description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
name:
type: string
description: The name of the connector.
type:
enum:
- .swimlane
type: string
description: The type of connector.
example: .swimlane
description: Defines properties for connectors when type is `.swimlane`.
Cases_connector_types:
enum:
- .cases-webhook
- .jira
- .none
- .resilient
- .servicenow
- .servicenow-sir
- .swimlane
type: string
description: The type of connector.
example: .none
Cases_create_case_request:
title: Create case request
required:
- connector
- description
- owner
- settings
- tags
- title
type: object
properties:
assignees:
$ref: '#/components/schemas/Cases_assignees'
category:
$ref: '#/components/schemas/Cases_case_category'
connector:
oneOf:
- $ref: '#/components/schemas/Cases_connector_properties_none'
- $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
- $ref: '#/components/schemas/Cases_connector_properties_jira'
- $ref: '#/components/schemas/Cases_connector_properties_resilient'
- $ref: '#/components/schemas/Cases_connector_properties_servicenow'
- $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
- $ref: '#/components/schemas/Cases_connector_properties_swimlane'
customFields:
maxItems: 10
minItems: 0
type: array
items:
required:
- key
- type
- value
type: object
properties:
key:
type: string
description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
type:
enum:
- text
- toggle
type: string
description: "The custom field type. It must match the type specified in the case configuration settings.\n"
value:
oneOf:
- maxLength: 160
minLength: 1
type:
- 'null'
- string
- type: boolean
description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
description: "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n"
description:
$ref: '#/components/schemas/Cases_case_description'
owner:
$ref: '#/components/schemas/Cases_owner'
settings:
$ref: '#/components/schemas/Cases_settings'
severity:
$ref: '#/components/schemas/Cases_case_severity'
tags:
$ref: '#/components/schemas/Cases_case_tags'
title:
$ref: '#/components/schemas/Cases_case_title'
description: The create case API request body varies depending on the type of connector.
Cases_external_service:
type:
- 'null'
- object
properties:
connector_id:
type: string
connector_name:
type: string
external_id:
type: string
external_title:
type: string
external_url:
type: string
pushed_at:
type: string
format: date-time
pushed_by:
type:
- 'null'
- object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
Cases_owner:
enum:
- cases
- observability
- securitySolution
type: string
description: "The application that owns the cases: Stack Management, Observability, or Elastic Security.\n"
example: cases
Cases_owners:
type: array
items:
$ref: '#/components/schemas/Cases_owner'
Cases_payload_alert_comment:
type: object
properties:
comment:
type: object
properties:
alertId:
oneOf:
- type: string
example: 1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d
- type: array
items:
type: string
index:
oneOf:
- type: string
example: .alerts-observability.logs.alerts-default
- type: array
items:
type: string
owner:
$ref: '#/components/schemas/Cases_owner'
rule:
type: object
properties:
id:
type: string
description: The rule identifier.
example: 94d80550-aaf4-11ec-985f-97e55adae8b9
name:
type: string
description: The rule name.
example: security_rule
type:
enum:
- alert
type: string
Cases_payload_assignees:
type: object
properties:
assignees:
$ref: '#/components/schemas/Cases_assignees'
Cases_payload_connector:
type: object
properties:
connector:
type: object
properties:
fields:
type:
- 'null'
- object
properties:
caseId:
type: string
description: The case identifier for Swimlane connectors.
category:
type: string
description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
destIp:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
impact:
type: string
description: The effect an incident had on business for ServiceNow ITSM connectors.
issueType:
type: string
description: The type of issue for Jira connectors.
issueTypes:
type: array
items:
type: string
description: The type of incident for IBM Resilient connectors.
malwareHash:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
malwareUrl:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
parent:
type: string
description: 'The key of the parent issue, when the issue type is sub-task for Jira connectors.'
priority:
type: string
description: The priority of the issue for Jira and ServiceNow SecOps connectors.
severity:
type: string
description: The severity of the incident for ServiceNow ITSM connectors.
severityCode:
type: string
description: The severity code of the incident for IBM Resilient connectors.
sourceIp:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
subcategory:
type: string
description: The subcategory of the incident for ServiceNow ITSM connectors.
urgency:
type: string
description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
description: 'An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.'
example: 'null'
id:
type: string
description: 'The identifier for the connector. To create a case without a connector, use `none`.'
example: none
name:
type: string
description: 'The name of the connector. To create a case without a connector, use `none`.'
example: none
type:
$ref: '#/components/schemas/Cases_connector_types'
Cases_payload_create_case:
type: object
properties:
assignees:
$ref: '#/components/schemas/Cases_assignees'
connector:
type: object
properties:
fields:
type:
- 'null'
- object
properties:
caseId:
type: string
description: The case identifier for Swimlane connectors.
category:
type: string
description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
destIp:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
impact:
type: string
description: The effect an incident had on business for ServiceNow ITSM connectors.
issueType:
type: string
description: The type of issue for Jira connectors.
issueTypes:
type: array
items:
type: string
description: The type of incident for IBM Resilient connectors.
malwareHash:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
malwareUrl:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
parent:
type: string
description: 'The key of the parent issue, when the issue type is sub-task for Jira connectors.'
priority:
type: string
description: The priority of the issue for Jira and ServiceNow SecOps connectors.
severity:
type: string
description: The severity of the incident for ServiceNow ITSM connectors.
severityCode:
type: string
description: The severity code of the incident for IBM Resilient connectors.
sourceIp:
type:
- 'null'
- boolean
description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
subcategory:
type: string
description: The subcategory of the incident for ServiceNow ITSM connectors.
urgency:
type: string
description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
description: 'An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.'
example: 'null'
id:
type: string
description: 'The identifier for the connector. To create a case without a connector, use `none`.'
example: none
name:
type: string
description: 'The name of the connector. To create a case without a connector, use `none`.'
example: none
type:
$ref: '#/components/schemas/Cases_connector_types'
description:
type: string
owner:
$ref: '#/components/schemas/Cases_owner'
settings:
$ref: '#/components/schemas/Cases_settings'
severity:
$ref: '#/components/schemas/Cases_case_severity'
status:
$ref: '#/components/schemas/Cases_case_status'
tags:
type: array
items:
type: string
example:
- tag-1
title:
type: string
Cases_payload_delete:
type:
- 'null'
- object
description: 'If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.'
Cases_payload_description:
type: object
properties:
description:
type: string
Cases_payload_pushed:
type: object
properties:
externalService:
$ref: '#/components/schemas/Cases_external_service'
Cases_payload_settings:
type: object
properties:
settings:
$ref: '#/components/schemas/Cases_settings'
Cases_payload_severity:
type: object
properties:
severity:
$ref: '#/components/schemas/Cases_case_severity'
Cases_payload_status:
type: object
properties:
status:
$ref: '#/components/schemas/Cases_case_status'
Cases_payload_tags:
type: object
properties:
tags:
type: array
items:
type: string
example:
- tag-1
Cases_payload_title:
type: object
properties:
title:
type: string
Cases_payload_user_comment:
type: object
properties:
comment:
type: object
properties:
comment:
type: string
owner:
$ref: '#/components/schemas/Cases_owner'
type:
enum:
- user
type: string
Cases_rule:
title: Alerting rule
type: object
properties:
id:
type: string
description: The rule identifier.
example: 94d80550-aaf4-11ec-985f-97e55adae8b9
name:
type: string
description: The rule name.
example: security_rule
description: "The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
x-state: Technical preview
Cases_searchFieldsType:
enum:
- description
- title
type: string
description: The fields to perform the `simple_query_string` parsed query against.
Cases_searchFieldsTypeArray:
type: array
items:
$ref: '#/components/schemas/Cases_searchFieldsType'
Cases_set_case_configuration_request:
title: Set case configuration request
required:
- closure_type
- connector
- owner
type: object
properties:
closure_type:
$ref: '#/components/schemas/Cases_closure_types'
connector:
required:
- fields
- id
- name
- type
type: object
properties:
fields:
type:
- 'null'
- object
description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
id:
type: string
description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
example: none
name:
type: string
description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
example: none
type:
$ref: '#/components/schemas/Cases_connector_types'
description: An object that contains the connector configuration.
customFields:
maxItems: 10
minItems: 0
type: array
items:
required:
- key
- label
- required
- type
type: object
properties:
defaultValue:
type:
- boolean
- string
description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
key:
maxLength: 36
minLength: 1
type: string
description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
label:
maxLength: 50
minLength: 1
type: string
description: The custom field label that is displayed in the case.
type:
enum:
- text
- toggle
type: string
description: The type of the custom field.
required:
type: boolean
description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
description: Custom fields case configuration.
owner:
$ref: '#/components/schemas/Cases_owner'
templates:
$ref: '#/components/schemas/Cases_templates'
description: 'External connection details, such as the closure type and default connector for cases.'
Cases_settings:
required:
- syncAlerts
type: object
properties:
syncAlerts:
type: boolean
description: Turns alert syncing on or off.
example: true
description: An object that contains the case settings.
Cases_string:
type: string
Cases_string_array:
maxItems: 100
type: array
items:
$ref: '#/components/schemas/Cases_string'
Cases_template_tags:
maxItems: 200
type: array
items:
maxLength: 256
type: string
description: "The words and phrases that help categorize templates. It can be an empty array.\n"
Cases_templates:
type: array
items:
type: object
properties:
caseFields:
type: object
properties:
assignees:
$ref: '#/components/schemas/Cases_assignees'
category:
$ref: '#/components/schemas/Cases_case_category'
connector:
type: object
properties:
fields:
type:
- 'null'
- object
description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
id:
type: string
description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
example: none
name:
type: string
description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
example: none
type:
$ref: '#/components/schemas/Cases_connector_types'
customFields:
type: array
items:
type: object
properties:
key:
type: string
description: The unique key for the custom field.
type:
enum:
- text
- toggle
type: string
description: The type of the custom field.
value:
type:
- boolean
- string
description: "The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
description: Custom field values in the template.
x-state: Technical preview
description:
$ref: '#/components/schemas/Cases_case_description'
settings:
$ref: '#/components/schemas/Cases_settings'
severity:
$ref: '#/components/schemas/Cases_case_severity'
tags:
$ref: '#/components/schemas/Cases_case_tags'
title:
$ref: '#/components/schemas/Cases_case_title'
description:
type: string
description: A description for the template.
key:
type: string
description: "A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.\n"
name:
type: string
description: The name of the template.
tags:
$ref: '#/components/schemas/Cases_template_tags'
x-state: Technical preview
Cases_update_alert_comment_request_properties:
title: Update case comment request properties for alerts
required:
- alertId
- id
- index
- owner
- rule
- type
- version
type: object
properties:
alertId:
$ref: '#/components/schemas/Cases_alert_identifiers'
id:
type: string
description: "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n"
example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
index:
$ref: '#/components/schemas/Cases_alert_indices'
owner:
$ref: '#/components/schemas/Cases_owner'
rule:
$ref: '#/components/schemas/Cases_rule'
type:
enum:
- alert
type: string
description: The type of comment.
example: alert
version:
type: string
description: "The current comment version. To retrieve version values, use the get comments API.\n"
example: Wzk1LDFd
description: Defines properties for case comment requests when type is alert.
Cases_update_case_comment_request:
title: Update case comment request
oneOf:
- $ref: '#/components/schemas/Cases_update_alert_comment_request_properties'
- $ref: '#/components/schemas/Cases_update_user_comment_request_properties'
description: The update case comment API request body varies depending on whether you are updating an alert or a comment.
discriminator:
propertyName: type
mapping:
alert: '#/components/schemas/Cases_update_alert_comment_request_properties'
user: '#/components/schemas/Cases_update_user_comment_request_properties'
Cases_update_case_configuration_request:
title: Update case configuration request
required:
- version
type: object
properties:
closure_type:
$ref: '#/components/schemas/Cases_closure_types'
connector:
required:
- fields
- id
- name
- type
type: object
properties:
fields:
type:
- 'null'
- object
description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
id:
type: string
description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
example: none
name:
type: string
description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
example: none
type:
$ref: '#/components/schemas/Cases_connector_types'
description: An object that contains the connector configuration.
customFields:
type: array
items:
required:
- key
- label
- required
- type
type: object
properties:
defaultValue:
type:
- boolean
- string
description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
key:
maxLength: 36
minLength: 1
type: string
description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
label:
maxLength: 50
minLength: 1
type: string
description: The custom field label that is displayed in the case.
type:
enum:
- text
- toggle
type: string
description: The type of the custom field.
required:
type: boolean
description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
description: Custom fields case configuration.
templates:
$ref: '#/components/schemas/Cases_templates'
version:
type: string
description: "The version of the connector. To retrieve the version value, use the get configuration API.\n"
example: WzIwMiwxXQ==
description: "You can update settings such as the closure type, custom fields, templates, and the default connector for cases.\n"
Cases_update_case_request:
title: Update case request
required:
- cases
type: object
properties:
cases:
maxItems: 100
minItems: 1
type: array
items:
required:
- id
- version
type: object
properties:
assignees:
$ref: '#/components/schemas/Cases_assignees'
category:
$ref: '#/components/schemas/Cases_case_category'
connector:
oneOf:
- $ref: '#/components/schemas/Cases_connector_properties_none'
- $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
- $ref: '#/components/schemas/Cases_connector_properties_jira'
- $ref: '#/components/schemas/Cases_connector_properties_resilient'
- $ref: '#/components/schemas/Cases_connector_properties_servicenow'
- $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
- $ref: '#/components/schemas/Cases_connector_properties_swimlane'
customFields:
maxItems: 10
minItems: 0
type: array
items:
required:
- key
- type
- value
type: object
properties:
key:
type: string
description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
type:
enum:
- text
- toggle
type: string
description: "The custom field type. It must match the type specified in the case configuration settings.\n"
value:
oneOf:
- maxLength: 160
minLength: 1
type:
- 'null'
- string
- type: boolean
description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
description: "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n"
description:
$ref: '#/components/schemas/Cases_case_description'
id:
maxLength: 30000
type: string
description: The identifier for the case.
settings:
$ref: '#/components/schemas/Cases_settings'
severity:
$ref: '#/components/schemas/Cases_case_severity'
status:
$ref: '#/components/schemas/Cases_case_status'
tags:
$ref: '#/components/schemas/Cases_case_tags'
title:
$ref: '#/components/schemas/Cases_case_title'
version:
type: string
description: 'The current version of the case. To determine this value, use the get case or find cases APIs.'
description: An array containing one or more case objects.
description: The update case API request body varies depending on the type of connector.
Cases_update_user_comment_request_properties:
title: Update case comment request properties for user comments
required:
- comment
- id
- owner
- type
- version
type: object
properties:
comment:
maxLength: 30000
type: string
description: The new comment. It is required only when `type` is `user`.
example: A new comment.
id:
type: string
description: "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n"
example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
owner:
$ref: '#/components/schemas/Cases_owner'
type:
enum:
- user
type: string
description: The type of comment.
example: user
version:
type: string
description: "The current comment version. To retrieve version values, use the get comments API.\n"
example: Wzk1LDFd
description: Defines properties for case comment requests when type is user.
Cases_user_actions_find_response_properties:
required:
- action
- comment_id
- created_at
- created_by
- id
- owner
- payload
- type
- version
type: object
properties:
action:
$ref: '#/components/schemas/Cases_actions'
comment_id:
type:
- 'null'
- string
example: 578608d0-03b1-11ed-920c-974bfa104448
created_at:
type: string
format: date-time
example: '2022-05-13T09:16:17.416Z'
created_by:
required:
- email
- full_name
- username
type: object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
id:
type: string
example: 22fd3e30-03b1-11ed-920c-974bfa104448
owner:
$ref: '#/components/schemas/Cases_owner'
payload:
oneOf:
- $ref: '#/components/schemas/Cases_payload_alert_comment'
- $ref: '#/components/schemas/Cases_payload_assignees'
- $ref: '#/components/schemas/Cases_payload_connector'
- $ref: '#/components/schemas/Cases_payload_create_case'
- $ref: '#/components/schemas/Cases_payload_delete'
- $ref: '#/components/schemas/Cases_payload_description'
- $ref: '#/components/schemas/Cases_payload_pushed'
- $ref: '#/components/schemas/Cases_payload_settings'
- $ref: '#/components/schemas/Cases_payload_severity'
- $ref: '#/components/schemas/Cases_payload_status'
- $ref: '#/components/schemas/Cases_payload_tags'
- $ref: '#/components/schemas/Cases_payload_title'
- $ref: '#/components/schemas/Cases_payload_user_comment'
type:
enum:
- assignees
- create_case
- comment
- connector
- description
- pushed
- tags
- title
- status
- settings
- severity
type: string
description: The type of action.
example: create_case
version:
type: string
example: WzM1ODg4LDFd
Cases_user_actions_response_properties:
required:
- action
- action_id
- case_id
- comment_id
- created_at
- created_by
- owner
- payload
- type
type: object
properties:
action:
$ref: '#/components/schemas/Cases_actions'
action_id:
type: string
example: 22fd3e30-03b1-11ed-920c-974bfa104448
case_id:
type: string
example: 22df07d0-03b1-11ed-920c-974bfa104448
comment_id:
type:
- 'null'
- string
example: 578608d0-03b1-11ed-920c-974bfa104448
created_at:
type: string
format: date-time
example: '2022-05-13T09:16:17.416Z'
created_by:
required:
- email
- full_name
- username
type: object
properties:
email:
type:
- 'null'
- string
example: 'null'
full_name:
type:
- 'null'
- string
example: 'null'
profile_uid:
type: string
example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
username:
type:
- 'null'
- string
example: elastic
owner:
$ref: '#/components/schemas/Cases_owner'
payload:
oneOf:
- $ref: '#/components/schemas/Cases_payload_alert_comment'
- $ref: '#/components/schemas/Cases_payload_assignees'
- $ref: '#/components/schemas/Cases_payload_connector'
- $ref: '#/components/schemas/Cases_payload_create_case'
- $ref: '#/components/schemas/Cases_payload_delete'
- $ref: '#/components/schemas/Cases_payload_description'
- $ref: '#/components/schemas/Cases_payload_pushed'
- $ref: '#/components/schemas/Cases_payload_settings'
- $ref: '#/components/schemas/Cases_payload_severity'
- $ref: '#/components/schemas/Cases_payload_status'
- $ref: '#/components/schemas/Cases_payload_tags'
- $ref: '#/components/schemas/Cases_payload_title'
- $ref: '#/components/schemas/Cases_payload_user_comment'
type:
$ref: '#/components/schemas/Cases_action_types'
Cases_user_comment_response_properties:
title: Case response properties for user comments
required:
- type
type: object
properties:
comment:
type: string
example: A new comment.
created_at:
type: string
format: date-time
example: '2022-05-13T09:16:17.416Z'
created_by:
$ref: '#/components/schemas/Cases_case_response_created_by_properties'
id:
type: string
example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
owner:
$ref: '#/components/schemas/Cases_owner'
pushed_at:
type:
- 'null'
- string
format: date-time
example: 'null'
pushed_by:
$ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
type:
enum:
- user
type: string
example: user
updated_at:
type:
- 'null'
- string
format: date-time
example: 'null'
updated_by:
$ref: '#/components/schemas/Cases_case_response_updated_by_properties'
version:
type: string
example: WzIwNDMxLDFd
Data_views_400_response:
title: Bad request
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
statusCode:
type: number
example: 400
Data_views_404_response:
type: object
properties:
error:
enum:
- Not Found
type: string
example: Not Found
message:
type: string
example: 'Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found'
statusCode:
enum:
- 404
type: integer
example: 404
Data_views_allownoindex:
type: boolean
description: Allows the data view saved object to exist before the data is available.
Data_views_create_data_view_request_object:
title: Create data view request
required:
- data_view
type: object
properties:
data_view:
required:
- title
type: object
properties:
allowNoIndex:
$ref: '#/components/schemas/Data_views_allownoindex'
fieldAttrs:
type: object
additionalProperties:
$ref: '#/components/schemas/Data_views_fieldattrs'
fieldFormats:
$ref: '#/components/schemas/Data_views_fieldformats'
fields:
type: object
id:
type: string
name:
type: string
description: The data view name.
namespaces:
$ref: '#/components/schemas/Data_views_namespaces'
runtimeFieldMap:
type: object
additionalProperties:
$ref: '#/components/schemas/Data_views_runtimefieldmap'
sourceFilters:
$ref: '#/components/schemas/Data_views_sourcefilters'
timeFieldName:
$ref: '#/components/schemas/Data_views_timefieldname'
title:
$ref: '#/components/schemas/Data_views_title'
type:
$ref: '#/components/schemas/Data_views_type'
typeMeta:
$ref: '#/components/schemas/Data_views_typemeta'
version:
type: string
description: The data view object.
override:
type: boolean
description: Override an existing data view if a data view with the provided title already exists.
default: false
Data_views_data_view_response_object:
title: Data view response properties
type: object
properties:
data_view:
type: object
properties:
allowNoIndex:
$ref: '#/components/schemas/Data_views_allownoindex'
fieldAttrs:
type: object
additionalProperties:
$ref: '#/components/schemas/Data_views_fieldattrs'
fieldFormats:
$ref: '#/components/schemas/Data_views_fieldformats'
fields:
type: object
id:
type: string
example: ff959d40-b880-11e8-a6d9-e546fe2bba5f
name:
type: string
description: The data view name.
namespaces:
$ref: '#/components/schemas/Data_views_namespaces'
runtimeFieldMap:
type: object
additionalProperties:
$ref: '#/components/schemas/Data_views_runtimefieldmap'
sourceFilters:
$ref: '#/components/schemas/Data_views_sourcefilters'
timeFieldName:
$ref: '#/components/schemas/Data_views_timefieldname'
title:
$ref: '#/components/schemas/Data_views_title'
typeMeta:
$ref: '#/components/schemas/Data_views_typemeta_response'
version:
type: string
example: WzQ2LDJd
Data_views_fieldattrs:
type: object
properties:
count:
type: integer
description: Popularity count for the field.
customDescription:
maxLength: 300
type: string
description: Custom description for the field.
customLabel:
type: string
description: Custom label for the field.
description: A map of field attributes by field name.
Data_views_fieldformats:
type: object
description: A map of field formats by field name.
Data_views_namespaces:
type: array
items:
type: string
default: default
description: An array of space identifiers for sharing the data view between multiple spaces.
Data_views_runtimefieldmap:
required:
- script
- type
type: object
properties:
script:
type: object
properties:
source:
type: string
description: Script for the runtime field.
type:
type: string
description: Mapping type of the runtime field.
description: A map of runtime field definitions by field name.
Data_views_sourcefilters:
type: array
items:
required:
- value
type: object
properties:
value:
type: string
description: The array of field names you want to filter out in Discover.
Data_views_swap_data_view_request_object:
title: Data view reference swap request
required:
- fromId
- toId
type: object
properties:
delete:
type: boolean
description: Deletes referenced saved object if all references are removed.
forId:
oneOf:
- type: string
- type: array
items:
type: string
description: Limit the affected saved objects to one or more by identifier.
forType:
type: string
description: Limit the affected saved objects by type.
fromId:
type: string
description: The saved object reference to change.
fromType:
type: string
description: "Specify the type of the saved object reference to alter. The default value is `index-pattern` for data views.\n"
toId:
type: string
description: New saved object reference value to replace the old value.
Data_views_timefieldname:
type: string
description: 'The timestamp field name, which you use for time-based data views.'
Data_views_title:
type: string
description: 'Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (`*`).'
Data_views_type:
type: string
description: 'When set to `rollup`, identifies the rollup data views.'
Data_views_typemeta:
required:
- aggs
- params
type: object
properties:
aggs:
type: object
description: A map of rollup restrictions by aggregation type and field name.
params:
type: object
description: Properties for retrieving rollup fields.
description: 'When you use rollup indices, contains the field list for the rollup data view API endpoints.'
Data_views_typemeta_response:
type:
- 'null'
- object
properties:
aggs:
type: object
description: A map of rollup restrictions by aggregation type and field name.
params:
type: object
description: Properties for retrieving rollup fields.
description: 'When you use rollup indices, contains the field list for the rollup data view API endpoints.'
Data_views_update_data_view_request_object:
title: Update data view request
required:
- data_view
type: object
properties:
data_view:
type: object
properties:
allowNoIndex:
$ref: '#/components/schemas/Data_views_allownoindex'
fieldFormats:
$ref: '#/components/schemas/Data_views_fieldformats'
fields:
type: object
name:
type: string
runtimeFieldMap:
type: object
additionalProperties:
$ref: '#/components/schemas/Data_views_runtimefieldmap'
sourceFilters:
$ref: '#/components/schemas/Data_views_sourcefilters'
timeFieldName:
$ref: '#/components/schemas/Data_views_timefieldname'
title:
$ref: '#/components/schemas/Data_views_title'
type:
$ref: '#/components/schemas/Data_views_type'
typeMeta:
$ref: '#/components/schemas/Data_views_typemeta'
description: "The data view properties you want to update. Only the specified properties are updated in the data view. Unspecified fields stay as they are persisted.\n"
refresh_fields:
type: boolean
description: Reloads the data view fields after the data view is updated.
default: false
Fleet_agent:
title: Agent
required:
- type
- active
- enrolled_at
- id
- status
type: object
properties:
access_api_key:
type: string
access_api_key_id:
type: string
active:
type: boolean
components:
type: array
items:
$ref: '#/components/schemas/Fleet_agent_component'
default_api_key:
type: string
default_api_key_id:
type: string
enrolled_at:
type: string
id:
type: string
last_checkin:
type: string
local_metadata:
$ref: '#/components/schemas/Fleet_agent_metadata'
metrics:
type: object
properties:
cpu_avg:
type: number
description: 'Average agent CPU usage during the last 5 minutes, number between 0-1'
memory_size_byte_avg:
type: number
description: Average agent memory consumption during the last 5 minutes
policy_id:
type: string
policy_revision:
type: number
status:
$ref: '#/components/schemas/Fleet_agent_status'
type:
$ref: '#/components/schemas/Fleet_agent_type'
unenrolled_at:
type: string
unenrollment_started_at:
type: string
user_provided_metadata:
$ref: '#/components/schemas/Fleet_agent_metadata'
Fleet_agent_action:
title: Agent action
oneOf:
- properties:
ack_data:
type: string
data:
type: string
type:
enum:
- UNENROLL
- UPGRADE
- POLICY_REASSIGN
type: string
- properties:
data:
type: object
properties:
log_level:
enum:
- debug
- info
- warning
- error
type:
- 'null'
- string
type:
type: string
Fleet_agent_component:
title: Agent component
type: object
properties:
id:
type: string
message:
type: string
status:
$ref: '#/components/schemas/Fleet_agent_component_status'
type:
type: string
units:
type: array
items:
$ref: '#/components/schemas/Fleet_agent_component_unit'
Fleet_agent_component_status:
title: Agent component status
enum:
- starting
- configuring
- healthy
- degraded
- failed
- stopping
- stopped
type: string
Fleet_agent_component_unit:
title: Agent component unit
type: object
properties:
id:
type: string
message:
type: string
payload:
type: object
status:
$ref: '#/components/schemas/Fleet_agent_component_status'
type:
$ref: '#/components/schemas/Fleet_agent_component_unit_type'
Fleet_agent_component_unit_type:
title: Agent component unit type
enum:
- input
- output
type: string
Fleet_agent_diagnostics:
title: Agent diagnostics
required:
- id
- name
- createTime
- filePath
- actionId
- status
type: object
properties:
actionId:
type: string
createTime:
type: string
filePath:
type: string
id:
type: string
name:
type: string
status:
enum:
- READY
- AWAITING_UPLOAD
- DELETED
- IN_PROGRESS
Fleet_agent_get_by_actions:
title: Agents get by action ids
type: array
items:
type: array
items:
type: string
Fleet_agent_metadata:
title: Agent metadata
type: object
Fleet_agent_policy:
title: Agent Policy
required:
- id
- status
- name
- namespace
type: object
properties:
advanced_settings:
type:
- 'null'
- object
description: 'Advanced settings stored in the agent policy, e.g. agent_limits_go_max_procs'
agent_features:
type: array
items:
required:
- name
- enabled
type: object
properties:
enabled:
type: boolean
name:
type: string
agents:
type: number
data_output_id:
type:
- 'null'
- string
description:
type: string
download_source_id:
type:
- 'null'
- string
fleet_server_host_id:
type:
- 'null'
- string
global_data_tags:
type: array
items:
type: object
additionalProperties:
type:
- number
- string
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
id:
type: string
inactivity_timeout:
type: integer
is_protected:
type: boolean
description: Indicates whether the agent policy has tamper protection enabled. Default false.
keep_monitoring_alive:
type:
- 'null'
- boolean
description: 'When set to true, monitoring will be enabled but logs/metrics collection will be disabled'
monitoring_diagnostics:
type: object
properties:
limit:
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
type: array
items:
enum:
- metrics
- logs
type: string
monitoring_http:
required:
- enabled
type: object
properties:
enabled:
type: boolean
host:
type: string
port:
type: number
monitoring_output_id:
type:
- 'null'
- string
monitoring_pprof_enabled:
type: boolean
name:
type: string
namespace:
type: string
overrides:
type:
- 'null'
- object
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
package_policies:
type: array
items:
$ref: '#/components/schemas/Fleet_package_policy'
description: 'This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter'
revision:
type: number
supports_agentless:
type: boolean
description: Indicates whether the agent policy supports agentless integrations. Only allowed in a serverless environment.
unenroll_timeout:
type: integer
unprivileged_agents:
type: number
updated_by:
type: string
updated_on:
type: string
format: date-time
Fleet_agent_policy_create_request:
title: Create agent policy request
required:
- name
- namespace
type: object
properties:
agent_features:
type: array
items:
required:
- name
- enabled
type: object
properties:
enabled:
type: boolean
name:
type: string
data_output_id:
type:
- 'null'
- string
description:
type: string
download_source_id:
type:
- 'null'
- string
fleet_server_host_id:
type:
- 'null'
- string
force:
type: boolean
description: Force agent policy creation even if packages are not verified.
global_data_tags:
type: array
items:
type: object
additionalProperties:
type:
- number
- string
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
id:
type: string
inactivity_timeout:
type: integer
is_protected:
type: boolean
monitoring_enabled:
type: array
items:
enum:
- metrics
- logs
type: string
monitoring_output_id:
type:
- 'null'
- string
name:
type: string
namespace:
type: string
unenroll_timeout:
type: integer
Fleet_agent_policy_full:
title: Agent policy full response
type: object
oneOf:
- type: object
properties:
item:
type: string
- type: object
properties:
item:
$ref: '#/components/schemas/Fleet_full_agent_policy'
Fleet_agent_policy_update_request:
title: Update agent policy request
required:
- name
- namespace
type: object
properties:
agent_features:
type: array
items:
required:
- name
- enabled
type: object
properties:
enabled:
type: boolean
name:
type: string
data_output_id:
type:
- 'null'
- string
description:
type: string
download_source_id:
type:
- 'null'
- string
fleet_server_host_id:
type:
- 'null'
- string
force:
type: boolean
description: Force agent policy creation even if packages are not verified.
global_data_tags:
type: array
items:
type: object
additionalProperties:
type:
- number
- string
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
inactivity_timeout:
type: integer
is_protected:
type: boolean
monitoring_enabled:
type: array
items:
enum:
- metrics
- logs
type: string
monitoring_output_id:
type:
- 'null'
- string
name:
type: string
namespace:
type: string
unenroll_timeout:
type: integer
Fleet_agent_status:
title: Elastic Agent status
enum:
- offline
- error
- online
- inactive
- warning
type: string
Fleet_agent_type:
title: Agent type
enum:
- PERMANENT
- EPHEMERAL
- TEMPORARY
type: string
Fleet_bulk_install_packages_response:
title: Bulk install packages response
required:
- items
type: object
properties:
items:
type: array
items:
type: object
properties:
name:
type: string
version:
type: string
response:
type: array
items:
type: object
properties:
name:
type: string
version:
type: string
deprecated: true
Fleet_bulk_upgrade_agents:
title: Bulk upgrade agents
required:
- agents
- version
type: object
properties:
agents:
oneOf:
- maxLength: 500000
type: string
description: 'KQL query string, leave empty to action all agents'
- type: array
items:
maxLength: 512
type: string
description: list of agent IDs
force:
type: boolean
description: 'Force upgrade, skipping validation (should be used with caution)'
rollout_duration_seconds:
type: number
description: rolling upgrade window duration in seconds
skipRateLimitCheck:
type: boolean
description: Skip rate limit check for upgrade
source_uri:
type: string
description: alternative upgrade binary download url
start_time:
type: string
description: start time of upgrade in ISO 8601 format
version:
type: string
description: version to upgrade to
Fleet_data_stream:
title: Data stream
type: object
properties:
dashboard:
type: array
items:
type: object
properties:
id:
type: string
title:
type: string
dataset:
type: string
index:
type: string
last_activity_ms:
type: number
namespace:
type: string
package:
type: string
package_version:
type: string
size_in_bytes:
type: number
size_in_bytes_formatted:
type: string
type:
type: string
Fleet_download_sources:
title: Download Source
required:
- is_default
- name
- host
type: object
properties:
host:
type: string
id:
type: string
is_default:
type: boolean
name:
type: string
proxy_id:
type:
- 'null'
- string
description: The ID of the proxy to use for this download source. See the proxies API for more information.
Fleet_elasticsearch_asset_type:
title: Elasticsearch asset type
enum:
- component_template
- ingest_pipeline
- index_template
- ilm_policy
- transform
- data_stream_ilm_policy
type: string
Fleet_enrollment_api_key:
title: Enrollment API key
required:
- id
- api_key_id
- api_key
- active
- created_at
type: object
properties:
active:
type: boolean
description: 'When false, the enrollment API key is revoked and cannot be used for enrolling Elastic Agents.'
api_key:
type: string
description: The enrollment API key (token) used for enrolling Elastic Agents.
api_key_id:
type: string
description: The ID of the API key in the Security API.
created_at:
type: string
id:
type: string
name:
type: string
description: The name of the enrollment API key.
policy_id:
type: string
description: The ID of the agent policy the Elastic Agent will be enrolled in.
Fleet_fleet_server_host:
title: Fleet Server Host
required:
- fleet_server_hosts
- id
- is_default
- is_preconfigured
- host_urls
type: object
properties:
host_urls:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_internal:
type: boolean
is_preconfigured:
type: boolean
name:
type: string
proxy_id:
type: string
Fleet_fleet_settings_response:
title: Fleet settings response
required:
- item
type: object
properties:
item:
$ref: '#/components/schemas/Fleet_settings'
Fleet_fleet_setup_response:
title: Fleet Setup response
required:
- isInitialized
- nonFatalErrors
type: object
properties:
isInitialized:
type: boolean
nonFatalErrors:
type: array
items:
required:
- name
- message
type: object
properties:
message:
type: string
name:
type: string
Fleet_fleet_status_response:
title: Fleet status response
required:
- isReady
- missing_requirements
- missing_optional_features
type: object
properties:
isReady:
type: boolean
missing_optional_features:
type: array
items:
enum:
- encrypted_saved_object_encryption_key_required
type: string
missing_requirements:
type: array
items:
enum:
- tls_required
- api_keys
- fleet_admin_user
- fleet_server
type: string
package_verification_key_id:
type: string
Fleet_full_agent_policy:
title: Full agent policy
required:
- id
- outputs
- inputs
type: object
properties:
agent:
type:
- 'null'
- string
fleet:
oneOf:
- type: object
properties:
hosts:
type: array
items:
type: string
proxy_headers: { }
proxy_url:
type: string
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
renegotiation:
type: string
verification_mode:
type: string
- type: object
properties:
kibana:
type: object
properties:
hosts:
type: array
items:
type: string
path:
type: string
protocol:
type: string
id:
type: string
inputs:
type: string
monitoring:
required:
- enabled
- metrics
- logs
- traces
type: object
properties:
diagnostics:
type: object
properties:
limit:
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
enabled:
type: boolean
http:
required:
- enabled
type: object
properties:
enabled:
type: boolean
host:
type: string
port:
type: number
logs:
type: boolean
metrics:
type: boolean
namespace:
type: string
pprof:
required:
- enabled
type: object
properties:
enabled:
type: boolean
traces:
type: boolean
use_output:
type: string
output_permissions:
type: object
additionalProperties:
type: object
properties:
data:
$ref: '#/components/schemas/Fleet_full_agent_policy_output_permissions'
output:
type: integer
outputs:
type: object
additionalProperties:
$ref: '#/components/schemas/Fleet_full_agent_policy_output'
revision:
type: number
secret_references:
type: array
items:
type: object
properties:
id:
type: string
Fleet_full_agent_policy_input:
title: Full agent policy input
allOf:
- required:
- id
- name
- revision
- type
- data_stream
- use_output
type: object
properties:
data_stream:
required:
- namespace
type: object
properties:
namespace:
type: string
id:
type: string
meta:
type: object
properties:
package:
required:
- name
- version
type: object
properties:
name:
type: string
version:
type: string
name:
type: string
revision:
type: number
streams:
$ref: '#/components/schemas/Fleet_full_agent_policy_input_stream'
type:
type: string
use_output:
type: string
Fleet_full_agent_policy_input_stream:
title: Full agent policy input stream
allOf:
- required:
- id
- data_stream
type: object
properties:
data_stream:
required:
- dataset
- type
type: object
properties:
dataset:
type: string
type:
type: string
id:
type: string
Fleet_full_agent_policy_output:
title: Full agent policy
required:
- type
- hosts
- ca_sha256
type: object
properties:
additionalProperties:
type: object
properties:
text: { }
ca_sha256:
type:
- 'null'
- string
hosts:
type: array
items:
type: string
proxy_headers: { }
proxy_url:
type: string
type: { }
Fleet_full_agent_policy_output_permissions:
title: Full agent policy output permissions
additionalProperties:
type: object
properties:
data:
type: object
properties:
cluster:
type: array
items:
type: string
indices:
type: array
items:
type: object
properties:
names:
type: array
items:
type: string
privileges:
type: array
items:
type: string
packagePolicyName:
type: string
Fleet_get_agent_tags_response:
title: Get Agent Tags response
type: object
properties:
items:
type: array
items:
type: string
Fleet_get_agents_response:
title: Get Agent response
required:
- items
- total
- page
- perPage
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_agent'
list:
type: array
items:
$ref: '#/components/schemas/Fleet_agent'
deprecated: true
page:
type: number
perPage:
type: number
statusSummary:
type: object
properties:
degraded':
type: number
enrolling:
type: number
error:
type: number
inactive:
type: number
offline:
type: number
online:
type: number
unenrolled:
type: number
unenrolling:
type: number
updating:
type: number
total:
type: number
Fleet_get_bulk_assets_response:
title: Bulk get assets response
required:
- items
type: object
properties:
items:
type: array
items:
type: object
properties:
appLink:
type: string
attributes:
type: object
properties:
description:
type: string
title:
type: string
id:
type: string
type:
$ref: '#/components/schemas/Fleet_saved_object_type'
updatedAt:
type: string
deprecated: true
Fleet_get_categories_response:
title: Get categories response
required:
- items
type: object
properties:
items:
type: array
items:
required:
- id
- title
- count
type: object
properties:
count:
type: number
id:
type: string
title:
type: string
response:
type: array
items:
required:
- id
- title
- count
type: object
properties:
count:
type: number
id:
type: string
title:
type: string
deprecated: true
Fleet_get_packages_response:
title: Get Packages response
required:
- items
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Fleet_search_result'
response:
type: array
items:
$ref: '#/components/schemas/Fleet_search_result'
deprecated: true
Fleet_installation_info:
title: Installation info object
required:
- installed_kibana
- installed_es
- name
- version
- install_status
- install_version
- install_started_at
- install_source
- verification_status
- latest_install_failed_attempts
type: object
properties:
created_at:
type: string
experimental_data_stream_features:
type: array
items:
type: object
properties:
data_stream:
type: string
features:
type: object
properties:
doc_value_only_numeric:
type:
- 'null'
- boolean
doc_value_only_other:
type:
- 'null'
- boolean
synthetic_source:
type:
- 'null'
- boolean
tsdb:
type:
- 'null'
- boolean
install_format_schema_version:
type: string
install_kibana_space_id:
type: string
install_source:
enum:
- registry
- upload
- bundled
type: string
install_status:
enum:
- installed
- installing
- install_failed
type: string
installed_es:
type: object
properties:
deferred:
type: boolean
id:
type: string
type:
$ref: '#/components/schemas/Fleet_elasticsearch_asset_type'
installed_kibana:
type: object
properties:
id:
type: string
type:
$ref: '#/components/schemas/Fleet_kibana_saved_object_type'
latest_executed_state:
type: object
properties:
error:
type: string
name:
enum:
- create_restart_installation
- install_kibana_assets
- install_ilm_policies
- install_ml_model
- install_index_template_pipelines
- remove_legacy_templates
- update_current_write_indices
- install_transforms
- delete_previous_pipelines
- save_archive_entries_from_assets_map
- update_so
type: string
started_at:
type: string
description: Latest successfully executed state in package install state machine
latest_install_failed_attempts:
type: array
items:
type: object
properties:
created_at:
type: string
error:
type: object
properties:
message:
type: string
name:
type: string
stack:
type: string
target_version:
type: string
description: Latest failed install errors
name:
type: string
namespaces:
type: array
items:
type: string
type:
type: string
updated_at:
type: string
verification_key_id:
type:
- 'null'
- string
verification_status:
enum:
- verified
- unverified
- unknown
type: string
version:
type: string
Fleet_kibana_saved_object_type:
title: Kibana saved object asset type
enum:
- dashboard
- visualization
- search
- index-pattern
- map
- lens
- ml-module
- security-rule
- csp_rule_template
type: string
Fleet_new_package_policy:
title: New package policy
required:
- inputs
- name
type: object
properties:
description:
type: string
enabled:
type: boolean
inputs:
type: array
items:
required:
- type
- enabled
type: object
properties:
config:
type: object
enabled:
type: boolean
processors:
type: array
items:
type: string
streams:
type: array
items: { }
type:
type: string
vars:
type: object
name:
type: string
namespace:
type: string
output_id:
type: string
overrides:
type: object
package:
required:
- name
- version
type: object
properties:
name:
type: string
requires_root:
type: boolean
title:
type: string
version:
type: string
policy_id:
type:
- 'null'
- string
deprecated: true
policy_ids:
type: array
items:
type: string
description: ''
Fleet_output_create_request:
title: Output
oneOf:
- $ref: '#/components/schemas/Fleet_output_create_request_elasticsearch'
- $ref: '#/components/schemas/Fleet_output_create_request_kafka'
- $ref: '#/components/schemas/Fleet_output_create_request_logstash'
- $ref: '#/components/schemas/Fleet_output_create_request_remote_elasticsearch'
discriminator:
propertyName: type
mapping:
elasticsearch: '#/components/schemas/Fleet_output_create_request_elasticsearch'
kafka: '#/components/schemas/Fleet_output_create_request_kafka'
logstash: '#/components/schemas/Fleet_output_create_request_logstash'
remote_elasticsearch: '#/components/schemas/Fleet_output_create_request_remote_elasticsearch'
Fleet_output_create_request_elasticsearch:
title: elasticsearch
required:
- name
type: object
properties:
ca_sha256:
type: string
ca_trusted_fingerprint:
type: string
config:
type: object
config_yaml:
type: string
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
name:
type: string
preset:
enum:
- balanced
- custom
- throughput
- scale
- latency
type: string
proxy_id:
type: string
shipper:
type: object
properties:
compression_level:
type: number
disk_queue_compression_enabled:
type: boolean
disk_queue_enabled:
type: boolean
disk_queue_encryption_enabled:
type: boolean
disk_queue_max_size:
type: number
disk_queue_path:
type: string
loadbalance:
type: boolean
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
type:
enum:
- elasticsearch
type: string
Fleet_output_create_request_kafka:
title: kafka
required:
- name
- type
- topics
- auth_type
- hosts
type: object
properties:
auth_type:
type: string
broker_timeout:
type: number
ca_sha256:
type: string
ca_trusted_fingerprint:
type: string
client_id:
type: string
compression:
type: string
compression_level:
type: number
config:
type: object
config_yaml:
type: string
connection_type:
enum:
- plaintext
- encryption
type: string
headers:
type: array
items:
type: object
properties:
key:
type: string
value:
type: string
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
key:
type: string
name:
type: string
partition:
type: string
password:
type: string
proxy_id:
type: string
random:
type: object
properties:
group_events:
type: number
required_acks:
type: number
round_robin:
type: object
properties:
group_events:
type: number
sasl:
type: object
properties:
mechanism:
type: string
secrets:
type: object
properties:
password:
type: string
ssl:
type: object
properties:
key:
type: string
shipper:
type: object
properties:
compression_level:
type: number
disk_queue_compression_enabled:
type: boolean
disk_queue_enabled:
type: boolean
disk_queue_encryption_enabled:
type: boolean
disk_queue_max_size:
type: number
disk_queue_path:
type: string
loadbalance:
type: boolean
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
verification_mode:
enum:
- none
- full
- certificate
- strict
type: string
timeout:
type: number
topic:
type: string
topics:
type: array
items:
type: object
properties:
topic:
type: string
when:
type: object
properties:
condition:
type: string
type:
type: string
description: 'Deprecated, kafka output do not support conditionnal topics anymore.'
deprecated: true
description: Use topic instead.
deprecated: true
type:
enum:
- kafka
type: string
username:
type: string
version:
type: string
Fleet_output_create_request_logstash:
title: logstash
required:
- name
- hosts
- type
type: object
properties:
ca_sha256:
type: string
ca_trusted_fingerprint:
type: string
config:
type: object
config_yaml:
type: string
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
name:
type: string
proxy_id:
type: string
secrets:
type: object
properties:
ssl:
type: object
properties:
key:
type: string
shipper:
type: object
properties:
compression_level:
type: number
disk_queue_compression_enabled:
type: boolean
disk_queue_enabled:
type: boolean
disk_queue_encryption_enabled:
type: boolean
disk_queue_max_size:
type: number
disk_queue_path:
type: string
loadbalance:
type: boolean
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
type:
enum:
- logstash
type: string
Fleet_output_create_request_remote_elasticsearch:
title: remote_elasticsearch
required:
- name
type: object
properties:
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
name:
type: string
secrets:
type: object
properties:
service_token:
type: string
service_token:
type: string
type:
enum:
- remote_elasticsearch
type: string
Fleet_output_update_request:
title: Output
oneOf:
- $ref: '#/components/schemas/Fleet_output_update_request_elasticsearch'
- $ref: '#/components/schemas/Fleet_output_update_request_kafka'
- $ref: '#/components/schemas/Fleet_output_update_request_logstash'
discriminator:
propertyName: type
mapping:
elasticsearch: '#/components/schemas/Fleet_output_update_request_elasticsearch'
kafka: '#/components/schemas/Fleet_output_update_request_kafka'
logstash: '#/components/schemas/Fleet_output_update_request_logstash'
Fleet_output_update_request_elasticsearch:
title: elasticsearch
required:
- name
- hosts
- type
type: object
properties:
ca_sha256:
type: string
ca_trusted_fingerprint:
type: string
config:
type: object
config_yaml:
type: string
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
name:
type: string
preset:
enum:
- balanced
- custom
- throughput
- scale
- latency
type: string
proxy_id:
type: string
shipper:
type: object
properties:
compression_level:
type: number
disk_queue_compression_enabled:
type: boolean
disk_queue_enabled:
type: boolean
disk_queue_encryption_enabled:
type: boolean
disk_queue_max_size:
type: number
disk_queue_path:
type: string
loadbalance:
type: boolean
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
type:
enum:
- elasticsearch
type: string
Fleet_output_update_request_kafka:
title: kafka
required:
- name
type: object
properties:
auth_type:
type: string
broker_timeout:
type: number
ca_sha256:
type: string
ca_trusted_fingerprint:
type: string
client_id:
type: string
compression:
type: string
compression_level:
type: number
config:
type: object
config_yaml:
type: string
connection_type:
enum:
- plaintext
- encryption
type: string
headers:
type: array
items:
type: object
properties:
key:
type: string
value:
type: string
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
key:
type: string
name:
type: string
partition:
type: string
password:
type: string
proxy_id:
type: string
random:
type: object
properties:
group_events:
type: number
required_acks:
type: number
round_robin:
type: object
properties:
group_events:
type: number
sasl:
type: object
properties:
mechanism:
type: string
shipper:
type: object
properties:
compression_level:
type: number
disk_queue_compression_enabled:
type: boolean
disk_queue_enabled:
type: boolean
disk_queue_encryption_enabled:
type: boolean
disk_queue_max_size:
type: number
disk_queue_path:
type: string
loadbalance:
type: boolean
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
verification_mode:
enum:
- none
- full
- certificate
- strict
type: string
timeout:
type: number
topic:
type: string
topics:
type: array
items:
type: object
properties:
topic:
type: string
when:
type: object
properties:
condition:
type: string
type:
type: string
description: 'Deprecated, kafka output do not support conditionnal topics anymore.'
deprecated: true
description: Use topic instead.
deprecated: true
type:
enum:
- kafka
type: string
username:
type: string
version:
type: string
Fleet_output_update_request_logstash:
title: logstash
required:
- name
type: object
properties:
ca_sha256:
type: string
ca_trusted_fingerprint:
type: string
config:
type: object
config_yaml:
type: string
hosts:
type: array
items:
type: string
id:
type: string
is_default:
type: boolean
is_default_monitoring:
type: boolean
is_internal:
type: boolean
name:
type: string
proxy_id:
type: string
shipper:
type: object
properties:
compression_level:
type: number
disk_queue_compression_enabled:
type: boolean
disk_queue_enabled:
type: boolean
disk_queue_encryption_enabled:
type: boolean
disk_queue_max_size:
type: number
disk_queue_path:
type: string
loadbalance:
type: boolean
ssl:
type: object
properties:
certificate:
type: string
certificate_authorities:
type: array
items:
type: string
key:
type: string
type:
enum:
- logstash
type: string
Fleet_package_info:
title: Package information
required:
- name
- title
- version
- description
- type
- categories
- conditions
- assets
- format_version
- download
- path
- owner
type: object
properties:
agent:
type: object
properties:
privileges:
type: object
properties:
root:
type: boolean
asset_tags:
type: array
items:
required:
- text
type: object
properties:
asset_ids:
type: array
items:
type: string
asset_types:
type: array
items:
type: string
text:
type: string
assets:
type: array
items:
type: string
categories:
type: array
items:
type: string
conditions:
type: object
properties:
elasticsearch:
type: object
properties:
subscription:
enum:
- basic
- gold
- platinum
- enterprise
type: string
kibana:
type: object
properties:
versions:
type: string
data_streams:
type: array
items:
required:
- title
- name
- release
- ingeset_pipeline
- type
- package
type: object
properties:
ingeset_pipeline:
type: string
name:
type: string
package:
type: string
release:
type: string
title:
type: string
type:
type: string
vars:
type: array
items:
required:
- name
- default
type: object
properties:
default:
type: string
name:
type: string
description:
type: string
discovery:
type: object
properties:
fields:
type: array
items:
required:
- name
type: object
properties:
name:
type: string
download:
type: string
elasticsearch:
type: object
properties:
privileges:
type: object
properties:
cluster:
type: array
items:
type: string
format_version:
type: string
icons:
type: array
items:
type: string
internal:
type: boolean
name:
type: string
owner:
required:
- github
type: object
properties:
github:
type: string
type:
enum:
- elastic
- partner
- community
type: string
path:
type: string
readme:
type: string
release:
enum:
- experimental
- beta
- ga
type: string
description: 'release label is deprecated, derive from the version instead (packages follow semver)'
deprecated: true
screenshots:
type: array
items:
required:
- src
- path
type: object
properties:
path:
type: string
size:
type: string
src:
type: string
title:
type: string
type:
type: string
source:
type: object
properties:
license:
enum:
- Apache-2.0
- Elastic-2.0
type: string
title:
type: string
type:
enum:
- integration
- input
- content
type: string
version:
type: string
Fleet_package_policy:
title: Package policy
allOf:
- required:
- id
- revision
type: object
properties:
id:
type: string
inputs:
oneOf:
- type: array
items: { }
- type: object
revision:
type: number
- $ref: '#/components/schemas/Fleet_new_package_policy'
Fleet_package_policy_request:
title: Package Policy Request
required:
- name
- package
type: object
properties:
description:
type: string
description: Package policy description
example: my description
force:
type: boolean
description: 'Force package policy creation even if package is not verified, or if the agent policy is managed.'
id:
type: string
description: Package policy unique identifier
inputs:
type: object
additionalProperties:
type: object
properties:
enabled:
type: boolean
description: 'enable or disable that input, (default to true)'
streams:
type: object
additionalProperties:
type: object
properties:
enabled:
type: boolean
description: 'enable or disable that stream, (default to true)'
vars:
type: object
description: Stream level variable (see integration documentation for more information)
description: Input streams (see integration documentation to know what streams are available)
vars:
type: object
description: Input level variable (see integration documentation for more information)
description: Package policy inputs (see integration documentation to know what inputs are available)
example:
nginx-logfile:
enabled: true
streams:
nginx.access:
enabled: true
vars:
ignore_older: 72h
paths:
- /var/log/nginx/access.log*
preserve_original_event: false
tags:
- nginx-access
name:
type: string
description: Package policy name (should be unique)
example: nginx-123
namespace:
type: string
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
example: customnamespace
output_id:
type:
- 'null'
- string
description: Output ID to send package data to
example: output-id
overrides:
type:
- 'null'
- object
properties:
inputs:
type: object
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
package:
required:
- name
- version
type: object
properties:
name:
type: string
description: Package name
example: nginx
version:
type: string
description: Package version
example: '1.6.0'
policy_id:
type:
- 'null'
- string
description: Agent policy ID where that package policy will be added
example: agent-policy-id
deprecated: true
policy_ids:
type: array
items:
type: string
description: Agent policy IDs where that package policy will be added
example:
- agent-policy-id
vars:
type: object
description: Package root level variable (see integration documentation for more information)
Fleet_package_usage_stats:
title: Package usage stats
required:
- agent_policy_count
type: object
properties:
agent_policy_count:
type: integer
Fleet_proxies:
title: Fleet Proxy
required:
- name
- url
type: object
properties:
certificate:
type: string
certificate_authorities:
type: string
certificate_key:
type: string
id:
type: string
name:
type: string
proxy_headers:
type: object
url:
type: string
Fleet_saved_object_type:
title: Saved Object type
oneOf:
- enum:
- dashboard
- visualization
- search
- index_pattern
- map
- lens
- security_rule
- csp_rule_template
- ml_module
- tag
- osquery_pack_asset
- osquery_saved_query
type: string
- enum:
- index
- component_template
- ingest_pipeline
- index_template
- ilm_policy
- transform
- data_stream_ilm_policy
- ml_model
type: string
Fleet_search_result:
title: Search result
required:
- description
- download
- icons
- name
- path
- title
- type
- version
- status
type: object
properties:
description:
type: string
download:
type: string
icons:
type: string
installationInfo:
$ref: '#/components/schemas/Fleet_installation_info'
name:
type: string
path:
type: string
savedObject:
type: object
deprecated: true
status:
type: string
title:
type: string
type:
type: string
version:
type: string
Fleet_settings:
title: Settings
required:
- fleet_server_hosts
- id
type: object
properties:
delete_unenrolled_agents:
type: object
properties:
enabled:
type: boolean
is_preconfigured:
type: boolean
fleet_server_hosts:
type: array
items:
type: string
deprecated: true
has_seen_add_data_notice:
type: boolean
id:
type: string
prerelease_integrations_enabled:
type: boolean
Fleet_upgrade_agent:
title: Upgrade agent
required:
- version
type: object
properties:
force:
type: boolean
description: 'Force upgrade, skipping validation (should be used with caution)'
skipRateLimitCheck:
type: boolean
description: Skip rate limit check for upgrade
source_uri:
type: string
version:
type: string
Fleet_upgrade_agent_diff:
title: Package policy Upgrade dryrun
type: array
items:
type: array
items:
$ref: '#/components/schemas/Fleet_full_agent_policy_input'
Fleet_upgrade_diff:
title: Package policy Upgrade dryrun
type: array
items:
allOf:
- $ref: '#/components/schemas/Fleet_package_policy'
- type: object
allOf:
- $ref: '#/components/schemas/Fleet_new_package_policy'
- type: object
properties:
errors:
type: array
items:
type: object
properties:
key:
type: string
message:
type: string
missingVars:
type: array
items:
type: string
Kibana_HTTP_APIs_core_status_redactedResponse:
required:
- status
type: object
properties:
status:
required:
- overall
type: object
properties:
overall:
required:
- level
type: object
properties:
level:
enum:
- available
- degraded
- unavailable
- critical
type: string
description: Service status levels as human and machine readable values.
additionalProperties: false
additionalProperties: false
additionalProperties: false
description: A minimal representation of Kibana's operational status.
