{
"openapi": "3.1.2",
"info": {
"title": "Kibana APIs",
"description": "The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.\nThe API calls are stateless.\nEach request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the\nrequest.\nAPI requests return JSON output, which is a format that is machine-readable and works well for automation.\n\nTo interact with Kibana APIs, use the following operations:\n\n- GET: Fetches the information.\n- PATCH: Applies partial modifications to the existing information.\n- POST: Adds new information.\n- PUT: Updates the existing information.\n- DELETE: Removes the information.\n\nYou can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.\nFor example:\n\n```\nGET kbn:/api/data_views\n```\n\nFor more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).\n\nNOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.\n\n## Documentation source and versions\n\nThis documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.\nIt is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).\n\nThis documentation contains work-in-progress information for future Elastic Stack releases.\n",
"contact": {
"name": "Kibana Team"
},
"version": "",
"x-doc-license": {
"name": "Attribution-NonCommercial-NoDerivatives 4.0 International",
"url": "https://creativecommons.org/licenses/by-nc-nd/4.0/"
},
"x-feedbackLink": {
"label": "Feedback",
"url": "https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+"
}
},
"servers": [
{
"url": "https://{kibana_url}",
"variables": {
"kibana_url": {
"default": "localhost:5601"
}
}
}
],
"paths": {
"/api/actions/connector_types": {
"get": {
"tags": [
"connectors"
],
"summary": "Get connector types",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/actions/connector_types
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou do not need any Kibana feature privileges to run this API.",
"operationId": "get-actions-connector-types",
"parameters": [
{
"name": "feature_id",
"in": "query",
"description": "A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).",
"schema": {
"maxLength": 100,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_connector_type_response"
}
},
"examples": {
"getConnectorTypesServerlessResponse": {
"$ref": "#/components/examples/get_connector_types_generativeai_response"
}
}
}
}
},
"403": {
"description": "Indicates that this call is forbidden."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/actions/connector/_oauth_callback": {
"get": {
"tags": [
"connectors"
],
"summary": "Handle OAuth callback",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nHandles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.
[Required authorization] Route required privileges: actions:oauth.",
"operationId": "get-actions-connector-oauth-callback",
"parameters": [
{
"name": "code",
"in": "query",
"description": "The authorization code returned by the OAuth provider.",
"schema": {
"type": "string"
}
},
{
"name": "state",
"in": "query",
"description": "The state parameter for CSRF protection.",
"schema": {
"type": "string"
}
},
{
"name": "error",
"in": "query",
"description": "Error code if the authorization failed.",
"schema": {
"type": "string"
}
},
{
"name": "error_description",
"in": "query",
"description": "Human-readable error description.",
"schema": {
"type": "string"
}
},
{
"name": "session_state",
"in": "query",
"description": "Session state from the OAuth provider (e.g., Microsoft).",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Returns an HTML callback page."
},
"302": {
"description": "Redirects to the return URL with authorization result query parameters."
},
"401": {
"description": "User is not authenticated."
}
},
"x-state": "Added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/actions/connector/_oauth_callback_script": {
"get": {
"summary": "",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.",
"operationId": "post-actions-connector-id-execute",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "An identifier for the connector.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_connector_execute_request"
},
"examples": {
"runIndexConnectorRequest": {
"$ref": "#/components/examples/run_index_connector_request"
},
"runJiraConnectorRequest": {
"$ref": "#/components/examples/run_jira_connector_request"
},
"runServerLogConnectorRequest": {
"$ref": "#/components/examples/run_servicenow_itom_connector_request"
},
"runSlackConnectorRequest": {
"$ref": "#/components/examples/run_slack_api_connector_request"
},
"runSwimlaneConnectorRequest": {
"$ref": "#/components/examples/run_swimlane_connector_request"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_connector_response"
},
"examples": {
"runIndexConnectorResponse": {
"$ref": "#/components/examples/run_index_connector_response"
},
"runJiraConnectorResponse": {
"$ref": "#/components/examples/run_jira_connector_response"
},
"runServerLogConnectorResponse": {
"$ref": "#/components/examples/run_server_log_connector_response"
},
"runServiceNowITOMConnectorResponse": {
"$ref": "#/components/examples/run_servicenow_itom_connector_response"
},
"runSlackConnectorResponse": {
"$ref": "#/components/examples/run_slack_api_connector_response"
},
"runSwimlaneConnectorResponse": {
"$ref": "#/components/examples/run_swimlane_connector_response"
}
}
}
}
},
"403": {
"description": "Indicates that this call is forbidden."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/actions/connectors": {
"get": {
"tags": [
"connectors"
],
"summary": "Get all connectors",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/actions/connectors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "get-actions-connectors",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_connector_response_with_references_count"
}
},
"examples": {
"getConnectorsResponse": {
"$ref": "#/components/examples/get_connectors_response"
}
}
}
}
},
"403": {
"description": "Indicates that this call is forbidden."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/a2a/{agentId}": {
"post": {
"tags": [
"agent builder"
],
"summary": "Send A2A task",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/agent_builder/a2a/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n> warn\n> This endpoint is designed for A2A protocol clients and should not be used directly via REST APIs. Use an A2A SDK or A2A Inspector instead.\nTo learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-a2a-agentid",
"parameters": [
{
"name": "agentId",
"in": "path",
"description": "The unique identifier of the agent to send the A2A task to.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": { },
"examples": {
"a2aTaskRequestExample": {
"description": "WARNING: DO NOT USE THIS ENDPOINT VIA REST API. These examples are auto-generated and should not be run. Integrate with A2A using an A2A SDK or A2A Inspector instead.",
"value": {
"id": "task-123",
"jsonrpc": "2.0",
"method": "complete",
"params": {
"messages": [
{
"content": "Hello from A2A protocol",
"role": "user"
}
]
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"a2aTaskResponseExample": {
"description": "Example response from A2A Task Endpoint with results of task execution",
"value": {
"id": "task-123",
"jsonrpc": "2.0",
"result": {
"conversation_id": "conv-456",
"response": {
"message": "Hello! How can I help you today?"
},
"type": "response"
}
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/a2a/{agentId}.json": {
"get": {
"tags": [
"agent builder"
],
"summary": "Get A2A agent card",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet agent discovery metadata in JSON format. Use this endpoint to provide agent information for A2A protocol integration and discovery. To learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all available agents. Use this endpoint to retrieve complete agent information including their current configuration and assigned tools. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-agents",
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"listAgentsResponseExample": {
"description": "Example response that returns one built-in Elastic agent and one created by the user",
"value": {
"results": [
{
"access_control": "null",
"configuration": {
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Elastic AI Agent",
"id": "elastic-ai-agent",
"name": "Elastic AI Agent",
"permissions": {
"update_access_control": false,
"update_agent": false
},
"type": "chat"
},
{
"access_control": {
"access_mode": "private",
"entries": [
{
"name": "alice",
"role": "manager",
"type": "user"
}
]
},
"avatar_color": "#BFDBFF",
"avatar_symbol": "SI",
"configuration": {
"instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Hi! I can help you search the data within the indices starting with \"content-\" prefix.",
"id": "created-agent-id",
"labels": [
"custom-indices",
"department-search"
],
"name": "Search Index Helper",
"permissions": {
"update_access_control": true,
"update_agent": true
},
"type": "chat"
}
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/agent_builder/agents\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/agent_builder/agents\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"agent builder"
],
"summary": "Create an agent",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/agent_builder/agents
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new agent. Use this endpoint to define the agent's behavior, appearance, and capabilities through comprehensive configuration options. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:manageAgents.",
"operationId": "post-agent-builder-agents",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name",
"description",
"configuration"
],
"type": "object",
"properties": {
"access_control": {
"required": [
"access_mode"
],
"type": "object",
"properties": {
"access_mode": {
"enum": [
"public",
"shared",
"private"
],
"type": "string",
"description": "Access-control mode: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write). Agents created without an access-control mode default to `private`.",
"x-state": "Generally available; added in 9.4.0"
}
},
"additionalProperties": false
},
"avatar_color": {
"type": "string",
"description": "Optional hex color code for the agent avatar."
},
"avatar_symbol": {
"type": "string",
"description": "Optional symbol/initials for the agent avatar."
},
"configuration": {
"required": [
"tools"
],
"type": "object",
"properties": {
"ai_indices": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string",
"description": "AI indices to associate with the agent."
},
"description": "Array of AI indices to associate with the agent."
},
"connector_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Connector ID to associate with the agent."
},
"description": "Array of connector IDs to associate with the agent."
},
"enable_elastic_capabilities": {
"type": "boolean",
"description": "When true, enables built-in Elastic capabilities for the agent."
},
"instructions": {
"type": "string",
"description": "Optional system instructions that define the agent behavior."
},
"plugin_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Plugin ID to assign to the agent."
},
"description": "Array of plugin IDs to assign to the agent."
},
"post_execution_workflow_ids": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 512,
"type": "string",
"description": "Optional list of workflow IDs. When set, these workflows run after the agent finishes each round."
}
},
"skill_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Skill ID to be available to the agent."
},
"description": "Array of skill IDs to be available to the agent."
},
"subagent_ids": {
"maxItems": 50,
"type": "array",
"items": {
"maxLength": 64,
"type": "string",
"description": "Agent ID this agent may spawn as a subagent via `run_subagent`. Use '_self' to enable self-fork."
},
"description": "Allowlist of subagent IDs this agent may spawn. Missing or empty disables the `run_subagent` tool. Use '_self' to enable self-fork.",
"x-state": "Generally available; added in 9.6.0"
},
"tools": {
"type": "array",
"items": {
"required": [
"tool_ids"
],
"type": "object",
"properties": {
"tool_ids": {
"type": "array",
"items": {
"type": "string",
"description": "Tool ID to be available to the agent."
},
"description": "Array of tool IDs that the agent can use."
}
},
"additionalProperties": false,
"description": "Tool selection configuration for the agent."
}
},
"workflow_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Optional list of workflow IDs. When set, these workflows run before every agent execution, in order."
}
}
},
"additionalProperties": false,
"description": "Configuration settings for the agent."
},
"description": {
"type": "string",
"description": "Description of what the agent does."
},
"id": {
"type": "string",
"description": "Unique identifier for the agent."
},
"labels": {
"type": "array",
"items": {
"type": "string",
"description": "Label for categorizing the agent."
},
"description": "Optional labels for categorizing and organizing agents."
},
"name": {
"type": "string",
"description": "Display name for the agent."
}
},
"additionalProperties": false
},
"examples": {
"createAgentRequestExample": {
"description": "Example request for creating a custom agent with special prompt and tools",
"value": {
"avatar_color": "#BFDBFF",
"avatar_symbol": "SI",
"configuration": {
"instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Hi! I can help you search the data within the indices starting with \"content-\" prefix.",
"id": "created-agent-id",
"labels": [
"custom-indices",
"department-search"
],
"name": "Search Index Helper"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"createAgentResponseExample": {
"description": "Example response returning the definition of an agent created as a result of the request",
"value": {
"avatar_color": "#BFDBFF",
"avatar_symbol": "SI",
"configuration": {
"instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Hi! I can help you search the data within the indices starting with \"content-\" prefix.",
"id": "created-agent-id",
"labels": [
"custom-indices",
"department-search"
],
"name": "Search Index Helper",