Kibana_HTTP_APIs_core_status_response:
required:
- name
- uuid
- version
- status
- metrics
type: object
properties:
metrics:
required:
- elasticsearch_client
- last_updated
- collection_interval_in_millis
type: object
properties:
collection_interval_in_millis:
type: number
description: The interval at which metrics should be collected.
elasticsearch_client:
required:
- totalActiveSockets
- totalIdleSockets
- totalQueuedRequests
type: object
properties:
totalActiveSockets:
type: number
description: Count of network sockets currently in use.
totalIdleSockets:
type: number
description: Count of network sockets currently idle.
totalQueuedRequests:
type: number
description: Count of requests not yet assigned to sockets.
additionalProperties: false
description: Current network metrics of Kibana's Elasticsearch client.
last_updated:
type: string
description: The time metrics were collected.
additionalProperties: false
description: Metric groups collected by Kibana.
name:
type: string
description: Kibana instance name.
status:
required:
- overall
- core
- plugins
type: object
properties:
core:
required:
- elasticsearch
- savedObjects
type: object
properties:
elasticsearch:
required:
- level
- summary
- meta
type: object
properties:
detail:
type: string
description: Human readable detail of the service status.
documentationUrl:
type: string
description: A URL to further documentation regarding this service.
level:
enum:
- available
- degraded
- unavailable
- critical
type: string
description: Service status levels as human and machine readable values.
meta:
type: object
additionalProperties: { }
description: An unstructured set of extra metadata about this service.
summary:
type: string
description: A human readable summary of the service status.
additionalProperties: false
savedObjects:
required:
- level
- summary
- meta
type: object
properties:
detail:
type: string
description: Human readable detail of the service status.
documentationUrl:
type: string
description: A URL to further documentation regarding this service.
level:
enum:
- available
- degraded
- unavailable
- critical
type: string
description: Service status levels as human and machine readable values.
meta:
type: object
additionalProperties: { }
description: An unstructured set of extra metadata about this service.
summary:
type: string
description: A human readable summary of the service status.
additionalProperties: false
additionalProperties: false
description: Statuses of core Kibana services.
overall:
required:
- level
- summary
- meta
type: object
properties:
detail:
type: string
description: Human readable detail of the service status.
documentationUrl:
type: string
description: A URL to further documentation regarding this service.
level:
enum:
- available
- degraded
- unavailable
- critical
type: string
description: Service status levels as human and machine readable values.
meta:
type: object
additionalProperties: { }
description: An unstructured set of extra metadata about this service.
summary:
type: string
description: A human readable summary of the service status.
additionalProperties: false
plugins:
type: object
additionalProperties:
required:
- level
- summary
- meta
type: object
properties:
detail:
type: string
description: Human readable detail of the service status.
documentationUrl:
type: string
description: A URL to further documentation regarding this service.
level:
enum:
- available
- degraded
- unavailable
- critical
type: string
description: Service status levels as human and machine readable values.
meta:
type: object
additionalProperties: { }
description: An unstructured set of extra metadata about this service.
summary:
type: string
description: A human readable summary of the service status.
additionalProperties: false
description: A dynamic mapping of plugin ID to plugin status.
additionalProperties: false
uuid:
type: string
description: 'Unique, generated Kibana instance UUID. This UUID should persist even if the Kibana process restarts.'
version:
required:
- number
- build_hash
- build_number
- build_snapshot
- build_flavor
- build_date
type: object
properties:
build_date:
type: string
description: The date and time of this build.
build_flavor:
enum:
- serverless
- traditional
type: string
description: 'The build flavour determines configuration and behavior of Kibana. On premise users will almost always run the "traditional" flavour, while other flavours are reserved for Elastic-specific use cases.'
build_hash:
type: string
description: A unique hash value representing the git commit of this Kibana build.
build_number:
type: number
description: 'A monotonically increasing number, each subsequent build will have a higher number.'
build_snapshot:
type: boolean
description: Whether this build is a snapshot build.
number:
type: string
description: A semantic version number.
additionalProperties: false
additionalProperties: false
description: Kibana's operational status as well as a detailed breakdown of plugin statuses indication of various loads (like event loop utilization and network traffic) at time of request.
Machine_learning_APIs_mlSync200Response:
title: Successful sync API response
type: object
properties:
datafeedsAdded:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds'
description: 'If a saved object for an anomaly detection job is missing a datafeed identifier, it is added when you run the sync machine learning saved objects API.'
datafeedsRemoved:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds'
description: 'If a saved object for an anomaly detection job references a datafeed that no longer exists, it is deleted when you run the sync machine learning saved objects API.'
savedObjectsCreated:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsCreated'
savedObjectsDeleted:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted'
Machine_learning_APIs_mlSync4xxResponse:
title: Unsuccessful sync API response
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
statusCode:
type: integer
example: 401
Machine_learning_APIs_mlSyncResponseAnomalyDetectors:
title: Sync API response for anomaly detection jobs
type: object
properties:
success:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
description: 'The sync machine learning saved objects API response contains this object when there are anomaly detection jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.'
Machine_learning_APIs_mlSyncResponseDatafeeds:
title: Sync API response for datafeeds
type: object
properties:
success:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
description: 'The sync machine learning saved objects API response contains this object when there are datafeeds affected by the synchronization. There is an object for each relevant datafeed, which contains the synchronization status.'
Machine_learning_APIs_mlSyncResponseDataFrameAnalytics:
title: Sync API response for data frame analytics jobs
type: object
properties:
success:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
description: 'The sync machine learning saved objects API response contains this object when there are data frame analytics jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.'
Machine_learning_APIs_mlSyncResponseSavedObjectsCreated:
title: Sync API response for created saved objects
type: object
properties:
anomaly-detector:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors'
description: 'If saved objects are missing for anomaly detection jobs, they are created.'
data-frame-analytics:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics'
description: 'If saved objects are missing for data frame analytics jobs, they are created.'
trained-model:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels'
description: 'If saved objects are missing for trained models, they are created.'
description: 'If saved objects are missing for machine learning jobs or trained models, they are created when you run the sync machine learning saved objects API.'
Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted:
title: Sync API response for deleted saved objects
type: object
properties:
anomaly-detector:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors'
description: 'If there are saved objects exist for nonexistent anomaly detection jobs, they are deleted.'
data-frame-analytics:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics'
description: 'If there are saved objects exist for nonexistent data frame analytics jobs, they are deleted.'
trained-model:
type: object
additionalProperties:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels'
description: 'If there are saved objects exist for nonexistent trained models, they are deleted.'
description: 'If saved objects exist for machine learning jobs or trained models that no longer exist, they are deleted when you run the sync machine learning saved objects API.'
Machine_learning_APIs_mlSyncResponseSuccess:
type: boolean
description: The success or failure of the synchronization.
Machine_learning_APIs_mlSyncResponseTrainedModels:
title: Sync API response for trained models
type: object
properties:
success:
$ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
description: 'The sync machine learning saved objects API response contains this object when there are trained models affected by the synchronization. There is an object for each relevant trained model, which contains the synchronization status.'
Saved_objects_400_response:
title: Bad request
required:
- error
- message
- statusCode
type: object
properties:
error:
enum:
- Bad Request
type: string
message:
type: string
statusCode:
enum:
- 400
type: integer
Saved_objects_attributes:
type: object
description: "The data that you want to create. WARNING: When you create saved objects, attributes are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.\n"
Saved_objects_initial_namespaces:
type: array
description: "Identifiers for the spaces in which this object is created. If this is provided, the object is created only in the explicitly defined spaces. If this is not provided, the object is created in the current space (default behavior). For shareable object types (registered with `namespaceType: 'multiple'`), this option can be used to specify one or more spaces, including the \"All spaces\" identifier ('*'). For isolated object types (registered with `namespaceType: 'single'` or `namespaceType: 'multiple-isolated'`), this option can only be used to specify a single space, and the \"All spaces\" identifier ('*') is not allowed. For global object types (`registered with `namespaceType: agnostic`), this option cannot be used.\n"
Saved_objects_references:
type: array
description: "Objects with `name`, `id`, and `type` properties that describe the other saved objects that this object references. Use `name` in attributes to refer to the other saved object, but never the `id`, which can update automatically during migrations or import and export.\n"
Security_AI_Assistant_API_AnonymizationFieldCreateProps:
required:
- field
type: object
properties:
allowed:
type: boolean
description: Whether this field is allowed to be sent to the model.
example: true
anonymized:
type: boolean
description: Whether this field should be anonymized.
example: false
field:
type: string
description: Name of the anonymization field to create.
example: host.name
Security_AI_Assistant_API_AnonymizationFieldDetailsInError:
required:
- id
type: object
properties:
id:
type: string
description: The ID of the anonymization field.
example: field12
name:
type: string
description: Name of the anonymization field.
example: host.name
Security_AI_Assistant_API_AnonymizationFieldResponse:
required:
- id
- field
type: object
properties:
allowed:
type: boolean
description: Whether this field is allowed to be sent to the model.
example: true
anonymized:
type: boolean
description: Whether this field should be anonymized.
example: false
createdAt:
type: string
description: Timestamp of when the anonymization field was created.
example: '2023-10-31T12:00:00Z'
createdBy:
type: string
description: Username of the person who created the anonymization field.
example: user1
field:
type: string
description: Name of the anonymization field.
example: url.domain
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
namespace:
type: string
description: Kibana space in which this anonymization field exists.
example: default
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
updatedAt:
type: string
description: Timestamp of the last update.
example: '2023-10-31T12:00:00Z'
updatedBy:
type: string
description: Username of the person who last updated the field.
example: user1
Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason:
enum:
- ANONYMIZATION_FIELD_NOT_MODIFIED
type: string
description: Reason why the anonymization field was not modified.
Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult:
required:
- id
- skip_reason
type: object
properties:
id:
type: string
description: The ID of the anonymization field that was not modified.
example: field4
name:
type: string
description: Name of the anonymization field that was not modified.
example: user.name
skip_reason:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason'
Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse:
required:
- attributes
type: object
properties:
anonymization_fields_count:
type: integer
description: Total number of anonymization fields processed.
example: 5
attributes:
required:
- results
- summary
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedAnonymizationFieldError'
description: List of errors that occurred during the bulk operation.
results:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary'
message:
type: string
description: Message providing information about the bulk action result.
example: Bulk action completed successfully
status_code:
type: integer
description: HTTP status code returned.
example: 200
success:
type: boolean
description: Indicates if the bulk action was successful.
example: true
Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults:
required:
- updated
- created
- deleted
- skipped
type: object
properties:
created:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
description: List of anonymization fields successfully created.
deleted:
type: array
items:
type: string
description: Array of IDs of anonymization fields that were deleted.
example: field3
skipped:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult'
description: List of anonymization fields that were skipped during the operation.
updated:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
description: List of anonymization fields successfully updated.
Security_AI_Assistant_API_AnonymizationFieldUpdateProps:
required:
- id
type: object
properties:
allowed:
type: boolean
description: Whether this field is allowed to be sent to the model.
example: true
anonymized:
type: boolean
description: Whether this field should be anonymized.
example: false
id:
type: string
description: The ID of the anonymization field to update.
example: field8
Security_AI_Assistant_API_ApiConfig:
required:
- connectorId
- actionTypeId
type: object
properties:
actionTypeId:
type: string
description: Action type ID
example: actionType456
connectorId:
type: string
description: Connector ID
example: connector123
defaultSystemPromptId:
type: string
description: Default system prompt ID
example: systemPrompt001
model:
type: string
description: Model
example: gpt-4
provider:
$ref: '#/components/schemas/Security_AI_Assistant_API_Provider'
Security_AI_Assistant_API_BaseContentReference:
required:
- id
- type
type: object
properties:
id:
type: string
description: Id of the content reference
example: content123
type:
type: string
description: Type of the content reference
example: SecurityAlert
description: The basis of a content reference
Security_AI_Assistant_API_BulkCrudActionSummary:
required:
- failed
- skipped
- succeeded
- total
type: object
properties:
failed:
type: integer
description: The number of failed actions.
example: 0
skipped:
type: integer
description: The number of skipped actions.
example: 1
succeeded:
type: integer
description: The number of successfully performed actions.
example: 10
total:
type: integer
description: The total number of actions attempted.
example: 12
Security_AI_Assistant_API_ChatCompleteProps:
required:
- messages
- persist
- connectorId
type: object
properties:
connectorId:
type: string
description: Required connector identifier to route the request.
example: conn-001
conversationId:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
isStream:
type: boolean
description: 'If true, the response will be streamed in chunks.'
example: true
langSmithApiKey:
type: string
description: API key for LangSmith integration.
example: sk-abc123
langSmithProject:
type: string
description: LangSmith project name for tracing.
example: security_ai_project
messages:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatMessage'
description: List of chat messages exchanged so far.
model:
type: string
description: Model ID or name to use for the response.
example: gpt-4
persist:
type: boolean
description: Whether to persist the chat and response to storage.
example: true
promptId:
type: string
description: Prompt template identifier.
example: prompt_001
responseLanguage:
type: string
description: ISO language code for the assistant's response.
example: en
description: The request payload for creating a chat completion.
example:
connectorId: conn-001
conversationId: abc123
isStream: true
langSmithApiKey: sk-abc123
langSmithProject: security_ai_project
messages:
- content: How do I detect ransomware on my endpoints?
data:
device_id: device-567
fields_to_anonymize:
- device.name
- file.path
role: user
model: gpt-4
persist: true
promptId: prompt_456
responseLanguage: en
Security_AI_Assistant_API_ChatMessage:
required:
- role
type: object
properties:
content:
type: string
description: The textual content of the message.
example: What security incidents have been reported today?
data:
$ref: '#/components/schemas/Security_AI_Assistant_API_MessageData'
fields_to_anonymize:
type: array
items:
type: string
description: List of field names within the data object that should be anonymized.
example:
- user.name
- source.ip
role:
$ref: '#/components/schemas/Security_AI_Assistant_API_ChatMessageRole'
description: A message exchanged within the AI chat conversation.
Security_AI_Assistant_API_ChatMessageRole:
enum:
- system
- user
- assistant
type: string
description: The role associated with the message in the chat.
example: user
Security_AI_Assistant_API_ContentReferences:
type: object
additionalProperties:
oneOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_SecurityAlertContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_SecurityAlertsPageContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_ProductDocumentationContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_EsqlContentReference'
- $ref: '#/components/schemas/Security_AI_Assistant_API_HrefContentReference'
description: A union of all content reference types
Security_AI_Assistant_API_ConversationCategory:
enum:
- assistant
- insights
type: string
description: The conversation category.
example: assistant
Security_AI_Assistant_API_ConversationConfidence:
enum:
- low
- medium
- high
type: string
description: The conversation confidence.
example: high
Security_AI_Assistant_API_ConversationCreateProps:
required:
- title
type: object
properties:
apiConfig:
$ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
category:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
excludeFromLastConversationStorage:
type: boolean
description: Exclude from last conversation storage.
id:
type: string
description: The conversation id.
example: conversation123
messages:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_Message'
description: The conversation messages.
replacements:
$ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
title:
type: string
description: The conversation title.
example: Security AI Assistant Setup
Security_AI_Assistant_API_ConversationResponse:
required:
- id
- title
- createdAt
- users
- namespace
- category
type: object
properties:
apiConfig:
$ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
category:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
createdAt:
type: string
description: The time conversation was created.
example: '2025-04-30T14:00:00Z'
excludeFromLastConversationStorage:
type: boolean
description: Exclude from last conversation storage.
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
messages:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_Message'
description: The conversation messages.
namespace:
type: string
description: Kibana space
example: default
replacements:
$ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationSummary'
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
title:
type: string
description: The conversation title.
example: Security AI Assistant Setup
updatedAt:
type: string
description: The last time conversation was updated.
example: '2025-04-30T16:30:00Z'
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
Security_AI_Assistant_API_ConversationSummary:
type: object
properties:
confidence:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationConfidence'
content:
type: string
description: Summary text of the conversation over time.
example: This conversation covered how to configure the Security AI Assistant.
public:
type: boolean
description: Define if summary is marked as publicly available.
example: true
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
Security_AI_Assistant_API_ConversationUpdateProps:
required:
- id
type: object
properties:
apiConfig:
$ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
category:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
excludeFromLastConversationStorage:
type: boolean
description: Exclude from last conversation storage.
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
messages:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_Message'
description: The conversation messages.
replacements:
$ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_ConversationSummary'
title:
type: string
description: The conversation title.
example: Updated Security AI Assistant Setup
Security_AI_Assistant_API_DeleteResponseFields:
required:
- id
type: object
properties:
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
Security_AI_Assistant_API_DocumentEntry:
allOf:
- required:
- name
- namespace
- global
- users
type: object
properties:
global:
type: boolean
description: 'Whether this Knowledge Base Entry is global, defaults to false.'
example: false
name:
type: string
description: Name of the Knowledge Base Entry.
example: Example Entry
namespace:
type: string
description: 'Kibana Space, defaults to ''default'' space.'
example: default
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
- $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields'
Security_AI_Assistant_API_DocumentEntryCreateFields:
allOf:
- required:
- name
type: object
properties:
global:
type: boolean
description: 'Whether this Knowledge Base Entry is global, defaults to false.'
example: false
name:
type: string
description: Name of the Knowledge Base Entry.
example: Example Entry
namespace:
type: string
description: 'Kibana Space, defaults to ''default'' space.'
example: default
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
Security_AI_Assistant_API_DocumentEntryOptionalFields:
type: object
properties:
required:
type: boolean
description: 'Whether this resource should always be included, defaults to false.'
example: false
vector:
$ref: '#/components/schemas/Security_AI_Assistant_API_Vector'
Security_AI_Assistant_API_DocumentEntryRequiredFields:
required:
- type
- kbResource
- source
- text
type: object
properties:
kbResource:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResource'
source:
type: string
description: Source document name or filepath.
example: /documents/example.txt
text:
type: string
description: Knowledge Base Entry content.
example: This is the content of the document.
type:
enum:
- document
type: string
description: Entry type.
example: document
Security_AI_Assistant_API_DocumentEntryResponseFields:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
Security_AI_Assistant_API_DocumentEntryUpdateFields:
allOf:
- required:
- id
type: object
properties:
global:
type: boolean
description: 'Whether this Knowledge Base Entry is global, defaults to false.'
example: false
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
name:
type: string
description: Name of the Knowledge Base Entry.
example: Example Entry
namespace:
type: string
description: 'Kibana Space, defaults to ''default'' space.'
example: default
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
Security_AI_Assistant_API_EsqlContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- required:
- type
- query
- label
type: object
properties:
label:
type: string
description: Label of the query
example: High Severity Alerts
query:
type: string
description: An ESQL query
example: SELECT * FROM alerts WHERE severity = "high"
timerange:
required:
- from
- to
type: object
properties:
from:
type: string
example: '2025-04-01T00:00:00Z'
to:
type: string
example: '2025-04-30T23:59:59Z'
description: Time range to select in the time picker.
type:
enum:
- EsqlQuery
type: string
example: EsqlQuery
description: References an ESQL query
Security_AI_Assistant_API_FindAnonymizationFieldsSortField:
enum:
- created_at
- anonymized
- allowed
- field
- updated_at
type: string
Security_AI_Assistant_API_FindConversationsSortField:
enum:
- created_at
- title
- updated_at
type: string
description: 'The field by which to sort the conversations. Possible values are `created_at`, `title`, and `updated_at`.'
example: created_at
Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField:
enum:
- created_at
- is_default
- title
- updated_at
type: string
description: Fields available for sorting Knowledge Base Entries.
example: title
Security_AI_Assistant_API_FindPromptsSortField:
enum:
- created_at
- is_default
- name
- updated_at
type: string
description: Field by which to sort the prompts.
example: created_at
Security_AI_Assistant_API_HrefContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- required:
- type
- href
type: object
properties:
href:
type: string
description: URL to the external resource
label:
type: string
description: Label of the query
type:
enum:
- Href
type: string
description: References an external URL
Security_AI_Assistant_API_IndexEntry:
allOf:
- required:
- name
- namespace
- global
- users
type: object
properties:
global:
type: boolean
description: 'Whether this Knowledge Base Entry is global, defaults to false.'
example: false
name:
type: string
description: Name of the Knowledge Base Entry.
example: Example Entry
namespace:
type: string
description: 'Kibana Space, defaults to ''default'' space.'
example: default
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
- $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields'
Security_AI_Assistant_API_IndexEntryCreateFields:
allOf:
- required:
- name
type: object
properties:
global:
type: boolean
description: 'Whether this Knowledge Base Entry is global, defaults to false.'
example: false
name:
type: string
description: Name of the Knowledge Base Entry.
example: Example Entry
namespace:
type: string
description: 'Kibana Space, defaults to ''default'' space.'
example: default
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
Security_AI_Assistant_API_IndexEntryOptionalFields:
type: object
properties:
inputSchema:
$ref: '#/components/schemas/Security_AI_Assistant_API_InputSchema'
outputFields:
type: array
items:
type: string
description: 'Fields to extract from the query result, defaults to all fields if not provided or empty.'
example:
- title
- author
Security_AI_Assistant_API_IndexEntryRequiredFields:
required:
- type
- index
- field
- description
- queryDescription
type: object
properties:
description:
type: string
description: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
example: Query this index for general knowledge base content.
field:
type: string
description: Field to query for Knowledge Base content.
example: content
index:
type: string
description: Index or Data Stream to query for Knowledge Base content.
example: knowledge_base_index
queryDescription:
type: string
description: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
example: Search for documents containing the specified keywords.
type:
enum:
- index
type: string
description: Entry type.
example: index
Security_AI_Assistant_API_IndexEntryResponseFields:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
Security_AI_Assistant_API_IndexEntryUpdateFields:
allOf:
- required:
- id
type: object
properties:
global:
type: boolean
description: 'Whether this Knowledge Base Entry is global, defaults to false.'
example: false
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
name:
type: string
description: Name of the Knowledge Base Entry.
example: Example Entry
namespace:
type: string
description: 'Kibana Space, defaults to ''default'' space.'
example: default
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
Security_AI_Assistant_API_InputSchema:
type: array
items:
required:
- fieldName
- fieldType
- description
type: object
properties:
description:
type: string
description: Description of the field.
example: The title of the document.
fieldName:
type: string
description: Name of the field.
example: title
fieldType:
type: string
description: Type of the field.
example: string
description: 'Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.'
Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason:
enum:
- KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
type: string
description: Reason why a Knowledge Base Entry was skipped during the bulk action.
Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult:
required:
- id
- skip_reason
type: object
properties:
id:
type: string
description: ID of the skipped Knowledge Base Entry.
example: '123'
name:
type: string
description: Name of the skipped Knowledge Base Entry.
example: Skipped Entry
skip_reason:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason'
Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse:
required:
- attributes
type: object
properties:
attributes:
required:
- results
- summary
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError'
description: List of errors encountered during the bulk action.
example:
- err_code: UPDATE_FAILED
knowledgeBaseEntries:
- id: '456'
name: Error Entry
message: Failed to update entry.
statusCode: 400
results:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary'
knowledgeBaseEntriesCount:
type: integer
description: Total number of Knowledge Base Entries processed.
example: 8
message:
type: string
description: Message describing the result of the bulk action.
example: Bulk action completed successfully.
statusCode:
type: integer
description: HTTP status code of the response.
example: 200
success:
type: boolean
description: Indicates whether the bulk action was successful.
example: true
Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults:
required:
- updated
- created
- deleted
- skipped
type: object
properties:
created:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
description: List of Knowledge Base Entries that were successfully created.
example:
- content: This is the content of the new entry.
id: '456'
title: New Entry
deleted:
type: array
items:
type: string
description: List of IDs of Knowledge Base Entries that were successfully deleted.
example:
- '789'
skipped:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult'
description: List of Knowledge Base Entries that were skipped during the bulk action.
example:
- id: '123'
name: Skipped Entry
skip_reason: KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
updated:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
description: List of Knowledge Base Entries that were successfully updated.
example:
- content: Updated content.
id: '123'
title: Updated Entry
Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary:
required:
- failed
- skipped
- succeeded
- total
type: object
properties:
failed:
type: integer
description: Number of Knowledge Base Entries that failed during the bulk action.
example: 2
skipped:
type: integer
description: Number of Knowledge Base Entries that were skipped during the bulk action.
example: 1
succeeded:
type: integer
description: Number of Knowledge Base Entries that were successfully processed during the bulk action.
example: 5
total:
type: integer
description: Total number of Knowledge Base Entries involved in the bulk action.
example: 8
Security_AI_Assistant_API_KnowledgeBaseEntryContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- required:
- type
- knowledgeBaseEntryId
- knowledgeBaseEntryName
type: object
properties:
knowledgeBaseEntryId:
type: string
description: Id of the Knowledge Base Entry
example: kbentry456
knowledgeBaseEntryName:
type: string
description: Name of the knowledge base entry
example: Network Security Best Practices
type:
enum:
- KnowledgeBaseEntry
type: string
example: KnowledgeBaseEntry
description: References a knowledge base entry
Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
discriminator:
propertyName: type
Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError:
required:
- id
type: object
properties:
id:
type: string
description: ID of the Knowledge Base Entry that encountered an error.
example: '456'
name:
type: string
description: Name of the Knowledge Base Entry that encountered an error.
example: Error Entry
Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema:
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
description: Error type or category.
example: Not Found
message:
type: string
description: Detailed error message.
example: The requested Knowledge Base Entry was not found.
statusCode:
type: number
description: HTTP status code of the error.
example: 404
additionalProperties: false
Security_AI_Assistant_API_KnowledgeBaseEntryResponse:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
discriminator:
propertyName: type
Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
discriminator:
propertyName: type
Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps:
anyOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
- $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
discriminator:
propertyName: type
Security_AI_Assistant_API_KnowledgeBaseResource:
enum:
- security_labs
- user
type: string
description: 'Knowledge Base resource name for grouping entries, e.g. ''security_labs'', ''user'', etc.'
example: security_labs
Security_AI_Assistant_API_KnowledgeBaseResponse:
type: object
properties:
success:
type: boolean
description: Identify the success of the method execution.
example: true
description: AI assistant KnowledgeBase.
Security_AI_Assistant_API_Message:
required:
- timestamp
- content
- role
type: object
properties:
content:
type: string
description: Message content.
example: 'Hello, how can I assist you today?'
isError:
type: boolean
description: Is error message.
example: false
metadata:
$ref: '#/components/schemas/Security_AI_Assistant_API_MessageMetadata'
reader:
$ref: '#/components/schemas/Security_AI_Assistant_API_Reader'
refusal:
type: string
description: Refusal reason returned by the model when content is filtered.
role:
$ref: '#/components/schemas/Security_AI_Assistant_API_MessageRole'
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
traceData:
$ref: '#/components/schemas/Security_AI_Assistant_API_TraceData'
description: AI assistant conversation message.
Security_AI_Assistant_API_MessageData:
type: object
description: ECS-style metadata attached to the message.
example:
alert_id: alert-456
user_id: abc123
Security_AI_Assistant_API_MessageMetadata:
type: object
properties:
contentReferences:
$ref: '#/components/schemas/Security_AI_Assistant_API_ContentReferences'
description: Message metadata
Security_AI_Assistant_API_MessageRole:
enum:
- system
- user
- assistant
type: string
description: Message role.
example: assistant
Security_AI_Assistant_API_NonEmptyString:
minLength: 1
type: string
description: A string that does not contain only whitespace characters.
format: nonempty
example: I am a string
Security_AI_Assistant_API_NonEmptyTimestamp:
minLength: 1
type: string
description: A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
format: nonempty
example: '2023-10-31T12:00:00Z'
Security_AI_Assistant_API_NormalizedAnonymizationFieldError:
required:
- message
- status_code
- anonymization_fields
type: object
properties:
anonymization_fields:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldDetailsInError'
description: Array of anonymization fields that caused the error.
err_code:
type: string
description: Error code indicating the type of failure.
example: UPDATE_FAILED
message:
type: string
description: Error message.
example: Failed to update anonymization field.
status_code:
type: integer
description: Status code of the response.
example: 400
Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError:
required:
- message
- statusCode
- knowledgeBaseEntries
type: object
properties:
err_code:
type: string
description: Specific error code for the issue.
example: UPDATE_FAILED
knowledgeBaseEntries:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError'
description: List of Knowledge Base Entries that encountered the error.
message:
type: string
description: Error message describing the issue.
example: Failed to update entry.
statusCode:
type: integer
description: HTTP status code associated with the error.
example: 400
Security_AI_Assistant_API_NormalizedPromptError:
required:
- message
- status_code
- prompts
type: object
properties:
err_code:
type: string
description: A code representing the error type.
message:
type: string
description: A message describing the error encountered.
prompts:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptDetailsInError'
description: List of prompts that encountered errors.
status_code:
type: integer
description: The HTTP status code associated with the error.
Security_AI_Assistant_API_ProductDocumentationContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- required:
- type
- title
- url
type: object
properties:
title:
type: string
description: Title of the documentation
example: Getting Started with Security AI Assistant
type:
enum:
- ProductDocumentation
type: string
example: ProductDocumentation
url:
type: string
description: URL to the documentation
example: https://docs.example.com/security-ai-assistant
description: References the product documentation
Security_AI_Assistant_API_PromptCreateProps:
required:
- name
- content
- promptType
type: object
properties:
categories:
type: array
items:
type: string
description: List of categories for the prompt.
example:
- security
- verification
color:
type: string
description: The color associated with the prompt.
example: blue
consumer:
type: string
description: The consumer associated with the prompt.
example: admin
content:
type: string
description: The content of the prompt.
example: Please verify the security settings.
isDefault:
type: boolean
description: Whether this prompt should be the default.
example: false
isNewConversationDefault:
type: boolean
description: Whether this prompt should be the default for new conversations.
example: true
name:
type: string
description: The name of the prompt.
example: New Security Prompt
promptType:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptType'
Security_AI_Assistant_API_PromptDetailsInError:
required:
- id
type: object
properties:
id:
type: string
description: The ID of the prompt that encountered an error.
name:
type: string
description: The name of the prompt that encountered an error.
Security_AI_Assistant_API_PromptResponse:
required:
- id
- name
- promptType
- content
type: object
properties:
categories:
type: array
items:
type: string
description: Categories associated with the prompt.
color:
type: string
description: The color associated with the prompt.
consumer:
type: string
description: The consumer that the prompt is associated with.
content:
type: string
description: The content of the prompt.
createdAt:
type: string
description: The timestamp of when the prompt was created.
createdBy:
type: string
description: The user who created the prompt.
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
isDefault:
type: boolean
description: Whether this prompt is the default.
isNewConversationDefault:
type: boolean
description: Whether this prompt is the default for new conversations.
name:
type: string
description: The name of the prompt.
namespace:
type: string
description: Kibana space where the prompt is located.
promptType:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptType'
timestamp:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
updatedAt:
type: string
description: The timestamp of when the prompt was last updated.
updatedBy:
type: string
description: The user who last updated the prompt.
users:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_User'
description: List of users associated with the prompt.
Security_AI_Assistant_API_PromptsBulkActionSkipReason:
enum:
- PROMPT_FIELD_NOT_MODIFIED
type: string
description: Reason why a prompt was skipped during the bulk action.
Security_AI_Assistant_API_PromptsBulkActionSkipResult:
required:
- id
- skip_reason
type: object
properties:
id:
type: string
description: The ID of the prompt that was skipped.
name:
type: string
description: The name of the prompt that was skipped.
skip_reason:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipReason'
Security_AI_Assistant_API_PromptsBulkCrudActionResponse:
required:
- attributes
type: object
properties:
attributes:
required:
- results
- summary
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedPromptError'
results:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResults'
summary:
$ref: '#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary'
message:
type: string
description: A message describing the result of the bulk action.
example: Bulk action completed successfully.
prompts_count:
type: integer
description: The number of prompts processed in the bulk action.
example: 6
status_code:
type: integer
description: The HTTP status code of the response.
example: 200
success:
type: boolean
description: Indicates if the bulk action was successful.
example: true
Security_AI_Assistant_API_PromptsBulkCrudActionResults:
required:
- updated
- created
- deleted
- skipped
type: object
properties:
created:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
description: List of prompts that were created.
deleted:
type: array
items:
type: string
description: List of IDs of prompts that were deleted.
skipped:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipResult'
description: List of prompts that were skipped.
updated:
type: array
items:
$ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
description: List of prompts that were updated.
Security_AI_Assistant_API_PromptType:
enum:
- system
- quick
type: string
description: Type of the prompt (either system or quick).
Security_AI_Assistant_API_PromptUpdateProps:
required:
- id
type: object
properties:
categories:
type: array
items:
type: string
description: The updated categories for the prompt.
example:
- security
- alert
color:
type: string
description: The updated color associated with the prompt.
example: green
consumer:
type: string
description: The updated consumer for the prompt.
example: user123
content:
type: string
description: The updated content for the prompt.
example: Updated content for security prompt.
id:
type: string
description: The ID of the prompt to update.
example: prompt123
isDefault:
type: boolean
description: Whether this prompt should be the default.
example: true
isNewConversationDefault:
type: boolean
description: Whether the prompt should be the default for new conversations.
example: false
Security_AI_Assistant_API_Provider:
enum:
- OpenAI
- Azure OpenAI
- Other
type: string
description: Provider
example: OpenAI
Security_AI_Assistant_API_Reader:
type: object
Security_AI_Assistant_API_Replacements:
type: object
additionalProperties:
type: string
description: Replacements object used to anonymize/deanonymize messages
Security_AI_Assistant_API_ResponseFields:
required:
- id
- createdAt
- createdBy
- updatedAt
- updatedBy
type: object
properties:
createdAt:
type: string
description: Time the Knowledge Base Entry was created.
example: '2023-01-01T12:00:00Z'
createdBy:
type: string
description: User who created the Knowledge Base Entry.
example: admin
id:
$ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
updatedAt:
type: string
description: Time the Knowledge Base Entry was last updated.
example: '2023-01-02T12:00:00Z'
updatedBy:
type: string
description: User who last updated the Knowledge Base Entry.
example: editor
Security_AI_Assistant_API_SecurityAlertContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- required:
- type
- alertId
type: object
properties:
alertId:
type: string
description: ID of the Alert
example: alert789
type:
enum:
- SecurityAlert
type: string
example: SecurityAlert
description: References a security alert
Security_AI_Assistant_API_SecurityAlertsPageContentReference:
allOf:
- $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
- required:
- type
type: object
properties:
type:
enum:
- SecurityAlertsPage
type: string
example: SecurityAlertsPage
description: References the security alerts page
Security_AI_Assistant_API_SortOrder:
enum:
- asc
- desc
type: string
description: The order in which results are sorted.
example: asc
Security_AI_Assistant_API_TraceData:
type: object
properties:
traceId:
type: string
description: 'Could be any string, not necessarily a UUID'
example: d9876543-f0a1-2345-6789-abcdef123456
transactionId:
type: string
description: 'Could be any string, not necessarily a UUID'
example: a1234567-bc89-0def-1234-56789abcdef0
description: Trace Data
Security_AI_Assistant_API_User:
type: object
properties:
id:
type: string
description: User id.
example: user123
name:
type: string
description: User name.
example: John Doe
description: 'Could be any string, not necessarily a UUID.'
Security_AI_Assistant_API_Vector:
required:
- modelId
- tokens
type: object
properties:
modelId:
type: string
description: ID of the model used to create the embeddings.
example: bert-base-uncased
tokens:
type: object
additionalProperties:
type: number
description: Tokens with their corresponding values.
example:
token1: 0.123
token2: 0.456
description: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
Security_Detections_API_AlertAssignees:
required:
- add
- remove
type: object
properties:
add:
type: array
items:
minLength: 1
type: string
description: A list of user profile `uid`s to assign. Users need to activate their user profile by logging into Kibana at least once.
format: nonempty
remove:
type: array
items:
minLength: 1
type: string
description: A list of user profile `uid`s to unassign. Users need to activate their user profile by logging into Kibana at least once.
format: nonempty
Security_Detections_API_AlertIds:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
description: A list of alerts ids.
Security_Detections_API_AlertsIndex:
type: string
description: (deprecated) Has no effect.
deprecated: true
Security_Detections_API_AlertsIndexMigrationError:
required:
- index
- error
type: object
properties:
error:
required:
- message
- status_code
type: object
properties:
message:
type: string
status_code:
type: string
index:
type: string
Security_Detections_API_AlertsIndexMigrationSuccess:
required:
- index
- migration_id
- migration_index
type: object
properties:
index:
type: string
migration_id:
type: string
migration_index:
type: string
Security_Detections_API_AlertsIndexNamespace:
type: string
description: Has no effect.
Security_Detections_API_AlertsReindexOptions:
type: object
properties:
requests_per_second:
minimum: 1
type: integer
size:
minimum: 1
type: integer
slices:
minimum: 1
type: integer
Security_Detections_API_AlertsSort:
oneOf:
- $ref: '#/components/schemas/Security_Detections_API_AlertsSortCombinations'
- type: array
items:
$ref: '#/components/schemas/Security_Detections_API_AlertsSortCombinations'
Security_Detections_API_AlertsSortCombinations:
type:
- string
- object
Security_Detections_API_AlertStatus:
enum:
- open
- closed
- acknowledged
- in-progress
type: string
Security_Detections_API_AlertSuppression:
required:
- group_by
type: object
properties:
duration:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDuration'
group_by:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppressionGroupBy'
missing_fields_strategy:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppressionMissingFieldsStrategy'
description: Defines alert suppression configuration.
Security_Detections_API_AlertSuppressionDuration:
required:
- value
- unit
type: object
properties:
unit:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDurationUnit'
value:
minimum: 1
type: integer
Security_Detections_API_AlertSuppressionDurationUnit:
enum:
- s
- m
- h
type: string
description: Time unit
Security_Detections_API_AlertSuppressionGroupBy:
maxItems: 3
minItems: 1
type: array
items:
type: string
Security_Detections_API_AlertSuppressionMissingFieldsStrategy:
enum:
- doNotSuppress
- suppress
type: string
description: "Describes how alerts will be generated for documents with missing suppress by fields:\ndoNotSuppress - per each document a separate alert will be created\nsuppress - only alert will be created per suppress by bucket"
Security_Detections_API_AlertTag:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
Security_Detections_API_AlertTags:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
Security_Detections_API_AlertVersion:
required:
- version
- count
type: object
properties:
count:
type: integer
version:
type: integer
Security_Detections_API_AnomalyThreshold:
minimum: 0
type: integer
description: Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100.
Security_Detections_API_BuildingBlockType:
type: string
description: "Determines if the rule acts as a building block. If yes, the value must be `default`.\nBy default, building-block alerts are not displayed in the UI. These rules are used as a foundation for other rules that do generate alerts.\nFor more information, refer to [About building block rules](https://www.elastic.co/guide/en/security/current/building-block-rule.html).\n"
Security_Detections_API_BulkActionEditPayload:
anyOf:
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadTags'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadIndexPatterns'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadInvestigationFields'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadTimeline'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadRuleActions'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSchedule'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadAlertSuppression'
Security_Detections_API_BulkActionEditPayloadAlertSuppression:
anyOf:
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppression'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold'
- $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression'
Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression:
required:
- type
type: object
properties:
type:
enum:
- delete_alert_suppression
type: string
Security_Detections_API_BulkActionEditPayloadIndexPatterns:
required:
- type
- value
type: object
properties:
overwrite_data_views:
type: boolean
description: Resets the data view for the rule.
type:
enum:
- add_index_patterns
- delete_index_patterns
- set_index_patterns
type: string
value:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
description: "Edits index patterns of rulesClient.\n\n- `add_index_patterns` adds index patterns to rules. If an index pattern already exists for a rule, no changes are made.\n- `delete_index_patterns` removes index patterns from rules. If an index pattern does not exist for a rule, no changes are made.\n- `set_index_patterns` sets index patterns for rules, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.\n"
Security_Detections_API_BulkActionEditPayloadInvestigationFields:
required:
- type
- value
type: object
properties:
type:
enum:
- add_investigation_fields
- delete_investigation_fields
- set_investigation_fields
type: string
value:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
description: "Edits investigation fields of rules.\n\n- `add_investigation_fields` adds investigation fields to rules. If an investigation field already exists for a rule, no changes are made.\n- `delete_investigation_fields` removes investigation fields from rules. If an investigation field does not exist for a rule, no changes are made.\n- `set_investigation_fields` sets investigation fields for rules. If the set of investigation fields is the same as the existing investigation fields, no changes are made.\n"
Security_Detections_API_BulkActionEditPayloadRuleActions:
required:
- type
- value
type: object
properties:
type:
enum:
- add_rule_actions
- set_rule_actions
type: string
value:
required:
- actions
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NormalizedRuleAction'
throttle:
$ref: '#/components/schemas/Security_Detections_API_ThrottleForBulkActions'
description: "Edits rule actions of rules.\n\n- `add_rule_actions` adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exists for a rule, it will be added again with a new unique ID.\n- `set_rule_actions` sets rule actions for rules. This action is non-idempotent, meaning that even if the same set of rule actions already exists for a rule, it will be set again and the actions will receive new unique IDs.\n"
Security_Detections_API_BulkActionEditPayloadSchedule:
required:
- type
- value
type: object
properties:
type:
enum:
- set_schedule
type: string
value:
required:
- interval
- lookback
type: object
properties:
interval:
pattern: '^[1-9]\d*[smh]$'
type: string
description: 'Interval in which the rule runs. For example, `"1h"` means the rule runs every hour.'
example: 1h
lookback:
pattern: '^[1-9]\d*[smh]$'
type: string
description: "Lookback time for the rules.\n\nAdditional look-back time that the rule analyzes. For example, \"10m\" means the rule analyzes the last 10 minutes of data in addition to the frequency interval.\n"
example: 1h
description: "Overwrites schedule of rules. \n\n- `set_schedule` sets a schedule for rules. If the same schedule already exists for a rule, no changes are made.\n\nBoth `interval` and `lookback` have a format of \"{integer}{time_unit}\", where accepted time units are `s` for seconds, `m` for minutes, and `h` for hours. The integer must be positive and larger than 0. Examples: \"45s\", \"30m\", \"6h\"\n"
Security_Detections_API_BulkActionEditPayloadSetAlertSuppression:
required:
- type
- value
type: object
properties:
type:
enum:
- set_alert_suppression
type: string
value:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold:
required:
- type
- value
type: object
properties:
type:
enum:
- set_alert_suppression_for_threshold
type: string
value:
$ref: '#/components/schemas/Security_Detections_API_ThresholdAlertSuppression'
Security_Detections_API_BulkActionEditPayloadTags:
required:
- type
- value
type: object
properties:
type:
enum:
- add_tags
- delete_tags
- set_tags
type: string
value:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
description: "Edits tags of rules.\n\n- `add_tags` adds tags to rules. If a tag already exists for a rule, no changes are made.\n- `delete_tags` removes tags from rules. If a tag does not exist for a rule, no changes are made.\n- `set_tags` sets tags for rules, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.\n"
Security_Detections_API_BulkActionEditPayloadTimeline:
required:
- type
- value
type: object
properties:
type:
enum:
- set_timeline
type: string
value:
required:
- timeline_id
- timeline_title
type: object
properties:
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
description: "Edits timeline of rules.\n\n- `set_timeline` sets a timeline for rules. If the same timeline already exists for a rule, no changes are made.\n"
Security_Detections_API_BulkActionsDryRunErrCode:
enum:
- IMMUTABLE
- PREBUILT_CUSTOMIZATION_LICENSE
- MACHINE_LEARNING_AUTH
- MACHINE_LEARNING_INDEX_PATTERN
- ESQL_INDEX_PATTERN
- MANUAL_RULE_RUN_FEATURE
- MANUAL_RULE_RUN_DISABLED_RULE
- THRESHOLD_RULE_TYPE_IN_SUPPRESSION
- UNSUPPORTED_RULE_IN_SUPPRESSION_FOR_THRESHOLD
- RULE_FILL_GAPS_DISABLED_RULE
type: string
Security_Detections_API_BulkActionSkipResult:
required:
- id
- skip_reason
type: object
properties:
id:
type: string
name:
type: string
skip_reason:
oneOf:
- $ref: '#/components/schemas/Security_Detections_API_BulkEditSkipReason'
- $ref: '#/components/schemas/Security_Detections_API_BulkGapsFillingSkipReason'
Security_Detections_API_BulkCrudRulesResponse:
type: array
items:
oneOf:
- $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
- $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
Security_Detections_API_BulkDeleteRules:
required:
- action
type: object
properties:
action:
enum:
- delete
type: string
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkDisableRules:
required:
- action
type: object
properties:
action:
enum:
- disable
type: string
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkDuplicateRules:
required:
- action
type: object
properties:
action:
enum:
- duplicate
type: string
duplicate:
required:
- include_exceptions
- include_expired_exceptions
type: object
properties:
include_exceptions:
type: boolean
description: Whether to copy exceptions from the original rule
include_expired_exceptions:
type: boolean
description: Whether to copy expired exceptions from the original rule
description: Duplicate object that describes applying an update action.
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkEditActionResponse:
required:
- attributes
type: object
properties:
attributes:
required:
- results
- summary
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NormalizedRuleError'
results:
$ref: '#/components/schemas/Security_Detections_API_BulkEditActionResults'
summary:
$ref: '#/components/schemas/Security_Detections_API_BulkEditActionSummary'
message:
type: string
rules_count:
type: integer
status_code:
type: integer
success:
type: boolean
Security_Detections_API_BulkEditActionResults:
required:
- updated
- created
- deleted
- skipped
type: object
properties:
created:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleResponse'
deleted:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleResponse'
skipped:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_BulkActionSkipResult'
updated:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleResponse'
Security_Detections_API_BulkEditActionSummary:
required:
- failed
- skipped
- succeeded
- total
type: object
properties:
failed:
type: integer
skipped:
type: integer
succeeded:
type: integer
total:
type: integer
description: 'A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the `edit` action is used to add a tag to a rule that already has that tag, or to delete an index pattern that is not specified in a rule. Objects returned in `attributes.results.skipped` will only include rules'' `id`, `name`, and `skip_reason`.'
Security_Detections_API_BulkEditRules:
required:
- action
- edit
type: object
properties:
action:
enum:
- edit
type: string
edit:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
description: Array of objects containing the edit operations
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkEditSkipReason:
enum:
- RULE_NOT_MODIFIED
type: string
Security_Detections_API_BulkEnableRules:
required:
- action
type: object
properties:
action:
enum:
- enable
type: string
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkExportActionResponse:
type: string
Security_Detections_API_BulkExportRules:
required:
- action
type: object
properties:
action:
enum:
- export
type: string
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkGapsFillingSkipReason:
enum:
- NO_GAPS_TO_FILL
type: string
Security_Detections_API_BulkManualRuleFillGaps:
required:
- action
- fill_gaps
type: object
properties:
action:
enum:
- fill_gaps
type: string
fill_gaps:
required:
- start_date
- end_date
type: object
properties:
end_date:
type: string
description: End date of the manual gap fill
start_date:
type: string
description: Start date of the manual gap fill
description: Object that describes applying a manual gap fill action for the specified time range.
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
Security_Detections_API_BulkManualRuleRun:
required:
- action
- run
type: object
properties:
action:
enum:
- run
type: string
gaps_range_end:
type: string
description: 'Gaps range end, valid only when query is provided'
gaps_range_start:
type: string
description: 'Gaps range start, valid only when query is provided'
ids:
minItems: 1
type: array
items:
type: string
description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
query:
type: string
description: Query to filter rules.
run:
required:
- start_date
- end_date
type: object
properties:
end_date:
type: string
description: End date of the manual rule run
start_date:
type: string
description: Start date of the manual rule run
description: Object that describes applying a manual rule run action.
Security_Detections_API_ConcurrentSearches:
minimum: 1
type: integer
Security_Detections_API_DataViewId:
type: string
Security_Detections_API_DefaultParams:
required:
- command
type: object
properties:
command:
enum:
- isolate
type: string
comment:
type: string
Security_Detections_API_EcsMapping:
type: object
additionalProperties:
type: object
properties:
field:
type: string
value:
oneOf:
- type: string
- type: array
items:
type: string
description: 'Map Osquery results columns or static values to Elastic Common Schema (ECS) fields. Example: "ecs_mapping": {"process.pid": {"field": "pid"}}'
Security_Detections_API_EndpointResponseAction:
required:
- action_type_id
- params
type: object
properties:
action_type_id:
enum:
- .endpoint
type: string
params:
oneOf:
- $ref: '#/components/schemas/Security_Detections_API_DefaultParams'
- $ref: '#/components/schemas/Security_Detections_API_ProcessesParams'
Security_Detections_API_EqlOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
data_view_id:
$ref: '#/components/schemas/Security_Detections_API_DataViewId'
event_category_override:
$ref: '#/components/schemas/Security_Detections_API_EventCategoryOverride'
filters:
$ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
index:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
tiebreaker_field:
$ref: '#/components/schemas/Security_Detections_API_TiebreakerField'
timestamp_field:
$ref: '#/components/schemas/Security_Detections_API_TimestampField'
Security_Detections_API_EqlQueryLanguage:
enum:
- eql
type: string
Security_Detections_API_EqlRequiredFields:
required:
- type
- query
- language
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_EqlQueryLanguage'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
type:
enum:
- eql
type: string
description: Rule type
Security_Detections_API_EqlRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_EqlRuleResponseFields'
Security_Detections_API_EqlRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_EqlRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
Security_Detections_API_EqlRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateFields'
Security_Detections_API_EqlRulePatchFields:
allOf:
- type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_EqlQueryLanguage'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
type:
enum:
- eql
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
Security_Detections_API_EqlRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_EqlRulePatchFields'
Security_Detections_API_EqlRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_EqlRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
Security_Detections_API_EqlRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateFields'
Security_Detections_API_ErrorSchema:
required:
- error
type: object
properties:
error:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
minimum: 400
type: integer
id:
type: string
item_id:
minLength: 1
type: string
list_id:
minLength: 1
type: string
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
additionalProperties: false
Security_Detections_API_EsqlQueryLanguage:
enum:
- esql
type: string
Security_Detections_API_EsqlRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleResponseFields'
Security_Detections_API_EsqlRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields'
Security_Detections_API_EsqlRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateFields'
Security_Detections_API_EsqlRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
Security_Detections_API_EsqlRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
language:
$ref: '#/components/schemas/Security_Detections_API_EsqlQueryLanguage'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
type:
enum:
- esql
type: string
description: Rule type
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
Security_Detections_API_EsqlRuleRequiredFields:
required:
- type
- language
- query
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_EsqlQueryLanguage'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
type:
enum:
- esql
type: string
description: Rule type
Security_Detections_API_EsqlRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields'
Security_Detections_API_EsqlRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateFields'
Security_Detections_API_EventCategoryOverride:
type: string
Security_Detections_API_ExceptionListType:
enum:
- detection
- rule_default
- endpoint
- endpoint_trusted_apps
- endpoint_events
- endpoint_host_isolation_exceptions
- endpoint_blocklists
type: string
description: The exception type
Security_Detections_API_ExternalRuleSource:
required:
- type
- is_customized
type: object
properties:
is_customized:
$ref: '#/components/schemas/Security_Detections_API_IsExternalRuleCustomized'
type:
enum:
- external
type: string
description: 'Type of rule source for externally sourced rules, i.e. rules that have an external source, such as the Elastic Prebuilt rules repo.'