"type": "chat"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/agents\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"id\": \"new-agent-id\",\n \"name\": \"Search Index Helper\",\n \"description\": \"Hi! I can help you search the data within the indices starting with \\\"content-\\\" prefix.\",\n \"labels\": [\"custom-indices\", \"department-search\"],\n \"avatar_color\": \"#BFDBFF\",\n \"avatar_symbol\": \"SI\",\n \"configuration\": {\n \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n \"tools\": [\n {\n \"tool_ids\": [\n \"platform.core.search\",\n \"platform.core.list_indices\",\n \"platform.core.get_index_mapping\",\n \"platform.core.get_document_by_id\"\n ]\n }\n ]\n }\n}'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/agent_builder/agents\n{\n \"id\": \"new-agent-id\",\n \"name\": \"Search Index Helper\",\n \"description\": \"Hi! I can help you search the data within the indices starting with \\\"content-\\\" prefix.\",\n \"labels\": [\"custom-indices\", \"department-search\"],\n \"avatar_color\": \"#BFDBFF\",\n \"avatar_symbol\": \"SI\",\n \"configuration\": {\n \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n \"tools\": [\n {\n \"tool_ids\": [\n \"platform.core.search\",\n \"platform.core.list_indices\",\n \"platform.core.get_index_mapping\",\n \"platform.core.get_document_by_id\"\n ]\n }\n ]\n }\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/agents/{agent_id}/consumption": {
"post": {
"tags": [
"agent builder"
],
"summary": "Get agent consumption data",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns paginated, per-conversation token consumption data for a given agent. Includes input/output token counts, round counts, LLM call counts, and warnings for conversations with high token usage. Requires the manageAgents privilege. To learn more about monitoring agent token usage, refer to the [monitor usage documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/monitor-usage).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an agent by ID. This action cannot be undone. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:manageAgents.",
"operationId": "delete-agent-builder-agents-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The unique identifier of the agent to delete.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"deleteAgentResponseExample": {
"description": "Example response showing that deletion of the agent has been successful",
"value": {
"success": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X DELETE \"${KIBANA_URL}/api/agent_builder/agents/{id}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn://api/agent_builder/agents/{id}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"agent builder"
],
"summary": "Get an agent by ID",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/agent_builder/agents/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a specific agent by ID. Use this endpoint to retrieve the complete agent definition including all configuration details and tool assignments. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-agents-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier of the agent to retrieve.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"getAgentByIdResponseExample": {
"description": "Example response that an agent created by the user that will query elasticsearch indices starting with 'content-' prefix to answer the questions.",
"value": {
"access_control": {
"access_mode": "private",
"entries": [
{
"name": "alice",
"role": "manager",
"type": "user"
}
]
},
"avatar_color": "#BFDBFF",
"avatar_symbol": "SI",
"configuration": {
"instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Hi! I can help you search the data within the indices starting with \"content-\" prefix.",
"id": "created-agent-id",
"labels": [
"custom-indices",
"department-search"
],
"name": "Search Index Helper",
"permissions": {
"update_access_control": true,
"update_agent": true
},
"type": "chat"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/agent_builder/agents/{id}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/agent_builder/agents/{id}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"agent builder"
],
"summary": "Update an agent",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/agent_builder/agents/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing agent configuration. Use this endpoint to modify any aspect of the agent's behavior, appearance, or capabilities. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:manageAgents.",
"operationId": "put-agent-builder-agents-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The unique identifier of the agent to update.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"access_control": {
"required": [
"access_mode"
],
"type": "object",
"properties": {
"access_mode": {
"enum": [
"public",
"shared",
"private"
],
"type": "string",
"description": "Access-control mode: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write). Agents created without an access-control mode default to `private`.",
"x-state": "Generally available; added in 9.4.0"
}
},
"additionalProperties": false
},
"avatar_color": {
"type": "string",
"description": "Updated hex color code for the agent avatar."
},
"avatar_symbol": {
"type": "string",
"description": "Updated symbol/initials for the agent avatar."
},
"configuration": {
"type": "object",
"properties": {
"ai_indices": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string",
"description": "AI indices to associate with the agent."
},
"description": "Array of AI indices to associate with the agent."
},
"connector_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Connector ID to associate with the agent."
},
"description": "Array of connector IDs to associate with the agent."
},
"enable_elastic_capabilities": {
"type": "boolean",
"description": "When true, enables built-in Elastic capabilities for the agent."
},
"instructions": {
"type": "string",
"description": "Updated system instructions that define the agent behavior."
},
"plugin_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Plugin ID to assign to the agent."
},
"description": "Array of plugin IDs to assign to the agent."
},
"post_execution_workflow_ids": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 512,
"type": "string",
"description": "Updated list of workflow IDs. When set, these workflows run after the agent finishes each round."
}
},
"skill_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Skill ID to be available to the agent."
},
"description": "Array of skill IDs to be available to the agent."
},
"subagent_ids": {
"maxItems": 50,
"type": "array",
"items": {
"maxLength": 64,
"type": "string",
"description": "Agent ID this agent may spawn as a subagent via `run_subagent`. Use '_self' to enable self-fork."
},
"description": "Allowlist of subagent IDs this agent may spawn. Missing or empty disables the `run_subagent` tool. Use '_self' to enable self-fork.",
"x-state": "Generally available; added in 9.6.0"
},
"tools": {
"type": "array",
"items": {
"required": [
"tool_ids"
],
"type": "object",
"properties": {
"tool_ids": {
"type": "array",
"items": {
"type": "string",
"description": "Tool ID to be available to the agent."
},
"description": "Array of tool IDs that the agent can use."
}
},
"additionalProperties": false,
"description": "Tool selection configuration for the agent."
}
},
"workflow_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Updated list of workflow IDs. When set, these workflows run every agent execution, in order."
}
}
},
"additionalProperties": false,
"description": "Updated configuration settings for the agent."
},
"description": {
"type": "string",
"description": "Updated description of what the agent does."
},
"labels": {
"type": "array",
"items": {
"type": "string",
"description": "Updated label for categorizing the agent."
},
"description": "Updated labels for categorizing and organizing agents."
},
"name": {
"type": "string",
"description": "Updated display name for the agent."
}
},
"additionalProperties": false
},
"examples": {
"createAgentRequestExample": {
"description": "Example request for updating custom agent",
"value": {
"avatar_color": "#BFDBFF",
"avatar_symbol": "SI",
"configuration": {
"instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Updated description - Search for anything in \"content-*\" indices!",
"id": "created-agent-id",
"labels": [
"custom-indices",
"department-search",
"elastic-employees"
],
"name": "Search Index Helper"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"updateAgentResponseExample": {
"description": "Example response returning the agent definition with the changes applied from the request",
"value": {
"avatar_color": "#BFDBFF",
"avatar_symbol": "SI",
"configuration": {
"instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
"tools": [
{
"tool_ids": [
"platform.core.search",
"platform.core.list_indices",
"platform.core.get_index_mapping",
"platform.core.get_document_by_id"
]
}
]
},
"description": "Updated description - Search for anything in \"content-*\" indices!",
"id": "created-agent-id",
"labels": [
"custom-indices",
"department-search",
"elastic-employees"
],
"name": "Search Index Helper",
"type": "chat"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X PUT \"${KIBANA_URL}/api/agent_builder/agents/{id}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"name\": \"Search Index Helper\",\n \"description\": \"Updated description - Search for anything in \\\"content-*\\\" indices!\",\n \"labels\": [\"custom-indices\", \"department-search\", \"elastic-employees\"],\n \"avatar_color\": \"#BFDBFF\",\n \"avatar_symbol\": \"SI\",\n \"configuration\": {\n \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n \"tools\": [{\n \"tool_ids\": [\n \"platform.core.search\",\n \"platform.core.list_indices\",\n \"platform.core.get_index_mapping\",\n \"platform.core.get_document_by_id\"\n ]\n }]\n }\n }'\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/agent_builder/agents/{id}\n{\n \"name\": \"Search Index Helper\",\n \"description\": \"Updated description - Search for anything in \\\"content-*\\\" indices!\",\n \"labels\": [\"custom-indices\", \"department-search\", \"elastic-employees\"],\n \"avatar_color\": \"#BFDBFF\",\n \"avatar_symbol\": \"SI\",\n \"configuration\": {\n \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n \"tools\": [{\n \"tool_ids\": [\n \"platform.core.search\",\n \"platform.core.list_indices\",\n \"platform.core.get_index_mapping\",\n \"platform.core.get_document_by_id\"\n ]\n }]\n }\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/agents/{id}/access_control": {
"get": {
"tags": [
"agent builder"
],
"summary": "Get an agent's access control list",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the access control for a specific agent. Callers without permission to manage access control receive `permissions.update_access_control: false` and only their own entry. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-agents-id-access-control",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier of the agent whose access control to retrieve.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"getAgentAccessControlMaskedResponseExample": {
"description": "Example response for a caller without manage permission — only the caller's own entry is returned.",
"value": {
"access_control": {
"access_mode": "private",
"entries": [
{
"added_at": "2026-02-11T10:15:00.000Z",
"id": "u_bob_profile_uid",
"role": "user",
"type": "user"
}
]
},
"permissions": {
"update_access_control": false
}
}
},
"getAgentAccessControlResponseExample": {
"description": "Example response for a caller who can manage access control — the agent has two grantees keyed on their Kibana user profile uid.",
"value": {
"access_control": {
"access_mode": "private",
"entries": [
{
"added_at": "2026-02-11T10:15:00.000Z",
"id": "u_alice_profile_uid",
"role": "editor",
"type": "user"
},
{
"added_at": "2026-02-11T10:15:00.000Z",
"id": "u_bob_profile_uid",
"role": "user",
"type": "user"
}
]
},
"permissions": {
"update_access_control": true
}
}
}
}
}
}
},
"404": {
"description": "Not Found — no agent with this ID is visible to the caller. Matches the existing `agentNotFound` shape, so unprivileged callers cannot probe for hidden agents.",
"content": {
"application/json": {
"examples": {
"agentNotFoundResponseExample": {
"value": {
"attributes": {
"trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
},
"error": "Not Found",
"message": "Agent custom-agent-id not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/agent_builder/agents/{id}/access_control\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/agent_builder/agents/{id}/access_control\n"
}
],
"x-state": "Generally available; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"agent builder"
],
"summary": "Update an agent's access control list",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReplace the per-agent access-control entries. Each entry grants one user a role on this agent. Identify the user by their Kibana user profile uid (`id`). Entries created before profile uids were adopted may use `name` (deprecated) instead. The agent owner, cluster admins, and anyone access control grants Manager can call this endpoint. Each call replaces the entire entries list — the most recent successful update wins. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).
[Required authorization] Route required privileges: agentBuilder:manageAgents.",
"operationId": "put-agent-builder-agents-id-access-control",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The unique identifier of the agent whose access control to update.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"entries"
],
"type": "object",
"properties": {
"entries": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"role"
],
"type": "object",
"properties": {
"id": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Stable identifier of the user to grant access to (Kibana user profile uid). Preferred over `name`.",
"x-state": "Generally available; added in 9.6.0"
},
"name": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Case-sensitive Kibana username of the user to grant access to. Still supported, but `id` is preferred for new grants because a username cannot distinguish same-named users across authentication realms."
},
"role": {
"enum": [
"user",
"editor",
"manager"
],
"type": "string",
"description": "Role granted to the principal. Roles are hierarchical: `user` allows viewing, listing, reading, and running the agent; `editor` adds updating the agent configuration; `manager` adds deleting the agent and managing its access control."
},
"type": {
"enum": [
"user"
],
"type": "string"
}
},
"additionalProperties": false
},
"description": "Access-control entries to apply to the agent. Each entry has a `type` (for example `user`), a `role`, and either an `id` (the principal user profile uid, preferred) or a deprecated `name` (username)."
}
},
"additionalProperties": false
},
"examples": {
"clearAgentAccessControlRequestExample": {
"description": "Submit an empty entries list to remove all custom grants. Access then falls back to the agent's access-control mode.",
"value": {
"entries": [ ]
}
},
"updateAgentAccessControlRequestExample": {
"description": "Example request granting two users access to the agent by their Kibana user profile uid — Alice as Editor (can update the agent configuration), Bob as User (can run the agent).",
"value": {
"entries": [
{
"id": "u_alice_profile_uid",
"role": "editor",
"type": "user"
},
{
"id": "u_bob_profile_uid",
"role": "user",
"type": "user"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"updateAgentAccessControlResponseExample": {
"description": "Example response returning the persisted access control after the update.",
"value": {
"access_mode": "private",
"entries": [
{
"added_at": "2026-02-11T10:15:00.000Z",
"id": "u_alice_profile_uid",
"role": "editor",
"type": "user"
},
{
"added_at": "2026-02-11T10:15:00.000Z",
"id": "u_bob_profile_uid",
"role": "user",
"type": "user"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad Request — the request body failed validation, or the request targets the built-in Elastic default agent (which cannot have custom access control).",
"content": {
"application/json": {
"examples": {
"accessControlOnDefaultAgentResponseExample": {
"description": "The built-in Elastic default agent (`elastic-ai-agent`) cannot have custom access control — its access is governed by the platform, not per-agent grants.",
"value": {
"attributes": {
"trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
},
"error": "Bad Request",
"message": "The default agent (elastic-ai-agent) does not support custom access controls.",
"statusCode": 400
}
},
"tooManyEntriesResponseExample": {
"description": "Request body exceeds the 100-entry maximum.",
"value": {
"error": "Bad Request",
"message": "[request body.entries]: array size is [101], but cannot be greater than [100]",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found — no agent with this ID is visible to the caller, or the caller lacks write access. Matches the existing `agentNotFound` shape so unprivileged callers cannot probe for hidden agents.",
"content": {
"application/json": {
"examples": {
"agentNotFoundResponseExample": {
"value": {
"attributes": {
"trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
},
"error": "Not Found",
"message": "Agent custom-agent-id not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X PUT \"${KIBANA_URL}/api/agent_builder/agents/{id}/access_control\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"entries\": [\n { \"type\": \"user\", \"id\": \"u_alice_profile_uid\", \"role\": \"editor\" },\n { \"type\": \"user\", \"id\": \"u_bob_profile_uid\", \"role\": \"user\" }\n ]\n }'\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/agent_builder/agents/{id}/access_control\n{\n \"entries\": [\n { \"type\": \"user\", \"id\": \"u_alice_profile_uid\", \"role\": \"editor\" },\n { \"type\": \"user\", \"id\": \"u_bob_profile_uid\", \"role\": \"user\" }\n ]\n}\n"
}
],
"x-state": "Generally available; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations": {
"get": {
"tags": [
"agent builder"
],
"summary": "List conversations",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/agent_builder/conversations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all conversations for a user. Use the optional agent ID to filter conversations by a specific agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate an empty conversation without sending a message. Returns the created conversation immediately. Use this to obtain a conversation ID before starting a chat session. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-conversations",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"access_control": {
"required": [
"access_mode"
],
"type": "object",
"properties": {
"access_mode": {
"enum": [
"private",
"public"
],
"type": "string",
"description": "Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation's agent can read and continue it)."