Security_Detections_API_FindRulesSortField:
enum:
- created_at
- createdAt
- enabled
- execution_summary.last_execution.date
- execution_summary.last_execution.metrics.execution_gap_duration_s
- execution_summary.last_execution.metrics.total_indexing_duration_ms
- execution_summary.last_execution.metrics.total_search_duration_ms
- execution_summary.last_execution.status
- name
- risk_score
- riskScore
- severity
- updated_at
- updatedAt
type: string
Security_Detections_API_HistoryWindowStart:
minLength: 1
type: string
description: 'Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.'
format: nonempty
Security_Detections_API_IndexMigrationStatus:
required:
- index
- version
- signal_versions
- migrations
- is_outdated
type: object
properties:
index:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
is_outdated:
type: boolean
migrations:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_MigrationStatus'
signal_versions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_AlertVersion'
version:
type: integer
Security_Detections_API_IndexPatternArray:
type: array
items:
type: string
description: "Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanced Settings → `securitySolution:defaultIndex`).\n> info\n> This field is not supported for ES|QL rules.\n"
Security_Detections_API_InternalRuleSource:
required:
- type
type: object
properties:
type:
enum:
- internal
type: string
description: 'Type of rule source for internally sourced rules, i.e. created within the Kibana apps.'
Security_Detections_API_InvestigationFields:
required:
- field_names
type: object
properties:
field_names:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
description: "Schema for fields relating to investigation fields. These are user defined fields we use to highlight\nin various features in the UI such as alert details flyout and exceptions auto-population from alert.\n"
Security_Detections_API_InvestigationGuide:
type: string
description: Notes to help investigate alerts produced by the rule.
Security_Detections_API_IsExternalRuleCustomized:
type: boolean
description: Determines whether an external/prebuilt rule has been customized by the user (i.e. any of its fields have been modified and diverged from the base value).
Security_Detections_API_IsRuleEnabled:
type: boolean
description: Determines whether the rule is enabled. Defaults to true.
Security_Detections_API_IsRuleImmutable:
type: boolean
description: This field determines whether the rule is a prebuilt Elastic rule. It will be replaced with the `rule_source` field.
deprecated: true
Security_Detections_API_ItemsPerSearch:
minimum: 1
type: integer
Security_Detections_API_KqlQueryLanguage:
enum:
- kuery
- lucene
type: string
Security_Detections_API_MachineLearningJobId:
oneOf:
- type: string
- minItems: 1
type: array
items:
type: string
description: Machine learning job ID(s) the rule monitors for anomaly scores.
Security_Detections_API_MachineLearningRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleResponseFields'
Security_Detections_API_MachineLearningRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
Security_Detections_API_MachineLearningRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields'
Security_Detections_API_MachineLearningRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
Security_Detections_API_MachineLearningRulePatchFields:
allOf:
- type: object
properties:
anomaly_threshold:
$ref: '#/components/schemas/Security_Detections_API_AnomalyThreshold'
machine_learning_job_id:
$ref: '#/components/schemas/Security_Detections_API_MachineLearningJobId'
type:
enum:
- machine_learning
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
Security_Detections_API_MachineLearningRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRulePatchFields'
Security_Detections_API_MachineLearningRuleRequiredFields:
required:
- type
- machine_learning_job_id
- anomaly_threshold
type: object
properties:
anomaly_threshold:
$ref: '#/components/schemas/Security_Detections_API_AnomalyThreshold'
machine_learning_job_id:
$ref: '#/components/schemas/Security_Detections_API_MachineLearningJobId'
type:
enum:
- machine_learning
type: string
description: Rule type
Security_Detections_API_MachineLearningRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
Security_Detections_API_MachineLearningRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields'
Security_Detections_API_MaxSignals:
minimum: 1
type: integer
description: "Maximum number of alerts the rule can create during a single run (the rule’s Max alerts per run [advanced setting](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-advanced-params) value).\n> info\n> This setting can be superseded by the [Kibana configuration setting](https://www.elastic.co/guide/en/kibana/current/alert-action-settings-kb.html#alert-settings) `xpack.alerting.rules.run.alerts.max`, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, the rule can generate no more than 1000 alerts even if `max_signals` is set higher.\n"
default: 100
Security_Detections_API_MigrationCleanupResult:
required:
- id
- destinationIndex
- status
- sourceIndex
- version
- updated
type: object
properties:
destinationIndex:
type: string
error:
required:
- message
- status_code
type: object
properties:
message:
type: string
status_code:
type: integer
id:
type: string
sourceIndex:
type: string
status:
enum:
- success
- failure
- pending
type: string
updated:
type: string
format: date-time
version:
type: string
Security_Detections_API_MigrationFinalizationResult:
required:
- id
- completed
- destinationIndex
- status
- sourceIndex
- version
- updated
type: object
properties:
completed:
type: boolean
destinationIndex:
type: string
error:
required:
- message
- status_code
type: object
properties:
message:
type: string
status_code:
type: integer
id:
type: string
sourceIndex:
type: string
status:
enum:
- success
- failure
- pending
type: string
updated:
type: string
format: date-time
version:
type: string
Security_Detections_API_MigrationStatus:
required:
- id
- status
- version
- updated
type: object
properties:
id:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
status:
enum:
- success
- failure
- pending
type: string
updated:
type: string
format: date-time
version:
type: integer
Security_Detections_API_NewTermsFields:
maxItems: 3
minItems: 1
type: array
items:
type: string
description: Fields to monitor for new values.
Security_Detections_API_NewTermsRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleResponseFields'
Security_Detections_API_NewTermsRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields'
Security_Detections_API_NewTermsRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields'
Security_Detections_API_NewTermsRuleDefaultableFields:
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_NewTermsRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
data_view_id:
$ref: '#/components/schemas/Security_Detections_API_DataViewId'
filters:
$ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
index:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
Security_Detections_API_NewTermsRulePatchFields:
allOf:
- type: object
properties:
history_window_start:
$ref: '#/components/schemas/Security_Detections_API_HistoryWindowStart'
new_terms_fields:
$ref: '#/components/schemas/Security_Detections_API_NewTermsFields'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
type:
enum:
- new_terms
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields'
Security_Detections_API_NewTermsRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRulePatchFields'
Security_Detections_API_NewTermsRuleRequiredFields:
required:
- type
- query
- new_terms_fields
- history_window_start
type: object
properties:
history_window_start:
$ref: '#/components/schemas/Security_Detections_API_HistoryWindowStart'
new_terms_fields:
$ref: '#/components/schemas/Security_Detections_API_NewTermsFields'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
type:
enum:
- new_terms
type: string
description: Rule type
Security_Detections_API_NewTermsRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
- required:
- language
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_NewTermsRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields'
Security_Detections_API_NonEmptyString:
minLength: 1
type: string
description: A string that does not contain only whitespace characters
format: nonempty
Security_Detections_API_NormalizedRuleAction:
required:
- id
- params
type: object
properties:
alerts_filter:
$ref: '#/components/schemas/Security_Detections_API_RuleActionAlertsFilter'
frequency:
$ref: '#/components/schemas/Security_Detections_API_RuleActionFrequency'
group:
$ref: '#/components/schemas/Security_Detections_API_RuleActionGroup'
id:
$ref: '#/components/schemas/Security_Detections_API_RuleActionId'
params:
$ref: '#/components/schemas/Security_Detections_API_RuleActionParams'
additionalProperties: false
Security_Detections_API_NormalizedRuleError:
required:
- message
- status_code
- rules
type: object
properties:
err_code:
$ref: '#/components/schemas/Security_Detections_API_BulkActionsDryRunErrCode'
message:
type: string
rules:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleDetailsInError'
status_code:
type: integer
Security_Detections_API_OsqueryParams:
type: object
properties:
ecs_mapping:
$ref: '#/components/schemas/Security_Detections_API_EcsMapping'
pack_id:
type: string
description: 'To specify a query pack, use the packId field. Example: "packId": "processes_elastic"'
queries:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_OsqueryQuery'
query:
type: string
description: 'To run a single query, use the query field and enter a SQL query. Example: "query": "SELECT * FROM processes;"'
saved_query_id:
type: string
description: 'To run a saved query, use the saved_query_id field and specify the saved query ID. Example: "saved_query_id": "processes_elastic"'
timeout:
type: number
description: 'A timeout period, in seconds, after which the query will stop running. Overwriting the default timeout allows you to support queries that require more time to complete. The default and minimum supported value is 60. The maximum supported value is 900. Example: "timeout": 120.'
Security_Detections_API_OsqueryQuery:
required:
- id
- query
type: object
properties:
ecs_mapping:
$ref: '#/components/schemas/Security_Detections_API_EcsMapping'
id:
type: string
description: Query ID
platform:
type: string
query:
type: string
description: Query to run
removed:
type: boolean
snapshot:
type: boolean
version:
type: string
description: Query version
Security_Detections_API_OsqueryResponseAction:
required:
- action_type_id
- params
type: object
properties:
action_type_id:
enum:
- .osquery
type: string
params:
$ref: '#/components/schemas/Security_Detections_API_OsqueryParams'
Security_Detections_API_PlatformErrorResponse:
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: integer
Security_Detections_API_ProcessesParams:
required:
- command
- config
type: object
properties:
command:
enum:
- kill-process
- suspend-process
type: string
description: 'To run an endpoint response action, specify a value for the command field. Example: "command": "isolate"'
comment:
type: string
description: 'Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: "comment": "Check processes"'
config:
required:
- field
type: object
properties:
field:
type: string
description: Field to use instead of process.pid
overwrite:
type: boolean
description: Whether to overwrite field with process.pid
default: true
Security_Detections_API_QueryRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleResponseFields'
Security_Detections_API_QueryRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields'
Security_Detections_API_QueryRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateFields'
Security_Detections_API_QueryRuleDefaultableFields:
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
Security_Detections_API_QueryRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
data_view_id:
$ref: '#/components/schemas/Security_Detections_API_DataViewId'
filters:
$ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
index:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
saved_id:
$ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
Security_Detections_API_QueryRulePatchFields:
allOf:
- type: object
properties:
type:
enum:
- query
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields'
Security_Detections_API_QueryRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_QueryRulePatchFields'
Security_Detections_API_QueryRuleRequiredFields:
required:
- type
type: object
properties:
type:
enum:
- query
type: string
description: Rule type
Security_Detections_API_QueryRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
- required:
- query
- language
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
Security_Detections_API_QueryRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateFields'
Security_Detections_API_RelatedIntegration:
required:
- package
- version
type: object
properties:
integration:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
package:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
version:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
description: "Related integration is a potential dependency of a rule. It's assumed that if the user installs\none of the related integrations of a rule, the rule might start to work properly because it will\nhave source events (generated by this integration) potentially matching the rule's query.\n\nNOTE: Proper work is not guaranteed, because a related integration, if installed, can be\nconfigured differently or generate data that is not necessarily relevant for this rule.\n\nRelated integration is a combination of a Fleet package and (optionally) one of the\npackage's \"integrations\" that this package contains. It is represented by 3 properties:\n\n- `package`: name of the package (required, unique id)\n- `version`: version of the package (required, semver-compatible)\n- `integration`: name of the integration of this package (optional, id within the package)\n\nThere are Fleet packages like `windows` that contain only one integration; in this case,\n`integration` should be unspecified. There are also packages like `aws` and `azure` that contain\nseveral integrations; in this case, `integration` should be specified.\n"
example:
integration: activitylogs
package: azure
version: ~1.1.6
Security_Detections_API_RelatedIntegrationArray:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegration'
Security_Detections_API_RequiredField:
required:
- name
- type
- ecs
type: object
properties:
ecs:
type: boolean
description: Indicates whether the field is ECS-compliant. This property is only present in responses. Its value is computed based on field’s name and type.
name:
minLength: 1
type: string
description: Name of an Elasticsearch field
format: nonempty
type:
minLength: 1
type: string
description: Type of the Elasticsearch field
format: nonempty
description: "Describes an Elasticsearch field that is needed for the rule to function.\n\nAlmost all types of Security rules check source event documents for a match to some kind of\nquery or filter. If a document has certain field with certain values, then it's a match and\nthe rule will generate an alert.\n\nRequired field is an event field that must be present in the source indices of a given rule.\n\n@example\nconst standardEcsField: RequiredField = {\n name: 'event.action',\n type: 'keyword',\n ecs: true,\n};\n\n@example\nconst nonEcsField: RequiredField = {\n name: 'winlog.event_data.AttributeLDAPDisplayName',\n type: 'keyword',\n ecs: false,\n};\n"
Security_Detections_API_RequiredFieldArray:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredField'
Security_Detections_API_RequiredFieldInput:
required:
- name
- type
type: object
properties:
name:
minLength: 1
type: string
description: Name of an Elasticsearch field
format: nonempty
type:
minLength: 1
type: string
description: Type of the Elasticsearch field
format: nonempty
description: 'Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type.'
Security_Detections_API_ResponseAction:
oneOf:
- $ref: '#/components/schemas/Security_Detections_API_OsqueryResponseAction'
- $ref: '#/components/schemas/Security_Detections_API_EndpointResponseAction'
Security_Detections_API_ResponseFields:
required:
- id
- rule_id
- immutable
- rule_source
- updated_at
- updated_by
- created_at
- created_by
- revision
- related_integrations
- required_fields
type: object
properties:
created_at:
type: string
format: date-time
created_by:
type: string
execution_summary:
$ref: '#/components/schemas/Security_Detections_API_RuleExecutionSummary'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
immutable:
$ref: '#/components/schemas/Security_Detections_API_IsRuleImmutable'
required_fields:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldArray'
revision:
$ref: '#/components/schemas/Security_Detections_API_RuleRevision'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_source:
$ref: '#/components/schemas/Security_Detections_API_RuleSource'
updated_at:
type: string
format: date-time
updated_by:
type: string
Security_Detections_API_RiskScore:
maximum: 100
minimum: 0
type: integer
description: "A numerical representation of the alert's severity from 0 to 100, where:\n* `0` - `21` represents low severity\n* `22` - `47` represents medium severity\n* `48` - `73` represents high severity\n* `74` - `100` represents critical severity\n"
Security_Detections_API_RiskScoreMapping:
type: array
items:
required:
- field
- operator
- value
type: object
properties:
field:
type: string
description: Source event field used to override the default `risk_score`.
operator:
enum:
- equals
type: string
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
value:
type: string
description: Overrides generated alerts' risk_score with a value from the source event
Security_Detections_API_RuleAction:
required:
- action_type_id
- id
- params
type: object
properties:
action_type_id:
type: string
description: "The action type used for sending notifications, can be:\n\n - `.slack`\n - `.slack_api`\n - `.email`\n - `.index`\n - `.pagerduty`\n - `.swimlane`\n - `.webhook`\n - `.servicenow`\n - `.servicenow-itom`\n - `.servicenow-sir`\n - `.jira`\n - `.resilient`\n - `.opsgenie`\n - `.teams`\n - `.torq`\n - `.tines`\n - `.d3security`\n"
alerts_filter:
$ref: '#/components/schemas/Security_Detections_API_RuleActionAlertsFilter'
frequency:
$ref: '#/components/schemas/Security_Detections_API_RuleActionFrequency'
group:
$ref: '#/components/schemas/Security_Detections_API_RuleActionGroup'
id:
$ref: '#/components/schemas/Security_Detections_API_RuleActionId'
params:
$ref: '#/components/schemas/Security_Detections_API_RuleActionParams'
uuid:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
Security_Detections_API_RuleActionAlertsFilter:
type: object
description: "Object containing an action’s conditional filters.\n\n- `timeframe` (object, optional): Object containing the time frame for when this action can be run.\n - `days` (array of integers, required): List of days of the week on which this action will be run. Days of the week are expressed as numbers between `1-7`, where `1` is Monday and `7` is Sunday. To select all days of the week, enter an empty array.\n - `hours` (object, required): The hours of the day during which this action will run. Hours of the day are expressed as two strings in the format `hh:mm` in `24` hour time. A start of `00:00` and an end of `24:00` means the action can run all day.\n - start (string, required): Start time in `hh:mm` format.\n - end (string, required): End time in `hh:mm` format.\n - `timezone` (string, required): An ISO timezone name, such as `Europe/Madrid` or `America/New_York`. Specific offsets such as `UTC` or `UTC+1` will also work, but lack built-in DST.\n- `query` (object, optional): Object containing a query filter which gets applied to an action and determines whether the action should run.\n - `kql` (string, required): A KQL string.\n - `filters` (array of objects, required): Array of filter objects, as defined in the `kbn-es-query` package.\n \n"
Security_Detections_API_RuleActionFrequency:
required:
- summary
- notifyWhen
- throttle
type: object
properties:
notifyWhen:
$ref: '#/components/schemas/Security_Detections_API_RuleActionNotifyWhen'
summary:
type: boolean
description: Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
description: 'The action frequency defines when the action runs (for example, only on rule execution or at specific time intervals).'
Security_Detections_API_RuleActionGroup:
type: string
description: Optionally groups actions by use cases. Use `default` for alert notifications.
Security_Detections_API_RuleActionId:
type: string
description: The connector ID.
Security_Detections_API_RuleActionNotifyWhen:
enum:
- onActiveAlert
- onThrottleInterval
- onActionGroupChange
type: string
description: Defines how often rules run actions.
Security_Detections_API_RuleActionParams:
type: object
description: "Object containing the allowed connector fields, which varies according to the connector type.\n\nFor Slack:\n\n - `message` (string, required): The notification message.\n\nFor email:\n\n - `to`, `cc`, `bcc` (string): Email addresses to which the notifications are sent. At least one field must have a value.\n - `subject` (string, optional): Email subject line.\n - `message` (string, required): Email body text.\n\nFor Webhook:\n\n - `body` (string, required): JSON payload.\n\nFor PagerDuty:\n\n - `severity` (string, required): Severity of on the alert notification, can be: `Critical`, `Error`, `Warning` or `Info`.\n - `eventAction` (string, required): Event [action type](https://v2.developer.pagerduty.com/docs/events-api-v2#event-action), which can be `trigger`, `resolve`, or `acknowledge`.\n - `dedupKey` (string, optional): Groups alert notifications with the same PagerDuty alert.\n - `timestamp` (DateTime, optional): ISO-8601 format [timestamp](https://v2.developer.pagerduty.com/docs/types#datetime).\n - `component` (string, optional): Source machine component responsible for the event, for example `security-solution`.\n - `group` (string, optional): Enables logical grouping of service components.\n - `source` (string, optional): The affected system. Defaults to the Kibana saved object ID of the action.\n - `summary` (string, options): Summary of the event. Defaults to `No summary provided`. Maximum length is 1024 characters.\n - `class` (string, optional): Value indicating the class/type of the event.\n"
Security_Detections_API_RuleActionThrottle:
oneOf:
- enum:
- no_actions
- rule
type: string
- pattern: '^[1-9]\d*[smhd]$'
type: string
description: 'Time interval in seconds, minutes, hours, or days.'
example: 1h
description: Defines how often rule actions are taken.
Security_Detections_API_RuleAuthorArray:
type: array
items:
type: string
description: The rule’s author.
Security_Detections_API_RuleCreateProps:
anyOf:
- $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
discriminator:
propertyName: type
Security_Detections_API_RuleDescription:
minLength: 1
type: string
description: The rule’s description.
example: Detects anomalous Windows process creation events.
Security_Detections_API_RuleDetailsInError:
required:
- id
type: object
properties:
id:
type: string
name:
type: string
Security_Detections_API_RuleExceptionList:
required:
- id
- list_id
- type
- namespace_type
type: object
properties:
id:
minLength: 1
type: string
description: ID of the exception container
format: nonempty
list_id:
minLength: 1
type: string
description: List ID of the exception container
format: nonempty
namespace_type:
enum:
- agnostic
- single
type: string
description: Determines the exceptions validity in rule's Kibana space
type:
$ref: '#/components/schemas/Security_Detections_API_ExceptionListType'
description: "Array of [exception containers](https://www.elastic.co/guide/en/security/current/exceptions-api-overview.html), which define exceptions that prevent the rule from generating alerts even when its other criteria are met.\n"
Security_Detections_API_RuleExecutionMetrics:
type: object
properties:
execution_gap_duration_s:
minimum: 0
type: integer
description: Duration in seconds of execution gap
frozen_indices_queried_count:
minimum: 0
type: integer
description: Count of frozen indices queried during the rule execution. These indices could not be entirely excluded after applying the time range filter.
gap_range:
required:
- gte
- lte
type: object
properties:
gte:
type: string
description: Start date of the execution gap
lte:
type: string
description: End date of the execution gap
description: Range of the execution gap
total_enrichment_duration_ms:
minimum: 0
type: integer
description: Total time spent enriching documents during current rule execution cycle
total_indexing_duration_ms:
minimum: 0
type: integer
description: Total time spent indexing documents during current rule execution cycle
total_search_duration_ms:
minimum: 0
type: integer
description: Total time spent performing ES searches as measured by Kibana; includes network latency and time spent serializing/deserializing request/response
Security_Detections_API_RuleExecutionStatus:
enum:
- going to run
- running
- partial failure
- failed
- succeeded
type: string
description: "Custom execution status of Security rules that is different from the status used in the Alerting Framework. We merge our custom status with the Framework's status to determine the resulting status of a rule.\n- going to run - @deprecated Replaced by the 'running' status but left for backwards compatibility with rule execution events already written to Event Log in the prior versions of Kibana. Don't use when writing rule status changes.\n- running - Rule execution started but not reached any intermediate or final status.\n- partial failure - Rule can partially fail for various reasons either in the middle of an execution (in this case we update its status right away) or in the end of it. So currently this status can be both intermediate and final at the same time. A typical reason for a partial failure: not all the indices that the rule searches over actually exist.\n- failed - Rule failed to execute due to unhandled exception or a reason defined in the business logic of its executor function.\n- succeeded - Rule executed successfully without any issues. Note: this status is just an indication of a rule's \"health\". The rule might or might not generate any alerts despite of it."
Security_Detections_API_RuleExecutionStatusOrder:
type: integer
Security_Detections_API_RuleExecutionSummary:
required:
- last_execution
type: object
properties:
last_execution:
required:
- date
- status
- status_order
- message
- metrics
type: object
properties:
date:
type: string
description: Date of the last execution
format: date-time
message:
type: string
metrics:
$ref: '#/components/schemas/Security_Detections_API_RuleExecutionMetrics'
status:
$ref: '#/components/schemas/Security_Detections_API_RuleExecutionStatus'
status_order:
$ref: '#/components/schemas/Security_Detections_API_RuleExecutionStatusOrder'
description: "Summary of the last execution of a rule.\n> info\n> This field is under development and its usage or schema may change\n"
Security_Detections_API_RuleFalsePositiveArray:
type: array
items:
type: string
description: String array used to describe common reasons why the rule may issue false-positive alerts. Defaults to an empty array.
Security_Detections_API_RuleFilterArray:
type: array
items: { }
description: "The query and filter context array used to define the conditions for when alerts are created from events. Defaults to an empty array.\n> info\n> This field is not supported for ES|QL rules.\n"
Security_Detections_API_RuleInterval:
type: string
description: 'Frequency of rule execution, using a date math range. For example, "1h" means the rule runs every hour. Defaults to 5m (5 minutes).'
Security_Detections_API_RuleIntervalFrom:
type: string
description: 'Time from which data is analyzed each time the rule runs, using a date math range. For example, now-4200s means the rule analyzes data from 70 minutes before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).'
format: date-math
Security_Detections_API_RuleIntervalTo:
type: string
Security_Detections_API_RuleLicense:
type: string
description: The rule's license.
Security_Detections_API_RuleMetadata:
type: object
description: "Placeholder for metadata about the rule.\n> info\n> This field is overwritten when you save changes to the rule’s settings.\n"
Security_Detections_API_RuleName:
minLength: 1
type: string
description: A human-readable name for the rule.
example: Anomalous Windows Process Creation
Security_Detections_API_RuleNameOverride:
type: string
description: 'Sets which field in the source event is used to populate the alert''s `signal.rule.name` value (in the UI, this value is displayed on the Rules page in the Rule column). When unspecified, the rule’s `name` value is used. The source field must be a string data type.'
Security_Detections_API_RuleObjectId:
$ref: '#/components/schemas/Security_Detections_API_UUID'
Security_Detections_API_RulePatchProps:
anyOf:
- $ref: '#/components/schemas/Security_Detections_API_EqlRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_QueryRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRulePatchProps'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRulePatchProps'
Security_Detections_API_RulePreviewLoggedRequest:
type: object
properties:
description:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
duration:
type: integer
request:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
request_type:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
Security_Detections_API_RulePreviewLogs:
required:
- errors
- warnings
- duration
type: object
properties:
duration:
type: integer
description: Execution duration in milliseconds
errors:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
requests:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RulePreviewLoggedRequest'
startedAt:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
warnings:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
Security_Detections_API_RulePreviewParams:
required:
- invocationCount
- timeframeEnd
type: object
properties:
invocationCount:
type: integer
timeframeEnd:
type: string
format: date-time
Security_Detections_API_RuleQuery:
type: string
description: "[Query](https://www.elastic.co/guide/en/kibana/8.17/search.html) used by the rule to create alerts.\n\n- For indicator match rules, only the query’s results are used to determine whether an alert is generated.\n- ES|QL rules have additional query requirements. Refer to [Create ES|QL](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-esql-rule) rules for more information.\n"
Security_Detections_API_RuleReferenceArray:
type: array
items:
type: string
description: Array containing notes about or references to relevant information about the rule. Defaults to an empty array.
Security_Detections_API_RuleResponse:
anyOf:
- $ref: '#/components/schemas/Security_Detections_API_EqlRule'
- $ref: '#/components/schemas/Security_Detections_API_QueryRule'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRule'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRule'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRule'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRule'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRule'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRule'
discriminator:
propertyName: type
Security_Detections_API_RuleRevision:
minimum: 0
type: integer
description: "The rule's revision number.\n\nIt represents the version of rule's object in Kibana. It is set to `0` when the rule is installed or created and then gets incremented on each update.\n> info\n> Not all updates to any rule fields will increment the revision. Only those fields that are considered static `rule parameters` can trigger revision increments. For example, an update to a rule's query or index fields will increment the rule's revision by `1`. However, changes to dynamic or technical fields like enabled or execution_summary will not cause revision increments.\n"
Security_Detections_API_RuleSignatureId:
type: string
description: 'A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.'
Security_Detections_API_RuleSource:
oneOf:
- $ref: '#/components/schemas/Security_Detections_API_ExternalRuleSource'
- $ref: '#/components/schemas/Security_Detections_API_InternalRuleSource'
description: 'Discriminated union that determines whether the rule is internally sourced (created within the Kibana app) or has an external source, such as the Elastic Prebuilt rules repo.'
discriminator:
propertyName: type
Security_Detections_API_RuleTagArray:
type: array
items:
type: string
description: 'String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array.'
Security_Detections_API_RuleUpdateProps:
anyOf:
- $ref: '#/components/schemas/Security_Detections_API_EqlRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_QueryRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps'
- $ref: '#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps'
discriminator:
propertyName: type
Security_Detections_API_RuleVersion:
minimum: 1
type: integer
description: "The rule's version number.\n\n- For prebuilt rules it represents the version of the rule's content in the source [detection-rules](https://github.com/elastic/detection-rules) repository (and the corresponding `security_detection_engine` Fleet package that is used for distributing prebuilt rules). \n- For custom rules it is set to `1` when the rule is created. \n> info\n> It is not incremented on each update. Compare this to the `revision` field.\n"
Security_Detections_API_RuntimeFieldMapping:
required:
- type
type: object
properties:
format:
maxLength: 100
type: string
description: 'Format string for date runtime fields, for example `strict_date_optional_time`.'
script:
required:
- source
type: object
properties:
source:
maxLength: 10000
type: string
description: Painless script source to execute.
additionalProperties: false
description: 'Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.'
type:
$ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
description: 'A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.'
Security_Detections_API_RuntimeFieldType:
enum:
- keyword
- long
- double
- date
- ip
- boolean
- geo_point
type: string
description: The data type for the runtime field type. Determines how the field value is indexed and queried.
Security_Detections_API_SavedObjectResolveAliasPurpose:
enum:
- savedObjectConversion
- savedObjectImport
type: string
Security_Detections_API_SavedObjectResolveAliasTargetId:
type: string
Security_Detections_API_SavedObjectResolveOutcome:
enum:
- exactMatch
- aliasMatch
- conflict
type: string
Security_Detections_API_SavedQueryId:
type: string
description: 'Kibana [saved search](https://www.elastic.co/guide/en/kibana/current/save-open-search.html) used by the rule to create alerts.'
Security_Detections_API_SavedQueryRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleResponseFields'
Security_Detections_API_SavedQueryRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields'
Security_Detections_API_SavedQueryRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields'
Security_Detections_API_SavedQueryRuleDefaultableFields:
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_SavedQueryRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
data_view_id:
$ref: '#/components/schemas/Security_Detections_API_DataViewId'
filters:
$ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
index:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
Security_Detections_API_SavedQueryRulePatchFields:
allOf:
- type: object
properties:
saved_id:
$ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
type:
enum:
- saved_query
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields'
Security_Detections_API_SavedQueryRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRulePatchFields'
Security_Detections_API_SavedQueryRuleRequiredFields:
required:
- type
- saved_id
type: object
properties:
saved_id:
$ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
type:
enum:
- saved_query
type: string
description: Rule type
Security_Detections_API_SavedQueryRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
- required:
- language
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_SavedQueryRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields'
Security_Detections_API_SetAlertsStatusByIds:
required:
- signal_ids
- status
type: object
properties:
signal_ids:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
description: 'List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.'
status:
$ref: '#/components/schemas/Security_Detections_API_AlertStatus'
Security_Detections_API_SetAlertsStatusByQuery:
required:
- query
- status
type: object
properties:
conflicts:
enum:
- abort
- proceed
type: string
default: abort
query:
type: object
runtime_fields:
maxProperties: 100
type: object
additionalProperties:
$ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
description: 'Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the alerts index mapping, for example, custom fields added via data view runtime fields. The combined number of unique field names across `runtime_fields` and `runtime_mappings` must not exceed 100.'
runtime_mappings:
maxProperties: 100
type: object
additionalProperties:
$ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
description: 'Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. The combined number of unique field names across `runtime_fields` and `runtime_mappings` must not exceed 100.'
status:
$ref: '#/components/schemas/Security_Detections_API_AlertStatus'
Security_Detections_API_SetAlertTags:
required:
- tags_to_add
- tags_to_remove
type: object
properties:
tags_to_add:
$ref: '#/components/schemas/Security_Detections_API_AlertTags'
tags_to_remove:
$ref: '#/components/schemas/Security_Detections_API_AlertTags'
Security_Detections_API_SetupGuide:
type: string
description: 'Populates the rule’s setup guide with instructions on rule prerequisites such as required integrations, configuration steps, and anything else needed for the rule to work correctly.'
Security_Detections_API_Severity:
enum:
- low
- medium
- high
- critical
type: string
description: "Severity level of alerts produced by the rule, which must be one of the following:\n* `low`: Alerts that are of interest but generally not considered to be security incidents\n* `medium`: Alerts that require investigation\n* `high`: Alerts that require immediate investigation\n* `critical`: Alerts that indicate it is highly likely a security incident has occurred\n"
Security_Detections_API_SeverityMapping:
type: array
items:
required:
- field
- operator
- severity
- value
type: object
properties:
field:
type: string
description: Source event field used to override the default `severity`.
operator:
enum:
- equals
type: string
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
value:
type: string
description: Overrides generated alerts' severity with values from the source event
Security_Detections_API_SiemErrorResponse:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
type: integer
Security_Detections_API_SkippedAlertsIndexMigration:
required:
- index
type: object
properties:
index:
type: string
Security_Detections_API_SortOrder:
enum:
- asc
- desc
type: string
Security_Detections_API_Threat:
required:
- framework
- tactic
type: object
properties:
framework:
type: string
description: Relevant attack framework
tactic:
$ref: '#/components/schemas/Security_Detections_API_ThreatTactic'
technique:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ThreatTechnique'
description: Array containing information on the attack techniques (optional)
description: "> info\n> Currently, only threats described using the MITRE ATT&CK™ framework are supported.\n"
Security_Detections_API_ThreatArray:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_Threat'
Security_Detections_API_ThreatFilters:
type: array
items:
description: Query and filter context array used to filter documents from the Elasticsearch index containing the threat values
Security_Detections_API_ThreatIndex:
type: array
items:
type: string
description: Elasticsearch indices used to check which field values generate alerts.
Security_Detections_API_ThreatIndicatorPath:
type: string
description: Defines the path to the threat indicator in the indicator documents (optional)
Security_Detections_API_ThreatMapping:
minItems: 1
type: array
items:
required:
- entries
type: object
properties:
entries:
type: array
items:
required:
- field
- type
- value
type: object
properties:
field:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
type:
enum:
- mapping
type: string
value:
$ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
description: "Array of entries objects that define mappings between the source event fields and the values in the Elasticsearch threat index. Each entries object must contain these fields:\n\n- field: field from the event indices on which the rule runs\n- type: must be mapping\n- value: field from the Elasticsearch threat index\n \nYou can use Boolean and and or logic to define the conditions for when matching fields and values generate alerts. Sibling entries objects are evaluated using or logic, whereas multiple entries in a single entries object use and logic. See Example of Threat Match rule which uses both `and` and `or` logic.\n"
Security_Detections_API_ThreatMatchRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleResponseFields'
Security_Detections_API_ThreatMatchRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields'
Security_Detections_API_ThreatMatchRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields'
Security_Detections_API_ThreatMatchRuleDefaultableFields:
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_ThreatMatchRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
concurrent_searches:
$ref: '#/components/schemas/Security_Detections_API_ConcurrentSearches'
data_view_id:
$ref: '#/components/schemas/Security_Detections_API_DataViewId'
filters:
$ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
index:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
items_per_search:
$ref: '#/components/schemas/Security_Detections_API_ItemsPerSearch'
saved_id:
$ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
threat_filters:
$ref: '#/components/schemas/Security_Detections_API_ThreatFilters'
threat_indicator_path:
$ref: '#/components/schemas/Security_Detections_API_ThreatIndicatorPath'
threat_language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_ThreatMatchRulePatchFields:
allOf:
- type: object
properties:
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
threat_index:
$ref: '#/components/schemas/Security_Detections_API_ThreatIndex'
threat_mapping:
$ref: '#/components/schemas/Security_Detections_API_ThreatMapping'
threat_query:
$ref: '#/components/schemas/Security_Detections_API_ThreatQuery'
type:
enum:
- threat_match
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields'
Security_Detections_API_ThreatMatchRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRulePatchFields'
Security_Detections_API_ThreatMatchRuleRequiredFields:
required:
- type
- query
- threat_query
- threat_mapping
- threat_index
type: object
properties:
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
threat_index:
$ref: '#/components/schemas/Security_Detections_API_ThreatIndex'
threat_mapping:
$ref: '#/components/schemas/Security_Detections_API_ThreatMapping'
threat_query:
$ref: '#/components/schemas/Security_Detections_API_ThreatQuery'
type:
enum:
- threat_match
type: string
description: Rule type
Security_Detections_API_ThreatMatchRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
- required:
- language
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_ThreatMatchRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields'
Security_Detections_API_ThreatQuery:
type: string
description: Query used to determine which fields in the Elasticsearch index are used for generating alerts.
Security_Detections_API_ThreatSubtechnique:
required:
- id
- name
- reference
type: object
properties:
id:
type: string
description: Subtechnique ID
name:
type: string
description: Subtechnique name
reference:
type: string
description: Subtechnique reference
Security_Detections_API_ThreatTactic:
required:
- id
- name
- reference
type: object
properties:
id:
type: string
description: Tactic ID
name:
type: string
description: Tactic name
reference:
type: string
description: Tactic reference
description: "Object containing information on the attack type\n"
Security_Detections_API_ThreatTechnique:
required:
- id
- name
- reference
type: object
properties:
id:
type: string
description: Technique ID
name:
type: string
description: Technique name
reference:
type: string
description: Technique reference
subtechnique:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ThreatSubtechnique'
description: "Array containing more specific information on the attack technique.\n"
Security_Detections_API_Threshold:
required:
- field
- value
type: object
properties:
cardinality:
$ref: '#/components/schemas/Security_Detections_API_ThresholdCardinality'
field:
$ref: '#/components/schemas/Security_Detections_API_ThresholdField'
value:
$ref: '#/components/schemas/Security_Detections_API_ThresholdValue'
Security_Detections_API_ThresholdAlertSuppression:
required:
- duration
type: object
properties:
duration:
$ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDuration'
description: Defines alert suppression configuration.
Security_Detections_API_ThresholdCardinality:
type: array
items:
required:
- field
- value
type: object
properties:
field:
type: string
description: The field on which to calculate and compare the cardinality.
value:
minimum: 0
type: integer
description: The threshold value from which an alert is generated based on unique number of values of cardinality.field.
description: The field on which the cardinality is applied.
Security_Detections_API_ThresholdField:
oneOf:
- type: string
- type: array
items:
type: string
description: 'The field on which the threshold is applied. If you specify an empty array ([]), alerts are generated when the query returns at least the number of results specified in the value field.'
Security_Detections_API_ThresholdRule:
allOf:
- required:
- name
- description
- risk_score
- severity
- version
- tags
- enabled
- risk_score_mapping
- severity_mapping
- interval
- from
- to
- actions
- exceptions_list
- author
- false_positives
- references
- max_signals
- threat
- setup
- related_integrations
- required_fields
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleResponseFields'
Security_Detections_API_ThresholdRuleCreateFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields'
Security_Detections_API_ThresholdRuleCreateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields'
Security_Detections_API_ThresholdRuleDefaultableFields:
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_ThresholdRuleOptionalFields:
type: object
properties:
alert_suppression:
$ref: '#/components/schemas/Security_Detections_API_ThresholdAlertSuppression'
data_view_id:
$ref: '#/components/schemas/Security_Detections_API_DataViewId'
filters:
$ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
index:
$ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
saved_id:
$ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
Security_Detections_API_ThresholdRulePatchFields:
allOf:
- type: object
properties:
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
threshold:
$ref: '#/components/schemas/Security_Detections_API_Threshold'
type:
enum:
- threshold
type: string
description: Rule type
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields'
Security_Detections_API_ThresholdRulePatchProps:
allOf:
- type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRulePatchFields'
Security_Detections_API_ThresholdRuleRequiredFields:
required:
- type
- query
- threshold
type: object
properties:
query:
$ref: '#/components/schemas/Security_Detections_API_RuleQuery'
threshold:
$ref: '#/components/schemas/Security_Detections_API_Threshold'
type:
enum:
- threshold
type: string
description: Rule type
Security_Detections_API_ThresholdRuleResponseFields:
allOf:
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
- required:
- language
type: object
properties:
language:
$ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
Security_Detections_API_ThresholdRuleUpdateProps:
allOf:
- required:
- name
- description
- risk_score
- severity
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleAction'
description: Array defining the automated actions (notifications) taken when alerts are generated.
alias_purpose:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
alias_target_id:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
author:
$ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
building_block_type:
$ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
description:
$ref: '#/components/schemas/Security_Detections_API_RuleDescription'
enabled:
$ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
exceptions_list:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
false_positives:
$ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
from:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
id:
$ref: '#/components/schemas/Security_Detections_API_UUID'
interval:
$ref: '#/components/schemas/Security_Detections_API_RuleInterval'
investigation_fields:
$ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
license:
$ref: '#/components/schemas/Security_Detections_API_RuleLicense'
max_signals:
$ref: '#/components/schemas/Security_Detections_API_MaxSignals'
meta:
$ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
name:
$ref: '#/components/schemas/Security_Detections_API_RuleName'
namespace:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
note:
$ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
outcome:
$ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
output_index:
$ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
references:
$ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
related_integrations:
$ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
required_fields:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
response_actions:
type: array
items:
$ref: '#/components/schemas/Security_Detections_API_ResponseAction'
risk_score:
$ref: '#/components/schemas/Security_Detections_API_RiskScore'
risk_score_mapping:
$ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
rule_id:
$ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
rule_name_override:
$ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
setup:
$ref: '#/components/schemas/Security_Detections_API_SetupGuide'
severity:
$ref: '#/components/schemas/Security_Detections_API_Severity'
severity_mapping:
$ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
tags:
$ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
threat:
$ref: '#/components/schemas/Security_Detections_API_ThreatArray'
throttle:
$ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
timeline_id:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
timeline_title:
$ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
timestamp_override:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
timestamp_override_fallback_disabled:
$ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
to:
$ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
version:
$ref: '#/components/schemas/Security_Detections_API_RuleVersion'
- $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields'
Security_Detections_API_ThresholdValue:
minimum: 1
type: integer
description: The threshold value from which an alert is generated.
Security_Detections_API_ThrottleForBulkActions:
enum:
- rule
- 1h
- 1d
- 7d
type: string
description: "Defines the maximum interval in which a rule’s actions are executed.\n> info\n> The rule level `throttle` field is deprecated in Elastic Security 8.8 and will remain active for at least the next 12 months.\n> In Elastic Security 8.8 and later, you can use the `frequency` field to define frequencies for individual actions. Actions without frequencies will acquire a converted version of the rule’s `throttle` field. In the response, the converted `throttle` setting appears in the individual actions' `frequency` field.\n"
Security_Detections_API_TiebreakerField:
type: string
description: Sets a secondary field for sorting events
Security_Detections_API_TimelineTemplateId:
type: string
description: Timeline template ID
Security_Detections_API_TimelineTemplateTitle:
type: string
description: Timeline template title
Security_Detections_API_TimestampField:
type: string
description: 'Specifies the name of the event timestamp field used for sorting a sequence of events. Not to be confused with `timestamp_override`, which specifies the more general field used for querying events within a range. Defaults to the @timestamp ECS field.'
Security_Detections_API_TimestampOverride:
type: string
description: 'Sets the time field used to query indices. When unspecified, rules query the `@timestamp` field. The source field must be an Elasticsearch date data type.'
Security_Detections_API_TimestampOverrideFallbackDisabled:
type: boolean
description: Disables the fallback to the event's @timestamp field
Security_Detections_API_UUID:
type: string
description: A universally unique identifier
format: uuid
Security_Detections_API_WarningSchema:
required:
- type
- message
- actionPath
type: object
properties:
actionPath:
type: string
buttonLabel:
type: string
message:
type: string
type:
type: string
Security_Endpoint_Exceptions_API_EndpointList:
oneOf:
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionList'
- type: object
additionalProperties: false
Security_Endpoint_Exceptions_API_EndpointListItem:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
Security_Endpoint_Exceptions_API_ExceptionList:
required:
- id
- list_id
- type
- name
- description
- immutable
- namespace_type
- version
- tie_breaker_id
- created_at
- created_by
- updated_at
- updated_by
type: object
properties:
_version:
type: string
created_at:
type: string
format: date-time
created_by:
type: string
description:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListDescription'
id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
immutable:
type: boolean
list_id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListMeta'
name:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListName'
namespace_type:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType'
os_types:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray'
tags:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListTags'
tie_breaker_id:
type: string
type:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListType'
updated_at:
type: string
format: date-time
updated_by:
type: string
version:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListVersion'
Security_Endpoint_Exceptions_API_ExceptionListDescription:
type: string
Security_Endpoint_Exceptions_API_ExceptionListHumanId:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListId:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItem:
required:
- id
- item_id
- list_id
- type
- name
- description
- entries
- namespace_type
- comments
- tie_breaker_id
- created_at
- created_by
- updated_at
- updated_by
type: object
properties:
_version:
type: string
comments:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray'
created_at:
type: string
format: date-time
created_by:
type: string
description:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription'
entries:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray'
expire_time:
type: string
format: date-time
id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
item_id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
list_id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta'
name:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
namespace_type:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType'
os_types:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray'
tags:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags'
tie_breaker_id:
type: string
type:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType'
updated_at:
type: string
format: date-time
updated_by:
type: string
Security_Endpoint_Exceptions_API_ExceptionListItemComment:
required:
- id
- comment
- created_at
- created_by
type: object
properties:
comment:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
created_at:
type: string
format: date-time
created_by:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
updated_at:
type: string
format: date-time
updated_by:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray:
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemComment'
Security_Endpoint_Exceptions_API_ExceptionListItemDescription:
type: string
Security_Endpoint_Exceptions_API_ExceptionListItemEntry:
anyOf:
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryList'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard'
discriminator:
propertyName: type
Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray:
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntry'
Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists:
required:
- type
- field
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- exists
type: string
Security_Endpoint_Exceptions_API_ExceptionListItemEntryList:
required:
- type
- field
- list
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
list:
required:
- id
- type
type: object
properties:
id:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
type:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ListType'
operator:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- list
type: string
Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch:
required:
- type
- field
- value
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- match
type: string
value:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny:
required:
- type
- field
- value
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- match_any
type: string
value:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard:
required:
- type
- field
- value
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- wildcard
type: string
value:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested:
required:
- type
- field
- entries
type: object
properties:
entries:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem'
field:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
type:
enum:
- nested
type: string
Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem:
oneOf:
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny'
- $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists'
Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator:
enum:
- excluded
- included
type: string
Security_Endpoint_Exceptions_API_ExceptionListItemHumanId:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemId:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemMeta:
type: object
Security_Endpoint_Exceptions_API_ExceptionListItemName:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray:
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType'
Security_Endpoint_Exceptions_API_ExceptionListItemTags:
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ExceptionListItemType:
enum:
- simple
type: string
Security_Endpoint_Exceptions_API_ExceptionListMeta:
type: object
Security_Endpoint_Exceptions_API_ExceptionListName:
type: string
Security_Endpoint_Exceptions_API_ExceptionListOsType:
enum:
- linux
- macos
- windows
type: string
Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray:
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType'
Security_Endpoint_Exceptions_API_ExceptionListTags:
type: array
items:
type: string
Security_Endpoint_Exceptions_API_ExceptionListType:
enum:
- detection
- rule_default
- endpoint
- endpoint_trusted_apps
- endpoint_events
- endpoint_host_isolation_exceptions
- endpoint_blocklists
type: string
Security_Endpoint_Exceptions_API_ExceptionListVersion:
minimum: 1
type: integer
Security_Endpoint_Exceptions_API_ExceptionNamespaceType:
enum:
- agnostic
- single
type: string
description: "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n"
Security_Endpoint_Exceptions_API_FindEndpointListItemsFilter:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ListId:
$ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
Security_Endpoint_Exceptions_API_ListType:
enum:
- binary
- boolean
- byte
- date
- date_nanos
- date_range
- double
- double_range
- float
- float_range
- geo_point
- geo_shape
- half_float
- integer
- integer_range
- ip
- ip_range
- keyword
- long
- long_range
- shape
- short
- text
type: string
Security_Endpoint_Exceptions_API_NonEmptyString:
minLength: 1
type: string
description: A string that does not contain only whitespace characters
format: nonempty
Security_Endpoint_Exceptions_API_PlatformErrorResponse:
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: integer
Security_Endpoint_Exceptions_API_SiemErrorResponse:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
type: integer
Security_Endpoint_Management_API_ActionLogRequestQuery:
type: object
properties:
end_date:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndDate'
page:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
page_size:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
start_date:
$ref: '#/components/schemas/Security_Endpoint_Management_API_StartDate'
Security_Endpoint_Management_API_ActionStateSuccessResponse:
required:
- body
type: object
properties:
body:
required:
- data
type: object
properties:
data:
type: object
properties:
canEncrypt:
type: boolean
Security_Endpoint_Management_API_ActionStatusSuccessResponse:
required:
- body
type: object
properties:
body:
required:
- data
type: object
properties:
data:
required:
- agent_id
- pending_actions
type: object
properties:
agent_id:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
pending_actions:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionsSchema'
Security_Endpoint_Management_API_AgentId:
type: string
description: Agent ID
Security_Endpoint_Management_API_AgentIds:
minLength: 1
oneOf:
- maxItems: 50
minItems: 1
type: array
items:
minLength: 1
type: string
- minLength: 1
type: string
description: A list of agent IDs. Max of 50.
example:
- agent-id-1
- agent-id-2
Security_Endpoint_Management_API_AgentTypes:
enum:
- endpoint
- sentinel_one
- crowdstrike
- microsoft_defender_endpoint
type: string
description: List of agent types to retrieve. Defaults to `endpoint`.
example: endpoint
Security_Endpoint_Management_API_AlertIds:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Management_API_NonEmptyString'
description: A list of alerts ids.
Security_Endpoint_Management_API_CaseIds:
minItems: 1
type: array
items:
minLength: 1
type: string
description: Case IDs to be updated (cannot contain empty strings)
example:
- case-id-1
- case-id-2
Security_Endpoint_Management_API_CloudFileScriptParameters:
required:
- cloudFile
type: object
properties:
cloudFile:
minLength: 1
type: string
description: Script name in cloud storage.
commandLine:
minLength: 1
type: string
description: Command line arguments.
timeout:
minimum: 1
type: integer
description: Timeout in seconds.
Security_Endpoint_Management_API_Command:
minLength: 1
enum:
- isolate
- unisolate
- kill-process
- suspend-process
- running-processes
- get-file
- execute
- upload
- scan
type: string
description: The command to be executed (cannot be an empty string)
Security_Endpoint_Management_API_Commands:
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
description: A list of response action command names.
example:
- isolate
- unisolate
Security_Endpoint_Management_API_Comment:
type: string
description: Optional comment
example: This is a comment
Security_Endpoint_Management_API_EndDate:
type: string
description: An end date in ISO format or Date Math format.
example: '2023-10-31T23:59:59.999Z'
Security_Endpoint_Management_API_EndpointIds:
minItems: 1
type: array
items:
minLength: 1
type: string
description: List of endpoint IDs (cannot contain empty strings)
example:
- endpoint-id-1
- endpoint-id-2
Security_Endpoint_Management_API_EndpointMetadataResponse:
type: object
example:
host_status: healthy
last_checkin: '2023-07-04T15:48:57.360Z'
metadata:
'@timestamp': '2023-07-04T15:48:57.3609346Z'
agent:
build:
original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
id: abb8a826-6812-448c-a571-6d8269b51449
type: endpoint
version: '7.16.0'
data_stream:
dataset: endpoint.metadata
namespace: default
type: metrics
ecs:
version: '1.11.0'
elastic:
agent:
id: abb8a826-6812-448c-a571-6d8269b51449
Endpoint:
capabilities:
- isolation
configuration:
isolation: false
policy:
applied:
endpoint_policy_version: '2'
id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
name: test
status: success
version: '3'
state:
isolation: false
status: enrolled
event:
action: endpoint_metadata
agent_id_status: verified
category:
- host
created: '2023-07-04T15:48:57.3609346Z'
dataset: endpoint.metadata
id: MNtRc++KoKHXXwlj+++++OhZ
ingested: '2023-07-04T15:48:58Z'
kind: metric
module: endpoint
sequence: 43757
type:
- info
host:
architecture: x86_64
hostname: WinDev2104Eval
id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
ip:
- 10.0.2.15
- fe80::21a6:63d3:d70e:e3ad
- 127.0.0.1
- '::1'
mac:
- 08:00:27:b1:1d:5a
name: WinDev2104Eval
os:
Ext:
variant: Windows 10 Enterprise Evaluation
family: windows
full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
kernel: 20H2 (10.0.19042.906)
name: Windows
platform: windows
type: windows
version: 20H2 (10.0.19042.906)
message: Endpoint metadata
policy_info:
agent:
applied:
id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
revision: 3
configured:
id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
revision: 3
endpoint:
id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
revision: 2
Security_Endpoint_Management_API_ExecuteRouteRequestBody:
allOf:
- required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
- required:
- parameters
type: object
properties:
parameters:
required:
- command
type: object
properties:
command:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
timeout:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Timeout'
example:
comment: Get list of all files
endpoint_ids:
- b3d6de74-36b0-4fa8-be46-c375bf1771bf
parameters:
command: ls -al
timeout: 600
Security_Endpoint_Management_API_ExecuteRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentState:
ed518850-681a-4d60-bb98-e22640cae2a8:
isCompleted: false
wasSuccessful: false
agentType: endpoint
command: execute
comment: Get list of all files
createdBy: myuser
hosts:
ed518850-681a-4d60-bb98-e22640cae2a8:
name: gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r
id: 9f934028-2300-4927-b531-b26376793dc4
isCompleted: false
isExpired: false
outputs: { }
parameters:
command: ls -al
timeout: 600
startedAt: '2023-07-28T18:43:27.362Z'
status: pending
wasSuccessful: false
Security_Endpoint_Management_API_GetEndpointActionListResponse:
type: object
example:
data:
- agents:
- afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
agentType: endpoint
command: running-processes
completedAt: '2022-08-08T09:50:47.672Z'
createdBy: elastic
id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
isCompleted: true
isExpired: false
startedAt: '2022-08-08T15:24:57.402Z'
wasSuccessful: true
- agents:
- afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
agentType: endpoint
command: isolate
completedAt: '2022-08-08T10:41:57.352Z'
createdBy: elastic
id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
isCompleted: true
isExpired: false
startedAt: '2022-08-08T15:23:37.359Z'
wasSuccessful: true
- agents:
- afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
agentType: endpoint
command: kill-process
comment: bad process - taking up too much cpu
completedAt: '2022-08-08T09:44:50.952Z'
createdBy: elastic
id: 5bc92c86-b8e6-42dd-837f-12ad29e09caa
isCompleted: true
isExpired: false
startedAt: '2022-08-08T14:38:44.125Z'
wasSuccessful: true
- agents:
- afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
agentType: endpoint
command: unisolate
comment: Not a threat to the network
completedAt: '2022-08-08T09:40:47.398Z'
createdBy: elastic
id: 790d54e0-3aa3-4e5b-8255-3ce9d851246a
isCompleted: true
isExpired: false
startedAt: '2022-08-08T14:38:15.391Z'
wasSuccessful: true
elasticAgentIds:
- afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
endDate: now
page: 1
pageSize: 10
startDate: now-24h/h
total: 4
Security_Endpoint_Management_API_GetEndpointActionResponse:
type: object
example:
data:
agents:
- afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
agentType: endpoint
command: running-processes
completedAt: '2022-08-08T09:50:47.672Z'
createdBy: elastic
id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
isCompleted: true
isExpired: false
outputs:
afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0:
content:
entries:
- command: /opt/cmd1
entity_id: fk2ym7bl3oiu3okjcik0xosc0i0m75x3eh49nu3uaqt4dqanjt
pid: '822'
user: Dexter
- command: /opt/cmd3/opt/cmd3/opt/cmd3/opt/cmd3
entity_id: pwvz91m48wpj9j7ov9gtw8fp7u2rat4eu5ipte37hnhdcbi2pt
pid: '984'
user: Jada
type: json
startedAt: '2022-08-08T15:24:57.402Z'
wasSuccessful: true
Security_Endpoint_Management_API_GetFileRouteRequestBody:
allOf:
- required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
- required:
- parameters
type: object
properties:
parameters:
required:
- path
type: object
properties:
path:
type: string
example:
comment: Get my file
endpoint_ids:
- ed518850-681a-4d60-bb98-e22640cae2a8
parameters:
path: /usr/my-file.txt
Security_Endpoint_Management_API_GetFileRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentState:
ed518850-681a-4d60-bb98-e22640cae2a8:
isCompleted: false
wasSuccessful: false
agentType: endpoint
command: get-file
createdBy: myuser
hosts:
ed518850-681a-4d60-bb98-e22640cae2a8:
name: gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r
id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
isCompleted: false
isExpired: false
outputs: { }
parameters:
path: /usr/my-file.txt
startedAt: '2023-07-28T19:00:03.911Z'
status: pending
wasSuccessful: false
Security_Endpoint_Management_API_GetProcessesRouteRequestBody:
required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
example:
endpoint_ids:
- ed518850-681a-4d60-bb98-e22640cae2a8
Security_Endpoint_Management_API_GetProcessesRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentType: endpoint
command: running-processes
comment: ''
completedAt: '2022-07-29T19:09:44.961Z'
createdBy: myuser
errors: [ ]
id: 233db9ea-6733-4849-9226-5a7039c7161d
isCompleted: true
isExpired: false
outputs:
ed518850-681a-4d60-bb98-e22640cae2a8:
content:
key: value
type: json
parameters: { }
startedAt: '2022-07-29T19:08:49.126Z'
wasSuccessful: true
Security_Endpoint_Management_API_HostPathScriptParameters:
required:
- hostPath
type: object
properties:
commandLine:
minLength: 1
type: string
description: Command line arguments.
hostPath:
minLength: 1
type: string
description: Absolute or relative path of script on host machine.
timeout:
minimum: 1
type: integer
description: Timeout in seconds.