},
"entries": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"id",
"role"
],
"type": "object",
"properties": {
"id": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access."
},
"role": {
"enum": [
"member"
],
"type": "string",
"description": "Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation."
},
"type": {
"enum": [
"user"
],
"type": "string"
}
},
"additionalProperties": false
},
"description": "Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected."
}
},
"additionalProperties": false,
"description": "Optional access control settings. Defaults to private."
},
"agent_id": {
"maxLength": 64,
"type": "string",
"description": "The ID of the agent to associate with the conversation. Defaults to the default Elastic AI agent."
},
"conversation_id": {
"maxLength": 256,
"type": "string",
"description": "Optional client-supplied UUID for the conversation. Server-generated if omitted."
},
"metadata": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 2000,
"type": "string"
}
}
]
},
"description": "Initial metadata values. Each key must be declared by the referenced template; each value is validated against the field definition (type, options, min/max, regex, max_length). Requires `template_id`."
},
"template_id": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Optional ID of a conversation template to apply. When set, the template seeds default metadata and any caller-supplied `metadata` is validated against the template field definitions."
},
"title": {
"maxLength": 500,
"type": "string",
"description": "Title for the conversation. Defaults to \"New conversation\"."
}
},
"additionalProperties": false
},
"examples": {
"createConversationFromTemplateExample": {
"description": "Example request applying a conversation template and seeding metadata (each key must be declared by the template)",
"value": {
"metadata": {
"on_call": true,
"services": [
"checkout",
"payments"
],
"severity": "high"
},
"template_id": "incident-response",
"title": "Incident triage"
}
},
"createConversationRequestExample": {
"description": "Example request for creating a private shared conversation with a custom title and two members",
"value": {
"access_control": {
"access_mode": "private",
"entries": [
{
"id": "u_abc123_uid",
"role": "member",
"type": "user"
},
{
"id": "u_def456_uid",
"role": "member",
"type": "user"
}
]
},
"title": "My new conversation"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"createConversationResponseExample": {
"description": "Example response returning the newly created conversation",
"value": {
"access_control": {
"access_mode": "private",
"entries": [
{
"added_at": "2026-08-14T10:00:00.000Z",
"id": "u_abc123_uid",
"role": "member",
"type": "user"
},
{
"added_at": "2026-08-14T10:00:00.000Z",
"id": "u_def456_uid",
"role": "member",
"type": "user"
}
]
},
"agent_id": "elastic-ai-agent",
"created_at": "2026-08-14T10:00:00.000Z",
"id": "bcc176c5-38f6-40be-be0c-898e34fa1480",
"permissions": {
"delete": true,
"rename": true
},
"rounds": [ ],
"title": "My new conversation",
"updated_at": "2026-08-14T10:00:00.000Z",
"user": {
"username": "elastic"
}
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/conversations\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"title\": \"My new conversation\",\n \"access_control\": {\n \"access_mode\": \"private\",\n \"entries\": [{ \"type\": \"user\", \"id\": \"u_abc123_uid\", \"role\": \"member\" }]\n }\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/agent_builder/conversations\n{\n \"title\": \"My new conversation\",\n \"access_control\": {\n \"access_mode\": \"private\",\n \"entries\": [{ \"type\": \"user\", \"id\": \"u_abc123_uid\", \"role\": \"member\" }]\n }\n}\n"
}
],
"x-state": "Added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations/{conversation_id}": {
"delete": {
"tags": [
"agent builder"
],
"summary": "Delete conversation by ID",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a conversation by ID. This action cannot be undone. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "delete-agent-builder-conversations-conversation-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation to delete.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"deleteConversationResponseExample": {
"description": "Example response showing that deletion of conversation has been successful",
"value": {
"success": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X DELETE \"${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn://api/agent_builder/conversations/{conversation_id}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"agent builder"
],
"summary": "Get conversation by ID",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a specific conversation by ID. Use this endpoint to retrieve the complete conversation history including all messages and metadata. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-conversations-conversation-id",
"parameters": [
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation to retrieve.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"getConversationByIdResponseExample": {
"description": "Example response containing the contents of a convesation with the chat agent",
"value": {
"agent_id": "elastic-ai-agent",
"created_at": "2025-09-19T17:45:39.554Z",
"id": "bcc176c5-38f6-40be-be0c-898e34fa1480",
"permissions": {
"delete": true,
"rename": true
},
"rounds": [
{
"feedback": {
"chips": [
"accurate",
"useful"
],
"comment": "",
"submitted_at": "2025-09-19T17:46:12.000Z",
"vote": "up"
},
"id": "170ec3b2-0f5a-4538-8b60-549572386d2a",
"input": {
"message": "Hello, how are you?"
},
"response": {
"message": "Since this is a general greeting that doesn't require any organizational or product-specific information, I can respond without using tools.\n\nHello! I'm doing well, thank you for asking. I'm here to help you with any questions you may have. How can I assist you today?"
},
"steps": [ ]
}
],
"title": "General Greeting",
"updated_at": "2025-09-19T17:45:39.554Z",
"user": {
"username": "elastic"
}
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/agent_builder/conversations/{conversation_id}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations/{conversation_id}/_add_events": {
"post": {
"tags": [
"agent builder"
],
"summary": "Add events to a conversation",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAppend custom events to a conversation's timeline. The caller must be the owner, a member, or the conversation must be public. Server assigns id, created_at, and actor for each event; the body provides type and data. Only registered custom event types are accepted — built-in lifecycle types are rejected. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-conversations-conversation-id-add-events",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"events"
],
"type": "object",
"properties": {
"events": {
"maxItems": 10,
"minItems": 1,
"type": "array",
"items": {
"required": [
"type",
"data"
],
"type": "object",
"properties": {
"data": {
"type": "object",
"description": "The event payload. Its shape is defined by the event type."
},
"type": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The registered custom event type."
}
},
"additionalProperties": false
},
"description": "Events to append. Between 1 and 10."
}
},
"additionalProperties": false
},
"examples": {
"addEventsRequestExample": {
"description": "Example request appending two custom events to a conversation",
"value": {
"events": [
{
"data": {
"text": "First note on this conversation"
},
"type": "text_note"
},
{
"data": {
"text": "Second note on this conversation"
},
"type": "text_note"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"addEventsResponseExample": {
"description": "Example response returning the materialized events with server-assigned fields",
"value": {
"events": [
{
"actor": {
"id": "u_abc123_uid",
"type": "user",
"username": "elastic"
},
"created_at": "2026-09-14T10:00:00.000Z",
"data": {
"text": "First note on this conversation"
},
"id": "7d3f1a2b-4c5e-6f7a-8b9c-0d1e2f3a4b5c",
"type": "text_note"
},
{
"actor": {
"id": "u_abc123_uid",
"type": "user",
"username": "elastic"
},
"created_at": "2026-09-14T10:00:00.000Z",
"data": {
"text": "Second note on this conversation"
},
"id": "8e4f2b3c-5d6f-7a8b-9c0d-1e2f3a4b5c6d",
"type": "text_note"
}
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/conversations/${CONVERSATION_ID}/_add_events\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"elastic-api-version: 2023-10-31\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"events\": [\n { \"type\": \"text_note\", \"data\": { \"text\": \"A note on this conversation\" } }\n ]\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/agent_builder/conversations/${CONVERSATION_ID}/_add_events\n{\n \"events\": [\n { \"type\": \"text_note\", \"data\": { \"text\": \"A note on this conversation\" } }\n ]\n}\n"
}
],
"x-state": "Technical Preview; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations/{conversation_id}/access_control": {
"put": {
"tags": [
"agent builder"
],
"summary": "Update a conversation's access control",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReplace a conversation's access mode and member list. Only the conversation owner can call this endpoint; every other caller receives a not-found response. Each call replaces the entire access control — the most recent successful update wins. Members can read and continue the conversation, but still need access to the conversation's agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "put-agent-builder-conversations-conversation-id-access-control",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation whose access control to update.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"access_mode",
"entries"
],
"type": "object",
"properties": {
"access_mode": {
"enum": [
"private",
"public"
],
"type": "string",
"description": "Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation's agent can read and continue it)."
},
"entries": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"id",
"role"
],
"type": "object",
"properties": {
"id": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access."
},
"role": {
"enum": [
"member"
],
"type": "string",
"description": "Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation."
},
"type": {
"enum": [
"user"
],
"type": "string"
}
},
"additionalProperties": false
},
"description": "Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected."
}
},
"additionalProperties": false
},
"examples": {
"publishConversationRequestExample": {
"description": "Switch the conversation to `public` so any user with access to its agent can read and continue it. A public conversation is already open to everyone with agent access, so `entries` must be empty.",
"value": {
"access_mode": "public",
"entries": [ ]
}
},
"shareConversationRequestExample": {
"description": "Example request sharing a private conversation with two users. They can read and continue the conversation, provided they also have access to its agent.",
"value": {
"access_mode": "private",
"entries": [
{
"id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
"role": "member",
"type": "user"
},
{
"id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
"role": "member",
"type": "user"
}
]
}
},
"unshareConversationRequestExample": {
"description": "Submit an empty entries list to remove every member. Access then falls back to the access mode alone.",
"value": {
"access_mode": "private",
"entries": [ ]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"updateConversationAccessControlResponseExample": {
"description": "Example response returning the persisted access control. `added_at` is stamped by the server for newly added members and preserved for members that were already listed.",
"value": {
"access_mode": "private",
"entries": [
{
"added_at": "2026-08-11T10:00:00.000Z",
"id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0",
"role": "member",
"type": "user"
},
{
"added_at": "2026-08-11T11:30:00.000Z",
"id": "u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0",
"role": "member",
"type": "user"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad Request — the request body failed validation.",
"content": {
"application/json": {
"examples": {
"duplicateEntryResponseExample": {
"description": "Two entries name the same user id.",
"value": {
"error": "Bad Request",
"message": "Duplicate ACL entry for user \"u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\"",
"statusCode": 400
}
},
"entriesWithPublicModeResponseExample": {
"description": "`entries` must be empty when `access_mode` is `public` — a public conversation is already open to everyone with agent access.",
"value": {
"error": "Bad Request",
"message": "ACL entries are not supported when access_mode is \"public\"",
"statusCode": 400
}
},
"tooManyEntriesResponseExample": {
"description": "Request body exceeds the 100-member maximum.",
"value": {
"error": "Bad Request",
"message": "[request body.entries]: array size is [101], but cannot be greater than [100]",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found — no conversation with this ID is readable by the caller, or the caller is not its owner. Matches the existing `conversationNotFound` shape, so members cannot distinguish a conversation they may not re-share from one that does not exist.",
"content": {
"application/json": {
"examples": {
"conversationNotFoundResponseExample": {
"value": {
"attributes": {
"trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
},
"error": "Not Found",
"message": "Conversation my-conversation-id not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X PUT \"${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}/access_control\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"access_mode\": \"private\",\n \"entries\": [\n { \"type\": \"user\", \"id\": \"u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\", \"role\": \"member\" }\n ]\n }'\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/agent_builder/conversations/{conversation_id}/access_control\n{\n \"access_mode\": \"private\",\n \"entries\": [\n { \"type\": \"user\", \"id\": \"u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\", \"role\": \"member\" }\n ]\n}\n"
}
],
"x-state": "Generally available; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations/{conversation_id}/attachments": {
"get": {
"tags": [
"agent builder"
],
"summary": "List conversation attachments",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all attachments for a conversation. Use the optional include_deleted query parameter to include soft-deleted attachments.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new attachment for a conversation with version tracking.