Security_Endpoint_Management_API_HostStatuses:
type: array
items:
enum:
- healthy
- offline
- updating
- inactive
- unenrolled
type: string
description: A set of agent health statuses to filter by.
example:
- healthy
- updating
Security_Endpoint_Management_API_IsolateRouteResponse:
type: object
example:
action: 233db9ea-6733-4849-9226-5a7039c7161d
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentType: endpoint
command: suspend-process
comment: suspend the process
completedAt: '2022-07-29T19:09:44.961Z'
createdBy: myuser
errors: [ ]
id: 233db9ea-6733-4849-9226-5a7039c7161d
isCompleted: true
isExpired: false
outputs:
ed518850-681a-4d60-bb98-e22640cae2a8:
content:
key: value
type: json
parameters:
entity_id: abc123
startedAt: '2022-07-29T19:08:49.126Z'
wasSuccessful: true
Security_Endpoint_Management_API_KillProcessRouteRequestBody:
allOf:
- required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
- required:
- parameters
type: object
properties:
parameters:
oneOf:
- type: object
properties:
pid:
minimum: 1
type: integer
description: The process ID (PID) of the process to terminate.
example: 123
- type: object
properties:
entity_id:
minLength: 1
type: string
description: The entity ID of the process to terminate.
example: abc123
- type: object
properties:
process_name:
minLength: 1
type: string
description: The name of the process to terminate. Valid for SentinelOne agent type only.
example: Elastic
example:
comment: terminate the process
endpoint_ids:
- ed518850-681a-4d60-bb98-e22640cae2a8
parameters:
entity_id: abc123
Security_Endpoint_Management_API_KillProcessRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentType: endpoint
command: kill-process
comment: terminate the process
completedAt: '2022-07-29T19:09:44.961Z'
createdBy: myuser
errors: [ ]
id: 233db9ea-6733-4849-9226-5a7039c7161d
isCompleted: true
isExpired: false
outputs:
ed518850-681a-4d60-bb98-e22640cae2a8:
content:
key: value
type: json
parameters:
entity_id: abc123
startedAt: '2022-07-29T19:08:49.126Z'
wasSuccessful: true
Security_Endpoint_Management_API_Kuery:
type: string
description: A KQL string.
example: 'united.endpoint.host.os.name : ''Windows'''
Security_Endpoint_Management_API_MetadataListResponse:
type: object
example:
data:
- host_status: healthy
last_checkin: '2023-07-04T15:47:57.432Z'
metadata:
'@timestamp': '2023-07-04T15:47:57.432173535Z'
agent:
build:
original: 'version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
id: 285297c6-3bff-4b83-9a07-f3e749801123
type: endpoint
version: '7.16.0'
data_stream:
dataset: endpoint.metadata
namespace: default
type: metrics
ecs:
version: '1.11.0'
elastic:
agent:
id: 285297c6-3bff-4b83-9a07-f3e749801123
Endpoint:
capabilities:
- isolation
configuration:
isolation: false
policy:
applied:
endpoint_policy_version: '2'
id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
name: test
status: success
version: '3'
state:
isolation: false
status: enrolled
event:
action: endpoint_metadata
agent_id_status: verified
category:
- host
created: '2023-07-04T15:47:57.432173535Z'
dataset: endpoint.metadata
id: MNtSXK/SkhEBnmgt++++++7S
ingested: '2023-07-04T15:47:58Z'
kind: metric
module: endpoint
sequence: 400
type:
- info
host:
architecture: x86_64
hostname: david-Xubuntu
id: 0cfead88e2024bd8a27476352b5ab264
ip:
- 127.0.0.1
- '::1'
- 10.0.2.15
- fe80::2ac7:8e15:b957:2fa1
mac:
- 08:00:27:e6:78:8b
name: david-Xubuntu
os:
Ext:
variant: Ubuntu
family: ubuntu
full: Ubuntu 20.04.2
kernel: '5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021'
name: Linux
platform: ubuntu
type: linux
version: 20.04.2
message: Endpoint metadata
policy_info:
agent:
applied:
id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
revision: 0
configured:
id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
revision: 3
endpoint:
id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
revision: 2
- host_status: healthy
last_checkin: '2023-07-04T15:44:31.491Z'
metadata:
'@timestamp': '2023-07-04T15:44:31.4917849Z'
agent:
build:
original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
id: abb8a826-6812-448c-a571-6d8269b51449
type: endpoint
version: '7.16.0'
data_stream:
dataset: endpoint.metadata
namespace: default
type: metrics
ecs:
version: '1.11.0'
elastic:
agent:
id: abb8a826-6812-448c-a571-6d8269b51449
Endpoint:
capabilities:
- isolation
configuration:
isolation: false
policy:
applied:
endpoint_policy_version: '2'
id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
name: test
status: success
version: '3'
state:
isolation: false
status: enrolled
event:
action: endpoint_metadata
agent_id_status: verified
category:
- host
created: '2023-07-04T15:44:31.4917849Z'
dataset: endpoint.metadata
id: MNtRc++KoKHXXwlj+++++/N9
ingested: '2023-07-04T15:44:33Z'
kind: metric
module: endpoint
sequence: 5159
type:
- info
host:
architecture: x86_64
hostname: WinDev2104Eval
id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
ip:
- 10.0.2.15
- fe80::21a6:63d3:d70e:e3ad
- 127.0.0.1
- '::1'
mac:
- 08:00:27:b1:1d:5a
name: WinDev2104Eval
os:
Ext:
variant: Windows 10 Enterprise Evaluation
family: windows
full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
kernel: 20H2 (10.0.19042.906)
name: Windows
platform: windows
type: windows
version: 20H2 (10.0.19042.906)
message: Endpoint metadata
policy_info:
agent:
applied:
id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
revision: 0
configured:
id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
revision: 3
endpoint:
id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
revision: 2
page: 0
pageSize: 10
sortDirection: desc
sortField: enrolled_at
total: 2
Security_Endpoint_Management_API_NonEmptyString:
minLength: 1
type: string
description: A string that does not contain only whitespace characters
format: nonempty
Security_Endpoint_Management_API_Page:
minimum: 1
type: integer
description: Page number
default: 1
example: 1
Security_Endpoint_Management_API_PageSize:
maximum: 100
minimum: 1
type: integer
description: Number of items per page
default: 10
example: 10
Security_Endpoint_Management_API_Parameters:
type: object
description: Optional parameters object
Security_Endpoint_Management_API_PendingActionDataType:
type: integer
Security_Endpoint_Management_API_PendingActionsSchema:
oneOf:
- type: object
properties:
execute:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
get-file:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
isolate:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
kill-process:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
running-processes:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
scan:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
suspend-process:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
unisolate:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
upload:
$ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
- type: object
Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse:
type: object
properties:
note:
type: string
Security_Endpoint_Management_API_RawScriptParameters:
required:
- raw
type: object
properties:
commandLine:
minLength: 1
type: string
description: Command line arguments.
raw:
minLength: 1
type: string
description: Raw script content.
timeout:
minimum: 1
type: integer
description: Timeout in seconds.
Security_Endpoint_Management_API_RunScriptRouteRequestBody:
required:
- parameters
type: object
properties:
parameters:
oneOf:
- $ref: '#/components/schemas/Security_Endpoint_Management_API_RawScriptParameters'
- $ref: '#/components/schemas/Security_Endpoint_Management_API_HostPathScriptParameters'
- $ref: '#/components/schemas/Security_Endpoint_Management_API_CloudFileScriptParameters'
description: 'Exactly one of ''Raw'', ''HostPath'', or ''CloudFile'' must be provided. CommandLine and Timeout are optional for all.'
Security_Endpoint_Management_API_ScanRouteRequestBody:
allOf:
- required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
- required:
- parameters
type: object
properties:
parameters:
required:
- path
type: object
properties:
path:
type: string
description: The folder or file’s full path (including the file name).
example: /usr/my-file.txt
example:
comment: Scan the file for malware
endpoint_ids:
- ed518850-681a-4d60-bb98-e22640cae2a8
parameters:
path: /usr/my-file.txt
Security_Endpoint_Management_API_ScanRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentState:
ed518850-681a-4d60-bb98-e22640cae2a8:
isCompleted: false
wasSuccessful: false
agentType: endpoint
command: scan
createdBy: myuser
hosts:
ed518850-681a-4d60-bb98-e22640cae2a8:
name: gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r
id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
isCompleted: false
isExpired: false
outputs: { }
parameters:
path: /usr/my-file.txt
startedAt: '2023-07-28T19:00:03.911Z'
status: pending
wasSuccessful: false
Security_Endpoint_Management_API_SortDirection:
enum:
- asc
- desc
type: string
description: Determines the sort order.
example: desc
Security_Endpoint_Management_API_SortField:
enum:
- enrolled_at
- metadata.host.hostname
- host_status
- metadata.Endpoint.policy.applied.name
- metadata.Endpoint.policy.applied.status
- metadata.host.os.name
- metadata.host.ip
- metadata.agent.version
- last_checkin
type: string
description: Determines which field is used to sort the results.
example: enrolled_at
Security_Endpoint_Management_API_StartDate:
type: string
description: A start date in ISO 8601 format or Date Math format.
example: '2023-10-31T00:00:00.000Z'
Security_Endpoint_Management_API_SuccessResponse:
type: object
Security_Endpoint_Management_API_SuspendProcessRouteRequestBody:
allOf:
- required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
- required:
- parameters
type: object
properties:
parameters:
oneOf:
- type: object
properties:
pid:
minimum: 1
type: integer
description: The process ID (PID) of the process to suspend.
example: 123
- type: object
properties:
entity_id:
minLength: 1
type: string
description: The entity ID of the process to suspend.
example: abc123
example:
comment: suspend the process
endpoint_ids:
- ed518850-681a-4d60-bb98-e22640cae2a8
parameters:
entity_id: abc123
Security_Endpoint_Management_API_SuspendProcessRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentType: endpoint
command: suspend-process
comment: suspend the process
completedAt: '2022-07-29T19:09:44.961Z'
createdBy: myuser
errors: [ ]
id: 233db9ea-6733-4849-9226-5a7039c7161d
isCompleted: true
isExpired: false
outputs:
ed518850-681a-4d60-bb98-e22640cae2a8:
content:
key: value
type: json
parameters:
entity_id: abc123
startedAt: '2022-07-29T19:08:49.126Z'
wasSuccessful: true
Security_Endpoint_Management_API_Timeout:
minimum: 1
type: integer
description: The maximum timeout value in milliseconds (optional)
Security_Endpoint_Management_API_Type:
enum:
- automated
- manual
type: string
description: Type of response action
Security_Endpoint_Management_API_Types:
maxLength: 2
minLength: 1
type: array
items:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Type'
description: List of types of response actions
example:
- automated
- manual
Security_Endpoint_Management_API_UnisolateRouteResponse:
type: object
example:
action: 233db9ea-6733-4849-9226-5a7039c7161d
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentType: endpoint
command: suspend-process
comment: suspend the process
completedAt: '2022-07-29T19:09:44.961Z'
createdBy: myuser
errors: [ ]
id: 233db9ea-6733-4849-9226-5a7039c7161d
isCompleted: true
isExpired: false
outputs:
ed518850-681a-4d60-bb98-e22640cae2a8:
content:
key: value
type: json
parameters:
entity_id: abc123
startedAt: '2022-07-29T19:08:49.126Z'
wasSuccessful: true
Security_Endpoint_Management_API_UploadRouteRequestBody:
allOf:
- required:
- endpoint_ids
type: object
properties:
agent_type:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
alert_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_AlertIds'
case_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_CaseIds'
comment:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
endpoint_ids:
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
parameters:
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
- required:
- parameters
- file
type: object
properties:
file:
type: string
description: The binary content of the file.
format: binary
example: RWxhc3RpYw==
parameters:
type: object
properties:
overwrite:
type: boolean
description: Overwrite the file on the host if it already exists.
default: false
example: false
example:
endpoint_ids:
- ed518850-681a-4d60-bb98-e22640cae2a8
file: RWxhc3RpYw==
parameters: { }
Security_Endpoint_Management_API_UploadRouteResponse:
type: object
example:
data:
agents:
- ed518850-681a-4d60-bb98-e22640cae2a8
agentState:
ed518850-681a-4d60-bb98-e22640cae2a8:
isCompleted: false
wasSuccessful: false
agentType: endpoint
command: upload
createdBy: elastic
hosts:
ed518850-681a-4d60-bb98-e22640cae2a8:
name: Host-5i6cuc8kdv
id: 9ff6aebc-2cb6-481e-8869-9b30036c9731
isCompleted: false
isExpired: false
outputs: { }
parameters:
file_id: 10e4ce3d-4abb-4f93-a0cd-eaf63a489280
file_name: fix-malware.sh
file_sha256: a0bed94220193ba4895c0aa5b4e7e293381d15765cb164ddf7be5cdd010ae42a
file_size: 69
startedAt: '2023-07-03T15:07:22.837Z'
status: pending
wasSuccessful: false
Security_Endpoint_Management_API_UserIds:
oneOf:
- minItems: 1
type: array
items:
minLength: 1
type: string
- minLength: 1
type: string
description: A list of user IDs.
example:
- user-id-1
- user-id-2
Security_Endpoint_Management_API_WithOutputs:
oneOf:
- minItems: 1
type: array
items:
minLength: 1
type: string
- minLength: 1
type: string
description: A list of action IDs that should include the complete output of the action.
example:
- action-id-1
- action-id-2
Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem:
required:
- message
- index
type: object
properties:
index:
type: integer
message:
type: string
Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats:
required:
- successful
- failed
- total
type: object
properties:
failed:
type: integer
successful:
type: integer
total:
type: integer
Security_Entity_Analytics_API_AssetCriticalityLevel:
enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
description: The criticality level of the asset.
Security_Entity_Analytics_API_AssetCriticalityRecord:
allOf:
- $ref: '#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord'
- $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts'
- required:
- '@timestamp'
type: object
properties:
'@timestamp':
type: string
description: The time the record was created or updated.
format: date-time
example: '2017-07-21T17:32:28Z'
example:
'@timestamp': '2024-08-02T11:15:34.290Z'
asset:
criticality: high_impact
criticality_level: high_impact
host:
asset:
criticality: high_impact
name: my_host
id_field: host.name
id_value: my_host
Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts:
required:
- asset
type: object
properties:
asset:
required:
- asset
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
host:
required:
- name
type: object
properties:
asset:
required:
- criticality
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
name:
type: string
service:
required:
- name
type: object
properties:
asset:
required:
- criticality
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
name:
type: string
user:
required:
- name
type: object
properties:
asset:
required:
- criticality
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
name:
type: string
Security_Entity_Analytics_API_AssetCriticalityRecordIdParts:
required:
- id_value
- id_field
type: object
properties:
id_field:
$ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
id_value:
type: string
description: The ID value of the asset.
Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse:
required:
- cleanup_successful
- errors
type: object
properties:
cleanup_successful:
type: boolean
example: false
errors:
type: array
items:
required:
- seq
- error
type: object
properties:
error:
type: string
seq:
type: integer
Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse:
required:
- risk_engine_saved_object_configured
- errors
type: object
properties:
errors:
type: array
items:
required:
- seq
- error
type: object
properties:
error:
type: string
seq:
type: integer
risk_engine_saved_object_configured:
type: boolean
example: false
Security_Entity_Analytics_API_CreateAssetCriticalityRecord:
allOf:
- $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts'
- required:
- criticality_level
type: object
properties:
criticality_level:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
Security_Entity_Analytics_API_EngineComponentResource:
enum:
- entity_engine
- entity_definition
- index
- component_template
- index_template
- ingest_pipeline
- enrich_policy
- task
- transform
type: string
description: The type of Elasticsearch or Kibana resource backing an engine component.
Security_Entity_Analytics_API_EngineComponentStatus:
required:
- id
- installed
- resource
type: object
properties:
errors:
type: array
items:
type: object
properties:
message:
type: string
description: Detailed error message.
title:
type: string
description: Short error title.
description: 'Errors reported by this component, if any.'
health:
enum:
- green
- yellow
- red
- unavailable
- unknown
type: string
description: The health status of the component.
id:
type: string
description: Unique identifier for the component.
installed:
type: boolean
description: Whether the component is currently installed.
resource:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EngineComponentResource'
description: Status of an individual Elasticsearch or Kibana resource backing an engine.
Security_Entity_Analytics_API_EngineDataviewUpdateResult:
required:
- type
type: object
properties:
changes:
type: object
properties:
indexPatterns:
type: array
items:
type: string
description: The updated list of index patterns now used by the engine.
description: The changes applied to the engine.
type:
type: string
description: The entity type of the engine that was updated.
description: The result of applying data view index changes to a single engine.
Security_Entity_Analytics_API_EngineDescriptor:
required:
- type
- indexPattern
- status
- fieldHistoryLength
type: object
properties:
delay:
pattern: '[smdh]$'
type: string
description: 'The delay before the transform processes new data, allowing late-arriving documents to be included.'
default: 1m
example: 1m
docsPerSecond:
type: integer
description: Throttle value for the number of documents processed per second. Use -1 for no throttle.
error:
required:
- message
- action
type: object
properties:
action:
enum:
- init
type: string
description: The lifecycle action that caused the error.
message:
type: string
description: A human-readable error message.
description: Present when the engine status is `error`. Describes the failure.
fieldHistoryLength:
type: integer
description: The number of historical values retained per field.
example: 10
filter:
type: string
description: An optional Kibana Query Language (KQL) filter applied to source documents before aggregation.
example: 'host.name: "my-host"'
frequency:
pattern: '[smdh]$'
type: string
description: How often the transform runs.
default: 1m
example: 1m
indexPattern:
$ref: '#/components/schemas/Security_Entity_Analytics_API_IndexPattern'
lookbackPeriod:
pattern: '[smdh]$'
type: string
description: How far back the transform looks when calculating aggregations.
default: 24h
example: 24h
status:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EngineStatus'
timeout:
pattern: '[smdh]$'
type: string
description: The timeout for initializing the aggregating transform.
default: 180s
example: 180s
timestampField:
type: string
description: The field used as the timestamp for source documents.
example: '@timestamp'
type:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EntityType'
description: 'Describes a single entity engine, including its configuration and current status.'
Security_Entity_Analytics_API_EngineStatus:
enum:
- installing
- started
- stopped
- updating
- error
type: string
description: The current operational status of an entity engine.
Security_Entity_Analytics_API_Entity:
oneOf:
- $ref: '#/components/schemas/Security_Entity_Analytics_API_UserEntity'
- $ref: '#/components/schemas/Security_Entity_Analytics_API_HostEntity'
- $ref: '#/components/schemas/Security_Entity_Analytics_API_ServiceEntity'
description: 'An entity record from the Entity Store. The `entity` namespace is a root-level field in the latest index, unlike source logs where it is nested under `host`, `user`, or `service`.'
Security_Entity_Analytics_API_EntityRiskLevels:
enum:
- Unknown
- Low
- Moderate
- High
- Critical
type: string
Security_Entity_Analytics_API_EntityRiskScoreRecord:
required:
- '@timestamp'
- id_field
- id_value
- calculated_level
- calculated_score
- calculated_score_norm
- category_1_score
- category_1_count
- inputs
- notes
type: object
properties:
'@timestamp':
type: string
description: The time at which the risk score was calculated.
format: date-time
example: '2017-07-21T17:32:28Z'
calculated_level:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EntityRiskLevels'
calculated_score:
type: number
description: The raw numeric value of the given entity's risk score.
format: double
calculated_score_norm:
maximum: 100
minimum: 0
type: number
description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
format: double
category_1_count:
type: integer
description: The number of risk input documents that contributed to the Category 1 score (`category_1_score`).
category_1_score:
type: number
description: The contribution of Category 1 to the overall risk score (`calculated_score`). Category 1 contains Detection Engine Alerts.
format: double
category_2_count:
type: integer
category_2_score:
type: number
format: double
criticality_level:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
criticality_modifier:
type: number
format: double
id_field:
type: string
description: 'The identifier field defining this risk score. Coupled with `id_value`, uniquely identifies the entity being scored.'
example: host.name
id_value:
type: string
description: 'The identifier value defining this risk score. Coupled with `id_field`, uniquely identifies the entity being scored.'
example: example.host
inputs:
type: array
items:
$ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreInput'
description: A list of the highest-risk documents contributing to this risk score. Useful for investigative purposes.
notes:
type: array
items:
type: string
Security_Entity_Analytics_API_EntityType:
enum:
- user
- host
- service
type: string
description: The type of entity.
Security_Entity_Analytics_API_HostEntity:
required:
- host
- entity
type: object
properties:
'@timestamp':
type: string
description: The time the entity record was last updated.
format: date-time
asset:
required:
- criticality
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
entity:
required:
- name
- source
type: object
properties:
name:
type: string
source:
type: string
event:
type: object
properties:
ingested:
type: string
description: When the event was ingested into Elasticsearch.
format: date-time
host:
required:
- name
type: object
properties:
architecture:
type: array
items:
type: string
description: Observed CPU architectures.
domain:
type: array
items:
type: string
description: Observed host domains.
hostname:
type: array
items:
type: string
description: Observed hostnames.
id:
type: array
items:
type: string
description: Observed host IDs.
ip:
type: array
items:
type: string
description: Observed IP addresses.
mac:
type: array
items:
type: string
description: Observed MAC addresses.
name:
type: string
description: Primary host name.
risk:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EntityRiskScoreRecord'
type:
type: array
items:
type: string
description: Observed host types.
description: Elastic Common Schema (ECS) host fields collected on the entity.
description: 'An entity record representing a host, stored in the Entity Store latest index.'
Security_Entity_Analytics_API_IdField:
enum:
- host.name
- user.name
- service.name
type: string
Security_Entity_Analytics_API_IndexPattern:
type: string
description: An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
example: logs-*
Security_Entity_Analytics_API_InspectQuery:
required:
- dsl
- response
type: object
properties:
dsl:
type: array
items:
type: string
description: Elasticsearch query DSL that was executed.
response:
type: array
items:
type: string
description: Raw Elasticsearch responses.
description: Debug information about the Elasticsearch query executed.
Security_Entity_Analytics_API_Interval:
pattern: '^[1-9]\d*[smh]$'
type: string
description: 'Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,'
example: 1h
Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse:
required:
- message
- full_error
type: object
properties:
full_error:
type: string
message:
type: string
Security_Entity_Analytics_API_RiskEngineScheduleNowResponse:
type: object
properties:
success:
type: boolean
Security_Entity_Analytics_API_RiskScoreInput:
required:
- id
- index
- description
- category
type: object
properties:
category:
type: string
description: The risk category of the risk input document.
example: category_1
contribution_score:
type: number
format: double
description:
type: string
description: A human-readable description of the risk input document.
example: 'Generated from Detection Engine Rule: Malware Prevention Alert'
id:
type: string
description: The unique identifier (`_id`) of the original source document
example: 91a93376a507e86cfbf282166275b89f9dbdb1f0be6c8103c6ff2909ca8e1a1c
index:
type: string
description: The unique index (`_index`) of the original source document
example: .internal.alerts-security.alerts-default-000001
risk_score:
maximum: 100
minimum: 0
type: number
description: The weighted risk score of the risk input document.
format: double
timestamp:
type: string
description: The @timestamp of the risk input document.
example: '2017-07-21T17:32:28Z'
description: A generic representation of a document contributing to a Risk Score.
Security_Entity_Analytics_API_ServiceEntity:
required:
- service
- entity
type: object
properties:
'@timestamp':
type: string
description: The time the entity record was last updated.
format: date-time
asset:
required:
- criticality
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
entity:
required:
- name
- source
type: object
properties:
name:
type: string
source:
type: string
event:
type: object
properties:
ingested:
type: string
description: When the event was ingested into Elasticsearch.
format: date-time
service:
required:
- name
type: object
properties:
name:
type: string
description: Primary service name.
risk:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EntityRiskScoreRecord'
description: Elastic Common Schema (ECS) service fields collected on the entity.
description: 'An entity record representing a service, stored in the Entity Store latest index.'
Security_Entity_Analytics_API_StoreStatus:
enum:
- not_installed
- installing
- running
- stopped
- error
type: string
description: The overall operational status of the Entity Store.
Security_Entity_Analytics_API_TaskManagerUnavailableResponse:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
minimum: 400
type: integer
description: Task manager is unavailable
Security_Entity_Analytics_API_UserEntity:
required:
- user
- entity
type: object
properties:
'@timestamp':
type: string
description: The time the entity record was last updated.
format: date-time
asset:
required:
- criticality
type: object
properties:
criticality:
$ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
entity:
required:
- name
- source
type: object
properties:
name:
type: string
source:
type: string
event:
type: object
properties:
ingested:
type: string
description: When the event was ingested into Elasticsearch.
format: date-time
user:
required:
- name
type: object
properties:
domain:
type: array
items:
type: string
description: Observed user domains.
email:
type: array
items:
type: string
description: Observed email addresses.
full_name:
type: array
items:
type: string
description: Observed full names of the user.
hash:
type: array
items:
type: string
description: Observed user hashes.
id:
type: array
items:
type: string
description: Observed user IDs.
name:
type: string
description: Primary user name.
risk:
$ref: '#/components/schemas/Security_Entity_Analytics_API_EntityRiskScoreRecord'
roles:
type: array
items:
type: string
description: Observed roles assigned to the user.
description: Elastic Common Schema (ECS) user fields collected on the entity.
description: 'An entity record representing a user, stored in the Entity Store latest index.'
Security_Exceptions_API_CreateExceptionListItemComment:
required:
- comment
type: object
properties:
comment:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_CreateExceptionListItemCommentArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemComment'
Security_Exceptions_API_CreateRuleExceptionListItemComment:
required:
- comment
type: object
properties:
comment:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_CreateRuleExceptionListItemCommentArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemComment'
Security_Exceptions_API_CreateRuleExceptionListItemProps:
required:
- type
- name
- description
- entries
type: object
properties:
comments:
$ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemCommentArray'
description:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
entries:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
expire_time:
type: string
format: date-time
item_id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
name:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
namespace_type:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
os_types:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
tags:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
type:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
Security_Exceptions_API_ExceptionList:
required:
- id
- list_id
- type
- name
- description
- immutable
- namespace_type
- version
- tie_breaker_id
- created_at
- created_by
- updated_at
- updated_by
type: object
properties:
_version:
type: string
created_at:
type: string
format: date-time
created_by:
type: string
description:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
immutable:
type: boolean
list_id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
name:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
namespace_type:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
os_types:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
tags:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
tie_breaker_id:
type: string
type:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
updated_at:
type: string
format: date-time
updated_by:
type: string
version:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
Security_Exceptions_API_ExceptionListDescription:
type: string
Security_Exceptions_API_ExceptionListHumanId:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListId:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItem:
required:
- id
- item_id
- list_id
- type
- name
- description
- entries
- namespace_type
- comments
- tie_breaker_id
- created_at
- created_by
- updated_at
- updated_by
type: object
properties:
_version:
type: string
comments:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemCommentArray'
created_at:
type: string
format: date-time
created_by:
type: string
description:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
entries:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
expire_time:
type: string
format: date-time
id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
item_id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
list_id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
name:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
namespace_type:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
os_types:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
tags:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
tie_breaker_id:
type: string
type:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
updated_at:
type: string
format: date-time
updated_by:
type: string
Security_Exceptions_API_ExceptionListItemComment:
required:
- id
- comment
- created_at
- created_by
type: object
properties:
comment:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
created_at:
type: string
format: date-time
created_by:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
updated_at:
type: string
format: date-time
updated_by:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemCommentArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemComment'
Security_Exceptions_API_ExceptionListItemDescription:
type: string
Security_Exceptions_API_ExceptionListItemEntry:
anyOf:
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryList'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNested'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchWildcard'
discriminator:
propertyName: type
Security_Exceptions_API_ExceptionListItemEntryArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntry'
Security_Exceptions_API_ExceptionListItemEntryExists:
required:
- type
- field
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- exists
type: string
Security_Exceptions_API_ExceptionListItemEntryList:
required:
- type
- field
- list
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
list:
required:
- id
- type
type: object
properties:
id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
type:
$ref: '#/components/schemas/Security_Exceptions_API_ListType'
operator:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- list
type: string
Security_Exceptions_API_ExceptionListItemEntryMatch:
required:
- type
- field
- value
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- match
type: string
value:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemEntryMatchAny:
required:
- type
- field
- value
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- match_any
type: string
value:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemEntryMatchWildcard:
required:
- type
- field
- value
- operator
type: object
properties:
field:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
operator:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
type:
enum:
- wildcard
type: string
value:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemEntryNested:
required:
- type
- field
- entries
type: object
properties:
entries:
minItems: 1
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem'
field:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
type:
enum:
- nested
type: string
Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem:
oneOf:
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny'
- $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists'
Security_Exceptions_API_ExceptionListItemEntryOperator:
enum:
- excluded
- included
type: string
Security_Exceptions_API_ExceptionListItemHumanId:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemId:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemMeta:
type: object
Security_Exceptions_API_ExceptionListItemName:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemOsTypeArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsType'
Security_Exceptions_API_ExceptionListItemTags:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListItemType:
enum:
- simple
type: string
Security_Exceptions_API_ExceptionListMeta:
type: object
Security_Exceptions_API_ExceptionListName:
type: string
Security_Exceptions_API_ExceptionListOsType:
enum:
- linux
- macos
- windows
type: string
Security_Exceptions_API_ExceptionListOsTypeArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsType'
Security_Exceptions_API_ExceptionListsImportBulkError:
required:
- error
type: object
properties:
error:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
type: integer
id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
item_id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
list_id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ExceptionListsImportBulkErrorArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkError'
Security_Exceptions_API_ExceptionListTags:
type: array
items:
type: string
Security_Exceptions_API_ExceptionListType:
enum:
- detection
- rule_default
- endpoint
- endpoint_trusted_apps
- endpoint_events
- endpoint_host_isolation_exceptions
- endpoint_blocklists
type: string
Security_Exceptions_API_ExceptionListVersion:
minimum: 1
type: integer
Security_Exceptions_API_ExceptionNamespaceType:
enum:
- agnostic
- single
type: string
description: "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n"
Security_Exceptions_API_FindExceptionListItemsFilter:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_FindExceptionListsFilter:
type: string
Security_Exceptions_API_ListId:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_ListType:
enum:
- binary
- boolean
- byte
- date
- date_nanos
- date_range
- double
- double_range
- float
- float_range
- geo_point
- geo_shape
- half_float
- integer
- integer_range
- ip
- ip_range
- keyword
- long
- long_range
- shape
- short
- text
type: string
Security_Exceptions_API_NonEmptyString:
minLength: 1
type: string
description: A string that does not contain only whitespace characters
format: nonempty
Security_Exceptions_API_PlatformErrorResponse:
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: integer
Security_Exceptions_API_RuleId:
$ref: '#/components/schemas/Security_Exceptions_API_UUID'
Security_Exceptions_API_SiemErrorResponse:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
type: integer
Security_Exceptions_API_UpdateExceptionListItemComment:
required:
- comment
type: object
properties:
comment:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
Security_Exceptions_API_UpdateExceptionListItemCommentArray:
type: array
items:
$ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemComment'
Security_Exceptions_API_UUID:
type: string
description: A universally unique identifier
format: uuid
Security_Lists_API_FindListItemsCursor:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_FindListItemsFilter:
type: string
Security_Lists_API_FindListsCursor:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_FindListsFilter:
type: string
Security_Lists_API_List:
required:
- id
- type
- name
- description
- immutable
- version
- tie_breaker_id
- created_at
- created_by
- updated_at
- updated_by
type: object
properties:
_version:
type: string
'@timestamp':
type: string
format: date-time
created_at:
type: string
format: date-time
created_by:
type: string
description:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
immutable:
type: boolean
meta:
$ref: '#/components/schemas/Security_Lists_API_ListMetadata'
name:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
tie_breaker_id:
type: string
type:
$ref: '#/components/schemas/Security_Lists_API_ListType'
updated_at:
type: string
format: date-time
updated_by:
type: string
version:
minimum: 1
type: integer
Security_Lists_API_ListDescription:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_ListId:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_ListItem:
required:
- id
- type
- list_id
- value
- tie_breaker_id
- created_at
- created_by
- updated_at
- updated_by
type: object
properties:
_version:
type: string
'@timestamp':
type: string
format: date-time
created_at:
type: string
format: date-time
created_by:
type: string
id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
list_id:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
meta:
$ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
tie_breaker_id:
type: string
type:
$ref: '#/components/schemas/Security_Lists_API_ListType'
updated_at:
type: string
format: date-time
updated_by:
type: string
value:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_ListItemId:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_ListItemMetadata:
type: object
Security_Lists_API_ListItemPrivileges:
required:
- username
- has_all_requested
- cluster
- index
- application
type: object
properties:
application:
type: object
additionalProperties:
type: boolean
cluster:
type: object
additionalProperties:
type: boolean
has_all_requested:
type: boolean
index:
type: object
additionalProperties:
type: object
additionalProperties:
type: boolean
username:
type: string
Security_Lists_API_ListItemValue:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_ListMetadata:
type: object
Security_Lists_API_ListName:
$ref: '#/components/schemas/Security_Lists_API_NonEmptyString'
Security_Lists_API_ListPrivileges:
required:
- username
- has_all_requested
- cluster
- index
- application
type: object
properties:
application:
type: object
additionalProperties:
type: boolean
cluster:
type: object
additionalProperties:
type: boolean
has_all_requested:
type: boolean
index:
type: object
additionalProperties:
type: object
additionalProperties:
type: boolean
username:
type: string
Security_Lists_API_ListType:
enum:
- binary
- boolean
- byte
- date
- date_nanos
- date_range
- double
- double_range
- float
- float_range
- geo_point
- geo_shape
- half_float
- integer
- integer_range
- ip
- ip_range
- keyword
- long
- long_range
- shape
- short
- text
type: string
Security_Lists_API_NonEmptyString:
minLength: 1
type: string
description: A string that does not contain only whitespace characters
format: nonempty
Security_Lists_API_PlatformErrorResponse:
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: integer
Security_Lists_API_SiemErrorResponse:
required:
- status_code
- message
type: object
properties:
message:
type: string
status_code:
type: integer
Security_Osquery_API_ArrayQueries:
type: array
items:
$ref: '#/components/schemas/Security_Osquery_API_ArrayQueriesItem'
description: An array of queries to run.
Security_Osquery_API_ArrayQueriesItem:
type: object
properties:
ecs_mapping:
$ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
id:
$ref: '#/components/schemas/Security_Osquery_API_QueryId'
platform:
$ref: '#/components/schemas/Security_Osquery_API_Platform'
query:
$ref: '#/components/schemas/Security_Osquery_API_Query'
removed:
$ref: '#/components/schemas/Security_Osquery_API_Removed'
snapshot:
$ref: '#/components/schemas/Security_Osquery_API_Snapshot'
version:
$ref: '#/components/schemas/Security_Osquery_API_Version'
Security_Osquery_API_CreateLiveQueryRequestBody:
type: object
properties:
agent_all:
type: boolean
description: 'When `true`, the query runs on all agents.'
agent_ids:
type: array
items:
type: string
description: A list of agent IDs to run the query on.
agent_platforms:
type: array
items:
type: string
description: A list of agent platforms to run the query on.
agent_policy_ids:
type: array
items:
type: string
description: A list of agent policy IDs to run the query on.
alert_ids:
type: array
items:
type: string
description: A list of alert IDs associated with the live query.
case_ids:
type: array
items:
type: string
description: A list of case IDs associated with the live query.
ecs_mapping:
$ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
event_ids:
type: array
items:
type: string
description: A list of event IDs associated with the live query.
metadata:
type:
- 'null'
- object
description: Custom metadata object associated with the live query.
pack_id:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
queries:
$ref: '#/components/schemas/Security_Osquery_API_ArrayQueries'
query:
$ref: '#/components/schemas/Security_Osquery_API_Query'
saved_query_id:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
example:
agent_all: true
ecs_mapping:
host.uptime:
field: total_seconds
query: select * from uptime;
Security_Osquery_API_CreateLiveQueryResponse:
type: object
example:
data:
'@timestamp': '2022-07-26T09:59:32.220Z'
action_id: 3c42c847-eb30-4452-80e0-728584042334
agent_all: true
agent_ids: [ ]
agent_platforms: [ ]
agent_policy_ids: [ ]
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
expiration: '2022-07-26T10:04:32.220Z'
input_type: osquery
metadata:
execution_context:
name: osquery
url: /app/osquery/live_queries/new
queries:
- action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
ecs_mapping:
host.uptime:
field: total_seconds
id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
query: select * from uptime;
timeout: 120
type: INPUT_ACTION
user_id: elastic
Security_Osquery_API_CreatePacksRequestBody:
type: object
properties:
description:
$ref: '#/components/schemas/Security_Osquery_API_PackDescription'
enabled:
$ref: '#/components/schemas/Security_Osquery_API_Enabled'
name:
$ref: '#/components/schemas/Security_Osquery_API_PackName'
policy_ids:
$ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
queries:
$ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
shards:
$ref: '#/components/schemas/Security_Osquery_API_Shards'
example:
description: My pack
enabled: true
name: my_pack
policy_ids:
- my_policy_id
- fleet-server-policy
queries:
my_query:
ecs_mapping:
client.port:
field: port
tags:
value:
- tag1
- tag2
interval: 60
query: SELECT * FROM listening_ports;
timeout: 120
shards:
fleet-server-policy: 58
my_policy_id: 35
Security_Osquery_API_CreatePacksResponse:
type: object
example:
data:
created_at: '2025-02-26T13:37:30.452Z'
created_by: elastic
description: My pack
enabled: true
name: my_pack
queries:
ports:
ecs_mapping:
client.port:
field: port
interval: 60
query: SELECT * FROM listening_ports;
removed: false
snapshot: true
timeout: 120
saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
shards:
- key: 47638692-7c4c-4053-aa3e-7186f28df349
value: 35
- key: 5e267651-fe50-443e-8d3f-3bbc9171b618
value: 58
updated_at: '2025-02-26T13:37:30.452Z'
updated_by: elastic
Security_Osquery_API_CreateSavedQueryRequestBody:
type: object
properties:
description:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
ecs_mapping:
$ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
id:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
interval:
$ref: '#/components/schemas/Security_Osquery_API_Interval'
platform:
$ref: '#/components/schemas/Security_Osquery_API_Platform'
query:
$ref: '#/components/schemas/Security_Osquery_API_Query'
removed:
$ref: '#/components/schemas/Security_Osquery_API_Removed'
snapshot:
$ref: '#/components/schemas/Security_Osquery_API_Snapshot'
version:
$ref: '#/components/schemas/Security_Osquery_API_Version'
example:
description: Saved query description
ecs_mapping:
host.uptime:
field: total_seconds
id: saved_query_id
interval: '60'
platform: 'linux,darwin'
query: select * from uptime;
timeout: 120
version: '2.8.0'
Security_Osquery_API_CreateSavedQueryResponse:
type: object
example:
data: { }
Security_Osquery_API_DefaultSuccessResponse:
type: object
Security_Osquery_API_ECSMapping:
type: object
additionalProperties:
$ref: '#/components/schemas/Security_Osquery_API_ECSMappingItem'
description: Map osquery results columns or static values to Elastic Common Schema (ECS) fields
example:
host.uptime:
field: total_seconds
Security_Osquery_API_ECSMappingItem:
type: object
properties:
field:
type: string
description: The ECS field to map to.
example: host.uptime
value:
oneOf:
- type: string
- type: array
items:
type: string
description: The value to map to the ECS field.
example: total_seconds
Security_Osquery_API_ECSMappingOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
Security_Osquery_API_Enabled:
type: boolean
description: Enables the pack.
example: true
Security_Osquery_API_EnabledOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Enabled'
Security_Osquery_API_FindLiveQueryDetailsResponse:
type: object
example:
data:
'@timestamp': '2022-07-26T09:59:32.220Z'
action_id: 3c42c847-eb30-4452-80e0-728584042334
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
expiration: '2022-07-26T10:04:32.220Z'
queries:
- action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
docs: 0
ecs_mapping:
host.uptime:
field: total_seconds
failed: 1
id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
pending: 0
query: select * from uptime;
responded: 1
saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
status: completed
successful: 0
status: completed
user_id: elastic
Security_Osquery_API_FindLiveQueryResponse:
type: object
example:
data:
items:
- fields:
'@timestamp': '2023-10-31T00:00:00Z'
action_id: 3c42c847-eb30-4452-80e0-728584042334
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
expiration: '2023-10-31T00:00:00Z'
queries:
- action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
ecs_mapping:
host.uptime:
field: total_seconds
id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
query: select * from uptime;
saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
user_id: elastic
Security_Osquery_API_FindPackResponse:
type: object
example:
data:
created_at: '2022-07-25T19:41:10.263Z'
created_by: elastic
description: ''
enabled: true
id: 3c42c847-eb30-4452-80e0-728584042334
name: test_pack
namespaces:
- default
policy_ids: [ ]
queries:
uptime:
ecs_mapping:
message:
field: days
interval: 3600
query: select * from uptime
read_only: false
type: osquery-pack
updated_at: '2022-07-25T20:12:01.455Z'
updated_by: elastic
Security_Osquery_API_FindPacksResponse:
type: object
example:
data:
- attributes:
created_at: '2023-10-31T00:00:00Z'
created_by: elastic
description: My pack description
enabled: true
name: My Pack
queries:
- ecs_mapping:
- host.uptime:
field: total_seconds
id: uptime
interval: '3600'
query: select * from uptime;
updated_at: '2023-10-31T00:00:00Z'
updated_by: elastic
id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
namespaces:
- default
type: osquery-pack
page: 1
pageSize: 10
policy_ids: [ ]
total: 1
Security_Osquery_API_FindSavedQueryDetailResponse:
type: object
example:
data:
attributes:
created_at: '2022-07-26T09:28:08.597Z'
created_by: elastic
description: Saved query description
ecs_mapping:
host.uptime:
field: total_seconds
id: saved_query_id
interval: '60'
platform: 'linux,darwin'
prebuilt: false
query: select * from uptime;
updated_at: '2022-07-26T09:28:08.597Z'
updated_by: elastic
version: '2.8.0'
coreMigrationVersion: '8.4.0'
id: 3c42c847-eb30-4452-80e0-728584042334
namespaces:
- default
references: [ ]
type: osquery-saved-query
updated_at: '2022-07-26T09:28:08.600Z'
version: WzQzMTcsMV0=
Security_Osquery_API_FindSavedQueryResponse:
type: object
example:
data:
- attributes:
created_at: '2022-07-26T09:28:08.597Z'
created_by: elastic
description: Saved query description
ecs_mapping:
host.uptime:
field: total_seconds
id: saved_query_id
interval: '60'
platform: 'linux,darwin'
prebuilt: false
query: select * from uptime;
updated_at: '2022-07-26T09:28:08.597Z'
updated_by: elastic
version: '2.8.0'
id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
namespaces:
- default
type: osquery-saved-query
page: 1
per_page: 100
total: 11
Security_Osquery_API_GetLiveQueryResultsResponse:
type: object
description: The response for getting live query results.
example:
data:
edges:
- { }
- { }
total: 2
Security_Osquery_API_Interval:
type: string
description: 'An interval, in seconds, on which to run the query.'
example: '60'
Security_Osquery_API_IntervalOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Interval'
Security_Osquery_API_KueryOrUndefined:
type:
- 'null'
- string
description: The kuery to filter the results by.
example: 'agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13'
Security_Osquery_API_ObjectQueries:
type: object
additionalProperties:
$ref: '#/components/schemas/Security_Osquery_API_ObjectQueriesItem'
description: An object of queries.
Security_Osquery_API_ObjectQueriesItem:
type: object
properties:
ecs_mapping:
$ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
id:
$ref: '#/components/schemas/Security_Osquery_API_QueryId'
platform:
$ref: '#/components/schemas/Security_Osquery_API_Platform'
query:
$ref: '#/components/schemas/Security_Osquery_API_Query'
removed:
$ref: '#/components/schemas/Security_Osquery_API_Removed'
saved_query_id:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
snapshot:
$ref: '#/components/schemas/Security_Osquery_API_Snapshot'
version:
$ref: '#/components/schemas/Security_Osquery_API_Version'
Security_Osquery_API_PackDescription:
type: string
description: The pack description.
example: Pack description
Security_Osquery_API_PackDescriptionOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_PackDescription'
Security_Osquery_API_PackId:
type: string
description: 'The ID of the pack you want to run, retrieve, update, or delete.'
example: 3c42c847-eb30-4452-80e0-728584042334
Security_Osquery_API_PackIdOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
Security_Osquery_API_PackName:
type: string
description: The pack name.
Security_Osquery_API_PageOrUndefined:
type:
- 'null'
- integer
description: The page number to return. The default is 1.
example: 1
Security_Osquery_API_PageSizeOrUndefined:
type:
- 'null'
- integer
description: The number of results to return per page. The default is 20.
example: 20
Security_Osquery_API_Platform:
type: string
description: 'Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.'
example: 'linux,darwin'
Security_Osquery_API_PlatformOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Platform'
Security_Osquery_API_PolicyIds:
type: array
items:
type: string
description: A list of agents policy IDs.
example:
- policyId1
- policyId2
Security_Osquery_API_PolicyIdsOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
Security_Osquery_API_Query:
type: string
description: The SQL query you want to run.
example: select * from uptime;
Security_Osquery_API_QueryId:
type: string
description: The ID of the query.
example: 3c42c847-eb30-4452-80e0-728584042334
Security_Osquery_API_QueryOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Query'
Security_Osquery_API_Removed:
type: boolean
description: Indicates whether the query is removed.
example: false
Security_Osquery_API_RemovedOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Removed'
Security_Osquery_API_SavedQueryDescription:
type: string
description: The saved query description.
example: Saved query description
Security_Osquery_API_SavedQueryDescriptionOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
Security_Osquery_API_SavedQueryId:
type: string
description: The ID of a saved query.
example: 3c42c847-eb30-4452-80e0-728584042334
Security_Osquery_API_SavedQueryIdOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
Security_Osquery_API_Shards:
type: object
additionalProperties:
type: number
description: 'An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.'
example:
policy_id: 50
Security_Osquery_API_Snapshot:
type: boolean
description: Indicates whether the query is a snapshot.
example: true
Security_Osquery_API_SnapshotOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Snapshot'
Security_Osquery_API_SortOrderOrUndefined:
enum:
- asc
- desc
type: string
description: Specifies the sort order.
example: desc
Security_Osquery_API_SortOrUndefined:
type:
- 'null'
- string
description: The field that is used to sort the results.
default: createdAt
example: createdAt
Security_Osquery_API_UpdatePacksRequestBody:
type: object
properties:
description:
$ref: '#/components/schemas/Security_Osquery_API_PackDescription'
enabled:
$ref: '#/components/schemas/Security_Osquery_API_Enabled'
name:
$ref: '#/components/schemas/Security_Osquery_API_PackName'
policy_ids:
$ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
queries:
$ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
shards:
$ref: '#/components/schemas/Security_Osquery_API_Shards'
example:
name: updated_my_pack_name
Security_Osquery_API_UpdatePacksResponse:
type: object
example:
data:
created_at: '2025-02-26T13:37:30.452Z'
created_by: elastic
description: My pack
enabled: true
name: updated_my_pack_name
queries:
ports:
ecs_mapping:
client.port:
field: port
interval: 60
query: SELECT * FROM listening_ports;
removed: false
snapshot: true
timeout: 120
saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
shards:
- key: 47638692-7c4c-4053-aa3e-7186f28df349
value: 35
- key: 5e267651-fe50-443e-8d3f-3bbc9171b618
value: 58
updated_at: '2025-02-26T13:40:16.297Z'
updated_by: elastic
Security_Osquery_API_UpdateSavedQueryRequestBody:
type: object
properties:
description:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
ecs_mapping:
$ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
id:
$ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
interval:
$ref: '#/components/schemas/Security_Osquery_API_Interval'
platform:
$ref: '#/components/schemas/Security_Osquery_API_Platform'
query:
$ref: '#/components/schemas/Security_Osquery_API_Query'
removed:
$ref: '#/components/schemas/Security_Osquery_API_Removed'
snapshot:
$ref: '#/components/schemas/Security_Osquery_API_Snapshot'
version:
$ref: '#/components/schemas/Security_Osquery_API_Version'
example:
id: updated_my_saved_query_name
Security_Osquery_API_UpdateSavedQueryResponse:
type: object
example:
data: { }
Security_Osquery_API_Version:
type: string
description: Uses the Osquery versions greater than or equal to the specified version string.
example: 1.0.0
Security_Osquery_API_VersionOrUndefined:
$ref: '#/components/schemas/Security_Osquery_API_Version'
Security_Timeline_API_AssociatedFilterType:
enum:
- all
- document_only
- saved_object_only
- document_and_saved_object
- orphan
type: string
description: Filter notes based on their association with a document or saved object.
Security_Timeline_API_BareNote:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_NoteCreatedAndUpdatedMetadata'
- required:
- timelineId
type: object
properties:
eventId:
type:
- 'null'
- string
description: The `_id` of the associated event for this note.
example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
note:
type:
- 'null'
- string
description: The text of the note
example: This is an example text
timelineId:
type: string
description: The `savedObjectId` of the Timeline that this note is associated with
example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
Security_Timeline_API_BarePinnedEvent:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata'
- required:
- eventId
- timelineId
type: object
properties:
eventId:
type: string
description: The `_id` of the associated event for this pinned event.
example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
timelineId:
type: string
description: The `savedObjectId` of the timeline that this pinned event is associated with
example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
Security_Timeline_API_ColumnHeaderResult:
type: object
properties:
aggregatable:
type:
- 'null'
- boolean
category:
type:
- 'null'
- string
columnHeaderType:
type:
- 'null'
- string
description:
type:
- 'null'
- string
example:
type:
- 'null'
- string
id:
type:
- 'null'
- string
indexes:
type:
- 'null'
- array
items:
type: string
name:
type:
- 'null'
- string
placeholder:
type:
- 'null'
- string
searchable:
type:
- 'null'
- boolean
type:
type:
- 'null'
- string
Security_Timeline_API_DataProviderQueryMatch:
type: object
properties:
enabled:
type:
- 'null'
- boolean
excluded:
type:
- 'null'
- boolean
id:
type:
- 'null'
- string
kqlQuery:
type:
- 'null'
- string
name:
type:
- 'null'
- string
queryMatch:
$ref: '#/components/schemas/Security_Timeline_API_QueryMatchResult'
type:
$ref: '#/components/schemas/Security_Timeline_API_DataProviderType'
Security_Timeline_API_DataProviderResult:
type: object
properties:
and:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_DataProviderQueryMatch'
enabled:
type:
- 'null'
- boolean
excluded:
type:
- 'null'
- boolean
id:
type:
- 'null'
- string
kqlQuery:
type:
- 'null'
- string
name:
type:
- 'null'
- string
queryMatch:
$ref: '#/components/schemas/Security_Timeline_API_QueryMatchResult'
type:
$ref: '#/components/schemas/Security_Timeline_API_DataProviderType'
Security_Timeline_API_DataProviderType:
enum:
- default
- template
type: string
description: The type of data provider.
Security_Timeline_API_DocumentIds:
oneOf:
- type: array
items:
type: string
- type: string
Security_Timeline_API_FavoriteTimelineResponse:
required:
- savedObjectId
- version
type: object
properties:
code:
type:
- 'null'
- number
favorite:
type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResult'
message:
type:
- 'null'
- string
savedObjectId:
type: string
templateTimelineId:
type:
- 'null'
- string
templateTimelineVersion:
type:
- 'null'
- number
timelineType:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
version:
type: string
Security_Timeline_API_FavoriteTimelineResult:
type: object
properties:
favoriteDate:
type:
- 'null'
- number
fullName:
type:
- 'null'
- string
userName:
type:
- 'null'
- string
description: Indicates when and who marked a Timeline as a favorite.
example:
favoriteDate: 1741337636741
userName: elastic
Security_Timeline_API_FilterTimelineResult:
type: object
properties:
exists:
type:
- 'null'
- string
match_all:
type:
- 'null'
- string
meta:
type:
- 'null'
- object
properties:
alias:
type:
- 'null'
- string
controlledBy:
type:
- 'null'
- string
disabled:
type:
- 'null'
- boolean
field:
type:
- 'null'
- string
formattedValue:
type:
- 'null'
- string
index:
type:
- 'null'
- string
key:
type:
- 'null'
- string
negate:
type:
- 'null'
- boolean
params:
type:
- 'null'
- string
type:
type:
- 'null'
- string
value:
type:
- 'null'
- string
missing:
type:
- 'null'
- string
query:
type:
- 'null'
- string
range:
type:
- 'null'
- string
script:
type:
- 'null'
- string
example:
meta:
alias: Custom filter name
disabled: false
index: '.alerts-security.alerts-default,logs-*'
key: '@timestamp'
negate: 'false,'
type: exists
value: exists
query: '{"exists":{"field":"@timestamp"}}'
Security_Timeline_API_GetNotesResult:
required:
- totalCount
- notes
type: object
properties:
notes:
type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_Note'
totalCount:
type: number
Security_Timeline_API_ImportTimelineResult:
type: object
properties:
errors:
type: array
items:
type: object
properties:
error:
type: object
properties:
message:
type: string
description: The reason why the timeline could not be imported
example: Malformed JSON
status_code:
type: number
description: The HTTP status code of the error
example: 400
description: The error containing the reason why the timeline could not be imported
id:
type: string
description: The ID of the timeline that failed to import
example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
description: The list of failed Timeline imports
success:
type: boolean
description: Indicates whether any of the Timelines were successfully imports
success_count:
type: number
description: The amount of successfully imported/updated Timelines
example: 99
timelines_installed:
type: number
description: The amount of successfully installed Timelines
example: 80
timelines_updated:
type: number
description: The amount of successfully updated Timelines
example: 19
Security_Timeline_API_ImportTimelines:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
- required:
- savedObjectId
- version
- pinnedEventIds
- eventNotes
- globalNotes
type: object
properties:
eventNotes:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_BareNote'
globalNotes:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_BareNote'
pinnedEventIds:
type:
- 'null'
- array
items:
type: string
savedObjectId:
type:
- 'null'
- string
version:
type:
- 'null'
- string
Security_Timeline_API_Note:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_BareNote'
- required:
- noteId
- version
type: object
properties:
noteId:
type: string
description: The `savedObjectId` of the note
example: 709f99c6-89b6-4953-9160-35945c8e174e
version:
type: string
description: The version of the note
example: WzQ2LDFd
Security_Timeline_API_NoteCreatedAndUpdatedMetadata:
type: object
properties:
created:
type:
- 'null'
- number
description: 'The time the note was created, using a 13-digit Epoch timestamp.'
example: 1587468588922
createdBy:
type:
- 'null'
- string
description: The user who created the note.
example: casetester
updated:
type:
- 'null'
- number
description: 'The last time the note was updated, using a 13-digit Epoch timestamp'
example: 1741344876825
updatedBy:
type:
- 'null'
- string
description: The user who last updated the note
example: casetester
Security_Timeline_API_PersistPinnedEventResponse:
oneOf:
- allOf:
- $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
- $ref: '#/components/schemas/Security_Timeline_API_PinnedEventBaseResponseBody'
- type:
- 'null'
- object
Security_Timeline_API_PersistTimelineResponse:
required:
- data
type: object
properties:
data:
required:
- persistTimeline
type: object
properties:
persistTimeline:
required:
- timeline
type: object
properties:
timeline:
$ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
Security_Timeline_API_PinnedEvent:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_BarePinnedEvent'
- required:
- pinnedEventId
- version
type: object
properties:
pinnedEventId:
type: string
description: The `savedObjectId` of this pinned event
example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
version:
type: string
description: The version of this pinned event
example: WzQ2LDFe
Security_Timeline_API_PinnedEventBaseResponseBody:
required:
- code
type: object
properties:
code:
type: number
message:
type: string
Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata:
type: object
properties:
created:
type:
- 'null'
- number
description: 'The time the pinned event was created, using a 13-digit Epoch timestamp.'
example: 1587468588922
createdBy:
type:
- 'null'
- string
description: The user who created the pinned event.
example: casetester
updated:
type:
- 'null'
- number
description: 'The last time the pinned event was updated, using a 13-digit Epoch timestamp'
example: 1741344876825
updatedBy:
type:
- 'null'
- string
description: The user who last updated the pinned event
example: casetester
Security_Timeline_API_QueryMatchResult:
type: object
properties:
displayField:
type:
- 'null'
- string
displayValue:
type:
- 'null'
- string
field:
type:
- 'null'
- string
operator:
type:
- 'null'
- string
value:
oneOf:
- type:
- 'null'
- string
- type:
- 'null'
- array
items:
type: string
Security_Timeline_API_ResolvedTimeline:
required:
- timeline
- outcome
type: object
properties:
alias_purpose:
$ref: '#/components/schemas/Security_Timeline_API_SavedObjectResolveAliasPurpose'
alias_target_id:
type: string
outcome:
$ref: '#/components/schemas/Security_Timeline_API_SavedObjectResolveOutcome'
timeline:
$ref: '#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject'
Security_Timeline_API_ResponseNote:
required:
- code
- message
- note
type: object
properties:
code:
type: number
message:
type: string
note:
$ref: '#/components/schemas/Security_Timeline_API_Note'
Security_Timeline_API_RowRendererId:
enum:
- alert
- alerts
- auditd
- auditd_file
- library
- netflow
- plain
- registry
- suricata
- system
- system_dns
- system_endgame_process
- system_file
- system_fim
- system_security_event
- system_socket
- threat_match
- zeek
type: string
description: Identifies the available row renderers
Security_Timeline_API_SavedObjectIds:
oneOf:
- type: array
items:
type: string
- type: string
Security_Timeline_API_SavedObjectResolveAliasPurpose:
enum:
- savedObjectConversion
- savedObjectImport
type: string
Security_Timeline_API_SavedObjectResolveOutcome:
enum:
- exactMatch
- aliasMatch
- conflict
type: string
Security_Timeline_API_SavedTimeline:
type: object
properties:
columns:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_ColumnHeaderResult'
description: The Timeline's columns
example:
- columnHeaderType: not-filtered
id: '@timestamp'
- columnHeaderType: not-filtered
id: event.category
created:
type:
- 'null'
- number
description: 'The time the Timeline was created, using a 13-digit Epoch timestamp.'
example: 1587468588922
createdBy:
type:
- 'null'
- string
description: The user who created the Timeline.
example: casetester
dataProviders:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_DataProviderResult'
description: Object containing query clauses
example:
- enabled: true
excluded: false
id: id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
name: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
queryMatch:
field: '_id,'
operator: ':'
value: 'd3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,'
dataViewId:
type:
- 'null'
- string
description: ID of the Timeline's Data View
example: security-solution-default
dateRange:
type:
- 'null'
- object
properties:
end:
oneOf:
- type:
- 'null'
- string
- type:
- 'null'
- number
start:
oneOf:
- type:
- 'null'
- string
- type:
- 'null'
- number
description: The Timeline's search period.
example:
end: 1587456479201
start: 1587370079200
description:
type:
- 'null'
- string
description: The Timeline's description
example: Investigating exposure of CVE XYZ
eqlOptions:
type:
- 'null'
- object
properties:
eventCategoryField:
type:
- 'null'
- string
query:
type:
- 'null'
- string
size:
oneOf:
- type:
- 'null'
- string
- type:
- 'null'
- number
tiebreakerField:
type:
- 'null'
- string
timestampField:
type:
- 'null'
- string
description: EQL query that is used in the correlation tab
example:
eventCategoryField: event.category
query: 'sequence\n[process where process.name == "sudo"]\n[any where true]'
size: 100
timestampField: '@timestamp'
eventType:
type:
- 'null'
- string
description: Event types displayed in the Timeline
example: all
deprecated: true
excludedRowRendererIds:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_RowRendererId'
description: A list of row renderers that should not be used when in `Event renderers` mode
favorite:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResult'
filters:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_FilterTimelineResult'
description: A list of filters that should be applied to the query
indexNames:
type:
- 'null'
- array
items:
type: string
description: A list of index names to use in the query (e.g. when the default data view has been modified)
example:
- .logs*
kqlMode:
type:
- 'null'
- string
description: "Indicates whether the KQL bar filters the query results or searches for additional results, where:\n * `filter`: filters query results\n * `search`: displays additional search results"
example: search
kqlQuery:
$ref: '#/components/schemas/Security_Timeline_API_SerializedFilterQueryResult'
savedQueryId:
type:
- 'null'
- string
description: The ID of the saved query that might be used in the Query tab
example: c7b16904-02d7-4f32-b8f2-cc20f9625d6e
savedSearchId:
type:
- 'null'
- string
description: The ID of the saved search that is used in the ES|QL tab
example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
sort:
$ref: '#/components/schemas/Security_Timeline_API_Sort'
status:
$ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
templateTimelineId:
type:
- 'null'
- string
description: 'A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.'
example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
templateTimelineVersion:
type:
- 'null'
- number
description: 'Timeline template version number. For Timelines, the value is `null`.'
example: 12
timelineType:
$ref: '#/components/schemas/Security_Timeline_API_TimelineType'
title:
type:
- 'null'
- string
description: The Timeline's title.
example: CVE XYZ investigation
updated:
type:
- 'null'
- number
description: 'The last time the Timeline was updated, using a 13-digit Epoch timestamp'
example: 1741344876825
updatedBy:
type:
- 'null'
- string
description: The user who last updated the Timeline
example: casetester
Security_Timeline_API_SavedTimelineWithSavedObjectId:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
- required:
- savedObjectId
- version
type: object
properties:
savedObjectId:
type: string
description: The `savedObjectId` of the Timeline or Timeline template
example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
version:
type: string
description: The version of the Timeline or Timeline template
example: WzE0LDFd
Security_Timeline_API_SerializedFilterQueryResult:
type: object
properties:
filterQuery:
type:
- 'null'
- object
properties:
kuery:
type:
- 'null'
- object
properties:
expression:
type:
- 'null'
- string
kind:
type:
- 'null'
- string
serializedQuery:
type:
- 'null'
- string
description: KQL bar query.
example:
filterQuery: 'null'
kuery:
expression: '_id : *'
kind: kuery
serializedQuery: '{"bool":{"should":[{"exists":{"field":"_id"}}],"minimum_should_match":1}}'
Security_Timeline_API_Sort:
oneOf:
- $ref: '#/components/schemas/Security_Timeline_API_SortObject'
- type: array
items:
$ref: '#/components/schemas/Security_Timeline_API_SortObject'
Security_Timeline_API_SortFieldTimeline:
enum:
- title
- description
- updated
- created
type: string
description: The field to sort the timelines by.
Security_Timeline_API_SortObject:
type: object
properties:
columnId:
type:
- 'null'
- string
columnType:
type:
- 'null'
- string
sortDirection:
type:
- 'null'
- string
description: Object indicating how rows are sorted in the Timeline's grid
example:
columnId: '@timestamp'
sortDirection: desc
Security_Timeline_API_TimelineResponse:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
- $ref: '#/components/schemas/Security_Timeline_API_SavedTimelineWithSavedObjectId'
- type: object
properties:
eventIdToNoteIds:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_Note'
description: A list of all the notes that are associated to this Timeline.
noteIds:
type:
- 'null'
- array
items:
type: string
description: A list of all the ids of notes that are associated to this Timeline.
example:
- 709f99c6-89b6-4953-9160-35945c8e174e
notes:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_Note'
description: A list of all the notes that are associated to this Timeline.
pinnedEventIds:
type:
- 'null'
- array
items:
type: string
description: A list of all the ids of pinned events that are associated to this Timeline.
example:
- 983f99c6-89b6-4953-9160-35945c8a194f
pinnedEventsSaveObject:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
description: A list of all the pinned events that are associated to this Timeline.
Security_Timeline_API_TimelineSavedToReturnObject:
allOf:
- $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
- required:
- savedObjectId
- version
type: object
properties:
eventIdToNoteIds:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_Note'
noteIds:
type:
- 'null'
- array
items:
type: string
notes:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_Note'
pinnedEventIds:
type:
- 'null'
- array
items:
type: string
pinnedEventsSaveObject:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
savedObjectId:
type: string
version:
type: string
Security_Timeline_API_TimelineStatus:
enum:
- active
- draft
- immutable
type: string
description: The status of the Timeline.
Security_Timeline_API_TimelineType:
enum:
- default
- template
type: string
description: The type of Timeline.
Short_URL_APIs_urlResponse:
type: object
properties:
accessCount:
type: integer
accessDate:
type: string
createDate:
type: string
id:
type: string
description: The identifier for the short URL.
locator:
type: object
properties:
id:
type: string
description: The identifier for the locator.
state:
type: object
description: The locator parameters.
version:
type: string
description: The version of Kibana when the short URL was created.
slug:
type: string
description: "A random human-readable slug is automatically generated if the `humanReadableSlug` parameter is set to `true`. If it is set to `false`, a random short string is generated.\n"
SLOs_400_response:
title: Bad request
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
example: Bad Request
message:
type: string
example: 'Invalid value ''foo'' supplied to: [...]'
statusCode:
type: number
example: 400
SLOs_401_response:
title: Unauthorized
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
example: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]"
statusCode:
type: number
example: 401
SLOs_403_response:
title: Unauthorized
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
example: Unauthorized
message:
type: string
example: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]"
statusCode:
type: number
example: 403
SLOs_404_response:
title: Not found
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
example: Not Found
message:
type: string
example: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
statusCode:
type: number
example: 404
SLOs_409_response:
title: Conflict
required:
- statusCode
- error
- message
type: object
properties:
error:
type: string
example: Conflict
message:
type: string
example: 'SLO [d077e940-1515-11ee-9c50-9d096392f520] already exists'
statusCode:
type: number
example: 409
SLOs_budgeting_method:
title: Budgeting method
enum:
- occurrences
- timeslices
type: string
description: The budgeting method to use when computing the rollup data.
example: occurrences
SLOs_bulk_delete_request:
title: Bulk delete SLO request
required:
- list
type: object
properties:
list:
type: array
items:
type: string
description: The SLO Definition id
example: 8853df00-ae2e-11ed-90af-09bb6422b258
description: An array of SLO Definition id
description: "The bulk delete SLO request takes a list of SLOs Definition id to delete.\n"
SLOs_bulk_delete_response:
title: Bulk delete SLO response
type: object
properties:
taskId:
type: string
description: The taskId of the bulk delete operation
example: d08506b7-f0e8-4f8b-a06a-a83940f4db91
description: "The bulk delete SLO response returns a taskId that can be used to poll for its status\n"
SLOs_bulk_delete_status_response:
title: The status of the bulk deletion
type: object
properties:
error:
type: string
description: The error message if the bulk deletion operation failed
example: Task not found
isDone:
type: boolean
description: Indicates if the bulk deletion operation is completed
example: true
results:
type: array
items:
type: object
properties:
error:
type: string
description: The error message if the deletion operation failed for this SLO
example: 'SLO [d08506b7-f0e8-4f8b-a06a-a83940f4db91] not found'
id:
type: string
description: The ID of the SLO that was deleted
example: d08506b7-f0e8-4f8b-a06a-a83940f4db91
success:
type: boolean
description: The result of the deletion operation for this SLO
example: true
description: 'The results of the bulk deletion operation, including the success status and any errors for each SLO'
description: 'Indicates if the bulk deletion is completed, with the detailed results of the operation.'
SLOs_bulk_purge_rollup_request:
title: Bulk Purge Rollup data request
required:
- list
- purgePolicy
type: object
properties:
list:
type: array
items:
type: string
description: The SLO Definition id
example: 8853df00-ae2e-11ed-90af-09bb6422b258
description: An array of slo ids
purgePolicy:
type: object
oneOf:
- type: object
properties:
age:
type: string
description: 'The duration to determine which documents to purge, formatted as {duration}{unit}. This value should be greater than or equal to the time window of every SLO provided.'
example: 7d
purgeType:
enum:
- fixed-age
type: string
description: Specifies whether documents will be purged based on a specific age or on a timestamp
- type: object
properties:
purgeType:
enum:
- fixed-time
type: string
description: Specifies whether documents will be purged based on a specific age or on a timestamp
timestamp:
type: string
description: 'The timestamp to determine which documents to purge, formatted in ISO. This value should be older than the applicable time window of every SLO provided.'
example: '2024-12-31T00:00:00.000Z'
description: Policy that dictates which SLI documents to purge based on age
description: "The bulk purge rollup data request takes a list of SLO ids and a purge policy, then deletes the rollup data according to the purge policy. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n"
SLOs_bulk_purge_rollup_response:
title: Bulk Purge Rollup data response
type: object
properties:
taskId:
type: string
description: The task id of the purge operation
example: 8853df00-ae2e-11ed-90af-09bb6422b258
description: "The bulk purge rollup data response returns a task id from the elasticsearch deleteByQuery response.\n"
SLOs_create_slo_request:
title: Create SLO request
required:
- name
- description
- indicator
- timeWindow
- budgetingMethod
- objective
type: object
properties:
budgetingMethod:
$ref: '#/components/schemas/SLOs_budgeting_method'
description:
type: string
description: A description for the SLO.
groupBy:
$ref: '#/components/schemas/SLOs_group_by'
id:
type: string
description: A optional and unique identifier for the SLO. Must be between 8 and 36 chars
example: my-super-slo-id
indicator:
oneOf:
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
- $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
- $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
name:
type: string
description: A name for the SLO.
objective:
$ref: '#/components/schemas/SLOs_objective'
settings:
$ref: '#/components/schemas/SLOs_settings'
tags:
type: array
items:
type: string
description: List of tags
timeWindow:
$ref: '#/components/schemas/SLOs_time_window'
description: "The create SLO API request body varies depending on the type of indicator, time window and budgeting method.\n"
SLOs_create_slo_response:
title: Create SLO response
required:
- id
type: object
properties:
id:
type: string
example: 8853df00-ae2e-11ed-90af-09bb6422b258
SLOs_delete_slo_instances_request:
title: Delete SLO instances request
required:
- list
type: object
properties:
list:
type: array
items:
required:
- sloId
- instanceId
type: object
properties:
instanceId:
type: string
description: The SLO instance identifier
example: 8853df00-ae2e-11ed-90af-09bb6422b258
sloId:
type: string
description: The SLO unique identifier
example: 8853df00-ae2e-11ed-90af-09bb6422b258
description: An array of slo id and instance id
description: "The delete SLO instances request takes a list of SLO id and instance id, then delete the rollup and summary data. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n"
SLOs_error_budget:
title: Error budget
required:
- initial
- consumed
- remaining
- isEstimated
type: object
properties:
consumed:
type: number
description: 'The error budget consummed, as a percentage of the initial value.'
example: 0.8
initial:
type: number
description: 'The initial error budget, as 1 - objective'
example: 0.02
isEstimated:
type: boolean
description: Only for SLO defined with occurrences budgeting method and calendar aligned time window.
example: true
remaining:
type: number
description: 'The error budget remaining, as a percentage of the initial value.'
example: 0.2
SLOs_filter:
title: Filter
type: object
properties:
meta:
$ref: '#/components/schemas/SLOs_filter_meta'
query:
type: object
description: Defines properties for a filter
SLOs_filter_meta:
title: FilterMeta
type: object
properties:
alias:
type:
- 'null'
- string
controlledBy:
type: string
disabled:
type: boolean
field:
type: string
group:
type: string
index:
type: string
isMultiIndex:
type: boolean
key:
type: string
negate:
type: boolean
params:
type: object
type:
type: string
value:
type: string
description: Defines properties for a filter
SLOs_find_slo_definitions_response:
title: Find SLO definitions response
type: object
oneOf:
- type: object
properties:
page:
type: number
example: 1
perPage:
type: number
example: 25
results:
type: array
items:
$ref: '#/components/schemas/SLOs_slo_with_summary_response'
total:
type: number
example: 34
- type: object
properties:
page:
type: number
description: for backward compability
default: 1
perPage:
type: number
description: for backward compability
example: 25
results:
type: array
items:
$ref: '#/components/schemas/SLOs_slo_with_summary_response'
searchAfter:
type: array
items:
type: string
description: the cursor to provide to get the next paged results
example:
- some-slo-id
- other-cursor-id
size:
type: number
example: 25
total:
type: number
example: 34
description: "A paginated response of SLO definitions matching the query.\n"
SLOs_find_slo_response:
title: Find SLO response
type: object
properties:
page:
type: number
example: 1
perPage:
type: number
example: 25
results:
type: array
items:
$ref: '#/components/schemas/SLOs_slo_with_summary_response'
searchAfter:
type: string
size:
type: number
description: Size provided for cursor based pagination
example: 25
total:
type: number
example: 34
description: "A paginated response of SLOs matching the query.\n"
SLOs_group_by:
title: Group by
oneOf:
- type: string
- type: array
items:
type: string
description: optional group by field or fields to use to generate an SLO per distinct value
example:
-
- service.name
- service.name
-
- service.name
- service.environment
SLOs_indicator_properties_apm_availability:
title: APM availability
required:
- type
- params
type: object
properties:
params:
required:
- service
- environment
- transactionType
- transactionName
- index
type: object
properties:
environment:
type: string
description: The APM service environment or "*"
example: production
filter:
type: string
description: KQL query used for filtering the data
example: 'service.foo : "bar"'
index:
type: string
description: The index used by APM metrics
example: 'metrics-apm*,apm*'
service:
type: string
description: The APM service name
example: o11y-app
transactionName:
type: string
description: The APM transaction name or "*"
example: GET /my/api
transactionType:
type: string
description: The APM transaction type or "*"
example: request
description: An object containing the indicator parameters.
type:
type: string
description: The type of indicator.
example: sli.apm.transactionDuration
description: Defines properties for the APM availability indicator type
SLOs_indicator_properties_apm_latency:
title: APM latency
required:
- type
- params
type: object
properties:
params:
required:
- service
- environment
- transactionType
- transactionName
- index
- threshold
type: object
properties:
environment:
type: string
description: The APM service environment or "*"
example: production
filter:
type: string
description: KQL query used for filtering the data
example: 'service.foo : "bar"'
index:
type: string
description: The index used by APM metrics
example: 'metrics-apm*,apm*'
service:
type: string
description: The APM service name
example: o11y-app
threshold:
type: number
description: The latency threshold in milliseconds
example: 250
transactionName:
type: string
description: The APM transaction name or "*"
example: GET /my/api
transactionType:
type: string
description: The APM transaction type or "*"
example: request
description: An object containing the indicator parameters.
type:
type: string
description: The type of indicator.
example: sli.apm.transactionDuration
description: Defines properties for the APM latency indicator type
SLOs_indicator_properties_custom_kql:
title: Custom Query
required:
- type
- params
type: object
properties:
params:
required:
- index
- timestampField
- good
- total
type: object
properties:
dataViewId:
type: string
description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
example: 03b80ab3-003d-498b-881c-3beedbaf1162
filter:
$ref: '#/components/schemas/SLOs_kql_with_filters'
good:
$ref: '#/components/schemas/SLOs_kql_with_filters_good'
index:
type: string
description: The index or index pattern to use
example: my-service-*
timestampField:
type: string
description: "The timestamp field used in the source indice.\n"
example: timestamp
total:
$ref: '#/components/schemas/SLOs_kql_with_filters_total'
description: An object containing the indicator parameters.
type:
type: string
description: The type of indicator.
example: sli.kql.custom
description: Defines properties for a custom query indicator type
SLOs_indicator_properties_custom_metric:
title: Custom metric
required:
- type
- params
type: object
properties:
params:
required:
- index
- timestampField
- good
- total
type: object
properties:
dataViewId:
type: string
description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
example: 03b80ab3-003d-498b-881c-3beedbaf1162
filter:
type: string
description: the KQL query to filter the documents with.
example: 'field.environment : "production" and service.name : "my-service"'
good:
required:
- metrics
- equation
type: object
properties:
equation:
type: string
description: The equation to calculate the "good" metric.
example: A
metrics:
type: array
items:
required:
- name
- aggregation
- field
type: object
properties:
aggregation:
enum:
- sum
type: string
description: The aggregation type of the metric. Only valid option is "sum"
example: sum
field:
type: string
description: The field of the metric.
example: processor.processed
filter:
type: string
description: The filter to apply to the metric.
example: 'processor.outcome: "success"'
name:
pattern: '^[A-Z]$'
type: string
description: The name of the metric. Only valid options are A-Z
example: A
description: 'List of metrics with their name, aggregation type, and field.'
description: "An object defining the \"good\" metrics and equation\n"
index:
type: string
description: The index or index pattern to use
example: my-service-*
timestampField:
type: string
description: "The timestamp field used in the source indice.\n"
example: timestamp
total:
required:
- metrics
- equation
type: object
properties:
equation:
type: string
description: The equation to calculate the "total" metric.
example: A
metrics:
type: array
items:
required:
- name
- aggregation
- field
type: object
properties:
aggregation:
enum:
- sum
type: string
description: The aggregation type of the metric. Only valid option is "sum"
example: sum
field:
type: string
description: The field of the metric.
example: processor.processed
filter:
type: string
description: The filter to apply to the metric.
example: 'processor.outcome: *'
name:
pattern: '^[A-Z]$'
type: string
description: The name of the metric. Only valid options are A-Z
example: A
description: 'List of metrics with their name, aggregation type, and field.'
description: "An object defining the \"total\" metrics and equation\n"
description: An object containing the indicator parameters.
type:
type: string
description: The type of indicator.
example: sli.metric.custom
description: Defines properties for a custom metric indicator type
SLOs_indicator_properties_histogram:
title: Histogram indicator
required:
- type
- params
type: object
properties:
params:
required:
- index
- timestampField
- good
- total
type: object
properties:
dataViewId:
type: string
description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
example: 03b80ab3-003d-498b-881c-3beedbaf1162
filter:
type: string
description: the KQL query to filter the documents with.
example: 'field.environment : "production" and service.name : "my-service"'
good:
required:
- aggregation
- field
type: object
properties:
aggregation:
enum:
- value_count
- range
type: string
description: The type of aggregation to use.
example: value_count
field:
type: string
description: The field use to aggregate the good events.
example: processor.latency
filter:
type: string
description: The filter for good events.
example: 'processor.outcome: "success"'
from:
type: number
description: The starting value of the range. Only required for "range" aggregations.
example: 0
to:
type: number
description: The ending value of the range. Only required for "range" aggregations.
example: 100
description: "An object defining the \"good\" events\n"
index:
type: string
description: The index or index pattern to use
example: my-service-*
timestampField:
type: string
description: "The timestamp field used in the source indice.\n"
example: timestamp
total:
required:
- aggregation
- field
type: object
properties:
aggregation:
enum:
- value_count
- range
type: string
description: The type of aggregation to use.
example: value_count
field:
type: string
description: The field use to aggregate the good events.
example: processor.latency
filter:
type: string
description: The filter for total events.
example: 'processor.outcome : *'
from:
type: number
description: The starting value of the range. Only required for "range" aggregations.
example: 0
to:
type: number
description: The ending value of the range. Only required for "range" aggregations.
example: 100
description: "An object defining the \"total\" events\n"
description: An object containing the indicator parameters.
type:
type: string
description: The type of indicator.
example: sli.histogram.custom
description: Defines properties for a histogram indicator type
SLOs_indicator_properties_timeslice_metric:
title: Timeslice metric
required:
- type
- params
type: object
properties:
params:
required:
- index
- timestampField
- metric
type: object
properties:
dataViewId:
type: string
description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
example: 03b80ab3-003d-498b-881c-3beedbaf1162
filter:
type: string
description: the KQL query to filter the documents with.
example: 'field.environment : "production" and service.name : "my-service"'
index:
type: string
description: The index or index pattern to use
example: my-service-*
metric:
required:
- metrics
- equation
- comparator
- threshold
type: object
properties:
comparator:
enum:
- GT
- GTE
- LT
- LTE
type: string
description: The comparator to use to compare the equation to the threshold.
example: GT
equation:
type: string
description: The equation to calculate the metric.
example: A
metrics:
type: array
items:
anyOf:
- $ref: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
- $ref: '#/components/schemas/SLOs_timeslice_metric_percentile_metric'
- $ref: '#/components/schemas/SLOs_timeslice_metric_doc_count_metric'
description: 'List of metrics with their name, aggregation type, and field.'
threshold:
type: number
description: The threshold used to determine if the metric is a good slice or not.
example: 100
description: "An object defining the metrics, equation, and threshold to determine if it's a good slice or not\n"
timestampField:
type: string
description: "The timestamp field used in the source indice.\n"
example: timestamp
description: An object containing the indicator parameters.
type:
type: string
description: The type of indicator.
example: sli.metric.timeslice
description: Defines properties for a timeslice metric indicator type
SLOs_kql_with_filters:
title: KQL with filters
oneOf:
- type: string
description: the KQL query to filter the documents with.
example: 'field.environment : "production" and service.name : "my-service"'
- type: object
properties:
filters:
type: array
items:
$ref: '#/components/schemas/SLOs_filter'
kqlQuery:
type: string
description: Defines properties for a filter
SLOs_kql_with_filters_good:
title: KQL query for good events
oneOf:
- type: string
description: the KQL query to filter the documents with.
example: 'request.latency <= 150 and request.status_code : "2xx"'
- type: object
properties:
filters:
type: array
items:
$ref: '#/components/schemas/SLOs_filter'
kqlQuery:
type: string
description: The KQL query used to define the good events.
SLOs_kql_with_filters_total:
title: KQL query for all events
oneOf:
- type: string
description: the KQL query to filter the documents with.
example: 'field.environment : "production" and service.name : "my-service"'
- type: object
properties:
filters:
type: array
items:
$ref: '#/components/schemas/SLOs_filter'
kqlQuery:
type: string
description: The KQL query used to define all events.
SLOs_objective:
title: Objective
required:
- target
type: object
properties:
target:
exclusiveMaximum: 100
exclusiveMinimum: 0
type: number
description: the target objective between 0 and 1 excluded
example: 0.99
timesliceTarget:
maximum: 100
minimum: 0
type: number
description: the target objective for each slice when using a timeslices budgeting method
example: 0.995
timesliceWindow:
type: string
description: 'the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}'
example: 5m
description: Defines properties for the SLO objective
SLOs_settings:
title: Settings
type: object
properties:
frequency:
type: string
description: The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.
default: 1m
example: 5m
preventInitialBackfill:
type: boolean
description: 'Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.'
default: false
example: true
syncDelay:
type: string
description: The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.
default: 1m
example: 5m
syncField:
type: string
description: 'The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.'
example: event.ingested
description: Defines properties for SLO settings.
SLOs_slo_definition_response:
title: SLO definition response
required:
- id
- name
- description
- indicator
- timeWindow
- budgetingMethod
- objective
- settings
- revision
- enabled
- groupBy
- tags
- createdAt
- updatedAt
- version
type: object
properties:
budgetingMethod:
$ref: '#/components/schemas/SLOs_budgeting_method'
createdAt:
type: string
description: The creation date
example: '2023-01-12T10:03:19.000Z'
description:
type: string
description: The description of the SLO.
example: My SLO description
enabled:
type: boolean
description: Indicate if the SLO is enabled
example: true
groupBy:
$ref: '#/components/schemas/SLOs_group_by'
id:
type: string
description: The identifier of the SLO.
example: 8853df00-ae2e-11ed-90af-09bb6422b258
indicator:
oneOf:
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
- $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
- $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
discriminator:
propertyName: type
mapping:
sli.apm.transactionDuration: '#/components/schemas/SLOs_indicator_properties_apm_latency'
sli.apm.transactionErrorRate: '#/components/schemas/SLOs_indicator_properties_apm_availability'
sli.histogram.custom: '#/components/schemas/SLOs_indicator_properties_histogram'
sli.kql.custom: '#/components/schemas/SLOs_indicator_properties_custom_kql'
sli.metric.custom: '#/components/schemas/SLOs_indicator_properties_custom_metric'
sli.metric.timeslice: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
name:
type: string
description: The name of the SLO.
example: My Service SLO
objective:
$ref: '#/components/schemas/SLOs_objective'
revision:
type: number
description: The SLO revision
example: 2
settings:
$ref: '#/components/schemas/SLOs_settings'
tags:
type: array
items:
type: string
description: List of tags
timeWindow:
$ref: '#/components/schemas/SLOs_time_window'
updatedAt:
type: string
description: The last update date
example: '2023-01-12T10:03:19.000Z'
version:
type: number
description: The internal SLO version
example: 2
SLOs_slo_with_summary_response:
title: SLO response
required:
- id
- name
- description
- indicator
- timeWindow
- budgetingMethod
- objective
- settings
- revision
- summary
- enabled
- groupBy
- instanceId
- tags
- createdAt
- updatedAt
- version
type: object
properties:
budgetingMethod:
$ref: '#/components/schemas/SLOs_budgeting_method'
createdAt:
type: string
description: The creation date
example: '2023-01-12T10:03:19.000Z'
description:
type: string
description: The description of the SLO.
example: My SLO description
enabled:
type: boolean
description: Indicate if the SLO is enabled
example: true
groupBy:
$ref: '#/components/schemas/SLOs_group_by'
id:
type: string
description: The identifier of the SLO.
example: 8853df00-ae2e-11ed-90af-09bb6422b258
indicator:
oneOf:
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
- $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
- $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
discriminator:
propertyName: type
mapping:
sli.apm.transactionDuration: '#/components/schemas/SLOs_indicator_properties_apm_latency'
sli.apm.transactionErrorRate: '#/components/schemas/SLOs_indicator_properties_apm_availability'
sli.histogram.custom: '#/components/schemas/SLOs_indicator_properties_histogram'
sli.kql.custom: '#/components/schemas/SLOs_indicator_properties_custom_kql'
sli.metric.custom: '#/components/schemas/SLOs_indicator_properties_custom_metric'
sli.metric.timeslice: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
instanceId:
type: string
description: 'the value derived from the groupBy field, if present, otherwise ''*'''
example: host-abcde
name:
type: string
description: The name of the SLO.
example: My Service SLO
objective:
$ref: '#/components/schemas/SLOs_objective'
revision:
type: number
description: The SLO revision
example: 2
settings:
$ref: '#/components/schemas/SLOs_settings'
summary:
$ref: '#/components/schemas/SLOs_summary'
tags:
type: array
items:
type: string
description: List of tags
timeWindow:
$ref: '#/components/schemas/SLOs_time_window'
updatedAt:
type: string
description: The last update date
example: '2023-01-12T10:03:19.000Z'
version:
type: number
description: The internal SLO version
example: 2
SLOs_summary:
title: Summary
required:
- status
- sliValue
- errorBudget
type: object
properties:
errorBudget:
$ref: '#/components/schemas/SLOs_error_budget'
sliValue:
type: number
example: 0.9836
status:
$ref: '#/components/schemas/SLOs_summary_status'
description: The SLO computed data
SLOs_summary_status:
title: summary status
enum:
- NO_DATA
- HEALTHY
- DEGRADING
- VIOLATED
type: string
example: HEALTHY
SLOs_time_window:
title: Time window
required:
- duration
- type
type: object
properties:
duration:
type: string
description: 'the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)'
example: 30d
type:
enum:
- rolling
- calendarAligned
type: string
description: Indicates weither the time window is a rolling or a calendar aligned time window.
example: rolling
description: Defines properties for the SLO time window
SLOs_timeslice_metric_basic_metric_with_field:
title: Timeslice Metric Basic Metric with Field
required:
- name
- aggregation
- field
type: object
properties:
aggregation:
enum:
- sum
- avg
- min
- max
- std_deviation
- last_value
- cardinality
type: string
description: The aggregation type of the metric.
example: sum
field:
type: string
description: The field of the metric.
example: processor.processed
filter:
type: string
description: The filter to apply to the metric.
example: 'processor.outcome: "success"'
name:
pattern: '^[A-Z]$'
type: string
description: The name of the metric. Only valid options are A-Z
example: A
SLOs_timeslice_metric_doc_count_metric:
title: Timeslice Metric Doc Count Metric
required:
- name
- aggregation
type: object
properties:
aggregation:
enum:
- doc_count
type: string
description: The aggregation type of the metric. Only valid option is "doc_count"
example: doc_count
filter:
type: string
description: The filter to apply to the metric.
example: 'processor.outcome: "success"'
name:
pattern: '^[A-Z]$'
type: string
description: The name of the metric. Only valid options are A-Z
example: A
SLOs_timeslice_metric_percentile_metric:
title: Timeslice Metric Percentile Metric
required:
- name
- aggregation
- field
- percentile
type: object
properties:
aggregation:
enum:
- percentile
type: string
description: The aggregation type of the metric. Only valid option is "percentile"
example: percentile
field:
type: string
description: The field of the metric.
example: processor.processed
filter:
type: string
description: The filter to apply to the metric.
example: 'processor.outcome: "success"'
name:
pattern: '^[A-Z]$'
type: string
description: The name of the metric. Only valid options are A-Z
example: A
percentile:
type: number
description: The percentile value.
example: 95
SLOs_update_slo_request:
title: Update SLO request
type: object
properties:
budgetingMethod:
$ref: '#/components/schemas/SLOs_budgeting_method'
description:
type: string
description: A description for the SLO.
groupBy:
$ref: '#/components/schemas/SLOs_group_by'
indicator:
oneOf:
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
- $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
- $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
- $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
- $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
name:
type: string
description: A name for the SLO.
objective:
$ref: '#/components/schemas/SLOs_objective'
settings:
$ref: '#/components/schemas/SLOs_settings'
tags:
type: array
items:
type: string
description: List of tags
timeWindow:
$ref: '#/components/schemas/SLOs_time_window'
description: "The update SLO API request body varies depending on the type of indicator, time window and budgeting method. Partial update is handled.\n"
Synthetics_browserMonitorFields:
title: Browser monitor fields
allOf:
- $ref: '#/components/schemas/Synthetics_commonMonitorFields'
- required:
- inline_script
- type
type: object
properties:
ignore_https_errors:
type: boolean
description: Ignore HTTPS errors.
default: false
inline_script:
type: string
description: The inline script.
playwright_options:
type: object
description: Playwright options.
screenshots:
enum:
- on
- off
- only-on-failure
type: string
description: The screenshot option.
default: on
synthetics_args:
type: array
items:
type: string
description: Synthetics agent CLI arguments.
type:
enum:
- browser
type: string
description: The monitor type.
Synthetics_commonMonitorFields:
title: Common monitor fields
required:
- name
type: object
properties:
alert:
type: object
description: "The alert configuration. The default is `{ status: { enabled: true }, tls: { enabled: true } }`.\n"
enabled:
type: boolean
description: Specify whether the monitor is enabled.
default: true
labels:
type: object
additionalProperties:
type: string
description: "Key-value pairs of labels to associate with the monitor. Labels can be used for filtering and grouping monitors.\n"
locations:
type: array
items:
type: string
description: "The location to deploy the monitor.\nMonitors can be deployed in multiple locations so that you can detect differences in availability and response times across those locations.\nTo list available locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Management* and click *Create monitor*. Locations will be listed in *Locations*.\n"
externalDocs:
url: https://github.com/elastic/synthetics/blob/main/src/locations/public-locations.ts
name:
type: string
description: The monitor name.
namespace:
type: string
description: "The namespace field should be lowercase and not contain spaces. The namespace must not include any of the following characters: `*`, `\\`, `/`, `?`, `\"`, `<`, `>`, `|`, whitespace, `,`, `#`, `:`, or `-`.\n"
default: default
params:
type: string
description: The monitor parameters.
private_locations:
type: array
items:
type: string
description: "The private locations to which the monitors will be deployed.\nThese private locations refer to locations hosted and managed by you, whereas `locations` are hosted by Elastic.\nYou can specify a private location using the location's name.\nTo list available private locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Settings* and click *Private locationsr*. Private locations will be listed in the table.\n\n> info\n> You can provide `locations` or `private_locations` or both. At least one is required.\n"
retest_on_failure:
type: boolean
description: "Turn retesting for when a monitor fails on or off. By default, monitors are automatically retested if the monitor goes from \"up\" to \"down\". If the result of the retest is also \"down\", an error will be created and if configured, an alert sent. The monitor will then resume running according to the defined schedule. Using `retest_on_failure` can reduce noise related to transient problems.\n"
default: true
schedule:
type: number
description: "The monitor's schedule in minutes. Supported values are `1`, `3`, `5`, `10`, `15`, `30`, `60`, `120`, and `240`. The default value is `3` minutes for HTTP, TCP, and ICMP monitors. The default value is `10` minutes for Browser monitors.\n"
service.name:
type: string
description: The APM service name.
tags:
type: array
items:
type: string
description: An array of tags.
timeout:
type: number
description: "The monitor timeout in seconds. The monitor will fail if it doesn't complete within this time.\n"
default: 16
Synthetics_getParameterResponse:
title: Get parameter response
type: object
properties:
description:
type: string
description: "The description of the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
id:
type: string
description: The unique identifier of the parameter.
key:
type: string
description: The key of the parameter.
namespaces:
type: array
items:
type: string
description: "The namespaces associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
tags:
type: array
items:
type: string
description: "An array of tags associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
value:
type: string
description: "The value associated with the parameter. It will be included in the response if the user has write permissions. \n"
Synthetics_getPrivateLocation:
title: Post a private location
type: object
properties:
agentPolicyId:
type: string
description: The ID of the agent policy associated with the private location.
geo:
required:
- lat
- lon
type: object
properties:
lat:
type: number
description: The latitude of the location.
lon:
type: number
description: The longitude of the location.
description: Geographic coordinates (WGS84) for the location.
id:
type: string
description: The unique identifier of the private location.
isInvalid:
type: boolean
description: "Indicates whether the location is invalid. If `true`, the location is invalid, which means the agent policy associated with the location is deleted.\n"
label:
type: string
description: A label for the private location.
namespace:
type: string
description: 'The namespace of the location, which is the same as the namespace of the agent policy associated with the location.'
Synthetics_httpMonitorFields:
title: HTTP monitor fields
allOf:
- $ref: '#/components/schemas/Synthetics_commonMonitorFields'
- required:
- type
- url
type: object
properties:
check:
type: object
properties:
request:
type: object
properties:
body:
type: string
description: Optional request body content.
headers:
type: object
description: "A dictionary of additional HTTP headers to send. By default, Synthetics will set the User-Agent header to identify itself.\n"
method:
enum:
- HEAD
- GET
- POST
- OPTIONS
type: string
description: The HTTP method to use.
description: An optional request to send to the remote host.
response:
type: object
properties:
body:
type: object
headers:
type: object
description: 'A dictionary of expected HTTP headers. If the header is not found, the check fails.'
description: The expected response.
description: The check request settings.
ipv4:
type: boolean
description: 'If `true`, ping using the ipv4 protocol.'
default: true
ipv6:
type: boolean
description: 'If `true`, ping using the ipv6 protocol.'
default: true
max_redirects:
type: number
description: The maximum number of redirects to follow.
default: 0
mode:
enum:
- all
- any
type: string
description: "The mode of the monitor. If it is `all`, the monitor pings all resolvable IPs for a hostname. If it is `any`, the monitor pings only one IP address for a hostname. If you're using a DNS-load balancer and want to ping every IP address for the specified hostname, you should use `all`.\n"
default: any
password:
type: string
description: "The password for authenticating with the server. The credentials are passed with the request.\n"
proxy_headers:
type: object
description: Additional headers to send to proxies during CONNECT requests.
proxy_url:
type: string
description: The URL of the proxy to use for this monitor.
response:
type: object
description: Controls the indexing of the HTTP response body contents to the `http.response.body.contents field`.
ssl:
type: object
description: "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n"
type:
enum:
- http
type: string
description: The monitor type.
url:
type: string
description: The URL to monitor.
username:
type: string
description: "The username for authenticating with the server. The credentials are passed with the request.\n"
Synthetics_icmpMonitorFields:
title: ICMP monitor fields
allOf:
- $ref: '#/components/schemas/Synthetics_commonMonitorFields'
- required:
- host
- type
type: object
properties:
host:
type: string
description: The host to ping.
type:
enum:
- icmp
type: string
description: The monitor type.
wait:
type: number
description: The wait time in seconds.
default: 1
Synthetics_parameterRequest:
title: Parameter request
required:
- key
- value
type: object
properties:
description:
type: string
description: A description of the parameter.
key:
type: string
description: The key of the parameter.
share_across_spaces:
type: boolean
description: Specify whether the parameter should be shared across spaces.
tags:
type: array
items:
type: string
description: An array of tags to categorize the parameter.
value:
type: string
description: The value associated with the parameter.
Synthetics_postParameterResponse:
title: Post parameter response
type: object
properties:
description:
type: string
description: A description of the parameter.
id:
type: string
description: The unique identifier for the parameter.
key:
type: string
description: The parameter key.
share_across_spaces:
type: boolean
description: Indicates whether the parameter is shared across spaces.
tags:
type: array
items:
type: string
description: An array of tags associated with the parameter.
value:
type: string
description: The value associated with the parameter.
Synthetics_tcpMonitorFields:
title: TCP monitor fields
allOf:
- $ref: '#/components/schemas/Synthetics_commonMonitorFields'
- required:
- host
- type
type: object
properties:
host:
type: string
description: "The host to monitor; it can be an IP address or a hostname. The host can include the port using a colon, for example \"example.com:9200\".\n"
proxy_url:
type: string
description: "The URL of the SOCKS5 proxy to use when connecting to the server. The value must be a URL with a scheme of `socks5://`. If the SOCKS5 proxy server requires client authentication, then a username and password can be embedded in the URL. When using a proxy, hostnames are resolved on the proxy server instead of on the client. You can change this behavior by setting the `proxy_use_local_resolver` option.\n"
proxy_use_local_resolver:
type: boolean
description: "Specify that hostnames are resolved locally instead of being resolved on the proxy server. If `false`, name resolution occurs on the proxy server.\n"
default: false
ssl:
type: object
description: "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n"
type:
enum:
- tcp
type: string
description: The monitor type.
Task_manager_health_APIs_configuration:
type: object
description: "This object summarizes the current configuration of Task Manager. This includes dynamic configurations that change over time, such as `poll_interval` and `max_workers`, which can adjust in reaction to changing load on the system.\n"
Task_manager_health_APIs_health_response:
title: Task health response properties
type: object
properties:
id:
type: string
last_update:
type: string
stats:
type: object
properties:
capacity_estimation:
type: object
description: "This object provides a rough estimate about the sufficiency of its capacity. These are estimates based on historical data and should not be used as predictions.\n"
configuration:
$ref: '#/components/schemas/Task_manager_health_APIs_configuration'
runtime:
type: object
description: "This object tracks runtime performance of Task Manager, tracking task drift, worker load, and stats broken down by type, including duration and run results.\n"
workload:
$ref: '#/components/schemas/Task_manager_health_APIs_workload'
status:
type: string
timestamp:
type: string
Task_manager_health_APIs_workload:
type: object
description: "This object summarizes the work load across the cluster, including the tasks in the system, their types, and current status.\n"
Upgrade_assistant_APIs_errorMessage:
type: string
description: 'The error that caused the reindex to fail, if it failed.'
Upgrade_assistant_APIs_indexName:
type: string
description: The name of the old index.
Upgrade_assistant_APIs_lastCompletedStep:
type: integer
description: "The last successfully completed step of the reindex. For example:\n- `0`: The reindex task has been created in Kibana. - `10`: The index group services stopped. Only applies to some system indices. - `20`: The index is set to readonly. - `30`: The new destination index has been created. - `40`: The reindex task in Elasticsearch has started. - `50`: The reindex task in Elasticsearch has completed. - `60`: Aliases were created to point to the new index, and the old index has been deleted. - `70`: The index group services have resumed. Only applies to some system indices.\n"
Upgrade_assistant_APIs_locked:
type: string
Upgrade_assistant_APIs_newIndexName:
type: string
description: The name of the new index.
Upgrade_assistant_APIs_reindexOptions:
type: object
properties:
queueSettings:
type: object
properties:
queuedAt:
type: number
description: A Unix timestamp of when the reindex task was placed in the queue.
description: The presence of this key indicates that the reindex job will occur in the batch.