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-conversations-conversation-id-attachments",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"type",
"data"
],
"type": "object",
"properties": {
"data": {
"description": "The attachment data/content. Required unless origin is provided."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Human-readable description of the attachment."
},
"hidden": {
"type": "boolean",
"description": "Whether the attachment should be hidden from the user."
},
"id": {
"maxLength": 256,
"type": "string",
"description": "Optional custom ID for the attachment."
},
"origin": {
"maxLength": 2048,
"type": "string",
"description": "Origin string (for example, saved object ID) for by-reference attachments. When provided without data, the content is resolved once at creation time."
},
"render_inline": {
"type": "boolean",
"description": "When true, the attachment is rendered inline in the UI when the conversation is opened, without the agent referencing it.",
"default": false
},
"type": {
"maxLength": 256,
"type": "string",
"description": "The type of the attachment (e.g., text, esql, visualization)."
}
},
"additionalProperties": false
},
"examples": {
"createHiddenAttachmentExample": {
"description": "Example request for creating a hidden attachment",
"value": {
"data": "Internal system data",
"description": "System context",
"hidden": true,
"type": "text"
}
},
"createJsonAttachmentExample": {
"description": "Example request for creating a JSON attachment with custom ID",
"value": {
"data": {
"configuration": {
"enabled": true,
"threshold": 50
},
"metadata": {
"source": "user_input"
}
},
"description": "Application settings",
"id": "custom-attachment-id",
"type": "json"
}
},
"createTextAttachmentExample": {
"description": "Example request for creating a text attachment",
"value": {
"data": "This is the content of my text attachment",
"description": "Meeting notes",
"type": "text"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"createAttachmentResponseExample": {
"description": "Example response returning the created attachment",
"value": {
"attachment": {
"active": true,
"current_version": 1,
"description": "Meeting notes",
"id": "att-abc123",
"type": "text",
"versions": [
{
"content_hash": "sha256-xyz",
"created_at": "2025-01-06T10:00:00.000Z",
"data": "This is the content of my text attachment",
"estimated_tokens": 12,
"version": 1
}
]
}
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}": {
"delete": {
"tags": [
"agent builder"
],
"summary": "Delete conversation attachment",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an attachment. By default performs a soft delete (can be restored). Use permanent=true to permanently remove unreferenced attachments.
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "delete-agent-builder-conversations-conversation-id-attachments-attachment-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
},
{
"name": "attachment_id",
"in": "path",
"description": "The unique identifier of the attachment to delete.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
},
{
"name": "permanent",
"in": "query",
"description": "If true, permanently removes the attachment (only for unreferenced attachments).",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"permanentDeleteAttachmentResponseExample": {
"description": "Example response for permanent delete (cannot be restored)",
"value": {
"permanent": true,
"success": true
}
},
"softDeleteAttachmentResponseExample": {
"description": "Example response for soft delete (can be restored)",
"value": {
"permanent": false,
"success": true
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"agent builder"
],
"summary": "Get conversation attachment",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a single attachment by ID for a conversation.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRename an attachment without creating a new version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an attachment content. Creates a new version if content changed.
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "put-agent-builder-conversations-conversation-id-attachments-attachment-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
},
{
"name": "attachment_id",
"in": "path",
"description": "The unique identifier of the attachment to update.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"description": "The new attachment data/content."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Optional new description for the attachment."
},
"render_inline": {
"type": "boolean",
"description": "When true, the attachment is rendered inline in the UI when the conversation is opened, without the agent referencing it.",
"default": false
}
},
"additionalProperties": false
},
"examples": {
"updateAttachmentContentExample": {
"description": "Example request for updating attachment content",
"value": {
"data": "This is the updated content"
}
},
"updateAttachmentWithDescriptionExample": {
"description": "Example request for updating both content and description",
"value": {
"data": "New content version",
"description": "Updated meeting notes - v2"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"updateAttachmentResponseExample": {
"description": "Example response returning the updated attachment with new version",
"value": {
"attachment": {
"active": true,
"current_version": 2,
"description": "Meeting notes",
"id": "att-abc123",
"type": "text",
"versions": [
{
"content_hash": "sha256-abc",
"created_at": "2025-01-06T10:00:00.000Z",
"data": "Original content",
"estimated_tokens": 10,
"version": 1
},
{
"content_hash": "sha256-def",
"created_at": "2025-01-06T11:00:00.000Z",
"data": "This is the updated content",
"estimated_tokens": 12,
"version": 2
}
]
},
"new_version": 2
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/_restore": {
"post": {
"tags": [
"agent builder"
],
"summary": "Restore deleted attachment",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the origin reference for an attachment. Use this after saving a by-value attachment to link it to its persistent store.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nChecks staleness for the latest version of all conversation attachments against their origin snapshot.
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-conversations-conversation-id-attachments-stale",
"parameters": [
{
"name": "conversation_id",
"in": "path",
"description": "The unique identifier of the conversation.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"checkStaleAttachmentsResponseExample": {
"description": "Mixed conversation: attachments without a stale source return only id and is_stale. When a staleness check fails for one attachment, is_stale is false and an error explains why. When an origin-backed attachment is out of date, the response includes type, origin, and resolved data (here a simple text body) for resync.",
"value": {
"attachments": [
{
"id": "att-text-meeting-notes",
"is_stale": false
},
{
"id": "att-lens-active-users",
"is_stale": false
},
{
"error": "Origin could not be resolved",
"id": "att-query-attachment",
"is_stale": false
},
{
"data": "This is the content of my text attachment",
"hidden": false,
"id": "att-text-runbook",
"is_stale": true,
"origin": "document:hr-onboarding-v2",
"type": "text"
}
]
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/converse": {
"post": {
"tags": [
"agent builder"
],
"summary": "Send chat message",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/agent_builder/converse
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSend a message to an agent and receive a complete response. This synchronous endpoint waits for the agent to fully process your request before returning the final result. Use this for simple chat interactions where you need the complete response. To learn more about agent chat, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-converse",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"_execution_mode": {
"enum": [
"local",
"task_manager"
],
"type": "string",
"description": "define how to execute the agent (local execution or via task_manager)",
"x-state": "Experimental; added in 9.4.0"
},
"access_control": {
"required": [
"access_mode"
],
"type": "object",
"properties": {
"access_mode": {
"enum": [
"private",
"public"
],
"type": "string",
"description": "Access mode to apply when creating a new conversation. Set to public to make the conversation visible to other users who can access the underlying agent. This setting is ignored when continuing an existing conversation."