Upgrade_assistant_APIs_reindexTaskId:
type: string
description: "The task ID of the reindex task in Elasticsearch. This value appears when the reindexing starts.\n"
Upgrade_assistant_APIs_reindexTaskPercComplete:
type: number
description: "The progress of the reindexing task in Elasticsearch. It appears in decimal form, from 0 to 1.\n"
Upgrade_assistant_APIs_runningReindexCount:
type: number
Upgrade_assistant_APIs_status:
type: integer
description: "The reindex status. For example:\n- `0`: In progress - `1`: Completed - `2`: Failed - `3`: Paused\n"
bedrock_config:
title: Connector request properties for an Amazon Bedrock connector
required:
- apiUrl
type: object
properties:
apiUrl:
type: string
description: The Amazon Bedrock request URL.
region:
type: string
description: "Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, `us-west-1`).\n"
defaultModel:
type: string
description: "The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.\n"
default: us.anthropic.claude-3-7-sonnet-20250219-v1:0
description: Defines properties for connectors when type is `.bedrock`.
crowdstrike_config:
title: Connector request config properties for a Crowdstrike connector
required:
- url
type: object
properties:
url:
type: string
description: "The CrowdStrike tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
description: Defines config properties for connectors when type is `.crowdstrike`.
d3security_config:
title: Connector request properties for a D3 Security connector
required:
- url
type: object
properties:
url:
type: string
description: "The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
description: Defines properties for connectors when type is `.d3security`.
email_config:
title: Connector request properties for an email connector
required:
- from
type: object
properties:
clientId:
type:
- 'null'
- string
description: "The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n"
from:
type: string
description: "The from address for all emails sent by the connector. It must be specified in `user@host-name` format.\n"
hasAuth:
type: boolean
description: "Specifies whether a user and password are required inside the secrets configuration.\n"
default: true
host:
type: string
description: "The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n"
oauthTokenUrl:
type:
- 'null'
- string
port:
type: integer
description: "The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n"
secure:
type: boolean
description: "Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.\n"
service:
enum:
- elastic_cloud
- exchange_server
- gmail
- other
- outlook365
- ses
type: string
description: "The name of the email service.\n"
tenantId:
type:
- 'null'
- string
description: "The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n"
description: Defines properties for connectors when type is `.email`.
gemini_config:
title: Connector request properties for an Google Gemini connector
required:
- apiUrl
- gcpRegion
- gcpProjectID
type: object
properties:
apiUrl:
type: string
description: The Google Gemini request URL.
defaultModel:
type: string
description: The generative artificial intelligence model for Google Gemini to use.
default: gemini-2.5-pro
gcpRegion:
type: string
description: The GCP region where the Vertex AI endpoint enabled.
gcpProjectID:
type: string
description: The Google ProjectID that has Vertex AI endpoint enabled.
description: Defines properties for connectors when type is `.gemini`.
resilient_config:
title: Connector request properties for a IBM Resilient connector
required:
- apiUrl
- orgId
type: object
properties:
apiUrl:
type: string
description: The IBM Resilient instance URL.
orgId:
type: string
description: The IBM Resilient organization ID.
description: Defines properties for connectors when type is `.resilient`.
index_config:
title: Connector request properties for an index connector
required:
- index
type: object
properties:
executionTimeField:
type:
- 'null'
- string
description: A field that indicates when the document was indexed.
default: 'null'
index:
type: string
description: The Elasticsearch index to be written to.
refresh:
type: boolean
description: "The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.\n"
default: false
description: Defines properties for connectors when type is `.index`.
jira_config:
title: Connector request properties for a Jira connector
required:
- apiUrl
- projectKey
type: object
properties:
apiUrl:
type: string
description: The Jira instance URL.
projectKey:
type: string
description: The Jira project key.
description: Defines properties for connectors when type is `.jira`.
defender_config:
title: Connector request properties for a Microsoft Defender for Endpoint connector
required:
- apiUrl
- projectKey
type: object
properties:
apiUrl:
type: string
description: "The URL of the Microsoft Defender for Endpoint API. If you are using the `xpack.actions.allowedHosts` setting, make sure the hostname is added to the allowed hosts.\n"
clientId:
type: string
description: The application (client) identifier for your app in the Azure portal.
oAuthScope:
type: string
description: The OAuth scopes or permission sets for the Microsoft Defender for Endpoint API.
oAuthServerUrl:
type: string
description: The OAuth server URL where authentication is sent and received for the Microsoft Defender for Endpoint API.
tenantId:
type: string
description: The tenant identifier for your app in the Azure portal.
description: Defines properties for connectors when type is `.microsoft_defender_endpoint`.
genai_azure_config:
title: Connector request properties for an OpenAI connector that uses Azure OpenAI
required:
- apiProvider
- apiUrl
type: object
properties:
apiProvider:
enum:
- Azure OpenAI
type: string
description: The OpenAI API provider.
apiUrl:
type: string
description: The OpenAI API endpoint.
description: "Defines properties for connectors when type is `.gen-ai` and the API provider is `Azure OpenAI`.\n"
genai_openai_config:
title: Connector request properties for an OpenAI connector
required:
- apiProvider
- apiUrl
type: object
properties:
apiProvider:
enum:
- OpenAI
type: string
description: The OpenAI API provider.
apiUrl:
type: string
description: The OpenAI API endpoint.
defaultModel:
type: string
description: The default model to use for requests.
description: "Defines properties for connectors when type is `.gen-ai` and the API provider is `OpenAI`.\n"
opsgenie_config:
title: Connector request properties for an Opsgenie connector
required:
- apiUrl
type: object
properties:
apiUrl:
type: string
description: "The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
description: Defines properties for connectors when type is `.opsgenie`.
pagerduty_config:
title: Connector request properties for a PagerDuty connector
type: object
properties:
apiUrl:
type:
- 'null'
- string
description: The PagerDuty event URL.
example: https://events.pagerduty.com/v2/enqueue
description: Defines properties for connectors when type is `.pagerduty`.
sentinelone_config:
title: Connector request properties for a SentinelOne connector
required:
- url
type: object
properties:
url:
type: string
description: "The SentinelOne tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
description: Defines properties for connectors when type is `.sentinelone`.
servicenow_config:
title: Connector request properties for a ServiceNow ITSM connector
required:
- apiUrl
type: object
properties:
apiUrl:
type: string
description: The ServiceNow instance URL.
clientId:
type: string
description: "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n"
isOAuth:
type: boolean
description: "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n"
default: false
jwtKeyId:
type: string
description: "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n"
userIdentifierValue:
type: string
description: "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n"
usesTableApi:
type: boolean
description: "Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow.\n"
default: true
description: Defines properties for connectors when type is `.servicenow`.
servicenow_itom_config:
title: Connector request properties for a ServiceNow ITOM connector
required:
- apiUrl
type: object
properties:
apiUrl:
type: string
description: The ServiceNow instance URL.
clientId:
type: string
description: "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n"
isOAuth:
type: boolean
description: "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n"
default: false
jwtKeyId:
type: string
description: "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n"
userIdentifierValue:
type: string
description: "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n"
description: Defines properties for connectors when type is `.servicenow-itom`.
slack_api_config:
title: Connector request properties for a Slack connector
type: object
properties:
allowedChannels:
type: array
items:
maxItems: 25
required:
- id
- name
type: object
properties:
id:
minLength: 1
type: string
description: The Slack channel ID.
example: C123ABC456
name:
minLength: 1
type: string
description: The Slack channel name.
description: A list of valid Slack channels.
description: Defines properties for connectors when type is `.slack_api`.
swimlane_config:
title: Connector request properties for a Swimlane connector
required:
- apiUrl
- appId
- connectorType
type: object
properties:
apiUrl:
type: string
description: The Swimlane instance URL.
appId:
type: string
description: The Swimlane application ID.
connectorType:
enum:
- all
- alerts
- cases
type: string
description: 'The type of connector. Valid values are `all`, `alerts`, and `cases`.'
mappings:
title: Connector mappings properties for a Swimlane connector
type: object
properties:
alertIdConfig:
title: Alert identifier mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the alert ID.
caseIdConfig:
title: Case identifier mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the case ID.
caseNameConfig:
title: Case name mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the case name.
commentsConfig:
title: Case comment mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the case comments.
descriptionConfig:
title: Case description mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the case description.
ruleNameConfig:
title: Rule name mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the name of the alert's rule.
severityConfig:
title: Severity mapping
required:
- fieldType
- id
- key
- name
type: object
properties:
fieldType:
type: string
description: The type of field in Swimlane.
id:
type: string
description: The identifier for the field in Swimlane.
key:
type: string
description: The key for the field in Swimlane.
name:
type: string
description: The name of the field in Swimlane.
description: Mapping for the severity.
description: The field mapping.
description: Defines properties for connectors when type is `.swimlane`.
thehive_config:
title: Connector request properties for a TheHive connector
required:
- url
type: object
properties:
organisation:
type: string
description: "The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.\n"
url:
type: string
description: "The instance URL in TheHive. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
description: Defines configuration properties for connectors when type is `.thehive`.
tines_config:
title: Connector request properties for a Tines connector
required:
- url
type: object
properties:
url:
type: string
description: "The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.\n"
description: Defines properties for connectors when type is `.tines`.
torq_config:
title: Connector request properties for a Torq connector
required:
- webhookIntegrationUrl
type: object
properties:
webhookIntegrationUrl:
type: string
description: The endpoint URL of the Elastic Security integration in Torq.
description: Defines properties for connectors when type is `.torq`.
auth_type:
title: Authentication type
enum:
- webhook-authentication-basic
- webhook-authentication-ssl
type:
- 'null'
- string
description: "The type of authentication to use: basic, SSL, or none.\n"
ca:
title: Certificate authority
type: string
description: "A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.\n"
cert_type:
title: Certificate type
enum:
- ssl-crt-key
- ssl-pfx
type: string
description: "If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.\n"
has_auth:
title: Has authentication
type: boolean
description: 'If true, a username and password for login type authentication must be provided.'
default: true
verification_mode:
title: Verification mode
enum:
- certificate
- full
- none
type: string
description: "Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.\n"
default: full
webhook_config:
title: Connector request properties for a Webhook connector
type: object
properties:
authType:
$ref: '#/components/schemas/auth_type'
ca:
$ref: '#/components/schemas/ca'
certType:
$ref: '#/components/schemas/cert_type'
hasAuth:
$ref: '#/components/schemas/has_auth'
headers:
type:
- 'null'
- object
description: A set of key-value pairs sent as headers with the request.
method:
enum:
- post
- put
type: string
description: "The HTTP request method, either `post` or `put`.\n"
default: post
url:
type: string
description: "The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
verificationMode:
$ref: '#/components/schemas/verification_mode'
description: Defines properties for connectors when type is `.webhook`.
cases_webhook_config:
title: Connector request properties for Webhook - Case Management connector
required:
- createIncidentJson
- createIncidentResponseKey
- createIncidentUrl
- getIncidentResponseExternalTitleKey
- getIncidentUrl
- updateIncidentJson
- updateIncidentUrl
- viewIncidentUrl
type: object
properties:
authType:
$ref: '#/components/schemas/auth_type'
ca:
$ref: '#/components/schemas/ca'
certType:
$ref: '#/components/schemas/cert_type'
createCommentJson:
type: string
description: "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n"
example: '{"body": {{{case.comment}}}}'
createCommentMethod:
enum:
- patch
- post
- put
type: string
description: "The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.\n"
default: put
createCommentUrl:
type: string
description: "The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.\n"
example: 'https://example.com/issue/{{{external.system.id}}}/comment'
createIncidentJson:
type: string
description: "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n"
example: '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
createIncidentMethod:
enum:
- patch
- post
- put
type: string
description: "The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.\n"
default: post
createIncidentResponseKey:
type: string
description: The JSON key in the create external case response that contains the case ID.
createIncidentUrl:
type: string
description: "The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
getIncidentResponseExternalTitleKey:
type: string
description: The JSON key in get external case response that contains the case title.
getIncidentUrl:
type: string
description: "The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n"
example: 'https://example.com/issue/{{{external.system.id}}}'
hasAuth:
$ref: '#/components/schemas/has_auth'
headers:
type: string
description: "A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.\n"
updateIncidentJson:
type: string
description: "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n"
example: '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
updateIncidentMethod:
enum:
- patch
- post
- put
type: string
description: "The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`.\n"
default: put
updateIncidentUrl:
type: string
description: "The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
example: 'https://example.com/issue/{{{external.system.ID}}}'
verificationMode:
$ref: '#/components/schemas/verification_mode'
viewIncidentUrl:
type: string
description: "The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.\n"
example: 'https://testing-jira.atlassian.net/browse/{{{external.system.title}}}'
description: Defines properties for connectors when type is `.cases-webhook`.
xmatters_config:
title: Connector request properties for an xMatters connector
type: object
properties:
configUrl:
type:
- 'null'
- string
description: "The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`.\n"
usesBasic:
type: boolean
description: Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`).
default: true
description: Defines properties for connectors when type is `.xmatters`.
bedrock_secrets:
title: Connector secrets properties for an Amazon Bedrock connector
required:
- accessKey
- secret
type: object
properties:
accessKey:
type: string
description: The AWS access key for authentication.
secret:
type: string
description: The AWS secret for authentication.
description: Defines secrets for connectors when type is `.bedrock`.
crowdstrike_secrets:
title: Connector secrets properties for a Crowdstrike connector
required:
- clientId
- clientSecret
type: object
properties:
clientId:
type: string
description: The CrowdStrike API client identifier.
clientSecret:
type: string
description: The CrowdStrike API client secret to authenticate the `clientId`.
description: Defines secrets for connectors when type is `.crowdstrike`.
d3security_secrets:
title: Connector secrets properties for a D3 Security connector
required:
- token
type: object
properties:
token:
type: string
description: The D3 Security token.
description: Defines secrets for connectors when type is `.d3security`.
email_secrets:
title: Connector secrets properties for an email connector
type: object
properties:
clientSecret:
type: string
description: "The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required.\n"
password:
type: string
description: "The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
user:
type: string
description: "The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
description: Defines secrets for connectors when type is `.email`.
gemini_secrets:
title: Connector secrets properties for a Google Gemini connector
required:
- credentialsJson
type: object
properties:
credentialsJson:
type: string
description: The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it.
description: Defines secrets for connectors when type is `.gemini`.
resilient_secrets:
title: Connector secrets properties for IBM Resilient connector
required:
- apiKeyId
- apiKeySecret
type: object
properties:
apiKeyId:
type: string
description: The authentication key ID for HTTP Basic authentication.
apiKeySecret:
type: string
description: The authentication key secret for HTTP Basic authentication.
description: Defines secrets for connectors when type is `.resilient`.
jira_secrets:
title: Connector secrets properties for a Jira connector
required:
- apiToken
- email
type: object
properties:
apiToken:
type: string
description: The Jira API authentication token for HTTP basic authentication.
email:
type: string
description: The account email for HTTP Basic authentication.
description: Defines secrets for connectors when type is `.jira`.
teams_secrets:
title: Connector secrets properties for a Microsoft Teams connector
required:
- webhookUrl
type: object
properties:
webhookUrl:
type: string
description: "The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
description: Defines secrets for connectors when type is `.teams`.
genai_secrets:
title: Connector secrets properties for an OpenAI connector
type: object
properties:
apiKey:
type: string
description: "The API key for authentication. For OpenAI and Azure OpenAI providers, it is required. For the `Other` provider, it is required if you do not use PKI authentication. With PKI, you can also optionally include an API key if the OpenAI-compatible service supports or requires one.\n"
certificateData:
minLength: 1
type: string
description: "Base64-encoded PEM certificate content for PKI authentication (Other provider only). Required for PKI.\n"
privateKeyData:
minLength: 1
type: string
description: "Base64-encoded PEM private key content for PKI authentication (Other provider only). Required for PKI.\n"
caData:
minLength: 1
type: string
description: "Base64-encoded PEM CA certificate content for PKI authentication (Other provider only). Optional.\n"
description: "Defines secrets for connectors when type is `.gen-ai`. Supports both API key authentication (OpenAI, Azure OpenAI, and `Other`) and PKI authentication (`Other` provider only). PKI fields must be base64-encoded PEM content.\n"
opsgenie_secrets:
title: Connector secrets properties for an Opsgenie connector
required:
- apiKey
type: object
properties:
apiKey:
type: string
description: The Opsgenie API authentication key for HTTP Basic authentication.
description: Defines secrets for connectors when type is `.opsgenie`.
pagerduty_secrets:
title: Connector secrets properties for a PagerDuty connector
required:
- routingKey
type: object
properties:
routingKey:
type: string
description: "A 32 character PagerDuty Integration Key for an integration on a service.\n"
description: Defines secrets for connectors when type is `.pagerduty`.
sentinelone_secrets:
title: Connector secrets properties for a SentinelOne connector
required:
- token
type: object
properties:
token:
type: string
description: The A SentinelOne API token.
description: Defines secrets for connectors when type is `.sentinelone`.
servicenow_secrets:
title: 'Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors'
type: object
properties:
clientSecret:
type: string
description: The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`.
password:
type: string
description: The password for HTTP basic authentication. This property is required when `isOAuth` is `false`.
privateKey:
type: string
description: The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`.
privateKeyPassword:
type: string
description: The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key.
username:
type: string
description: The username for HTTP basic authentication. This property is required when `isOAuth` is `false`.
description: 'Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`.'
slack_api_secrets:
title: Connector secrets properties for a Web API Slack connector
required:
- token
type: object
properties:
token:
type: string
description: Slack bot user OAuth token.
description: Defines secrets for connectors when type is `.slack`.
swimlane_secrets:
title: Connector secrets properties for a Swimlane connector
type: object
properties:
apiToken:
type: string
description: Swimlane API authentication token.
description: Defines secrets for connectors when type is `.swimlane`.
thehive_secrets:
title: Connector secrets properties for a TheHive connector
required:
- apiKey
type: object
properties:
apiKey:
type: string
description: The API key for authentication in TheHive.
description: Defines secrets for connectors when type is `.thehive`.
tines_secrets:
title: Connector secrets properties for a Tines connector
required:
- email
- token
type: object
properties:
email:
type: string
description: The email used to sign in to Tines.
token:
type: string
description: The Tines API token.
description: Defines secrets for connectors when type is `.tines`.
torq_secrets:
title: Connector secrets properties for a Torq connector
required:
- token
type: object
properties:
token:
type: string
description: The secret of the webhook authentication header.
description: Defines secrets for connectors when type is `.torq`.
crt:
title: Certificate
type: string
description: 'If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file.'
key:
title: Certificate key
type: string
description: 'If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file.'
pfx:
title: Personal information exchange
type: string
description: 'If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file.'
webhook_secrets:
title: Connector secrets properties for a Webhook connector
type: object
properties:
crt:
$ref: '#/components/schemas/crt'
key:
$ref: '#/components/schemas/key'
pfx:
$ref: '#/components/schemas/pfx'
password:
type: string
description: "The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
user:
type: string
description: "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
description: Defines secrets for connectors when type is `.webhook`.
cases_webhook_secrets:
title: Connector secrets properties for Webhook - Case Management connector
type: object
properties:
crt:
$ref: '#/components/schemas/crt'
key:
$ref: '#/components/schemas/key'
pfx:
$ref: '#/components/schemas/pfx'
password:
type: string
description: "The password for HTTP basic authentication. If `hasAuth` is set to `true` and and `authType` is `webhook-authentication-basic`, this property is required.\n"
user:
type: string
description: "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
xmatters_secrets:
title: Connector secrets properties for an xMatters connector
type: object
properties:
password:
type: string
description: "A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n"
secretsUrl:
type: string
description: "The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`.\n"
user:
type: string
description: "A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n"
description: Defines secrets for connectors when type is `.xmatters`.
genai_openai_other_config:
title: Connector request properties for an OpenAI connector with Other provider
required:
- apiProvider
- apiUrl
- defaultModel
type: object
properties:
apiProvider:
enum:
- Other
type: string
description: The OpenAI API provider.
apiUrl:
type: string
description: The OpenAI-compatible API endpoint.
defaultModel:
type: string
description: The default model to use for requests.
certificateData:
minLength: 1
type: string
description: PEM-encoded certificate content.
privateKeyData:
minLength: 1
type: string
description: PEM-encoded private key content.
caData:
minLength: 1
type: string
description: PEM-encoded CA certificate content.
verificationMode:
enum:
- full
- certificate
- none
type: string
description: SSL verification mode for PKI authentication.
default: full
headers:
type: object
additionalProperties:
type: string
description: Custom headers to include in requests.
description: "Defines properties for connectors when type is `.gen-ai` and the API provider is `Other` (OpenAI-compatible service), including optional PKI authentication.\n"
defender_secrets:
title: Connector secrets properties for a Microsoft Defender for Endpoint connector
required:
- clientSecret
type: object
properties:
clientSecret:
type: string
description: The client secret for your app in the Azure portal.
description: Defines secrets for connectors when type is `..microsoft_defender_endpoint`.
run_acknowledge_resolve_pagerduty:
title: PagerDuty connector parameters
required:
- dedupKey
- eventAction
type: object
properties:
dedupKey:
maxLength: 255
type: string
description: The deduplication key for the PagerDuty alert.
eventAction:
enum:
- acknowledge
- resolve
type: string
description: The type of event.
description: Test an action that acknowledges or resolves a PagerDuty alert.
run_documents:
title: Index connector parameters
required:
- documents
type: object
properties:
documents:
type: array
items:
type: object
description: The documents in JSON format for index connectors.
description: Test an action that indexes a document into Elasticsearch.
run_message_email:
title: Email connector parameters
required:
- message
- subject
type: object
anyOf:
- required:
- to
- required:
- cc
- required:
- bcc
properties:
bcc:
type: array
items:
type: string
description: "A list of \"blind carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `` format\n"
cc:
type: array
items:
type: string
description: "A list of \"carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `` format \n"
message:
type: string
description: The email message text. Markdown format is supported.
subject:
type: string
description: The subject line of the email.
to:
type: array
items:
type: string
description: "A list of email addresses. Addresses can be specified in `user@host-name` format or in name `` format.\n"
description: "Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.\n"
run_message_serverlog:
title: Server log connector parameters
required:
- message
type: object
properties:
level:
enum:
- debug
- error
- fatal
- info
- trace
- warn
type: string
description: The log level of the message for server log connectors.
default: info
message:
type: string
description: The message for server log connectors.
description: Test an action that writes an entry to the Kibana server log.
run_message_slack:
title: Slack connector parameters
required:
- message
type: object
properties:
message:
type: string
description: 'The Slack message text, which cannot contain Markdown, images, or other advanced formatting.'
description: "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack`.\n"
run_trigger_pagerduty:
title: PagerDuty connector parameters
required:
- eventAction
type: object
properties:
class:
type: string
description: The class or type of the event.
example: cpu load
component:
type: string
description: The component of the source machine that is responsible for the event.
example: eth0
customDetails:
type: object
description: Additional details to add to the event.
dedupKey:
maxLength: 255
type: string
description: "All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.\n"
eventAction:
enum:
- trigger
type: string
description: The type of event.
group:
type: string
description: The logical grouping of components of a service.
example: app-stack
links:
type: array
items:
type: object
properties:
href:
type: string
description: The URL for the link.
text:
type: string
description: A plain text description of the purpose of the link.
description: A list of links to add to the event.
severity:
enum:
- critical
- error
- info
- warning
type: string
description: The severity of the event on the affected system.
default: info
source:
type: string
description: "The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.\n"
summary:
maxLength: 1024
type: string
description: A summery of the event.
timestamp:
type: string
description: An ISO-8601 timestamp that indicates when the event was detected or generated.
format: date-time
description: Test an action that triggers a PagerDuty alert.
run_addevent:
title: The addEvent subaction
required:
- subAction
type: object
properties:
subAction:
enum:
- addEvent
type: string
description: The action to test.
subActionParams:
type: object
properties:
additional_info:
type: string
description: Additional information about the event.
description:
type: string
description: The details about the event.
event_class:
type: string
description: A specific instance of the source.
message_key:
type: string
description: All actions sharing this key are associated with the same ServiceNow alert. The default value is `:`.
metric_name:
type: string
description: The name of the metric.
node:
type: string
description: The host that the event was triggered for.
resource:
type: string
description: The name of the resource.
severity:
type: string
description: The severity of the event.
source:
type: string
description: The name of the event source type.
time_of_event:
type: string
description: The time of the event.
type:
type: string
description: The type of event.
description: The set of configuration properties for the action.
description: The `addEvent` subaction for ServiceNow ITOM connectors.
run_closealert:
title: The closeAlert subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- closeAlert
type: string
description: The action to test.
subActionParams:
required:
- alias
type: object
properties:
alias:
type: string
description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
note:
type: string
description: Additional information for the alert.
source:
type: string
description: The display name for the source of the alert.
user:
type: string
description: The display name for the owner.
description: The `closeAlert` subaction for Opsgenie connectors.
run_closeincident:
title: The closeIncident subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- closeIncident
type: string
description: The action to test.
subActionParams:
required:
- incident
type: object
properties:
incident:
type: object
anyOf:
- required:
- correlation_id
- required:
- externalId
properties:
correlation_id:
maxLength: 100
type:
- 'null'
- string
description: "An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.\n"
default: '{{rule.id}}:{{alert.id}}'
externalId:
type:
- 'null'
- string
description: The unique identifier (`incidentId`) for the incident in ServiceNow.
description: The `closeIncident` subaction for ServiceNow ITSM connectors.
run_createalert:
title: The createAlert subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- createAlert
type: string
description: The action to test.
subActionParams:
type: object
properties:
actions:
type: array
items:
type: string
description: The custom actions available to the alert in Opsgenie connectors.
alias:
type: string
description: The unique identifier used for alert deduplication in Opsgenie.
description:
type: string
description: A description that provides detailed information about the alert.
details:
type: object
description: The custom properties of the alert in Opsgenie connectors.
example:
key1: value1
key2: value2
entity:
type: string
description: 'The domain of the alert in Opsgenie connectors. For example, the application or server name.'
message:
type: string
description: The alert message in Opsgenie connectors.
note:
type: string
description: Additional information for the alert in Opsgenie connectors.
priority:
enum:
- P1
- P2
- P3
- P4
- P5
type: string
description: The priority level for the alert in Opsgenie connectors.
responders:
type: array
items:
type: object
properties:
id:
type: string
description: The identifier for the entity.
name:
type: string
description: The name of the entity.
type:
enum:
- escalation
- schedule
- team
- user
type: string
description: 'The type of responders, in this case `escalation`.'
username:
type: string
description: A valid email address for the user.
description: "The entities to receive notifications about the alert in Opsgenie connectors. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.\n"
severity:
maximum: 4
minimum: 1
type: integer
description: "The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n"
source:
type: string
description: The display name for the source of the alert in Opsgenie and TheHive connectors.
sourceRef:
type: string
description: A source reference for the alert in TheHive connectors.
tags:
type: array
items:
type: string
description: The tags for the alert in Opsgenie and TheHive connectors.
title:
type: string
description: "A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.\n"
tlp:
maximum: 4
minimum: 0
type: integer
description: "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n"
default: 2
type:
type: string
description: The type of alert in TheHive connectors.
user:
type: string
description: The display name for the owner.
visibleTo:
type: array
items:
required:
- type
type: object
properties:
id:
type: string
description: The identifier for the entity.
name:
type: string
description: The name of the entity.
type:
enum:
- team
- user
type: string
description: Valid values are `team` and `user`.
username:
type: string
description: The user name. This property is required only when the `type` is `user`.
description: 'The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required.'
description: The `createAlert` subaction for Opsgenie and TheHive connectors.
run_fieldsbyissuetype:
title: The fieldsByIssueType subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- fieldsByIssueType
type: string
description: The action to test.
subActionParams:
required:
- id
type: object
properties:
id:
type: string
description: The Jira issue type identifier.
example: 10024
description: The `fieldsByIssueType` subaction for Jira connectors.
run_getagentdetails:
title: The getAgentDetails subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- getAgentDetails
type: string
description: The action to test.
subActionParams:
required:
- ids
type: object
properties:
ids:
type: array
items:
type: string
description: An array of CrowdStrike agent identifiers.
description: The set of configuration properties for the action.
description: The `getAgentDetails` subaction for CrowdStrike connectors.
run_getagents:
title: The getAgents subaction
required:
- subAction
type: object
properties:
subAction:
enum:
- getAgents
type: string
description: The action to test.
description: The `getAgents` subaction for SentinelOne connectors.
run_getchoices:
title: The getChoices subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- getChoices
type: string
description: The action to test.
subActionParams:
required:
- fields
type: object
properties:
fields:
type: array
items:
type: string
description: An array of fields.
description: The set of configuration properties for the action.
description: 'The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.'
run_getfields:
title: The getFields subaction
required:
- subAction
type: object
properties:
subAction:
enum:
- getFields
type: string
description: The action to test.
description: 'The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.'
run_getincident:
title: The getIncident subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- getIncident
type: string
description: The action to test.
subActionParams:
required:
- externalId
type: object
properties:
externalId:
type: string
description: 'The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.'
example: 71778
description: 'The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.'
run_issue:
title: The issue subaction
required:
- subAction
type: object
properties:
subAction:
enum:
- issue
type: string
description: The action to test.
subActionParams:
required:
- id
type: object
properties:
id:
type: string
description: The Jira issue identifier.
example: 71778
description: The `issue` subaction for Jira connectors.
run_issues:
title: The issues subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- issues
type: string
description: The action to test.
subActionParams:
required:
- title
type: object
properties:
title:
type: string
description: The title of the Jira issue.
description: The `issues` subaction for Jira connectors.
run_issuetypes:
title: The issueTypes subaction
required:
- subAction
type: object
properties:
subAction:
enum:
- issueTypes
type: string
description: The action to test.
description: The `issueTypes` subaction for Jira connectors.
run_postmessage:
title: The postMessage subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- postMessage
type: string
description: The action to test.
subActionParams:
type: object
properties:
channelIds:
maxItems: 1
type: array
items:
type: string
description: "The Slack channel identifier, which must be one of the `allowedChannels` in the connector configuration.\n"
channels:
maxItems: 1
type: array
items:
type: string
description: "The name of a channel that your Slack app has access to.\n"
deprecated: true
text:
minLength: 1
type: string
description: "The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.\n"
description: The set of configuration properties for the action.
description: "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack_api`.\n"
run_pushtoservice:
title: The pushToService subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- pushToService
type: string
description: The action to test.
subActionParams:
type: object
properties:
comments:
type: array
items:
type: object
properties:
comment:
type: string
description: 'A comment related to the incident. For example, describe how to troubleshoot the issue.'
commentId:
type: integer
description: A unique identifier for the comment.
description: 'Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.'
incident:
type: object
properties:
additional_fields:
maxLength: 20
type:
- 'null'
- string
description: "Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.\n"
alertId:
type: string
description: The alert identifier for Swimlane connectors.
caseId:
type: string
description: The case identifier for the incident for Swimlane connectors.
caseName:
type: string
description: The case name for the incident for Swimlane connectors.
category:
type: string
description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_display:
type: string
description: A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
correlation_id:
type: string
description: "The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.\n"
description:
type: string
description: 'The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.'
dest_ip:
oneOf:
- type: string
- type: array
items:
type: string
description: "A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.\n"
externalId:
type: string
description: "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.\n"
id:
type: string
description: The external case identifier for Webhook - Case Management connectors.
impact:
type: string
description: The impact of the incident for ServiceNow ITSM connectors.
issueType:
type: integer
description: 'The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`.'
labels:
type: array
items:
type: string
description: "The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.\n"
malware_hash:
oneOf:
- type: string
- type: array
items:
type: string
description: A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
malware_url:
type: string
oneOf:
- type: string
- type: array
items:
type: string
description: A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
otherFields:
maxProperties: 20
type: object
description: "Custom field identifiers and their values for Jira connectors.\n"
parent:
type: string
description: The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues.
priority:
type: string
description: The priority of the incident in Jira and ServiceNow SecOps connectors.
ruleName:
type: string
description: The rule name for Swimlane connectors.
severity:
type: integer
description: "The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n"
short_description:
type: string
description: "A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.\n"
source_ip:
oneOf:
- type: string
- type: array
items:
type: string
description: A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
status:
type: string
description: The status of the incident for Webhook - Case Management connectors.
subcategory:
type: string
description: The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
summary:
type: string
description: A summary of the incident for Jira connectors.
tags:
type: array
items:
type: string
description: A list of tags for TheHive and Webhook - Case Management connectors.
title:
type: string
description: "A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.\n"
tlp:
maximum: 4
minimum: 0
type: integer
description: "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n"
default: 2
urgency:
type: string
description: The urgency of the incident for ServiceNow ITSM connectors.
description: 'Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.'
description: The set of configuration properties for the action.
description: 'The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.'
run_validchannelid:
title: The validChannelId subaction
required:
- subAction
- subActionParams
type: object
properties:
subAction:
enum:
- validChannelId
type: string
description: The action to test.
subActionParams:
required:
- channelId
type: object
properties:
channelId:
type: string
description: The Slack channel identifier.
example: C123ABC456
description: "Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is `.slack_api`.\n"
params_property_apm_anomaly:
title: APM anomaly
required:
- windowSize
- windowUnit
- environment
- anomalySeverityType
type: object
properties:
serviceName:
type: string
description: The service name from APM
transactionType:
type: string
description: The transaction type from APM
windowSize:
type: number
description: The window size
example: 6
windowUnit:
enum:
- m
- h
- d
type: string
description: The window size unit
environment:
type: string
description: The environment from APM
anomalySeverityType:
enum:
- critical
- major
- minor
- warning
type: string
description: The anomaly threshold value
description: "The parameters for the APM anomaly rule. These parameters are appropriate when `rule_type_id` is `apm.rules.anomaly`.\n"
params_property_apm_error_count:
title: APM error count
required:
- windowSize
- windowUnit
- threshold
- environment
type: object
properties:
serviceName:
type: string
description: The service name from APM
windowSize:
type: number
description: The window size
example: 6
windowUnit:
enum:
- m
- h
- d
type: string
description: The window size unit
environment:
type: string
description: The environment from APM
threshold:
type: number
description: The error count threshold value
groupBy:
uniqueItems: true
type: array
items:
enum:
- service.name
- service.environment
- transaction.name
- error.grouping_key
type: string
default:
- service.name
- service.environment
errorGroupingKey:
type: string
description: "The parameters for the APM error count rule. These parameters are appropriate when `rule_type_id` is `apm.error_rate`.\n"
params_property_apm_transaction_duration:
title: APM transaction duration
required:
- windowSize
- windowUnit
- threshold
- environment
- aggregationType
type: object
properties:
serviceName:
type: string
description: The service name from APM
transactionType:
type: string
description: The transaction type from APM
transactionName:
type: string
description: The transaction name from APM
windowSize:
type: number
description: The window size
example: 6
windowUnit:
enum:
- m
- h
- d
type: string
description: ç
environment:
type: string
threshold:
type: number
description: The latency threshold value
groupBy:
uniqueItems: true
type: array
items:
enum:
- service.name
- service.environment
- transaction.type
- transaction.name
type: string
default:
- service.name
- service.environment
- transaction.type
aggregationType:
enum:
- avg
- 95th
- 99th
type: string
description: "The parameters for the APM transaction duration rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_duration`.\n"
params_property_apm_transaction_error_rate:
title: APM transaction error rate
required:
- windowSize
- windowUnit
- threshold
- environment
type: object
properties:
serviceName:
type: string
description: The service name from APM
transactionType:
type: string
description: The transaction type from APM
transactionName:
type: string
description: The transaction name from APM
windowSize:
type: number
description: The window size
example: 6
windowUnit:
enum:
- m
- h
- d
type: string
description: The window size unit
environment:
type: string
description: The environment from APM
threshold:
type: number
description: The error rate threshold value
groupBy:
uniqueItems: true
type: array
items:
enum:
- service.name
- service.environment
- transaction.type
- transaction.name
type: string
default:
- service.name
- service.environment
- transaction.type
description: "The parameters for the APM transaction error rate rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_error_rate`.\n"
aggfield:
type: string
description: "The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.\n"
aggtype:
enum:
- avg
- count
- max
- min
- sum
type: string
description: The type of aggregation to perform.
default: count
excludehitsfrompreviousrun:
type: boolean
description: "Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.\n"
groupby:
enum:
- all
- top
type: string
description: "Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.\n"
default: all
size:
type: integer
description: "The number of documents to pass to the configured actions when the threshold condition is met.\n"
termfield:
oneOf:
- type: string
- maxItems: 4
type: array
items:
type: string
description: "The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.\n"
termsize:
type: integer
description: "This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.\n"
threshold:
type: array
items:
type: integer
example: 4000
description: "The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values.\n"
thresholdcomparator:
enum:
- '>'
- '>='
- <
- <=
- between
- notBetween
type: string
description: 'The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".'
example: '>'
timefield:
type: string
description: The field that is used to calculate the time window.
timewindowsize:
type: integer
description: "The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n"
example: 5
timewindowunit:
enum:
- s
- m
- h
- d
type: string
description: "The type of units for the time window: seconds, minutes, hours, or days.\n"
example: m
params_es_query_dsl_rule:
title: Elasticsearch DSL query rule params
required:
- esQuery
- index
- threshold
- thresholdComparator
- timeField
- timeWindowSize
- timeWindowUnit
type: object
properties:
aggField:
$ref: '#/components/schemas/aggfield'
aggType:
$ref: '#/components/schemas/aggtype'
esQuery:
type: string
description: 'The query definition, which uses Elasticsearch Query DSL.'
excludeHitsFromPreviousRun:
$ref: '#/components/schemas/excludehitsfrompreviousrun'
groupBy:
$ref: '#/components/schemas/groupby'
index:
oneOf:
- type: array
items:
type: string
- type: string
description: The indices to query.
searchType:
enum:
- esQuery
type: string
description: 'The type of query, in this case a query that uses Elasticsearch Query DSL.'
default: esQuery
example: esQuery
size:
$ref: '#/components/schemas/size'
termField:
$ref: '#/components/schemas/termfield'
termSize:
$ref: '#/components/schemas/termsize'
threshold:
$ref: '#/components/schemas/threshold'
thresholdComparator:
$ref: '#/components/schemas/thresholdcomparator'
timeField:
$ref: '#/components/schemas/timefield'
timeWindowSize:
$ref: '#/components/schemas/timewindowsize'
timeWindowUnit:
$ref: '#/components/schemas/timewindowunit'
description: "An Elasticsearch query rule can run a query defined in Elasticsearch Query DSL and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.\n"
params_es_query_esql_rule:
title: Elasticsearch ES|QL query rule params
required:
- esqlQuery
- searchType
- size
- threshold
- thresholdComparator
- timeWindowSize
- timeWindowUnit
type: object
properties:
aggField:
$ref: '#/components/schemas/aggfield'
aggType:
$ref: '#/components/schemas/aggtype'
esqlQuery:
required:
- esql
type: object
properties:
esql:
type: string
description: 'The query definition, which uses Elasticsearch Query Language.'
excludeHitsFromPreviousRun:
$ref: '#/components/schemas/excludehitsfrompreviousrun'
groupBy:
$ref: '#/components/schemas/groupby'
searchType:
enum:
- esqlQuery
type: string
description: 'The type of query, in this case a query that uses Elasticsearch Query Language (ES|QL).'
example: esqlQuery
size:
type: integer
description: "When `searchType` is `esqlQuery`, this property is required but it does not affect the rule behavior.\n"
example: 0
termSize:
$ref: '#/components/schemas/termsize'
threshold:
type: array
items:
maximum: 0
minimum: 0
type: integer
description: "The threshold value that is used with the `thresholdComparator`. When `searchType` is `esqlQuery`, this property is required and must be set to zero.\n"
thresholdComparator:
enum:
- '>'
type: string
description: "The comparison function for the threshold. When `searchType` is `esqlQuery`, this property is required and must be set to \">\". Since the `threshold` value must be `0`, the result is that an alert occurs whenever the query returns results.\n"
example: '>'
timeField:
$ref: '#/components/schemas/timefield'
timeWindowSize:
$ref: '#/components/schemas/timewindowsize'
timeWindowUnit:
$ref: '#/components/schemas/timewindowunit'
description: "An Elasticsearch query rule can run an ES|QL query and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.\n"
filter:
type: object
properties:
meta:
type: object
properties:
alias:
type:
- 'null'
- string
controlledBy:
type: string
disabled:
type: boolean
field:
type: string
group:
type: string
index:
type: string
isMultiIndex:
type: boolean
key:
type: string
negate:
type: boolean
params:
type: object
type:
type: string
value:
type: string
query:
type: object
$state:
type: object
description: A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
params_es_query_kql_rule:
title: Elasticsearch KQL query rule params
required:
- searchType
- size
- threshold
- thresholdComparator
- timeWindowSize
- timeWindowUnit
type: object
properties:
aggField:
$ref: '#/components/schemas/aggfield'
aggType:
$ref: '#/components/schemas/aggtype'
excludeHitsFromPreviousRun:
$ref: '#/components/schemas/excludehitsfrompreviousrun'
groupBy:
$ref: '#/components/schemas/groupby'
searchConfiguration:
type: object
properties:
filter:
type: array
items:
$ref: '#/components/schemas/filter'
index:
oneOf:
- type: string
- type: array
items:
type: string
description: The indices to query.
query:
type: object
properties:
language:
type: string
example: kuery
query:
type: string
description: 'The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.'
searchType:
enum:
- searchSource
type: string
description: 'The type of query, in this case a text-based query that uses KQL or Lucene.'
example: searchSource
size:
$ref: '#/components/schemas/size'
termField:
$ref: '#/components/schemas/termfield'
termSize:
$ref: '#/components/schemas/termsize'
threshold:
$ref: '#/components/schemas/threshold'
thresholdComparator:
$ref: '#/components/schemas/thresholdcomparator'
timeField:
$ref: '#/components/schemas/timefield'
timeWindowSize:
$ref: '#/components/schemas/timewindowsize'
timeWindowUnit:
$ref: '#/components/schemas/timewindowunit'
description: "An Elasticsearch query rule can run a query defined in KQL or Lucene and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.\n"
params_index_threshold_rule:
title: Index threshold rule params
required:
- index
- threshold
- thresholdComparator
- timeField
- timeWindowSize
- timeWindowUnit
type: object
properties:
aggField:
$ref: '#/components/schemas/aggfield'
aggType:
$ref: '#/components/schemas/aggtype'
filterKuery:
type: string
description: A KQL expression thats limits the scope of alerts.
groupBy:
$ref: '#/components/schemas/groupby'
index:
type: array
items:
type: string
description: The indices to query.
termField:
$ref: '#/components/schemas/termfield'
termSize:
$ref: '#/components/schemas/termsize'
threshold:
$ref: '#/components/schemas/threshold'
thresholdComparator:
$ref: '#/components/schemas/thresholdcomparator'
timeField:
$ref: '#/components/schemas/timefield'
timeWindowSize:
$ref: '#/components/schemas/timewindowsize'
timeWindowUnit:
$ref: '#/components/schemas/timewindowunit'
description: 'An index threshold rule runs an Elasticsearch query, aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met. These parameters are appropriate when `rule_type_id` is `.index-threshold`.'
params_property_infra_inventory:
title: Inventory
type: object
properties:
criteria:
type: array
items:
type: object
properties:
metric:
enum:
- count
- cpu
- diskLatency
- load
- memory
- memoryTotal
- tx
- rx
- logRate
- diskIOReadBytes
- diskIOWriteBytes
- s3TotalRequests
- s3NumberOfObjects
- s3BucketSize
- s3DownloadBytes
- s3UploadBytes
- rdsConnections
- rdsQueriesExecuted
- rdsActiveTransactions
- rdsLatency
- sqsMessagesVisible
- sqsMessagesDelayed
- sqsMessagesSent
- sqsMessagesEmpty
- sqsOldestMessage
- custom
type: string
timeSize:
type: number
timeUnit:
enum:
- s
- m
- h
- d
type: string
sourceId:
type: string
threshold:
type: array
items:
type: number
comparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
customMetric:
type: object
properties:
type:
enum:
- custom
type: string
field:
type: string
aggregation:
enum:
- avg
- max
- min
- rate
type: string
id:
type: string
label:
type: string
warningThreshold:
type: array
items:
type: number
warningComparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
filterQuery:
type: string
filterQueryText:
type: string
nodeType:
enum:
- host
- pod
- container
- awsEC2
- awsS3
- awsSQS
- awsRDS
type: string
sourceId:
type: string
alertOnNoData:
type: boolean
description: "The parameters for the infrastructure inventory rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.inventory.threshold`.\n"
params_property_log_threshold:
oneOf:
- title: Log threshold count
required:
- count
- timeSize
- timeUnit
- logView
type: object
properties:
criteria:
type: array
items:
type: object
properties:
field:
type: string
example: my.field
comparator:
enum:
- more than
- more than or equals
- less than
- less than or equals
- equals
- does not equal
- matches
- does not match
- matches phrase
- does not match phrase
type: string
value:
type:
- number
- string
count:
type: object
properties:
comparator:
enum:
- more than
- more than or equals
- less than
- less than or equals
- equals
- does not equal
- matches
- does not match
- matches phrase
- does not match phrase
type: string
value:
type: number
example: 100
timeSize:
type: number
example: 6
timeUnit:
enum:
- s
- m
- h
- d
type: string
logView:
type: object
properties:
logViewId:
type: string
type:
enum:
- log-view-reference
type: string
example: log-view-reference
groupBy:
type: array
items:
type: string
description: "The parameters for a log threshold rule that counts the number of log entries that match the criteria. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`.\n"
- title: Log threshold ratio
required:
- count
- timeSize
- timeUnit
- logView
type: object
properties:
criteria:
type: array
items:
maxItems: 2
minItems: 2
type: array
items:
type: object
properties:
field:
type: string
example: my.field
comparator:
enum:
- more than
- more than or equals
- less than
- less than or equals
- equals
- does not equal
- matches
- does not match
- matches phrase
- does not match phrase
type: string
value:
type:
- number
- string
count:
type: object
properties:
comparator:
enum:
- more than
- more than or equals
- less than
- less than or equals
- equals
- does not equal
- matches
- does not match
- matches phrase
- does not match phrase
type: string
value:
type: number
example: 100
timeSize:
type: number
example: 6
timeUnit:
enum:
- s
- m
- h
- d
type: string
logView:
type: object
properties:
logViewId:
type: string
type:
enum:
- log-view-reference
type: string
example: log-view-reference
groupBy:
type: array
items:
type: string
description: "The parameters for a log threshold rule that calculates the ratio of log entries that match the criteria. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`.\n"
params_property_infra_metric_threshold:
title: Metric threshold
type: object
properties:
criteria:
type: array
items:
oneOf:
- title: non count criterion
type: object
properties:
threshold:
type: array
items:
type: number
description: "The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.\n"
comparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
description: "The comparison function for the threshold. For example, \"is above\", \"is above or equals\", \"is below\", \"is below or equals\", \"is between\", and \"outside\".\n"
timeUnit:
enum:
- s
- m
- h
- d
type: string
description: "The type of units for the time window: seconds, minutes, hours, or days.\n"
timeSize:
type: number
description: "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n"
warningThreshold:
type: array
items:
type: number
description: "The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.\n"
warningComparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
metric:
type: string
aggType:
enum:
- avg
- max
- min
- cardinality
- rate
- count
- sum
- p95
- p99
- custom
type: string
- title: count criterion
type: object
properties:
threshold:
type: array
items:
type: number
comparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
timeUnit:
enum:
- s
- m
- h
- d
type: string
description: "The type of units for the time window: seconds, minutes, hours, or days.\n"
timeSize:
type: number
description: "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n"
warningThreshold:
type: array
items:
type: number
warningComparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
aggType:
enum:
- count
type: string
- title: custom criterion
type: object
properties:
threshold:
type: array
items:
type: number
comparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
timeUnit:
enum:
- s
- m
- h
- d
type: string
description: "The type of units for the time window: seconds, minutes, hours, or days.\n"
timeSize:
type: number
description: "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n"
warningThreshold:
type: array
items:
type: number
warningComparator:
enum:
- <
- <=
- '>'
- '>='
- between
- outside
type: string
aggType:
enum:
- custom
type: string
customMetric:
type: array
items:
oneOf:
- type: object
properties:
name:
type: string
aggType:
enum:
- avg
- sum
- max
- min
- cardinality
type: string
description: "An aggregation to gather data for the rule. For example, find the average, highest or lowest value of a numeric field. Or use a cardinality aggregation to find the approximate number of unique values in a field. \n"
field:
type: string
- type: object
properties:
name:
type: string
aggType:
enum:
- count
type: string
filter:
type: string
equation:
type: string
label:
type: string
groupBy:
oneOf:
- type: string
- type: array
items:
type: string
description: "Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host.\nIMPORTANT: If you include the same field in both the `filterQuery` and `groupBy`, you might receive fewer results than you expect. For example, if you filter by `cloud.region: us-east`, grouping by `cloud.region` will have no effect because the filter query can match only one region.\n"
filterQuery:
type: string
description: "A query that limits the scope of the rule. The rule evaluates only metric data that matches the query.\n"
sourceId:
type: string
alertOnNoData:
type: boolean
description: 'If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails.'
alertOnGroupDisappear:
type: boolean
description: "If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically.\n"
description: "The parameters for the metric threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.threshold`.\n"
params_property_slo_burn_rate:
title: SLO burn rate
type: object
properties:
sloId:
type: string
description: The SLO identifier used by the rule
example: 8853df00-ae2e-11ed-90af-09bb6422b258
burnRateThreshold:
type: number
description: The burn rate threshold used to trigger the alert
example: 14.4
maxBurnRateThreshold:
type: number
description: The maximum burn rate threshold value defined by the SLO error budget
example: 168
longWindow:
type: object
properties:
value:
type: number
description: The duration value
example: 6
unit:
type: string
description: The duration unit
example: h
description: The duration of the long window used to compute the burn rate
shortWindow:
type: object
properties:
value:
type: number
description: The duration value
example: 30
unit:
type: string
description: The duration unit
example: m
description: The duration of the short window used to compute the burn rate
description: "The parameters for the SLO burn rate rule. These parameters are appropriate when `rule_type_id` is `slo.rules.burnRate`.\n"
params_property_synthetics_uptime_tls:
title: Synthetics TLS certificate
type: object
properties:
search:
type: string
certExpirationThreshold:
type: number
certAgeThreshold:
type: number
description: "The parameters for the synthetics TLS certificate rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.tls`.\n"
params_property_synthetics_monitor_status:
title: Synthetics monitor status
required:
- numTimes
- shouldCheckStatus
- shouldCheckAvailability
type: object
properties:
availability:
type: object
properties:
range:
type: number
rangeUnit:
type: string
threshold:
type: string
filters:
oneOf:
- type: string
- type: object
properties:
monitor.type:
type: array
items:
type: string
observer.geo.name:
type: array
items:
type: string
tags:
type: array
items:
type: string
url.port:
type: array
items:
type: string
deprecated: true
locations:
type: array
items:
type: string
deprecated: true
numTimes:
type: number
search:
type: string
shouldCheckStatus:
type: boolean
shouldCheckAvailability:
type: boolean
timerangeCount:
type: number
timerangeUnit:
type: string
timerange:
type: object
properties:
from:
type: string
to:
type: string
deprecated: true
version:
type: number
isAutoGenerated:
type: boolean
description: "The parameters for the Synthetics monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.monitorStatus`.\n"
responses:
Fleet_error:
description: Generic Error
content:
application/json:
schema:
type: object
properties:
error:
type: string
message:
type: string
statusCode:
type: number
parameters:
Alerting_kbn_xsrf:
name: kbn-xsrf
in: header
description: Cross-site request forgery protection
required: true
schema:
type: string
APM_UI_elastic_api_version:
name: elastic-api-version
in: header
description: The version of the API to use
required: true
schema:
enum:
- '2023-10-31'
type: string
default: '2023-10-31'
APM_UI_kbn_xsrf:
name: kbn-xsrf
in: header
description: A required header to protect against CSRF attacks
required: true
schema:
type: string
example: 'true'
Cases_alert_id:
name: alertId
in: path
description: An identifier for the alert.
required: true
schema:
type: string
example: 09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540
Cases_assignees_filter:
name: assignees
in: query
description: "Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.\n"
schema:
oneOf:
- $ref: '#/components/schemas/Cases_string'
- $ref: '#/components/schemas/Cases_string_array'
Cases_case_id:
name: caseId
in: path
description: 'The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.'
required: true
schema:
type: string
example: 9c235210-6834-11ea-a78c-6ffb38a34414
Cases_category:
name: category
in: query
description: Filters the returned cases by category.
schema:
oneOf:
- $ref: '#/components/schemas/Cases_case_category'
- $ref: '#/components/schemas/Cases_case_categories'
Cases_comment_id:
name: commentId
in: path
description: "The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs.\n"
required: true
schema:
type: string
example: 71ec1870-725b-11ea-a0b2-c51ea50a58e2
Cases_configuration_id:
name: configurationId
in: path
description: An identifier for the configuration.
required: true
schema:
type: string
example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9
Cases_connector_id:
name: connectorId
in: path
description: 'An identifier for the connector. To retrieve connector IDs, use the find connectors API.'
required: true
schema:
type: string
example: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
Cases_defaultSearchOperator:
name: defaultSearchOperator
in: query
description: he default operator to use for the simple_query_string.
schema:
type: string
default: OR
example: OR
Cases_from:
name: from
in: query
description: "Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.\n"
schema:
type: string
example: now-1d
Cases_ids:
name: ids
in: query
description: "The cases that you want to removed. All non-ASCII characters must be URL encoded.\n"
required: true
schema:
type: array
items:
maxItems: 100
minItems: 1
type: string
example:
- d4e7abb0-b462-11ec-9a8d-698504725a43
Cases_includeComments:
name: includeComments
in: query
description: Deprecated in 8.1.0. This parameter is deprecated and will be removed in a future release. It determines whether case comments are returned.
deprecated: true
schema:
type: boolean
default: true
Cases_kbn_xsrf:
name: kbn-xsrf
in: header
description: Cross-site request forgery protection
required: true
schema:
type: string
Cases_owner_filter:
name: owner
in: query
description: "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.\n"
schema:
oneOf:
- $ref: '#/components/schemas/Cases_owner'
- $ref: '#/components/schemas/Cases_owners'
example: cases
Cases_page_index:
name: page
in: query
description: The page number to return.
schema:
type: integer
default: 1
Cases_page_size:
name: perPage
in: query
description: The number of items to return. Limited to 100 items.
schema:
maximum: 100
type: integer
default: 20
Cases_reporters:
name: reporters
in: query
description: Filters the returned cases by the user name of the reporter.
schema:
oneOf:
- $ref: '#/components/schemas/Cases_string'
- $ref: '#/components/schemas/Cases_string_array'
example: elastic
Cases_search:
name: search
in: query
description: An Elasticsearch simple_query_string query that filters the objects in the response.
schema:
type: string
Cases_searchFields:
name: searchFields
in: query
description: The fields to perform the simple_query_string parsed query against.
schema:
oneOf:
- $ref: '#/components/schemas/Cases_searchFieldsType'
- $ref: '#/components/schemas/Cases_searchFieldsTypeArray'
Cases_severity:
name: severity
in: query
description: The severity of the case.
schema:
enum:
- critical
- high
- low
- medium
type: string
Cases_sort_order:
name: sortOrder
in: query
description: Determines the sort order.
schema:
enum:
- asc
- desc
type: string
default: desc
Cases_sortField:
name: sortField
in: query
description: Determines which field is used to sort the results.
schema:
enum:
- createdAt
- updatedAt
- closedAt
- title
- category
- status
- severity
type: string
default: createdAt
example: updatedAt
Cases_status:
name: status
in: query
description: Filters the returned cases by state.
schema:
enum:
- closed
- in-progress
- open
type: string
example: open
Cases_tags:
name: tags
in: query
description: Filters the returned cases by tags.
schema:
oneOf:
- $ref: '#/components/schemas/Cases_string'
- $ref: '#/components/schemas/Cases_string_array'
example: tag-1
Cases_to:
name: to
in: query
description: "Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.\n"
schema:
type: string
example: now+1d
Cases_user_action_types:
name: types
in: query
description: Determines the types of user actions to return.
schema:
type: array
items:
enum:
- action
- alert
- assignees
- attachment
- comment
- connector
- create_case
- description
- pushed
- settings
- severity
- status
- tags
- title
- user
type: string
example: create_case
Data_views_field_name:
name: fieldName
in: path
description: The name of the runtime field.
required: true
schema:
type: string
example: hour_of_day
Data_views_kbn_xsrf:
name: kbn-xsrf
in: header
description: Cross-site request forgery protection
required: true
schema:
type: string
Data_views_view_id:
name: viewId
in: path
description: An identifier for the data view.
required: true
schema:
type: string
example: ff959d40-b880-11e8-a6d9-e546fe2bba5f
Fleet_format:
name: format
in: query
description: Simplified or legacy format for package inputs
schema:
enum:
- simplified
- legacy
type: string
Fleet_kbn_xsrf:
name: kbn-xsrf
in: header
description: Kibana's anti Cross-Site Request Forgery token. Can be any string value.
required: true
schema:
type: string
Fleet_kuery:
name: kuery
in: query
schema:
type: string
Fleet_page_index:
name: page
in: query
schema:
type: integer
default: 1
Fleet_page_size:
name: perPage
in: query
description: The number of items to return
schema:
type: integer
default: 20
Fleet_show_inactive:
name: showInactive
in: query
schema:
type: boolean
Fleet_show_upgradeable:
name: showUpgradeable
in: query
schema:
type: boolean
Fleet_sort_field:
name: sortField
in: query
schema:
type: string
deprecated: true
Fleet_sort_order:
name: sortOrder
in: query
schema:
enum:
- asc
- desc
type: string
Fleet_with_metrics:
name: withMetrics
in: query
description: 'Return agent metrics, false by default'
schema:
type: boolean
Machine_learning_APIs_simulateParam:
name: simulate
in: query
description: 'When true, simulates the synchronization by returning only the list of actions that would be performed.'
schema:
type: boolean
example: 'true'
Saved_objects_kbn_xsrf:
name: kbn-xsrf
in: header
description: Cross-site request forgery protection
required: true
schema:
type: string
Saved_objects_saved_object_id:
name: id
in: path
description: An identifier for the saved object.
required: true
schema:
type: string
Saved_objects_saved_object_type:
name: type
in: path
description: 'Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`.'
required: true
schema:
type: string
Short_URL_APIs_idParam:
name: id
in: path
description: The identifier for the short URL.
required: true
schema:
type: string
SLOs_kbn_xsrf:
name: kbn-xsrf
in: header
description: Cross-site request forgery protection
required: true
schema:
type: string
SLOs_slo_id:
name: sloId
in: path
description: An identifier for the slo.
required: true
schema:
type: string
example: 9c235211-6834-11ea-a78c-6feb38a34414
SLOs_space_id:
name: spaceId
in: path
description: 'An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.'
required: true
schema:
type: string
example: default
examples:
Alerting_get_health_response:
summary: Retrieve information about the health of the alerting framework.
value:
alerting_framework_health:
decryption_health:
status: ok
timestamp: '2023-01-13T01:28:00.280Z'
execution_health:
status: ok
timestamp: '2023-01-13T01:28:00.280Z'
read_health:
status: ok
timestamp: '2023-01-13T01:28:00.280Z'
has_permanent_encryption_key: true
is_sufficiently_secure: true
Alerting_get_rule_types_response:
summary: Retrieve rule types associated with Kibana machine learning features
value:
- action_groups:
- id: anomaly_score_match
name: Anomaly score matched the condition
- id: recovered
name: Recovered
action_variables:
context:
- description: The bucket timestamp of the anomaly
name: timestamp
- description: The bucket time of the anomaly in ISO8601 format
name: timestampIso8601
- description: List of job IDs that triggered the alert
name: jobIds
- description: Alert info message
name: message
- description: Indicate if top hits contain interim results
name: isInterim
- description: Anomaly score at the time of the notification action
name: score
- description: Top records
name: topRecords
- description: Top influencers
name: topInfluencers
- description: URL to open in the Anomaly Explorer
name: anomalyExplorerUrl
useWithTripleBracesInTemplates: true
params: [ ]
state: [ ]
alerts:
context: ml.anomaly-detection
mappings:
fieldMap:
kibana.alert.anomaly_score:
array: false
type: double
required: false
kibana.alert.anomaly_timestamp:
array: false
type: date
required: false
kibana.alert.is_interim:
array: false
type: boolean
required: false
kibana.alert.job_id:
array: false
type: keyword
required: true
kibana.alert.top_influencers:
array: true
dynamic: false
type: object
properties:
influencer_field_name:
type: keyword
influencer_field_value:
type: keyword
influencer_score:
type: double
initial_influencer_score:
type: double
is_interim:
type: boolean
job_id:
type: keyword
timestamp:
type: date
required: false
kibana.alert.top_records:
array: true
dynamic: false
type: object
properties:
actual:
type: double
by_field_name:
type: keyword
by_field_value:
type: keyword
detector_index:
type: integer
field_name:
type: keyword
function:
type: keyword
initial_record_score:
type: double
is_interim:
type: boolean
job_id:
type: keyword
over_field_name:
type: keyword
over_field_value:
type: keyword
partition_field_name:
type: keyword
partition_field_value:
type: keyword
record_score:
type: double
timestamp:
type: date
typical:
type: double
required: false
shouldWrite: true
authorized_consumers:
alerts:
all: true
read: true
apm:
all: true
read: true
discover:
all: true
read: true
infrastructure:
all: true
read: true
logs:
all: true
read: true
ml:
all: true
read: true
monitoring:
all: true
read: true
siem:
all: true
read: true
slo:
all: true
read: true
stackAlerts:
all: true
read: true
uptime:
all: true
read: true
category: management
default_action_group_id: anomaly_score_match
does_set_recovery_context: true
enabled_in_license: true
has_alerts_mappings: true
has_fields_for_a_a_d: true
id: xpack.ml.anomaly_detection_alert
is_exportable: true
minimum_license_required: platinum
name: Anomaly detection alert
producer: ml
recovery_action_group:
id: recovered
name: Recovered
rule_task_timeout: 5m
- action_groups:
- id: anomaly_detection_realtime_issue
name: Issue detected
- id: recovered
name: Recovered
action_variables:
context:
- description: Results of the rule execution
name: results
- description: Alert info message
name: message
params: [ ]
state: [ ]
authorized_consumers:
alerts:
all: true
read: true
apm:
all: true
read: true
discover:
all: true
read: true
infrastructure:
all: true
read: true
logs:
all: true
read: true
ml:
all: true
read: true
monitoring:
all: true
read: true
siem:
all: true
read: true
slo:
all: true
read: true
stackAlerts:
all: true
read: true
uptime:
all: true
read: true
category: management
default_action_group_id: anomaly_detection_realtime_issue
does_set_recovery_context: true
enabled_in_license: true
has_alerts_mappings: false
has_fields_for_a_a_d: false
id: xpack.ml.anomaly_detection_jobs_health
is_exportable: true
minimum_license_required: platinum
name: Anomaly detection jobs health
producer: ml
recovery_action_group:
id: recovered
name: Recovered
rule_task_timeout: 5m
Cases_add_comment_request:
summary: Adds a comment to a case.
value:
comment: A new comment.
owner: cases
type: user
Cases_add_comment_response:
summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
value:
assignees: [ ]
category: 'null'
closed_at: 'null'
closed_by: 'null'
comments:
- comment: A new comment.
created_at: '2022-10-02T00:49:47.716Z'
created_by:
email: 'null'
full_name: 'null'
username: elastic
id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
owner: cases
type: user
version: WzIwNDMxLDFd
connector:
fields: 'null'
id: none
name: none
type: .none
created_at: '2022-03-24T00:37:03.906Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: Field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: true
description: A case description.
duration: 'null'
external_service: 'null'
id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
owner: cases
settings:
syncAlerts: false
severity: low
status: open
tags:
- tag 1
title: Case title 1
totalAlerts: 0
totalComment: 1
updated_at: '2022-06-03T00:49:47.716Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzIzMzgsMV0=
Cases_create_case_request:
summary: Create a security case that uses a Jira connector.
value:
connector:
fields:
issueType: '10006'
parent: 'null'
priority: High
id: 131d4448-abe0-4789-939d-8ef60680b498
name: My connector
type: .jira
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My field value
description: A case description.
owner: cases
settings:
syncAlerts: true
tags:
- tag-1
title: Case title 1
Cases_create_case_response:
summary: The create case API returns a JSON object that contains details about the case.
value:
assignees: [ ]
closed_at: 'null'
closed_by: 'null'
comments: [ ]
connector:
fields:
issueType: '10006'
parent: 'null'
priority: High
id: 131d4448-abe0-4789-939d-8ef60680b498
name: My connector
type: .jira
created_at: '2022-10-13T15:33:50.604Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: 'null'
description: A case description.
duration: 'null'
external_service: 'null'
id: 66b9aa00-94fa-11ea-9f74-e7e108796192
owner: cases
settings:
syncAlerts: true
severity: low
status: open
tags:
- tag 1
title: Case title 1
totalAlerts: 0
totalComment: 0
updated_at: 'null'
updated_by: 'null'
version: WzUzMiwxXQ==
Cases_find_case_activity_response:
summary: Retrieves all activity for a case
value:
page: 1
perPage: 20
total: 3
userActions:
- action: create
comment_id: 'null'
created_at: '2023-10-20T01:17:22.150Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: b4cd0770-07c9-11ed-a5fd-47154cb8767e
owner: cases
payload:
assignees: [ ]
category: 'null'
connector:
fields: 'null'
id: none
name: none
type: .none
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: 'null'
description: A case description.
owner: cases
settings:
syncAlerts: false
severity: low
status: open
tags:
- tag 1
title: Case title 1
type: create_case
version: WzM1ODg4LDFd
- action: create
comment_id: 578608d0-03b1-11ed-920c-974bfa104448
created_at: '2023-10-14T20:12:53.354Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: 57af14a0-03b1-11ed-920c-974bfa104448
owner: cases
payload:
comment: A new comment
owner: cases
type: user
type: comment
version: WzM1ODg4LDFa
- action: add
comment_id: 'null'
created_at: '2023-10-20T01:10:28.238Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: 573c6980-6123-11ed-aa41-81a0a61fe447
owner: cases
payload:
assignees:
uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
type: assignees
version: WzM1ODg4LDFb
Cases_find_case_response:
summary: 'Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.'
value:
cases:
- assignees: [ ]
category: 'null'
closed_at: 'null'
closed_by: 'null'
comments: [ ]
connector:
fields: 'null'
id: none
name: none
type: .none
created_at: '2023-10-12T00:16:36.371Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: 'null'
description: Case description
duration: 'null'
external_service: 'null'
id: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
owner: cases
settings:
syncAlerts: true
severity: low
status: open
tags:
- tag-1
title: Case title
totalAlerts: 0
totalComment: 1
updated_at: '2023-10-12T00:27:58.162Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzExMCwxXQ==
count_closed_cases: 0
count_in_progress_cases: 0
count_open_cases: 1
page: 1
per_page: 5
total: 1
Cases_find_connector_response:
summary: Retrieve information about the connectors and their settings.
value:
- actionTypeId: .jira
config:
apiUrl: https://elastic.atlassian.net/
projectKey: ES
id: 61787f53-4eee-4741-8df6-8fe84fa616f7
isDeprecated: false
isMissingSecrets: false
isPreconfigured: false
name: my-Jira
referencedByCount: 0
Cases_get_case_alerts_response:
summary: Retrieves all alerts attached to a case
value:
- attached_at: '2022-07-25T20:09:40.963Z'
id: f6a7d0c3-d52d-432c-b2e6-447cd7fce04d
index: .alerts-observability.logs.alerts-default
Cases_get_case_configuration_response:
summary: Get the case configuration.
value:
- closure_type: close-by-user
connector:
fields: 'null'
id: none
name: none
type: .none
created_at: '2024-07-01T17:07:17.767Z'
created_by:
email: 'null'
full_name: 'null'
username: elastic
customFields:
- defaultValue: Custom text field value.
key: d312efda-ec2b-42ec-9e2c-84981795c581
label: my-text-field
type: text
required: false
error: 'null'
id: 856ee650-6c82-11ee-a20a-6164169afa58
mappings: [ ]
owner: cases
templates:
- caseFields:
assignees:
- uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
category: Default-category
connector:
fields: 'null'
id: none
name: none
type: .none
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: Default text field value.
description: A default description for cases.
settings:
syncAlerts: false
tags:
- Default case tag
title: Default case title
description: A description of the template.
key: 505932fe-ee3a-4960-a661-c781b5acdb05
name: template-1
tags:
- Template tag 1
updated_at: 'null'
updated_by: 'null'
version: WzEyLDNd
Cases_get_case_observability_response:
summary: Retrieves information about an Observability case including its alerts and comments.
value:
assignees:
- uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
category: 'null'
closed_at: 'null'
closed_by: 'null'
comments:
- alertId:
- a6e12ac4-7bce-457b-84f6-d7ce8deb8446
created_at: '2023-11-06T19:29:38.424Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: 59d438d0-79a9-4864-8d4b-e63adacebf6e
index:
- .internal.alerts-observability.logs.alerts-default-000001
owner: observability
pushed_at: 'null'
pushed_by: 'null'
rule:
id: 03e4eb87-62ca-4e5d-9570-3d7625e9669d
name: Observability rule
type: alert
updated_at: 'null'
updated_by: 'null'
version: WzY3LDJd
- comment: The first comment.
created_at: '2023-11-06T19:29:57.812Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: d99342d3-3aa3-4b80-90ec-a702607604f5
owner: observability
pushed_at: 'null'
pushed_by: 'null'
type: user
updated_at: 'null'
updated_by: 'null'
version: WzcyLDJd
connector:
fields: 'null'
id: none
name: none
type: .none
created_at: '2023-11-06T19:29:04.086Z'
created_by:
email: 'null'
full_name: 'null'
username: elastic
customFields: [ ]
description: An Observability case description.
duration: 'null'
external_service: 'null'
id: c3ff7550-def1-4e90-b6bc-c9969a4a09b1
owner: observability
settings:
syncAlerts: false
severity: low
status: in-progress
tags:
- observability
- tag 1
title: Observability case title 1
totalAlerts: 1
totalComment: 1
updated_at: '2023-11-06T19:47:55.662Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzI0NywyXQ==
Cases_get_case_response:
summary: Retrieves information about a case including its comments.
value:
assignees:
- uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
category: 'null'
closed_at: 'null'
closed_by: 'null'
comments:
- comment: A new comment
created_at: '2023-10-13T15:40:32.335Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: 2134c1d0-02c2-11ed-85f2-4f7c222ca2fa
owner: cases
pushed_at: 'null'
pushed_by: 'null'
type: user
updated_at: 'null'
updated_by: 'null'
version: WzM3LDFd
connector:
fields: 'null'
id: none
name: none
type: .none
created_at: '2023-10-13T15:33:50.604Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: 'null'
description: A case description
duration: 'null'
external_service: 'null'
id: 31cdada0-02c1-11ed-85f2-4f7c222ca2fa
owner: cases
settings:
syncAlerts: true
severity: low
status: open
tags:
- tag 1
title: Case title 1
totalAlerts: 0
totalComment: 1
updated_at: '2023-10-13T15:40:32.335Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzM2LDFd
Cases_get_comment_response:
summary: A single user comment retrieved from a case
value:
comment: A new comment
created_at: '2023-10-07T19:32:13.104Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
owner: cases
pushed_at: 'null'
pushed_by: 'null'
type: user
updated_at: 'null'
updated_by: 'null'
version: WzIzLDFd
Cases_get_reporters_response:
summary: A list of two users that opened cases
value:
- email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
- email: jdoe@example.com
full_name: Jane Doe
profile_uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
username: jdoe
Cases_get_tags_response:
summary: A list of tags that are used in cases
value:
- observability
- security
- tag 1
- tag 2
Cases_push_case_response:
summary: The push case API returns a JSON object with details about the case and the external service.
value:
closed_at: 'null'
closed_by: 'null'
comments: [ ]
connector:
fields:
issueType: '10006'
parent: 'null'
priority: Low
id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
name: My connector
type: .jira
created_at: '2022-07-29T00:59:39.444Z'
created_by:
email: 'null'
full_name: 'null'
username: elastic
description: A case description.
duration: 'null'
external_service:
connector_id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
connector_name: My connector
external_id: '71926'
external_title: ES-554
external_url: https://cases.jira.com
pushed_at: '2022-07-29T01:20:58.436Z'
pushed_by:
email: 'null'
full_name: 'null'
username: elastic
id: b917f300-0ed9-11ed-bd18-65557fe66949
owner: cases
settings:
syncAlerts: true
severity: low
status: open
tags:
- tag 1
title: Case title 1
totalAlerts: 0
totalComment: 0
updated_at: '2022-07-29T01:20:58.436Z'
updated_by:
email: 'null'
full_name: 'null'
username: elastic
version: WzE3NjgsM10=
Cases_set_case_configuration_request:
summary: 'Set the closure type, custom fields, and default connector for Stack Management cases.'
value:
closure_type: close-by-user
connector:
fields: 'null'
id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
name: my-jira-connector
type: .jira
customFields:
- defaultValue: My custom field default value.
key: d312efda-ec2b-42ec-9e2c-84981795c581
label: my-text-field
type: text
required: false
owner: cases
templates:
- caseFields:
assignees:
- uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
category: Default-category
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: A text field value for the template.
description: A default description for cases.
tags:
- Default case tag
title: Default case title
description: A description of the template.
key: 505932fe-ee3a-4960-a661-c781b5acdb05
name: template-1
tags:
- Template tag 1
Cases_set_case_configuration_response:
summary: This is an example response for case settings.
value:
closure_type: close-by-user
connector:
fields: 'null'
id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
name: my-jira-connector
type: .jira
created_at: '2024-07-01T17:07:17.767Z'
created_by:
email: 'null,'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- defaultValue: My custom field default value.
key: d312efda-ec2b-42ec-9e2c-84981795c581
label: my-text-field
type: text
required: false
error: 'null'
id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
mappings:
- action_type: overwrite
source: title
target: summary
- action_type: overwrite
source: description
target: description
- action_type: append
source: comments
target: comments
- action_type: overwrite
source: tags
target: labels
owner: cases
templates:
- caseFields:
assignees:
- uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
category: Default-category
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: A text field value for the template.
description: A default description for cases.
tags:
- Default case tag
title: Default case title
description: A description of the template.
key: 505932fe-ee3a-4960-a661-c781b5acdb05
name: template-1
tags:
- Template tag 1
updated_at: 'null'
updated_by: 'null'
version: WzIwNzMsMV0=
Cases_update_case_configuration_request:
summary: Update the case settings.
value:
closure_type: close-by-user
connector:
fields: 'null'
id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
name: my-jira-connector
type: .jira
customFields:
- defaultValue: A new default value.
key: d312efda-ec2b-42ec-9e2c-84981795c581
label: my-text-field
type: text
required: true
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
label: my-toggle
type: toggle
required: false
version: WzExOSw0XQ==
Cases_update_case_configuration_response:
summary: This is an example response when the case configuration was updated.
value:
closure_type: close-by-user
connector:
fields: 'null'
id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
name: my-jira-connector
type: .jira
created_at: '2024-07-01T17:07:17.767Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- defaultValue: A new default value.
key: d312efda-ec2b-42ec-9e2c-84981795c581
label: my-text-field
type: text
required: true
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
label: my-toggle
type: toggle
required: false
error: 'null'
id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
mappings:
- action_type: overwrite
source: title
target: summary
- action_type: overwrite
source: description
target: description
- action_type: overwrite
source: tags
target: labels
- action_type: append
source: comments
target: comments
owner: cases
templates: [ ]
updated_at: '2024-07-19T00:52:42.401Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzI2LDNd
Cases_update_case_request:
summary: 'Update the case description, tags, and connector.'
value:
cases:
- connector:
fields:
issueType: '10006'
parent: 'null'
priority: 'null'
id: 131d4448-abe0-4789-939d-8ef60680b498
name: My connector
type: .jira
customFields:
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: false
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My new field value
description: A case description.
id: a18b38a0-71b0-11ea-a0b2-c51ea50a58e2
settings:
syncAlerts: true
tags:
- tag-1
version: WzIzLDFd
Cases_update_case_response:
summary: 'This is an example response when the case description, tags, and connector were updated.'
value:
- assignees: [ ]
category: 'null'
closed_at: 'null'
closed_by: 'null'
comments: [ ]
connector:
fields:
issueType: '10006'
parent: 'null'
priority: 'null'
id: 131d4448-abe0-4789-939d-8ef60680b498
name: My connector
type: .jira
created_at: '2023-10-13T09:16:17.416Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My new field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: false
description: A case description.
duration: 'null'
external_service:
connector_id: 05da469f-1fde-4058-99a3-91e4807e2de8
connector_name: Jira
external_id: '10003'
external_title: IS-4
external_url: https://hms.atlassian.net/browse/IS-4
pushed_at: '2023-10-13T09:20:40.672Z'
pushed_by:
email: 'null'
full_name: 'null'
username: elastic
id: 66b9aa00-94fa-11ea-9f74-e7e108796192
owner: cases
settings:
syncAlerts: true
severity: low
status: open
tags:
- tag-1
title: Case title 1
totalAlerts: 0
totalComment: 0
updated_at: '2023-10-13T09:48:33.043Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzU0OCwxXQ==
Cases_update_comment_request:
summary: Updates a comment of a case.
value:
comment: An updated comment.
id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
owner: cases
type: user
version: Wzk1LDFd
Cases_update_comment_response:
summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
value:
assignees: [ ]
category: 'null'
closed_at: 'null'
closed_by: 'null'
comments:
- comment: An updated comment.
created_at: '2023-10-24T00:37:10.832Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
owner: cases
pushed_at: 'null'
pushed_by: 'null'
type: user
updated_at: '2023-10-24T01:27:06.210Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzIwNjM3LDFd
connector:
fields: 'null'
id: none
name: none
type: .none
created_at: '2023-10-24T00:37:03.906Z'
created_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
customFields:
- key: d312efda-ec2b-42ec-9e2c-84981795c581
type: text
value: My new field value
- key: fcc6840d-eb14-42df-8aaf-232201a705ec
type: toggle
value: false
description: A case description.
duration: 'null'
external_service: 'null'
id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
owner: cases
settings:
syncAlerts: false
severity: low
status: open
tags:
- tag 1
title: Case title 1
totalAlerts: 0
totalComment: 1
updated_at: '2023-10-24T01:27:06.210Z'
updated_by:
email: 'null'
full_name: 'null'
profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
username: elastic
version: WzIwNjM2LDFd
Data_views_create_data_view_request:
summary: Create a data view with runtime fields.
value:
data_view:
name: My Logstash data view
runtimeFieldMap:
runtime_shape_name:
script:
source: 'emit(doc[''shape_name''].value)'
type: keyword
title: logstash-*
Data_views_create_runtime_field_request:
summary: Create a runtime field.
value:
name: runtimeFoo
runtimeField:
script:
source: 'emit(doc["foo"].value)'
type: long
Data_views_get_data_view_response:
summary: The get data view API returns a JSON object that contains information about the data view.
value:
data_view:
allowNoIndex: false
fieldAttrs:
products.manufacturer:
count: 1
products.price:
count: 1
products.product_name:
count: 1
total_quantity:
count: 1
fieldFormats:
products.base_price:
id: number
params:
pattern: '$0,0.00'
products.base_unit_price:
id: number
params:
pattern: '$0,0.00'
products.min_price:
id: number
params:
pattern: '$0,0.00'
products.price:
id: number
params:
pattern: '$0,0.00'
products.taxful_price:
id: number
params:
pattern: '$0,0.00'
products.taxless_price:
id: number
params:
pattern: '$0,0.00'
taxful_total_price:
id: number
params:
pattern: '$0,0.[00]'
taxless_total_price:
id: number
params:
pattern: '$0,0.00'
fields:
_id:
aggregatable: false
count: 0
esTypes:
- _id
format:
id: string
isMapped: true
name: _id
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
_index:
aggregatable: true
count: 0
esTypes:
- _index
format:
id: string
isMapped: true
name: _index
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
_score:
aggregatable: false
count: 0
format:
id: number
isMapped: true
name: _score
readFromDocValues: false
scripted: false
searchable: false
shortDotsEnable: false
type: number
_source:
aggregatable: false
count: 0
esTypes:
- _source
format:
id: _source
isMapped: true
name: _source
readFromDocValues: false
scripted: false
searchable: false
shortDotsEnable: false
type: _source
category:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: category
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
category.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: category.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: category
type: string
currency:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: currency
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
customer_birth_date:
aggregatable: true
count: 0
esTypes:
- date
format:
id: date
isMapped: true
name: customer_birth_date
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: date
customer_first_name:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: customer_first_name
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
customer_first_name.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: customer_first_name.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: customer_first_name
type: string
customer_full_name:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: customer_full_name
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
customer_full_name.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: customer_full_name.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: customer_full_name
type: string
customer_gender:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: customer_gender
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
customer_id:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: customer_id
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
customer_last_name:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: customer_last_name
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
customer_last_name.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: customer_last_name.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: customer_last_name
type: string
customer_phone:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: customer_phone
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
day_of_week:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: day_of_week
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
day_of_week_i:
aggregatable: true
count: 0
esTypes:
- integer
format:
id: number
isMapped: true
name: day_of_week_i
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
email:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: email
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
event.dataset:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: event.dataset
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
geoip.city_name:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: geoip.city_name
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
geoip.continent_name:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: geoip.continent_name
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
geoip.country_iso_code:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: geoip.country_iso_code
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
geoip.location:
aggregatable: true
count: 0
esTypes:
- geo_point
format:
id: geo_point
params:
transform: wkt
isMapped: true
name: geoip.location
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: geo_point
geoip.region_name:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: geoip.region_name
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
manufacturer:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: manufacturer
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
manufacturer.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: manufacturer.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: manufacturer
type: string
order_date:
aggregatable: true
count: 0
esTypes:
- date
format:
id: date
isMapped: true
name: order_date
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: date
order_id:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: order_id
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
products._id:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: products._id
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
products._id.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: products._id.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: products._id
type: string
products.base_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: products.base_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.base_unit_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: products.base_unit_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.category:
aggregatable: false
count: 0
esTypes:
- text
format:
id: string
isMapped: true
name: products.category
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
products.category.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: products.category.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: products.category
type: string
products.created_on:
aggregatable: true
count: 0
esTypes:
- date
format:
id: date
isMapped: true
name: products.created_on
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: date
products.discount_amount:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
isMapped: true
name: products.discount_amount
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.discount_percentage:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
isMapped: true
name: products.discount_percentage
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.manufacturer:
aggregatable: false
count: 1
esTypes:
- text
format:
id: string
isMapped: true
name: products.manufacturer
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
products.manufacturer.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: products.manufacturer.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: products.manufacturer
type: string
products.min_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: products.min_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.price:
aggregatable: true
count: 1
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: products.price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.product_id:
aggregatable: true
count: 0
esTypes:
- long
format:
id: number
isMapped: true
name: products.product_id
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.product_name:
aggregatable: false
count: 1
esTypes:
- text
format:
id: string
isMapped: true
name: products.product_name
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
products.product_name.keyword:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: products.product_name.keyword
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
subType:
multi:
parent: products.product_name
type: string
products.quantity:
aggregatable: true
count: 0
esTypes:
- integer
format:
id: number
isMapped: true
name: products.quantity
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.sku:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: products.sku
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
products.tax_amount:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
isMapped: true
name: products.tax_amount
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.taxful_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: products.taxful_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.taxless_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: products.taxless_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
products.unit_discount_amount:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
isMapped: true
name: products.unit_discount_amount
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
sku:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: sku
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
taxful_total_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.[00]'
isMapped: true
name: taxful_total_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
taxless_total_price:
aggregatable: true
count: 0
esTypes:
- half_float
format:
id: number
params:
pattern: '$0,0.00'
isMapped: true
name: taxless_total_price
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
total_quantity:
aggregatable: true
count: 1
esTypes:
- integer
format:
id: number
isMapped: true
name: total_quantity
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
total_unique_products:
aggregatable: true
count: 0
esTypes:
- integer
format:
id: number
isMapped: true
name: total_unique_products
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
type:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: type
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
user:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: user
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
name: Kibana Sample Data eCommerce
namespaces:
- default
runtimeFieldMap: { }
sourceFilters: [ ]
timeFieldName: order_date
title: kibana_sample_data_ecommerce
typeMeta: { }
version: WzUsMV0=
Data_views_get_data_views_response:
summary: The get all data views API returns a list of data views.
value:
data_view:
- id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
name: Kibana Sample Data eCommerce
namespaces:
- default
title: kibana_sample_data_ecommerce
typeMeta: { }
- id: d3d7af60-4c81-11e8-b3d7-01146121b73d
name: Kibana Sample Data Flights
namespaces:
- default
title: kibana_sample_data_flights
- id: 90943e30-9a47-11e8-b64d-95841ca0b247
name: Kibana Sample Data Logs
namespaces:
- default
title: kibana_sample_data_logs
Data_views_get_default_data_view_response:
summary: The get default data view API returns the default data view identifier.
value:
data_view_id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
Data_views_get_runtime_field_response:
summary: The get runtime field API returns a JSON object that contains information about the runtime field (`hour_of_day`) and the data view (`d3d7af60-4c81-11e8-b3d7-01146121b73d`).
value:
data_view:
allowNoIndex: false
fieldAttrs: { }
fieldFormats:
AvgTicketPrice:
id: number
params:
pattern: '$0,0.[00]'
hour_of_day:
id: number
params:
pattern: '00'
fields:
_id:
aggregatable: false
count: 0
esTypes:
- _id
format:
id: string
isMapped: true
name: _id
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
_index:
aggregatable: true
count: 0
esTypes:
- _index
format:
id: string
isMapped: true
name: _index
readFromDocValues: false
scripted: false
searchable: true
shortDotsEnable: false
type: string
_score:
aggregatable: false
count: 0
format:
id: number
isMapped: true
name: _score
readFromDocValues: false
scripted: false
searchable: false
shortDotsEnable: false
type: number
_source:
aggregatable: false
count: 0
esTypes:
- _source
format:
id: _source
isMapped: true
name: _source
readFromDocValues: false
scripted: false
searchable: false
shortDotsEnable: false
type: _source
AvgTicketPrice:
aggregatable: true
count: 0
esTypes:
- float
format:
id: number
params:
pattern: '$0,0.[00]'
isMapped: true
name: AvgTicketPrice
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
Cancelled:
aggregatable: true
count: 0
esTypes:
- boolean
format:
id: boolean
isMapped: true
name: Cancelled
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: boolean
Carrier:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: Carrier
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
dayOfWeek:
aggregatable: true
count: 0
esTypes:
- integer
format:
id: number
isMapped: true
name: dayOfWeek
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
Dest:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: Dest
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
DestAirportID:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: DestAirportID
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
DestCityName:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: DestCityName
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
DestCountry:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: DestCountry
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
DestLocation:
aggregatable: true
count: 0
esTypes:
- geo_point
format:
id: geo_point
params:
transform: wkt
isMapped: true
name: DestLocation
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: geo_point
DestRegion:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: DestRegion
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
DestWeather:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: DestWeather
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
DistanceKilometers:
aggregatable: true
count: 0
esTypes:
- float
format:
id: number
isMapped: true
name: DistanceKilometers
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
DistanceMiles:
aggregatable: true
count: 0
esTypes:
- float
format:
id: number
isMapped: true
name: DistanceMiles
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
FlightDelay:
aggregatable: true
count: 0
esTypes:
- boolean
format:
id: boolean
isMapped: true
name: FlightDelay
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: boolean
FlightDelayMin:
aggregatable: true
count: 0
esTypes:
- integer
format:
id: number
isMapped: true
name: FlightDelayMin
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
FlightDelayType:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: FlightDelayType
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
FlightNum:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: FlightNum
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
FlightTimeHour:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: FlightTimeHour
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
FlightTimeMin:
aggregatable: true
count: 0
esTypes:
- float
format:
id: number
isMapped: true
name: FlightTimeMin
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: number
hour_of_day:
aggregatable: true
count: 0
esTypes:
- long
format:
id: number
params:
pattern: '00'
name: hour_of_day
readFromDocValues: false
runtimeField:
script:
source: 'emit(doc[''timestamp''].value.getHour());'
type: long
scripted: false
searchable: true
shortDotsEnable: false
type: number
Origin:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: Origin
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
OriginAirportID:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: OriginAirportID
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
OriginCityName:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: OriginCityName
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
OriginCountry:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: OriginCountry
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
OriginLocation:
aggregatable: true
count: 0
esTypes:
- geo_point
format:
id: geo_point
params:
transform: wkt
isMapped: true
name: OriginLocation
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: geo_point
OriginRegion:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: OriginRegion
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
OriginWeather:
aggregatable: true
count: 0
esTypes:
- keyword
format:
id: string
isMapped: true
name: OriginWeather
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: string
timestamp:
aggregatable: true
count: 0
esTypes:
- date
format:
id: date
isMapped: true
name: timestamp
readFromDocValues: true
scripted: false
searchable: true
shortDotsEnable: false
type: date
id: d3d7af60-4c81-11e8-b3d7-01146121b73d
name: Kibana Sample Data Flights
runtimeFieldMap:
hour_of_day:
script:
source: 'emit(doc[''timestamp''].value.getHour());'
type: long
sourceFilters: [ ]
timeFieldName: timestamp
title: kibana_sample_data_flights
version: WzM2LDJd
fields:
- aggregatable: true
count: 0
esTypes:
- long
name: hour_of_day
readFromDocValues: false
runtimeField:
script:
source: 'emit(doc[''timestamp''].value.getHour());'
type: long
scripted: false
searchable: true
shortDotsEnable: false
type: number
Data_views_preview_swap_data_view_request:
summary: Preview swapping references from data view ID "abcd-efg" to "xyz-123".
value:
fromId: abcd-efg
toId: xyz-123
Data_views_set_default_data_view_request:
summary: Set the default data view identifier.
value:
data_view_id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
force: true
Data_views_swap_data_view_request:
summary: Swap references from data view ID "abcd-efg" to "xyz-123" and remove the data view that is no longer referenced.
value:
delete: true
fromId: abcd-efg
toId: xyz-123
Data_views_update_data_view_request:
summary: Update some properties for a data view.
value:
data_view:
allowNoIndex: false
name: Kibana Sample Data eCommerce
timeFieldName: order_date
title: kibana_sample_data_ecommerce
refresh_fields: true
Data_views_update_field_metadata_request:
summary: Update metadata for multiple fields.
value:
fields:
field1:
count: 123
customLabel: Field 1 label
field2:
customDescription: Field 2 description
customLabel: Field 2 label
Data_views_update_runtime_field_request:
summary: Update an existing runtime field on a data view.
value:
runtimeField:
script:
source: 'emit(doc["bar"].value)'
Machine_learning_APIs_mlSyncExample:
summary: Two anomaly detection jobs required synchronization in this example.
value:
datafeedsAdded: { }
datafeedsRemoved: { }
savedObjectsCreated:
anomaly-detector:
myjob1:
success: true
myjob2:
success: true
savedObjectsDeleted: { }
Saved_objects_export_objects_request:
summary: Export a specific saved object.
value:
excludeExportDetails: true
includeReferencesDeep: false
objects:
- id: de71f4f0-1902-11e9-919b-ffe5949a18d2
type: map
Saved_objects_export_objects_response:
summary: The export objects API response contains a JSON record for each exported object.
value:
attributes:
description: ''
layerListJSON: '[{"id":"0hmz5","alpha":1,"sourceDescriptor":{"type":"EMS_TMS","isAutoSelect":true,"lightModeDefault":"road_map_desaturated"},"visible":true,"style":{},"type":"EMS_VECTOR_TILE","minZoom":0,"maxZoom":24},{"id":"edh66","label":"Total Requests by Destination","minZoom":0,"maxZoom":24,"alpha":0.5,"sourceDescriptor":{"type":"EMS_FILE","id":"world_countries","tooltipProperties":["name","iso2"]},"visible":true,"style":{"type":"VECTOR","properties":{"fillColor":{"type":"DYNAMIC","options":{"field":{"name":"__kbnjoin__count__673ff994-fc75-4c67-909b-69fcb0e1060e","origin":"join"},"color":"Greys","fieldMetaOptions":{"isEnabled":false,"sigma":3}}},"lineColor":{"type":"STATIC","options":{"color":"#FFFFFF"}},"lineWidth":{"type":"STATIC","options":{"size":1}},"iconSize":{"type":"STATIC","options":{"size":10}},"symbolizeAs":{"options":{"value":"circle"}},"icon":{"type":"STATIC","options":{"value":"marker"}}}},"type":"GEOJSON_VECTOR","joins":[{"leftField":"iso2","right":{"type":"ES_TERM_SOURCE","id":"673ff994-fc75-4c67-909b-69fcb0e1060e","indexPatternTitle":"kibana_sample_data_logs","term":"geo.dest","indexPatternRefName":"layer_1_join_0_index_pattern","metrics":[{"type":"count","label":"web logs count"}],"applyGlobalQuery":true}}]},{"id":"gaxya","label":"Actual Requests","minZoom":9,"maxZoom":24,"alpha":1,"sourceDescriptor":{"id":"b7486535-171b-4d3b-bb2e-33c1a0a2854c","type":"ES_SEARCH","geoField":"geo.coordinates","limit":2048,"filterByMapBounds":true,"tooltipProperties":["clientip","timestamp","host","request","response","machine.os","agent","bytes"],"indexPatternRefName":"layer_2_source_index_pattern","applyGlobalQuery":true,"scalingType":"LIMIT"},"visible":true,"style":{"type":"VECTOR","properties":{"fillColor":{"type":"STATIC","options":{"color":"#2200ff"}},"lineColor":{"type":"STATIC","options":{"color":"#FFFFFF"}},"lineWidth":{"type":"STATIC","options":{"size":2}},"iconSize":{"type":"DYNAMIC","options":{"field":{"name":"bytes","origin":"source"},"minSize":1,"maxSize":23,"fieldMetaOptions":{"isEnabled":false,"sigma":3}}},"symbolizeAs":{"options":{"value":"circle"}},"icon":{"type":"STATIC","options":{"value":"marker"}}}},"type":"GEOJSON_VECTOR"},{"id":"tfi3f","label":"Total Requests and Bytes","minZoom":0,"maxZoom":9,"alpha":1,"sourceDescriptor":{"type":"ES_GEO_GRID","resolution":"COARSE","id":"8aaa65b5-a4e9-448b-9560-c98cb1c5ac5b","geoField":"geo.coordinates","requestType":"point","metrics":[{"type":"count","label":"web logs count"},{"type":"sum","field":"bytes"}],"indexPatternRefName":"layer_3_source_index_pattern","applyGlobalQuery":true},"visible":true,"style":{"type":"VECTOR","properties":{"fillColor":{"type":"DYNAMIC","options":{"field":{"name":"doc_count","origin":"source"},"color":"Blues","fieldMetaOptions":{"isEnabled":false,"sigma":3}}},"lineColor":{"type":"STATIC","options":{"color":"#cccccc"}},"lineWidth":{"type":"STATIC","options":{"size":1}},"iconSize":{"type":"DYNAMIC","options":{"field":{"name":"sum_of_bytes","origin":"source"},"minSize":7,"maxSize":25,"fieldMetaOptions":{"isEnabled":false,"sigma":3}}},"labelText":{"type":"DYNAMIC","options":{"field":{"name":"doc_count","origin":"source"},"fieldMetaOptions":{"isEnabled":false,"sigma":3}}},"labelSize":{"type":"DYNAMIC","options":{"field":{"name":"doc_count","origin":"source"},"minSize":12,"maxSize":24,"fieldMetaOptions":{"isEnabled":false,"sigma":3}}},"symbolizeAs":{"options":{"value":"circle"}},"icon":{"type":"STATIC","options":{"value":"marker"}}}},"type":"GEOJSON_VECTOR"}]'
mapStateJSON: '{"zoom":3.64,"center":{"lon":-88.92107,"lat":42.16337},"timeFilters":{"from":"now-7d","to":"now"},"refreshConfig":{"isPaused":true,"interval":0},"query":{"language":"kuery","query":""},"settings":{"autoFitToDataBounds":false}}'
title: '[Logs] Total Requests and Bytes'
uiStateJSON: '{"isDarkMode":false}'
coreMigrationVersion: '8.8.0'
created_at: '2023-08-23T20:03:32.204Z'
id: de71f4f0-1902-11e9-919b-ffe5949a18d2
managed: false
references:
- id: 90943e30-9a47-11e8-b64d-95841ca0b247
name: layer_1_join_0_index_pattern
type: index-pattern
- id: 90943e30-9a47-11e8-b64d-95841ca0b247
name: layer_2_source_index_pattern
type: index-pattern
- id: 90943e30-9a47-11e8-b64d-95841ca0b247
name: layer_3_source_index_pattern
type: index-pattern
type: map
typeMigrationVersion: '8.4.0'
updated_at: '2023-08-23T20:03:32.204Z'
version: WzEzLDFd
Saved_objects_import_objects_request:
value:
file: file.ndjson
Saved_objects_import_objects_response:
summary: 'The import objects API response indicates a successful import and the objects are created. Since these objects are created as new copies, each entry in the successResults array includes a destinationId attribute.'
value:
success: true
successCount: 1
successResults:
- destinationId: 82d2760c-468f-49cf-83aa-b9a35b6a8943
id: 90943e30-9a47-11e8-b64d-95841ca0b247
managed: false
meta:
icon: indexPatternApp
title: Kibana Sample Data Logs
type: index-pattern
Saved_objects_key_rotation_response:
summary: Encryption key rotation using default parameters.
value:
failed: 0
successful: 300
total: 1000
Saved_objects_resolve_missing_reference_request:
value:
file: file.ndjson
retries:
- id: my-pattern
overwrite: true
type: index-pattern
- destinationId: another-vis
id: my-vis
overwrite: true
type: visualization
- destinationId: yet-another-canvas
id: my-canvas
overwrite: true
type: canvas
- id: my-dashboard
type: dashboard
Saved_objects_resolve_missing_reference_response:
summary: Resolve missing reference errors.
value:
success: true
successCount: 3
successResults:
- id: my-vis
meta:
icon: visualizeApp
title: Look at my visualization
type: visualization
- id: my-search
meta:
icon: searchApp
title: Look at my search
type: search
- id: my-dashboard
meta:
icon: dashboardApp
title: Look at my dashboard
type: dashboard
Task_manager_health_APIs_health_200response:
description: A successful response from `GET api/task_manager/_health`.
value: "{\n \"id\": \"330bbc6a-56cd-44d5-88e3-e3229f14d619\",\n \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n \"status\": \"OK\",\n \"last_update\": \"2025-03-21T21:30:04.455Z\",\n \"stats\": {\n \"configuration\": {\n \"timestamp\": \"2025-03-21T21:26:10.002Z\",\n \"value\": {\n \"request_capacity\": 1000,\n \"monitored_aggregated_stats_refresh_rate\": 60000,\n \"monitored_stats_running_average_window\": 50,\n \"monitored_task_execution_thresholds\": {\n \"custom\": {},\n \"default\": {\n \"error_threshold\": 90,\n \"warn_threshold\": 80\n }\n },\n \"claim_strategy\": \"mget\",\n \"poll_interval\": 500,\n \"capacity\": {\n \"config\": 10,\n \"as_workers\": 10,\n \"as_cost\": 20\n }\n },\n \"status\": \"OK\"\n },\n \"runtime\": {\n \"timestamp\": \"2025-03-21T21:30:04.455Z\",\n \"value\": {\n \"polling\": {\n \"last_successful_poll\": \"2025-03-21T21:30:04.455Z\",\n \"last_polling_delay\": \"2025-03-21T21:26:10.001Z\",\n \"claim_duration\": {\n \"p50\": 17,\n \"p90\": 22,\n \"p95\": 25,\n \"p99\": 27\n },\n \"duration\": {\n \"p50\": 19,\n \"p90\": 25.5,\n \"p95\": 28,\n \"p99\": 28\n },\n \"claim_conflicts\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"claim_mismatches\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"claim_stale_tasks\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"result_frequency_percent_as_number\": {\n \"Failed\": 0,\n \"NoAvailableWorkers\": 0,\n \"NoTasksClaimed\": 100,\n \"RanOutOfCapacity\": 0,\n \"RunningAtCapacity\": 0,\n \"PoolFilled\": 0\n },\n \"persistence\": {\n \"recurring\": 88,\n \"non_recurring\": 12\n }\n },\n \"drift\": {\n \"p50\": 2089,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"drift_by_type\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"p50\": 2082,\n \"p90\": 2082,\n \"p95\": 2082,\n \"p99\": 2082\n },\n \"fleet:check-deleted-files-task\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"osquery:telemetry-saved-queries\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"p50\": 2089,\n \"p90\": 2089,\n \"p95\": 2089,\n \"p99\": 2089\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"p50\": 336.5,\n \"p90\": 2089,\n \"p95\": 2089,\n \"p99\": 2089\n },\n \"alerts_invalidate_api_keys\": {\n \"p50\": 2086,\n \"p90\": 2086,\n \"p95\": 2086,\n \"p99\": 2086\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"alerting_health_check\": {\n \"p50\": 2086,\n \"p90\": 2086,\n \"p95\": 2086,\n \"p99\": 2086\n },\n \"Fleet-Usage-Sender\": {\n \"p50\": 2079,\n \"p90\": 2079,\n \"p95\": 2079,\n \"p99\": 2079\n },\n \"security:endpoint-diagnostics\": {\n \"p50\": 2525,\n \"p90\": 2525,\n \"p95\": 2525,\n \"p99\": 2525\n },\n \"security:telemetry-lists\": {\n \"p50\": 2525,\n \"p90\": 2525,\n \"p95\": 2525,\n \"p99\": 2525\n },\n \"security:telemetry-timelines\": {\n \"p50\": 2526,\n \"p90\": 2526,\n \"p95\": 2526,\n \"p99\": 2526\n },\n \"cases-telemetry-task\": {\n \"p50\": 2083,\n \"p90\": 2083,\n \"p95\": 2083,\n \"p99\": 2083\n },\n \"osquery:telemetry-packs\": {\n \"p50\": 2530,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"Fleet-Metrics-Task\": {\n \"p50\": 133.5,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"p50\": 2530,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"osquery:telemetry-configs\": {\n \"p50\": 2529,\n \"p90\": 2529,\n \"p95\": 2529,\n \"p99\": 2529\n },\n \"endpoint:complete-external-response-actions\": {\n \"p50\": 519,\n \"p90\": 2526,\n \"p95\": 2526,\n \"p99\": 2526\n },\n \"security:telemetry-detection-rules\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:endpoint-meta-telemetry\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-filterlist-artifact\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-configuration\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:indices-metadata-telemetry\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"Fleet-Usage-Logger\": {\n \"p50\": 2190,\n \"p90\": 2190,\n \"p95\": 2190,\n \"p99\": 2190\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"p50\": 2189,\n \"p90\": 2189,\n \"p95\": 2189,\n \"p99\": 2189\n },\n \"dashboard_telemetry\": {\n \"p50\": 2452,\n \"p90\": 2452,\n \"p95\": 2452,\n \"p99\": 2452\n },\n \"session_cleanup\": {\n \"p50\": 2569,\n \"p90\": 2569,\n \"p95\": 2569,\n \"p99\": 2569\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"p50\": 2452,\n \"p90\": 2452,\n \"p95\": 2452,\n \"p99\": 2452\n },\n \"apm-telemetry-task\": {\n \"p50\": 2591,\n \"p90\": 2591,\n \"p95\": 2591,\n \"p99\": 2591\n },\n \"ML:saved-objects-sync\": {\n \"p50\": 2475,\n \"p90\": 2475,\n \"p95\": 2475,\n \"p99\": 2475\n },\n \"apm-source-map-migration-task\": {\n \"p50\": 1603.5,\n \"p90\": 2987,\n \"p95\": 2987,\n \"p99\": 2987\n },\n \"actions_telemetry\": {\n \"p50\": 771,\n \"p90\": 771,\n \"p95\": 771,\n \"p99\": 771\n },\n \"alerting_telemetry\": {\n \"p50\": 768,\n \"p90\": 768,\n \"p95\": 768,\n \"p99\": 768\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"p50\": 834,\n \"p90\": 834,\n \"p95\": 834,\n \"p99\": 834\n },\n \"endpoint:user-artifact-packager\": {\n \"p50\": 529.5,\n \"p90\": 835,\n \"p95\": 835,\n \"p99\": 835\n },\n \"fleet:bump_agent_policies\": {\n \"p50\": 361,\n \"p90\": 361,\n \"p95\": 361,\n \"p99\": 361\n }\n },\n \"load\": {\n \"p50\": 10,\n \"p90\": 100,\n \"p95\": 100,\n \"p99\": 100\n },\n \"execution\": {\n \"duration\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"p50\": 24,\n \"p90\": 24,\n \"p95\": 24,\n \"p99\": 24\n },\n \"fleet:check-deleted-files-task\": {\n \"p50\": 24,\n \"p90\": 24,\n \"p95\": 24,\n \"p99\": 24\n },\n \"osquery:telemetry-saved-queries\": {\n \"p50\": 25,\n \"p90\": 25,\n \"p95\": 25,\n \"p99\": 25\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"p50\": 28,\n \"p90\": 28,\n \"p95\": 28,\n \"p99\": 28\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"p50\": 7.5,\n \"p90\": 29,\n \"p95\": 29,\n \"p99\": 29\n },\n \"alerts_invalidate_api_keys\": {\n \"p50\": 34,\n \"p90\": 34,\n \"p95\": 34,\n \"p99\": 34\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"p50\": 39,\n \"p90\": 39,\n \"p95\": 39,\n \"p99\": 39\n },\n \"alerting_health_check\": {\n \"p50\": 42,\n \"p90\": 42,\n \"p95\": 42,\n \"p99\": 42\n },\n \"Fleet-Usage-Sender\": {\n \"p50\": 78,\n \"p90\": 78,\n \"p95\": 78,\n \"p99\": 78\n },\n \"security:endpoint-diagnostics\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-lists\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-timelines\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"cases-telemetry-task\": {\n \"p50\": 458,\n \"p90\": 458,\n \"p95\": 458,\n \"p99\": 458\n },\n \"osquery:telemetry-packs\": {\n \"p50\": 10,\n \"p90\": 10,\n \"p95\": 10,\n \"p99\": 10\n },\n \"Fleet-Metrics-Task\": {\n \"p50\": 5,\n \"p90\": 10,\n \"p95\": 10,\n \"p99\": 10\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"p50\": 11,\n \"p90\": 11,\n \"p95\": 11,\n \"p99\": 11\n },\n \"osquery:telemetry-configs\": {\n \"p50\": 12,\n \"p90\": 12,\n \"p95\": 12,\n \"p99\": 12\n },\n \"endpoint:complete-external-response-actions\": {\n \"p50\": 7,\n \"p90\": 11,\n \"p95\": 11,\n \"p99\": 11\n },\n \"security:telemetry-detection-rules\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:endpoint-meta-telemetry\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-filterlist-artifact\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:telemetry-configuration\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:indices-metadata-telemetry\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"Fleet-Usage-Logger\": {\n \"p50\": 18,\n \"p90\": 18,\n \"p95\": 18,\n \"p99\": 18\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"p50\": 8,\n \"p90\": 8,\n \"p95\": 8,\n \"p99\": 8\n },\n \"dashboard_telemetry\": {\n \"p50\": 12,\n \"p90\": 12,\n \"p95\": 12,\n \"p99\": 12\n },\n \"session_cleanup\": {\n \"p50\": 58,\n \"p90\": 58,\n \"p95\": 58,\n \"p99\": 58\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"p50\": 147,\n \"p90\": 147,\n \"p95\": 147,\n \"p99\": 147\n },\n \"apm-telemetry-task\": {\n \"p50\": 543,\n \"p90\": 543,\n \"p95\": 543,\n \"p99\": 543\n },\n \"ML:saved-objects-sync\": {\n \"p50\": 544,\n \"p90\": 544,\n \"p95\": 544,\n \"p99\": 544\n },\n \"apm-source-map-migration-task\": {\n \"p50\": 1649,\n \"p90\": 3282,\n \"p95\": 3282,\n \"p99\": 3282\n },\n \"actions_telemetry\": {\n \"p50\": 19,\n \"p90\": 19,\n \"p95\": 19,\n \"p99\": 19\n },\n \"alerting_telemetry\": {\n \"p50\": 64,\n \"p90\": 64,\n \"p95\": 64,\n \"p99\": 64\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"endpoint:user-artifact-packager\": {\n \"p50\": 10,\n \"p90\": 13,\n \"p95\": 13,\n \"p99\": 13\n },\n \"fleet:bump_agent_policies\": {\n \"p50\": 9,\n \"p90\": 9,\n \"p95\": 9,\n \"p99\": 9\n }\n },\n \"duration_by_persistence\": {\n \"recurring\": {\n \"p50\": 9,\n \"p90\": 63.39999999999999,\n \"p95\": 474.99999999999966,\n \"p99\": 544\n },\n \"non_recurring\": {\n \"p50\": 14,\n \"p90\": 2968.500000000001,\n \"p95\": 3282,\n \"p99\": 3282\n }\n },\n \"persistence\": {\n \"recurring\": 88,\n \"non_recurring\": 12\n },\n \"result_frequency_percent_as_number\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:check-deleted-files-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-saved-queries\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerts_invalidate_api_keys\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerting_health_check\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Usage-Sender\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:endpoint-diagnostics\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-lists\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-timelines\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"cases-telemetry-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-packs\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Metrics-Task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-configs\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:complete-external-response-actions\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-detection-rules\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:endpoint-meta-telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-filterlist-artifact\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-configuration\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:indices-metadata-telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Usage-Logger\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"dashboard_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"session_cleanup\": {\n \"Success\": 0,\n \"RetryScheduled\": 100,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"apm-telemetry-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"ML:saved-objects-sync\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"apm-source-map-migration-task\": {\n \"Success\": 50,\n \"RetryScheduled\": 50,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"actions_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerting_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:user-artifact-packager\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:bump_agent_policies\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n }\n }\n }\n },\n \"status\": \"OK\"\n },\n \"workload\": {\n \"timestamp\": \"2025-03-21T21:29:10.367Z\",\n \"value\": {\n \"count\": 35,\n \"cost\": 70,\n \"task_types\": {\n \"Fleet-Metrics-Task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"Fleet-Usage-Logger\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"Fleet-Usage-Sender\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"ML:saved-objects-sync\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"actions_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerting_health_check\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerting_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerts_invalidate_api_keys\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"apm-telemetry-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"cases-telemetry-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"dashboard_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:complete-external-response-actions\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:user-artifact-packager\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:check-deleted-files-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-configs\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-packs\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-saved-queries\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:endpoint-diagnostics\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:endpoint-meta-telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:indices-metadata-telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-configuration\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-detection-rules\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-filterlist-artifact\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-lists\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-timelines\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"session_cleanup\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n }\n },\n \"non_recurring\": 1,\n \"non_recurring_cost\": 2,\n \"schedule\": [\n [\n \"1m\",\n 2\n ],\n [\n \"60s\",\n 2\n ],\n [\n \"5m\",\n 2\n ],\n [\n \"10m\",\n 1\n ],\n [\n \"15m\",\n 1\n ],\n [\n \"45m\",\n 1\n ],\n [\n \"1h\",\n 9\n ],\n [\n \"3600s\",\n 1\n ],\n [\n \"60m\",\n 1\n ],\n [\n \"2h\",\n 1\n ],\n [\n \"720m\",\n 2\n ],\n [\n \"24h\",\n 7\n ],\n [\n \"1d\",\n 3\n ],\n [\n \"1440m\",\n 1\n ]\n ],\n \"overdue\": 0,\n \"overdue_cost\": 0,\n \"overdue_non_recurring\": 0,\n \"estimated_schedule_density\": [\n 0,\n 0,\n 0,\n 1,\n 1,\n 1,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 1,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0\n ],\n \"capacity_requirements\": {\n \"per_minute\": 4,\n \"per_hour\": 46,\n \"per_day\": 27\n }\n },\n \"status\": \"OK\"\n },\n \"capacity_estimation\": {\n \"status\": \"OK\",\n \"reason\": \"Task Manager is healthy, the assumedRequiredThroughputPerMinutePerKibana (148.78541666666666) < capacityPerMinutePerKibana (1200)\",\n \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n \"value\": {\n \"observed\": {\n \"observed_kibana_instances\": 1,\n \"max_throughput_per_minute_per_kibana\": 1200,\n \"max_throughput_per_minute\": 1200,\n \"minutes_to_drain_overdue\": 0,\n \"avg_recurring_required_throughput_per_minute\": 5,\n \"avg_recurring_required_throughput_per_minute_per_kibana\": 5,\n \"avg_required_throughput_per_minute\": 149,\n \"avg_required_throughput_per_minute_per_kibana\": 149\n },\n \"proposed\": {\n \"provisioned_kibana\": 2,\n \"min_required_kibana\": 1,\n \"avg_recurring_required_throughput_per_minute_per_kibana\": 3,\n \"avg_required_throughput_per_minute_per_kibana\": 75\n }\n }\n }\n }\n}"
get_connector_types_generativeai_response:
summary: A list of connector types for the `generativeAI` feature.
value:
- id: .gen-ai
name: OpenAI
enabled: true
enabled_in_config: true
enabled_in_license: true
minimum_license_required: enterprise
supported_feature_ids:
- generativeAIForSecurity
- generativeAIForObservability
- generativeAIForSearchPlayground
is_system_action_type: false
- id: .bedrock
name: AWS Bedrock
enabled: true
enabled_in_config: true
enabled_in_license: true
minimum_license_required: enterprise
supported_feature_ids:
- generativeAIForSecurity
- generativeAIForObservability
- generativeAIForSearchPlayground
is_system_action_type: false
- id: .gemini
name: Google Gemini
enabled: true
enabled_in_config: true
enabled_in_license: true
minimum_license_required: enterprise
supported_feature_ids:
- generativeAIForSecurity
is_system_action_type: false
get_connector_response:
summary: Get connector details.
value:
id: df770e30-8b8b-11ed-a780-3b746c987a81
name: my_server_log_connector
config: { }
connector_type_id: .server-log
is_preconfigured: false
is_deprecated: false
is_missing_secrets: false
is_system_action: false
update_index_connector_request:
summary: Update an index connector.
value:
name: updated-connector
config:
index: updated-index
create_email_connector_request:
summary: Create an email connector.
value:
name: email-connector-1
connector_type_id: .email
config:
from: tester@example.com
hasAuth: true
host: https://example.com
port: 1025
secure: false
service: other
secrets:
user: username
password: password
create_index_connector_request:
summary: Create an index connector.
value:
name: my-connector
connector_type_id: .index
config:
index: test-index
create_webhook_connector_request:
summary: Create a webhook connector with SSL authentication.
value:
name: my-webhook-connector
connector_type_id: .webhook
config:
method: post
url: https://example.com
authType: webhook-authentication-ssl
certType: ssl-crt-key
secrets:
crt: QmFnIEF0dH...
key: LS0tLS1CRUdJ...
password: my-passphrase
create_xmatters_connector_request:
summary: Create an xMatters connector with URL authentication.
value:
name: my-xmatters-connector
connector_type_id: .xmatters
config:
usesBasic: false
secrets:
secretsUrl: https://example.com?apiKey=xxxxx
create_email_connector_response:
summary: A new email connector.
value:
id: 90a82c60-478f-11ee-a343-f98a117c727f
connector_type_id: .email
name: email-connector-1
config:
from: tester@example.com
service: other
host: https://example.com
port: 1025
secure: false
hasAuth: true
tenantId: 'null'
clientId: 'null'
oauthTokenUrl: 'null'
is_preconfigured: false
is_deprecated: false
is_missing_secrets: false
is_system_action: false
create_index_connector_response:
summary: A new index connector.
value:
id: c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad
connector_type_id: .index
name: my-connector
config:
index: test-index
refresh: false
executionTimeField: 'null'
is_preconfigured: false
is_deprecated: false
is_missing_secrets: false
is_system_action: false
create_webhook_connector_response:
summary: A new webhook connector.
value:
id: 900eb010-3b9d-11ee-a642-8ffbb94e38bd
name: my-webhook-connector
config:
method: post
url: https://example.com
authType: webhook-authentication-ssl
certType: ssl-crt-key
verificationMode: full
headers: 'null'
hasAuth: true
connector_type_id: .webhook
is_preconfigured: false
is_deprecated: false
is_missing_secrets: false
is_system_action: false
run_index_connector_request:
summary: Run an index connector.
value:
params:
documents:
- id: my_doc_id
name: my_doc_name
message: 'hello, world'
run_jira_connector_request:
summary: Run a Jira connector to retrieve the list of issue types.
value:
params:
subAction: issueTypes
run_servicenow_itom_connector_request:
summary: Run a ServiceNow ITOM connector to retrieve the list of choices.
value:
params:
subAction: getChoices
subActionParams:
fields:
- severity
- urgency
run_slack_api_connector_request:
summary: Run a Slack connector that uses the web API method to post a message on a channel.
value:
params:
subAction: postMessage
subActionParams:
channelIds:
- C123ABC456
text: A test message.
run_swimlane_connector_request:
summary: Run a Swimlane connector to create an incident.
value:
params:
subAction: pushToService
subActionParams:
comments:
- commentId: 1
comment: A comment about the incident.
incident:
caseId: '1000'
caseName: Case name
description: Description of the incident.
run_index_connector_response:
summary: Response from running an index connector.
value:
connector_id: fd38c600-96a5-11ed-bb79-353b74189cba
data:
errors: false
items:
- create:
_id: 4JtvwYUBrcyxt2NnfW3y
_index: my-index
_primary_term: 1
_seq_no: 0
_shards:
failed: 0
successful: 1
total: 2
_version: 1
result: created
status: 201
took: 135
status: ok
run_jira_connector_response:
summary: Response from retrieving the list of issue types for a Jira connector.
value:
connector_id: b3aad810-edbe-11ec-82d1-11348ecbf4a6
data:
- id: 10024
name: Improvement
- id: 10006
name: Task
- id: 10007
name: Sub-task
- id: 10025
name: New Feature
- id: 10023
name: Bug
- id: 10000
name: Epic
status: ok
run_server_log_connector_response:
summary: Response from running a server log connector.
value:
connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907
status: ok
run_servicenow_itom_connector_response:
summary: Response from retrieving the list of choices for a ServiceNow ITOM connector.
value:
connector_id: 9d9be270-2fd2-11ed-b0e0-87533c532698
data:
- dependent_value: ''
element: severity
label: Critical
value: 1
- dependent_value: ''
element: severity
label: Major
value: 2
- dependent_value: ''
element: severity
label: Minor
value: 3
- dependent_value: ''
element: severity
label: Warning
value: 4
- dependent_value: ''
element: severity
label: OK
value: 5
- dependent_value: ''
element: severity
label: Clear
value: 0
- dependent_value: ''
element: urgency
label: 1 - High
value: 1
- dependent_value: ''
element: urgency
label: 2 - Medium
value: 2
- dependent_value: ''
element: urgency
label: 3 - Low
value: 3
status: ok
run_slack_api_connector_response:
summary: Response from posting a message with a Slack connector.
value:
status: ok
data:
ok: true
channel: C123ABC456
ts: '1234567890.123456'
message:
bot_id: B12BCDEFGHI
type: message
text: A test message
user: U12A345BC6D
ts: '1234567890.123456'
app_id: A01BC2D34EF
blocks:
- type: rich_text
block_id: /NXe
elements:
- type: rich_text_section
elements:
- type: text
text: A test message.
team: T01ABCDE2F
bot_profile:
id: B12BCDEFGHI
app_id: A01BC2D34EF
name: test
icons:
image_36: https://a.slack-edge.com/80588/img/plugins/app/bot_36.png
deleted: false
updated: 1672169705
team_id: T01ABCDE2F
connector_id: .slack_api
run_swimlane_connector_response:
summary: Response from creating a Swimlane incident.
value:
connector_id: a4746470-2f94-11ed-b0e0-87533c532698
data:
id: aKPmBHWzmdRQtx6Mx
title: TEST-457
url: https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx
pushedDate: '2022-09-08T16:52:27.866Z'
comments:
- commentId: 1
pushedDate: '2022-09-08T16:52:27.865Z'
status: ok
get_connectors_response:
summary: A list of connectors
value:
- id: preconfigured-email-connector
name: my-preconfigured-email-notification
connector_type_id: .email
is_preconfigured: true
is_deprecated: false
referenced_by_count: 0
is_system_action: false
- id: e07d0c80-8b8b-11ed-a780-3b746c987a81
name: my-index-connector
config:
index: test-index
refresh: false
executionTimeField: 'null'
connector_type_id: .index
is_preconfigured: false
is_deprecated: false
referenced_by_count: 2
is_missing_secrets: false
is_system_action: false
update_rule_request:
summary: Index threshold rule
description: Update an index threshold rule that uses a server log connector to send notifications when the threshold is met.
value:
actions:
- frequency:
summary: false
notify_when: onActionGroupChange
group: threshold met
id: 96b668d0-a1b6-11ed-afdf-d39a49596974
params:
level: info
message: "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
params:
aggField: sheet.version
aggType: avg
index:
- .updated-index
groupBy: top
termField: name.keyword
termSize: 6
threshold:
- 1000
thresholdComparator: '>'
timeField: '@timestamp'
timeWindowSize: 5
timeWindowUnit: m
name: new name
schedule:
interval: 1m
tags: [ ]
update_rule_response:
summary: Index threshold rule
description: The response for successfully updating an index threshold rule.
value:
id: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
consumer: alerts
tags: [ ]
name: new name
enabled: true
throttle: 'null'
revision: 1
running: false
schedule:
interval: 1m
params:
index:
- .updated-index
timeField: '@timestamp'
groupBy: top
aggType: avg
timeWindowSize: 5
timeWindowUnit: m
thresholdComparator: '>'
threshold:
- 1000
aggField: sheet.version
termField: name.keyword
termSize: 6
api_key_owner: elastic
created_by: elastic
updated_by: elastic
rule_type_id: .index-threshold
scheduled_task_id: 4c5eda00-e74f-11ec-b72f-5b18752ff9ea
created_at: '2024-03-26T23:13:20.985Z'
updated_at: '2024-03-26T23:22:59.949Z'
mute_all: false
muted_alert_ids: [ ]
execution_status:
status: ok
last_execution_date: '2024-03-26T23:22:51.390Z'
last_duration: 52
actions:
- group: threshold met
params:
level: info
message: "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}"
id: 96b668d0-a1b6-11ed-afdf-d39a49596974
uuid: 07aef2a0-9eed-4ef9-94ec-39ba58eb609d
connector_type_id: .server-log
frequency:
summary: false
throttle: 'null'
notify_when: onActionGroupChange
last_run:
alerts_count:
new: 0
ignored: 0
recovered: 0
active: 0
outcome_msg: 'null'
warning: 'null'
outcome: succeeded
next_run: '2024-03-26T23:23:51.316Z'
api_key_created_by_user: false
create_es_query_esql_rule_request:
summary: Elasticsearch query rule (ES|QL)
description: "Create an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL) to define its query and a server log connector to send notifications.\n"
value:
name: my Elasticsearch query ESQL rule
params:
searchType: esqlQuery
esqlQuery:
esql: 'FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != "GB" | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | SORT sumbytes desc | LIMIT 10'
timeField: '@timestamp'
timeWindowSize: 1
timeWindowUnit: d
size: 0
thresholdComparator: '>'
threshold:
- 0
consumer: stackAlerts
rule_type_id: .es-query
schedule:
interval: 1d
actions:
- group: query matched
id: d0db1fe0-78d6-11ee-9177-f7d404c8c945
params:
level: info
message: "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
frequency:
summary: false
notify_when: onActiveAlert
create_es_query_rule_request:
summary: Elasticsearch query rule (DSL)
description: "Create an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL) to define its query and a server log connector to send notifications.\n"
value:
actions:
- group: query matched
params:
level: info
message: 'The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts.'
id: fdbece50-406c-11ee-850e-c71febc4ca7f
frequency:
throttle: 1d
summary: true
notify_when: onThrottleInterval
- group: recovered
params:
level: info
message: Recovered
id: fdbece50-406c-11ee-850e-c71febc4ca7f
frequency:
summary: false
notify_when: onActionGroupChange
consumer: alerts
name: my Elasticsearch query rule
params:
esQuery: '"""{"query":{"match_all" : {}}}"""'
index:
- kibana_sample_data_logs
size: 100
threshold:
- 100
thresholdComparator: '>'
timeField: '@timestamp'
timeWindowSize: 1
timeWindowUnit: d
rule_type_id: .es-query
schedule:
interval: 1d
create_es_query_kql_rule_request:
summary: Elasticsearch query rule (KQL)
description: Create an Elasticsearch query rule that uses Kibana query language (KQL).
value:
consumer: alerts
name: my Elasticsearch query KQL rule
params:
aggType: count
excludeHitsFromPreviousRun: true
groupBy: all
searchConfiguration:
query:
query: '""geo.src : "US" ""'
language: kuery
index: 90943e30-9a47-11e8-b64d-95841ca0b247
searchType: searchSource
size: 100
threshold:
- 1000
thresholdComparator: '>'
timeWindowSize: 5
timeWindowUnit: m
rule_type_id: .es-query
schedule:
interval: 1m
create_index_threshold_rule_request:
summary: Index threshold rule
description: "Create an index threshold rule that uses a server log connector to send notifications when the threshold is met.\n"
value:
actions:
- id: 48de3460-f401-11ed-9f8e-399c75a2deeb
frequency:
notify_when: onActionGroupChange
summary: false
group: threshold met
params:
level: info
message: "Rule '{{rule.name}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
alert_delay:
active: 3
consumer: alerts
name: my rule
params:
aggType: avg
termSize: 6
thresholdComparator: '>'
timeWindowSize: 5
timeWindowUnit: m
groupBy: top
threshold:
- 1000
index:
- .test-index
timeField: '@timestamp'
aggField: sheet.version
termField: name.keyword
rule_type_id: .index-threshold
schedule:
interval: 1m
tags:
- cpu
create_tracking_containment_rule_request:
summary: Tracking containment rule
description: "Create a tracking containment rule that checks when an entity is contained or no longer contained within a boundary.\n"
value:
consumer: alerts
name: my tracking rule
params:
index: kibana_sample_data_logs
dateField": '@timestamp'
geoField: geo.coordinates
entity: agent.keyword
boundaryType: entireIndex
boundaryIndexTitle: boundary*
boundaryGeoField: location
boundaryNameField: name
indexId: 90943e30-9a47-11e8-b64d-95841ca0b247
boundaryIndexId: 0cd90abf-abe7-44c7-909a-f621bbbcfefc
rule_type_id: .geo-containment
schedule:
interval: 1h
create_es_query_esql_rule_response:
summary: Elasticsearch query rule (ES|QL)
description: The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).
value:
id: e0d62360-78e8-11ee-9177-f7d404c8c945
enabled: true
name: my Elasticsearch query ESQL rule
tags: [ ]
rule_type_id: .es-query
consumer: stackAlerts
schedule:
interval: 1d
actions:
- group: query matched
id: d0db1fe0-78d6-11ee-9177-f7d404c8c945
params:
level: info
message: "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
connector_type_id: .server-log
frequency:
summary: false
notify_when: onActiveAlert
throttle: 'null'
uuid: bfe370a3-531b-4855-bbe6-ad739f578844
params:
searchType: esqlQuery
esqlQuery:
esql: 'FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != "GB" | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | sort sumbytes desc | limit 10'
timeField: '@timestamp'
timeWindowSize: 1
timeWindowUnit: d
size: 0
thresholdComparator: '>'
threshold:
- 0
excludeHitsFromPreviousRun": 'true,'
aggType: count
groupBy: all
scheduled_task_id: e0d62360-78e8-11ee-9177-f7d404c8c945
created_by: elastic
updated_by: 'elastic",'
created_at: '2023-11-01T19:00:10.453Z'
updated_at: '2023-11-01T19:00:10.453Z'
api_key_owner: elastic
api_key_created_by_user: false
throttle: 'null'
mute_all: false
notify_when: 'null'
muted_alert_ids: [ ]
execution_status:
status: pending
last_execution_date: '2023-11-01T19:00:10.453Z'
revision: 0
running: false
create_es_query_rule_response:
summary: Elasticsearch query rule (DSL)
description: The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).
value:
id: 58148c70-407f-11ee-850e-c71febc4ca7f
enabled: true
name: my Elasticsearch query rule
tags: [ ]
rule_type_id: .es-query
consumer: alerts
schedule:
interval: 1d
actions:
- group: query matched
id: fdbece50-406c-11ee-850e-c71febc4ca7f
params:
level: info
message: 'The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts.'
connector_type_id: .server-log
frequency:
summary: true
notify_when: onThrottleInterval
throttle: 1d
uuid: 53f3c2a3-e5d0-4cfa-af3b-6f0881385e78
- group: recovered
id: fdbece50-406c-11ee-850e-c71febc4ca7f
params:
level: info
message: Recovered
connector_type_id: .server-log
frequency:
summary: false
notify_when: onActionGroupChange
throttle: 'null'
uuid: 2324e45b-c0df-45c7-9d70-4993e30be758
params:
thresholdComparator: '>'
timeWindowSize: 1
timeWindowUnit: d
threshold:
- 100
size: 100
timeField: '@timestamp'
index:
- kibana_sample_data_logs
esQuery: '"""{"query":{"match_all" : {}}}"""'
excludeHitsFromPreviousRun: true
aggType: count
groupBy: all
searchType: esQuery
scheduled_task_id: 58148c70-407f-11ee-850e-c71febc4ca7f
created_by: elastic
updated_by: elastic
created_at: '2023-08-22T00:03:38.263Z'
updated_at: '2023-08-22T00:03:38.263Z'
api_key_owner: elastic
api_key_created_by_user: false
throttle: 'null'
mute_all: false
notify_when: 'null'
muted_alert_ids: [ ]
execution_status:
status: pending
last_execution_date: '2023-08-22T00:03:38.263Z'
revision: 0
running: false
create_es_query_kql_rule_response:
summary: Elasticsearch query rule (KQL)
description: The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).
value:
id: 7bd506d0-2284-11ee-8fad-6101956ced88
enabled: true
name: my Elasticsearch query KQL rule"
tags: [ ]
rule_type_id: .es-query
consumer: alerts
schedule:
interval: 1m
actions: [ ]
params:
searchConfiguration:
query:
query: '""geo.src : "US" ""'
language: kuery
index: 90943e30-9a47-11e8-b64d-95841ca0b247
searchType: searchSource
timeWindowSize: 5
timeWindowUnit: m
threshold:
- 1000
thresholdComparator: '>'
size: 100
aggType: count
groupBy: all
excludeHitsFromPreviousRun: true
created_by: elastic
updated_by: elastic
created_at: '2023-07-14T20:24:50.729Z'
updated_at: '2023-07-14T20:24:50.729Z'
api_key_owner: elastic
api_key_created_by_user: false
throttle: 'null'
notify_when: 'null'
mute_all: false
muted_alert_ids: [ ]
scheduled_task_id: 7bd506d0-2284-11ee-8fad-6101956ced88
execution_status:
status: pending
last_execution_date: '2023-07-14T20:24:50.729Z'
revision: 0
running: false
create_index_threshold_rule_response:
summary: Index threshold rule
description: The response for successfully creating an index threshold rule.
value:
actions:
- group: threshold met
id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
uuid: 07aef2a0-9eed-4ef9-94ec-39ba58eb609d
connector_type_id: .server-log
frequency:
notify_when: onActionGroupChange
summary: false
throttle: 'null'
params:
level: info
message: "Rule {{rule.name}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
alert_delay:
active: 3
api_key_created_by_user: false
api_key_owner: elastic
consumer: alerts
created_at: '2022-06-08T17:20:31.632Z'
created_by: elastic
enabled: true
execution_status:
last_execution_date: '2022-06-08T17:20:31.632Z'
status: pending
id: 41893910-6bca-11eb-9e0d-85d233e3ee35
muted_alert_ids: [ ]
mute_all: false
name: my rule
notify_when: 'null'
params:
aggType: avg
termSize: 6
thresholdComparator: '>'
timeWindowSize: 5
timeWindowUnit: m
groupBy: top
threshold:
- 1000
index:
- .test-index
timeField: '@timestamp'
aggField: sheet.version
termField: name.keyword
revision: 0
rule_type_id: .index-threshold
running: false
schedule:
interval: 1m
scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35
tags:
- cpu
throttle: 'null'
updated_at: '2022-06-08T17:20:31.632Z'
updated_by: elastic
create_tracking_containment_rule_response:
summary: Tracking containment rule
description: The response for successfully creating a tracking containment rule.
value:
id: b6883f9d-5f70-4758-a66e-369d7c26012f
name: my tracking rule
tags: [ ]
enabled: true
consumer: alerts
throttle: 'null'
revision: 1
running: false
schedule:
interval: 1h
params:
index: kibana_sample_data_logs
dateField: '@timestamp'
geoField: geo.coordinates
entity: agent.keyword
boundaryType: entireIndex
boundaryIndexTitle: boundary*
boundaryGeoField: location
boundaryNameField: name
indexId: 90943e30-9a47-11e8-b64d-95841ca0b247
boundaryIndexId: 0cd90abf-abe7-44c7-909a-f621bbbcfefc
rule_type_id: .geo-containment
created_by: elastic
updated_by: elastic
created_at: '2024-02-14T19:52:55.920Z'
updated_at: '2024-02-15T03:24:32.574Z'
api_key_owner: elastic
notify_when: 'null'
mute_all: false
muted_alert_ids: [ ]
scheduled_task_id: b6883f9d-5f70-4758-a66e-369d7c26012f
execution_status:
status: ok
last_execution_date: '2024-02-15T03:25:38.125Z'
last_duration: 74
actions: [ ]
last_run:
alerts_count:
active: 0
new: 0
recovered: 0
ignored: 0
outcome_msg: 'null'
outcome_order: 0
outcome: succeeded
warning: 'null'
next_run: '2024-02-15T03:26:38.033Z'
api_key_created_by_user: false
find_rules_response:
summary: Index threshold rule
description: A response that contains information about an index threshold rule.
value:
page: 1
total: 1
per_page: 10
data:
- id: 3583a470-74f6-11ed-9801-35303b735aef
consumer: alerts
tags:
- cpu
name: my alert
enabled: true
throttle: 'null'
schedule:
interval: 1m
params:
aggType: avg
termSize: 6
thresholdComparator: '>'
timeWindowSize: 5
timeWindowUnit: m
groupBy: top
threshold:
- 1000
index:
- test-index
timeField: '@timestamp'
aggField: sheet.version
termField: name.keyword
revision: 1
rule_type_id: .index-threshold
created_by: elastic
updated_by: elastic
created_at: '2022-12-05T23:40:33.132Z'
updated_at: '2022-12-05T23:40:33.132Z'
api_key_owner: elastic
mute_all: false
muted_alert_ids: [ ]
scheduled_task_id: 3583a470-74f6-11ed-9801-35303b735aef
execution_status:
status: ok
last_execution_date: '2022-12-06T01:44:23.983Z'
last_duration: 48
actions:
- id: 9dca3e00-74f5-11ed-9801-35303b735aef
group: threshold met
uuid: 1c7a1280-f28c-4e06-96b2-e4e5f05d1d61
params:
level: info
message: "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
connector_type_id: .server-log
frequency:
summary: false
notify_when: onActionGroupChange
throttle: 'null'
last_run:
alerts_count:
new: 0
ignored: 0
recovered: 0
active: 0
outcome_msg: 'null'
warning: 'null'
outcome: succeeded
next_run: '2022-12-06T01:45:23.912Z'
api_key_created_by_user: false
find_rules_response_conditional_action:
summary: Security rule
description: A response that contains information about a security rule that has conditional actions.
value:
page: 1
total: 1
per_page: 10
data:
- id: 6107a8f0-f401-11ed-9f8e-399c75a2deeb
name: security_rule
consumer: siem
enabled: true
tags: [ ]
throttle: 'null'
revision: 1
running: false
schedule:
interval: 1m
params:
author: [ ]
description: A security threshold rule.
ruleId: an_internal_rule_id
falsePositives: [ ]
from: now-3660s
immutable: false
license: ''
outputIndex: ''
meta:
from: 1h
kibana_siem_app_url: https://localhost:5601/app/security
maxSignals: 100
riskScore: 21
riskScoreMapping: [ ]
severity: low
severityMapping: [ ]
threat: [ ]
to: now
references: [ ]
version: 1
exceptionsList: [ ]
type: threshold
language: kuery
index:
- kibana_sample_data_logs
query: '*'
filters: [ ]
threshold:
field:
- bytes
value: 1
cardinality: [ ]
rule_type_id: siem.thresholdRule
created_by: elastic
updated_by: elastic
created_at: '2023-05-16T15:50:28.358Z'
updated_at: '2023-05-16T20:25:42.559Z'
api_key_owner: elastic
notify_when: 'null'
mute_all: false
muted_alert_ids: [ ]
scheduled_task_id: 6107a8f0-f401-11ed-9f8e-399c75a2deeb
execution_status:
status: ok
last_execution_date: '2023-05-16T20:26:49.590Z'
last_duration: 166
actions:
- group: default
id: 49eae970-f401-11ed-9f8e-399c75a2deeb
params:
documents:
- rule_id:
'[object Object]': 'null'
rule_name:
'[object Object]': 'null'
alert_id:
'[object Object]': 'null'
context_message:
'[object Object]': 'null'
connector_type_id: .index
frequency:
summary: true
notify_when: onActiveAlert
throttle: 'null'
uuid: 1c7a1280-f28c-4e06-96b2-e4e5f05d1d61
alerts_filter:
timeframe:
days:
- 7
timezone: UTC
hours:
start: '08:00'
end: '17:00'
query:
kql: ''
filters:
- meta:
disabled: false
negate: false
alias: 'null'
index: c4bdca79-e69e-4d80-82a1-e5192c621bea
key: client.geo.region_iso_code
field: client.geo.region_iso_code
params:
query: CA-QC
type: phrase
$state:
store: appState
query:
match_phrase:
client.geo.region_iso_code: CA-QC
last_run:
alerts_count:
new: 0
ignored: 0
recovered: 0
active: 0
outcome_msg:
- Rule execution completed successfully
outcome_order: 0
warning: 'null'
outcome: succeeded
next_run: '2023-05-16T20:27:49.507Z'
api_key_created_by_user: false
get_roles_response1:
summary: Get all role details
value:
- name: my_kibana_role
description: My kibana role description
metadata:
version: 1
transient_metadata:
enabled: true
elasticsearch:
indices: [ ]
cluster: [ ]
run_as: [ ]
kibana:
- base:
- all
feature: { }
spaces:
- '*'
- name: my_admin_role
description: My admin role description
metadata:
version: 1
transient_metadata:
enabled: true
elasticsearch:
cluster:
- all
indices:
- names:
- index1
- index2
privileges:
- all
field_security:
grant:
- title
- body
query: '{\"match\": {\"title\": \"foo\"}}'
kibana: [ ]
get_role_response1:
summary: Get role details
value:
name: my_kibana_role
description: 'Grants all cluster privileges and full access to index1 and index2. Grants full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grants all Kibana privileges in the default space.'
metadata:
version: 1
transient_metadata:
enabled: true
elasticsearch:
cluster:
- all
remote_cluster:
- privileges:
- monitor_enrich
clusters:
- remote_cluster1
indices:
- names:
- index1
- index2
privileges:
- all
allow_restricted_indices: false
remote_indices:
- names:
- remote_index1
- remote_index2
privileges:
- all
allow_restricted_indices: false
clusters:
- remote_cluster1
run_as: [ ]
kibana:
- base:
- all
feature: { }
spaces:
- default
_transform_error: [ ]
_unrecognized_applications: [ ]
create_role_request1:
summary: Feature privileges in multiple spaces
description: Grant access to various features in some spaces.
value:
description: 'Grant full access to discover and dashboard features in the default space. Grant read access in the marketing, and sales spaces.'
metadata:
version: 1
elasticsearch:
cluster: [ ]
indices: [ ]
kibana:
- base: [ ]
feature:
discover:
- all
dashboard:
- all
spaces:
- default
- base:
- read
spaces:
- marketing
- sales
create_role_request2:
summary: Dashboard privileges in a space
description: Grant access to dashboard features in a Marketing space.
value:
description: Grant dashboard access in the Marketing space.
metadata:
version: 1
elasticsearch:
cluster: [ ]
indices: [ ]
kibana:
- base: [ ]
feature:
dashboard:
- read
spaces:
- marketing
create_role_request3:
summary: Feature privileges in a space
description: Grant full access to all features in the default space.
value:
metadata:
version: 1
elasticsearch:
cluster: [ ]
indices: [ ]
kibana:
- base:
- all
feature: { }
spaces:
- default
create_role_request4:
summary: Elasticsearch and Kibana feature privileges
description: Grant Elasticsearch and Kibana feature privileges.
value:
description: 'Grant all cluster privileges and full access to index1 and index2. Grant full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grant all Kibana privileges in the default space.'
metadata:
version: 1
elasticsearch:
cluster:
- all
indices:
- names:
- index1
- index2
privileges:
- all
remote_indices:
- clusters:
- remote_cluster1
names:
- remote_index1
- remote_index2
privileges:
- all
remote_cluster:
- clusters:
- remote_cluster1
privileges:
- monitor_enrich
kibana:
- base:
- all
feature: { }
spaces:
- default
copy_saved_objects_request1:
summary: Copy with createNewCopies
description: "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n"
value:
objects:
- type: dashboard
id: my-dashboard
spaces:
- marketing
includeReferences: true
copy_saved_objects_request2:
summary: Copy without createNewCopies
description: "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n"
value:
objects:
- type: dashboard
id: my-dashboard
spaces:
- marketing
includeReferences: true
createNewCopies: false
copy_saved_objects_response1:
summary: Copy with createNewCopies
description: "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. The result indicates a successful copy and all three objects are created. Since these objects were created as new copies, each entry in the successResults array includes a destinationId attribute.\n"
value:
marketing:
success: true
successCount: 3
successResults:
- id: my-dashboard
type: dashboard
destinationId: 1e127098-5b80-417f-b0f1-c60c8395358f
meta:
icon: dashboardApp
title: Look at my dashboard
- id: my-vis
type: visualization
destinationId: a610ed80-1c73-4507-9e13-d3af736c8e04
meta:
icon: visualizeApp
title: Look at my visualization
- id: my-index-pattern
type: index-pattern
destinationId: bc3c9c70-bf6f-4bec-b4ce-f4189aa9e26b
meta:
icon: indexPatternApp
title: my-pattern-*
copy_saved_objects_response2:
summary: Copy without createNewCopies
description: "The response for successfully copying a dashboard with the my-dashboard ID with createNewCopies turned off. The result indicates a successful copy and all three objects are created.\n"
value:
marketing:
success: true
successCount: 3
successResults:
- id: my-dashboard
type: dashboard
meta:
icon: dashboardApp
title: Look at my dashboard
- id: my-vis
type: visualization
meta:
icon: visualizeApp
title: Look at my visualization
- id: my-index-pattern
type: index-pattern
meta:
icon: indexPatternApp
title: my-pattern-*
copy_saved_objects_response3:
summary: Failed copy response with conflict errors
description: "A response for a failed copy of a dashboard with the my-dashboard ID including all references from the default space to the marketing and sales spaces. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to an index pattern. The result indicates a successful copy for the marketing space and an unsuccessful copy for the sales space because the data view, visualization, and Canvas workpad each resulted in a conflict error. Objects are created when the error is resolved using the resolve copy conflicts API.\n"
value:
marketing:
success: true
successCount: 4
successResults:
- id: my-dashboard
type: dashboard
meta:
icon: dashboardApp
title: Look at my dashboard
- id: my-vis
type: visualization
meta:
icon: visualizeApp
title: Look at my visualization
- id: my-canvas
type: canvas-workpad
meta:
icon: canvasApp
title: Look at my canvas
- id: my-index-pattern
type: index-pattern
meta:
icon: indexPatternApp
title: my-pattern-*
sales:
success: false
successCount: '1,'
errors:
- id: my-pattern
type: index-pattern
title: my-pattern-*
error:
type: conflict
meta:
icon: indexPatternApp
title: my-pattern-*
- id: my-visualization
type: my-vis
title: Look at my visualization
error:
type: conflict
destinationId: another-vis
meta:
icon: visualizeApp
title: Look at my visualization
- id: my-canvas
type: canvas-workpad
title: Look at my canvas
error:
type: ambiguous_conflict
destinations:
- id: another-canvas
title: Look at another canvas
updatedAt: '2020-07-08T16:36:32.377Z'
- id: yet-another-canvas
title: Look at yet another canvas
updatedAt: '2020-07-05T12:29:54.849Z'
meta:
icon: canvasApp
title: Look at my canvas
successResults":
- id: my-dashboard
type: dashboard
meta:
icon: dashboardApp
title: Look at my dashboard
copy_saved_objects_response4:
summary: Failed copy with missing reference errors
description: "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to a data view. The result indicates an unsuccessful copy because the visualization resulted in a missing references error. Objects are created when the errors are resolved using the resolve copy conflicts API.\n"
value:
marketing:
success: false
successCount: 2
errors:
- id: my-vis
type: visualization
title: Look at my visualization
error:
type: missing_references
references:
- type: index-pattern
id: my-pattern-*
meta:
icon: visualizeApp
title: Look at my visualization
successResults:
- id: my-dashboard
type: dashboard
meta:
icon: dashboardApp
title: Look at my dashboard
- id: my-canvas
type: canvas-workpad
meta:
icon: canvasApp
title: Look at my canvas
disable_legacy_url_request1:
summary: Disable legacy URL aliases
description: "This request leaves the alias intact but the legacy URL for this alias (http://localhost:5601/s/bills-space/app/dashboards#/view/123) will no longer function. The dashboard still exists and you can access it with the new URL.\n"
value:
aliases:
- targetSpace: bills-space
targetType: dashboard
sourceId: 123
resolve_copy_saved_objects_request1:
summary: Resolve conflict errors
description: "Resolve conflict errors for a data view, visualization, and Canvas workpad by overwriting the existing saved objects. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard accordingly.\n"
value:
objects:
- type: dashboard
id: my-dashboard
includeReferences: true
createNewCopies: false
retries:
sales:
- type: index-pattern
id: my-pattern
overwrite: true
- type: visualization
id: my-vis
overwrite: 'true,'
destinationId: another-vis
- type: canvas
id: my-canvas
overwrite: true
destinationId: yet-another-canvas
- type: dashboard
id: my-dashboard
resolve_copy_saved_objects_request2:
summary: Resolve missing reference errors
description: "Resolve missing reference errors for a visualization by ignoring the error. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard and canvas accordingly.\n"
value:
objects:
- type: dashboard
id: my-dashboard
includeReferences: true
createNewCopies: false
retries:
marketing:
- type: visualization
id: my-vis
ignoreMissingReferences: true
- type: canvas
id: my-canvas
- type: dashboard
id: my-dashboard
update_saved_objects_spaces_request1:
summary: Update saved object spaces
description: Update the spaces of each saved object and all its references.
value:
objects:
- type: index-pattern
id: 90943e30-9a47-11e8-b64d-95841ca0b247
spacesToAdd:
- test
spacesToRemove: [ ]
update_saved_objects_spaces_response1:
summary: Update saved object spaces
description: "The response from updating the spaces of saved objects.\n"
value:
objects:
- type: index-pattern
id: 90943e30-9a47-11e8-b64d-95841ca0b247
spaces:
- default
- test
get_spaces_response1:
summary: Get all spaces
description: Get all spaces without specifying any options.
value:
- id: default
name: Default
description: This is the Default Space
disabledFeatures: [ ]
imageUrl: ''
_reserved: true
- id: marketing
name: Marketing
description: This is the Marketing Space
color: 'null'
disabledFeatures:
- apm
initials: MK
imageUrl: 'data:image/png;base64,iVBORw0KGgoAAAANSU'
- id: sales
name: Sales
initials: MK
disabledFeatures:
- discover
imageUr": ''
solution: oblt
get_spaces_response2:
summary: Get all spaces with custom options
description: "The user has read-only access to the Sales space. Get all spaces with the following query parameters: \"purpose=shareSavedObjectsIntoSpace&include_authorized_purposes=true\"\n"
value:
- id: default
name: Default
description: This is the Default Space
disabledFeatures: [ ]
imageUrl: ''
_reserved: true
authorizedPurposes:
any: true
copySavedObjectsIntoSpace: true
findSavedObjects: true
shareSavedObjectsIntoSpace: true
- id: marketing
name: Marketing
description: This is the Marketing Space
color: 'null'
disabledFeatures:
- apm
initials: MK
imageUrl: 'data:image/png;base64,iVBORw0KGgoAAAANSU'
authorizedPurposes:
any: true
copySavedObjectsIntoSpace: true
findSavedObjects: true
shareSavedObjectsIntoSpace: true
- id: sales
name: Sales
initials: MK
disabledFeatures:
- discover
imageUrl: ''
authorizedPurposes:
any: true
copySavedObjectsIntoSpace: false
findSavedObjects: true
shareSavedObjectsIntoSpace: false
create_space_request:
summary: Create a marketing space
value:
id: marketing
name: Marketing
description: This is the Marketing Space
color: 'null'
initials: MK
disabledFeatures: [ ]
imageUrl: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAD4AAABACAYAAABC6cT1AAAGf0lEQVRoQ+3abYydRRUH8N882xYo0IqagEVjokQJKAiKBjXExC9G/aCkGowCIghCkRcrVSSKIu/FEiqgGL6gBIlAYrAqUTH6hZgQFVEMKlQFfItWoQWhZe8z5uzMLdvbfbkLxb13d+fbvfe588x/zpn/+Z9zJpmnI81T3BaAzzfLL1h8weLzZAcWXH2eGHo7zAWLL1h8nuzAjFw9G1N6Kzq8HnuM36MR8iibF3Fv4q+7cv8yDV6K13bYq2furSP8Ag8ncr/vnSnwRViJT2GfCV7yL1yHGxLb+l3EdM9lluNEnIC9xz+f2ZL4Er6Z2DrdXN3fZwp8CU7OfDHxggle8lTLbQ1nJ/7Z7yKmey5zYGZt4h2IzR8/trRc2PDlxJPTzfVcgJ+CC0wMPOa9F6cm7up3EVM9V9386MxliVdM8GwAv6hh/awCz/w7lY25OtF5ruBz4ZLP42NYNrDAFbC3YPWuILnMAfgq3oaRQQYea/stViV+sgssvjKzLvGySeaaNVfP4d7Btokgvxj/bblgpueuF1hmWcyTCmfE3J3M1lTcv0vMswM88zR+jpw4osu6me8kzkpsfLZWzxyRuabO22buxxOJ12FxnXfWgEe83pB5sOE47BsLymzscOoi7nw2JJfZreUjiUsTyzKPZm5NvBDvSuw268AzNzV8H5/Am+qCnsAXgpgSW2Zq9cyKlksbPlTd+te4quWNieMHBfiNDdciYnwsdI/MaOaWhnMTf54J8CqNj8x8JXFIZltYu+HqlmNT8YSBsHgAPw/vxvlVV4du/s0oaxbxg0TbL/jMni0nNcVjQq7+HZfgtpbzBg342TgQ63AkmsymxBW4IjE6A+D7Vzd/fyWxIM/VuCe+HzTgZ2Jpy/kNJ2FJLmLm24mPJ/42A+Bvrxt4SISwlhsaPodH26LZB8rVA3inwwebsrixJCZzX+KMxI/7AV61eVh3DV6Mx3EOvh4kN6jAg8nfUCXm4d1wE66OyxNPTQc+s3/o/MoXizL3JE5O3F3P/uBZPPF4Zr+Wi5uSO48ZPRdyCwn7YB/A35m5KhWNHox4fcNnIs0ddOCRSBxf8+cQG+Huf0l8NJVYP+nI7NXy2ar4QqIGm69JfKPOE2w/mBavCzwM11R2D+ChsUO7hyUfmwx55qDM1xJvqZ7y08TpifuGBfjeURVJnNIVGpkNiXNS0ds7jcySDitDCCWW56LJ10fRo8sNA+3qXUSZD2CtQlZh9T+1rB7h9oliembflnMbzqgSNZKbKGHdPm7OwXb1CvQ1metSETMpszmzvikCJNh/h5E5PHNl4qga/+/cxqrdeWDYgIe7X5L4cGJPJX2940lOX8pD41FnFnc4riluvQKbK0dcHJFi2IBHNTQSlguru4d2/wPOTNzRA3x5y+U1E1uqWDkETOT026XuUJzx6u7ReLhSYenQ7uHua0fKZmwfmcPqsQjxE5WVONcRxn7X89zgn/EKPMRMxOVQXmP18Mx3q3b/Y/0cQE/IhFtHESMsHFlZ1Ml3CH3DZPHImY+pxcKumNmYirtvqMBfhMuU6s3iqOQkTsMPe1tCQwO8Ajs0lxr7W+vnp1MJc9EgCNd/cy6x+9D4veXmprj5wxMw/3C4egW6zzgZOlYZzfwo3F2J7ael0pJamvlPKgWNKFft1AAcKotXoFEbD7kaoSoQPVKB35+5KHF0lai/rJo+up87jWEE/qqqwY+qrL21LWLm95lPJ16ppKw31XC3PXYPJauPEx7B6BHCgrSizRs18qiaRp8tlN3ueCTYPHH9RNaunjI8Z7wLYpT3jZSCYXQ8e9vTsRE/q+no3XMKeObgGtaintbb/AvXj4JDkNw/5hrwYPfIvlZFUbLn7G5q+eQIN09Vnho6cqvnM/Lt99RixH49wO8K0ZL41WTWHoQzvsNVkOheZqKhEGpsp3SzB+BBtZAYve7uOR9tuTaaB6l0XScdYfEQPpkTUyHEGP+XqyDBzu+NBCITUjNWHynkrbWKOuWFn1xKzqsyx0bdvS78odp0+N503Zao0uCsWuSIDku8/7EO60b41vN5+Ses9BKlTdvd8bhp9EBvJjWJAIn/vxwHe6b3tSk6JFPV4nq85oAOrx555v/x/rh3E6Lo+bnuNS4uB4Cuq0ZfvO8X1rM6q/+vnjLVqZq7v83onttc2oYF4HPJmv1gWbB4P7s0l55ZsPhcsmY/WBYs3s8uzaVn5q3F/wf70mRuBCtbjQAAAABJRU5ErkJggg=='
get_space_response:
summary: Get details about a marketing space
value:
id: marketing
name: Marketing
description: This is the Marketing Space
color: 'null'
initials: MK
disabledFeatures: [ ]
imageUrl: ''
solution: es
update_space_request:
summary: Update a marketing space
description: Update the marketing space to remove the imageUrl.
value:
id: marketing
name: Marketing
description: This is the Marketing Space
color: 'null'
initials: MK
disabledFeatures: [ ]
imageUrl: ''
securitySchemes:
apiKeyAuth:
type: apiKey
description: "These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`\n"
name: Authorization
in: header
basicAuth:
type: http
scheme: basic
security:
- apiKeyAuth: [ ]
- basicAuth: [ ]
tags:
- name: alerting
description: "Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.\n"
externalDocs:
description: Alerting documentation
url: https://www.elastic.co/guide/en/kibana/8.19/alerting-getting-started.html
x-displayName: Alerting
- name: APM agent configuration
description: "Adjust APM agent configuration without need to redeploy your application.\n"
- name: APM agent keys
description: "Configure APM agent keys to authorize requests from APM agents to the APM Server.\n"
- name: APM annotations
description: "Annotate visualizations in the APM app with significant events. Annotations enable you to easily see how events are impacting the performance of your applications.\n"
- name: APM server schema
description: Create APM fleet server schema.
- name: APM sourcemaps
description: Configure APM source maps.
- name: cases
description: "Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.\n"
externalDocs:
description: Cases documentation
url: https://www.elastic.co/guide/en/kibana/8.19/cases.html
x-displayName: Cases
- name: connectors
description: "Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.\n"
externalDocs:
description: Connector documentation
url: https://www.elastic.co/guide/en/kibana/8.19/action-types.html
x-displayName: Connectors
- name: Data streams
description: "Data stream APIs enable you to manage data streams, which are collections of indices that share the same index template and are managed as a single unit for time-series data.\n"
x-displayName: Data streams
- name: data views
description: 'Data view APIs enable you to manage data views, formerly known as Kibana index patterns.'
x-displayName: Data views
- name: Elastic Agent actions
description: "Elastic Agent actions APIs enable you to manage actions performed on Elastic Agents, including agent reassignment, diagnostics collection, enrollment management, upgrades, and bulk operations for agent lifecycle management.\n"
x-displayName: Elastic Agent actions
- name: Elastic Agent binary download sources
description: "Elastic Agent binary download sources APIs enable you to manage download sources for Elastic Agent binaries, including creating, updating, and deleting custom download sources for agent binaries.\n"
x-displayName: Elastic Agent binary download sources
- name: Elastic Agent policies
description: "Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.\n"
x-displayName: Elastic Agent policies
- name: Elastic Agent status
description: "Enables you to retrieve status information about Elastic Agents, including health summaries and operational status.\n"
x-displayName: Elastic Agent status
- name: Elastic Agents
description: "Elastic Agents APIs enable you to manage Elastic Agents, including retrieving agent information, managing agent lifecycle, handling file uploads, and initiating agent setup.\n"
x-displayName: Elastic Agents
- name: Elastic Package Manager (EPM)
description: "Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.\n"
x-displayName: Elastic Package Manager (EPM)
- name: Fleet enrollment API keys
description: "Fleet enrollment API keys APIs enable you to manage enrollment API keys for Fleet, including creating, retrieving, and revoking API keys used for agent enrollment.\n"
x-displayName: Fleet enrollment API keys
- name: Fleet internals
description: "Fleet internals APIs enable you to manage Fleet internal operations, including checking permissions, monitoring Fleet Server health, managing settings, and initiating Fleet setup.\n"
x-displayName: Fleet internals
- name: Fleet Kubernetes
- name: Fleet outputs
description: "Fleet outputs APIs enable you to manage Fleet outputs, including creating, updating, and deleting output configurations, generating Logstash API keys, and monitoring output health.\n"
x-displayName: Fleet outputs
- name: Fleet package policies
description: "Fleet package policies APIs enable you to manage Fleet package policies, including creating, updating, and deleting policies, performing bulk operations, and managing policy upgrades.\n"
x-displayName: Fleet package policies
- name: Fleet proxies
description: "Fleet proxies APIs enable you to manage Fleet proxies, including creating, updating, and deleting proxy configurations for Fleet agent communication.\n"
x-displayName: Fleet proxies
- name: Fleet Server hosts
description: "Fleet Server hosts APIs enable you to manage Fleet Server hosts, including creating, updating, and deleting Fleet Server host configurations.\n"
x-displayName: Fleet Server hosts
- name: Fleet service tokens
description: "Enables you to create tokens for Fleet service authentication and authorization.\n"
x-displayName: Fleet service tokens
- name: Fleet uninstall tokens
description: "Fleet uninstall tokens APIs enable you to manage Fleet uninstall tokens, including retrieving metadata and decrypted tokens for agent uninstallation.\n"
x-displayName: Fleet uninstall tokens
- name: logstash
description: "Programmatically integrate with Logstash configuration management.\n> warn\n> Do not directly access the `.logstash` index. The structure of the `.logstash` index is subject to change, which could cause your integration to break. Instead, use the Logstash configuration management APIs.\n"
externalDocs:
description: Centralized pipeline management
url: https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html
x-displayName: Logstash configuration management
- name: maintenance-window
description: "You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.\n"
externalDocs:
description: Maintenance window documentation
url: https://www.elastic.co/guide/en/kibana/8.19/maintenance-windows.html
x-displayName: Maintenance windows
- name: ml
description: "Enables you to synchronize machine learning saved objects.\n"
x-displayName: Machine learning
- name: roles
description: Manage the roles that grant Elasticsearch and Kibana privileges.
externalDocs:
description: Kibana role management
url: https://www.elastic.co/guide/en/kibana/8.19/kibana-role-management.html
x-displayName: Roles
- name: saved objects
description: "Export sets of saved objects that you want to import into Kibana, resolve import errors, and rotate an encryption key for encrypted saved objects with the saved objects APIs.\n\nTo manage a specific type of saved object, use the corresponding APIs.\nFor example, use:\n\n* [Data views](../group/endpoint-data-views)\n* [Spaces](../group/endpoint-spaces)\n* [Short URLs](../group/endpoint-short-url)\n\nWarning: Do not write documents directly to the `.kibana` index. When you write directly to the `.kibana` index, the data becomes corrupted and permanently breaks future Kibana versions.\n"
x-displayName: Saved objects
- name: Security AI Assistant API
description: Manage and interact with Security Assistant resources.
x-displayName: Security AI assistant
- name: Security Detections API
description: "Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.\n\nThis API supports both key-based authentication and basic authentication.\n\nTo use key-based authentication, create an API key, then specify the key in the header of your API calls.\n\nTo use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.\n\nIn both cases, the API key is subsequently used for authorization when the rule runs.\n> warn\n> If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.\n\n> If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.\n\nTo create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.\n"
x-displayName: Security detections
- name: Security Endpoint Exceptions API
description: Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.
x-displayName: Security Elastic Endpoint exceptions
- name: Security Endpoint Management API
description: Interact with and manage endpoints running the Elastic Defend integration.
x-displayName: Security endpoint management
- name: Security Entity Analytics API
description: "Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.\n"
x-displayName: Security entity analytics
- name: Security Exceptions API
description: "Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts.\n\nExceptions are made up of:\n\n* **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.\n* **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert.\n\nFor detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated.\n> info\n> You cannot use lists with endpoint rule exceptions.\n\n> info\n> Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container.\n\n## Exceptions requirements\n\nBefore you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).\n"
x-displayName: Security exceptions
- name: Security Lists API
description: "Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.\n\nLists are made up of:\n\n* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used:\n * `boolean`\n * `byte`\n * `date`\n * `date_nanos`\n * `date_range`\n * `double`\n * `double_range`\n * `float`\n * `float_range`\n * `half_float`\n * `integer`\n * `integer_range`\n * `ip`\n * `ip_range`\n * `keyword`\n * `long`\n * `long_range`\n * `short`\n * `text`\n* **List items**: The values used to determine whether the exception prevents an alert from being generated.\n\nAll list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:\n1. `192.168.1.1`\n2. `192.168.1.3`\n3. `192.168.1.18`\n4. `192.168.1.12`\n5. `192.168.1.7`\n\nTo use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.\n> info\n> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.\n\n## Lists requirements\n\nBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.\n"
x-displayName: Security lists
- name: Security Osquery API
description: 'Run live queries, manage packs and saved queries.'
x-displayName: Security Osquery
- name: Security Timeline API
description: 'You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.'
x-displayName: Security timeline
- name: short url
description: Manage Kibana short URLs.
x-displayName: Short URLs
- name: slo
description: 'SLO APIs enable you to define, manage and track service-level objectives'
x-displayName: Service level objectives
- name: spaces
description: Manage your Kibana spaces.
externalDocs:
description: Space overview
url: https://www.elastic.co/guide/en/kibana/8.19/xpack-spaces.html
x-displayName: Spaces
- name: synthetics
description: Synthetics APIs enable you to check the status of your services and applications.
externalDocs:
description: Synthetic monitoring
url: https://www.elastic.co/guide/en/observability/8.19/monitor-uptime-synthetics.html
x-displayName: Synthetics
- name: system
description: "Get information about the system status, resource usage, features, and installed plugins.\n"
x-displayName: System
- name: task manager
description: 'Task manager APIs enable you to check the health of the Kibana task manager, which is used by features such as alerting, actions, and reporting to run mission critical work as persistent background tasks.'
externalDocs:
description: Task manager
url: https://www.elastic.co/guide/en/kibana/current/task-manager-production-considerations.html
x-displayName: Task manager
- name: upgrade
description: Check the upgrade status of your Elasticsearch cluster and reindex indices that were created in the previous major version. The assistant helps you prepare for the next major version of Elasticsearch.
x-displayName: Upgrade assistant
- name: uptime
description: Uptime APIs enable you to view and update uptime monitoring settings.
externalDocs:
description: Uptime monitoring
url: https://www.elastic.co/guide/en/observability/current/uptime-intro.html
x-displayName: Uptime
- name: user session
description: "Enables you to invalidate user sessions for security and session management purposes.\n"
x-displayName: User session management
x-topics:
- title: Kibana spaces
content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```\ncurl -X GET \"http://localhost:5601/s/marketing/api/data_views\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/guide/en/kibana/8.19/xpack-spaces.html).\n"