}
},
"additionalProperties": false,
"description": "Optional conversation access control. Defaults to private.",
"x-state": "Generally available; added in 9.5.0"
},
"action": {
"enum": [
"regenerate"
],
"type": "string",
"description": "Deprecated and ignored. The \"regenerate\" action has been removed; the field is still accepted for backward compatibility.",
"deprecated": true
},
"agent_id": {
"type": "string",
"description": "The ID of the agent to chat with. Defaults to the default Elastic AI agent.",
"default": "elastic-ai-agent"
},
"attachments": {
"type": "array",
"items": {
"required": [
"type"
],
"type": "object",
"properties": {
"data": {
"type": "object",
"additionalProperties": { },
"description": "Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time)."
},
"description": {
"maxLength": 1024,
"type": "string",
"description": "Human-readable label for the attachment."
},
"group_id": {
"maxLength": 256,
"type": "string",
"description": "Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity."
},
"hidden": {
"type": "boolean",
"description": "When true, the attachment will not be displayed in the UI."
},
"id": {
"type": "string",
"description": "Optional id for the attachment."
},
"origin": {
"type": "string",
"description": "Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook."
},
"type": {
"type": "string",
"description": "Type of the attachment."
}
},
"additionalProperties": false
},
"description": "Optional attachments to send with the message.",
"x-state": "Technical Preview; added in 9.3.0"
},
"browser_api_tools": {
"type": "array",
"items": {
"required": [
"id",
"description",
"schema"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Description of what the browser API tool does."
},
"id": {
"type": "string",
"description": "Unique identifier for the browser API tool."
},
"schema": {
"description": "JSON Schema defining the tool parameters (JsonSchema7Type)."
}
},
"additionalProperties": false
},
"description": "Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side."
},
"configuration_overrides": {
"type": "object",
"properties": {
"enable_elastic_capabilities": {
"type": "boolean",
"description": "Whether to enable built-in Elastic skills for this execution."
},
"instructions": {
"type": "string",
"description": "Custom instructions for the agent."
},
"skill_ids": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Skill IDs to enable for this execution, replacing the stored skill list. Note: only fully restricts the available skill set when enable_elastic_capabilities is also set to false."
},
"tools": {
"type": "array",
"items": {
"required": [
"tool_ids"
],
"type": "object",
"properties": {
"tool_ids": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
"description": "Tool selection to enable for this execution."
}
},
"additionalProperties": false,
"description": "Runtime configuration overrides. These override the stored agent configuration for this execution only."
},
"connector_id": {
"type": [
"null",
"string"
],
"description": "Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one."
},
"conversation_id": {
"maxLength": 256,
"type": "string",
"description": "Optional existing conversation ID to continue a previous conversation."
},
"execution_id": {
"type": "string",
"description": "Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID."
},
"inference_id": {
"type": [
"null",
"string"
],
"description": "Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`."
},
"input": {
"maxLength": 100000,
"type": "string",
"description": "The user input message to send to the agent."
},
"project_routing": {
"maxLength": 2048,
"type": "string",
"description": "Cross-project search routing expression resolved from the header project picker, applied to the run's searches. Serverless (CPS) only; ignored elsewhere."
},
"prompts": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"required": [
"allow"
],
"type": "object",
"properties": {
"allow": {
"type": "boolean"
}
},
"additionalProperties": false
},
{
"required": [
"authorized"
],
"type": "object",
"properties": {
"authorized": {
"type": "boolean"
}
},
"additionalProperties": false
},
{
"required": [
"answers"
],
"type": "object",
"properties": {
"answers": {
"maxItems": 100,
"type": "array",
"items": {
"type": "object",
"properties": {
"choice": {
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
"custom": {
"maxLength": 20000,
"minLength": 1,
"type": "string"
},
"skipped": {
"type": "boolean"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false,
"description": "Answers to an `ask_user_question` prompt; one entry per question, in order.",
"x-state": "Technical Preview"
}
]
},
"description": "Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt."
},
"read_only": {
"type": "boolean",
"description": "When true, the created conversation is presented as read-only in the UI: its history is shown but no message input is offered. This carries no authorization meaning — the conversation can still be continued through the API. This setting is ignored when continuing an existing conversation.",
"x-state": "Technical Preview; added in 9.6.0"
},
"reasoning_level": {
"enum": [
"none",
"minimal",
"low",
"medium",
"high",
"xhigh"
],
"type": "string",
"description": "Reasoning effort level for the LLM. One of: none, minimal, low, medium, high, xhigh. Support depends on the underlying model and provider.",
"x-state": "Experimental; added in 9.6.0"
}
},
"additionalProperties": false
},
"examples": {
"conversePublicRequestExample": {
"description": "Example request to create a public conversation",
"value": {
"access_control": {
"access_mode": "public"
},
"agent_id": "elastic-ai-agent",
"connector_id": "my-connector-id",
"input": "What is Elasticsearch?"
}
},
"converseRequestExample": {
"description": "Example request to send a message to the agent as a part of the conversation",
"value": {
"agent_id": "elastic-ai-agent",
"connector_id": "my-connector-id",
"input": "What is Elasticsearch?"
}
},
"converseRequestInferenceExample": {
"description": "Example using inference_id (mutually exclusive with connector_id)",
"value": {
"agent_id": "elastic-ai-agent",
"inference_id": "my-inference-endpoint-id",
"input": "What is Elasticsearch?"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"converseResponseExample": {
"description": "Example response containing the chain of events representing a conversation with the agent",
"value": {
"access_control": {
"access_mode": "private"
},
"conversation_id": "696ccd6d-4bff-4b26-a62e-522ccf2dcd16",
"response": {
"message": "Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease."
},
"steps": [
{
"reasoning": "Searching for official documentation or content that explains what Elasticsearch is",
"type": "reasoning"
},
{
"params": {
"query": "what is elasticsearch definition overview introduction"
},
"progression": [
{
"message": "Selecting the best target for this query"
}
],
"results": [
{
"data": {
"message": "Could not figure out which index to use"
},
"type": "error"
}
],
"tool_call_id": "tooluse_shOdUwKIRwC9YhqGzeg0cQ",
"tool_id": "platform.core.search",
"type": "tool_call"
}
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/converse\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"input\": \"What is Elasticsearch?\",\n \"agent_id\": \"elastic-ai-agent\",\n \"access_control\": {\n \"access_mode\": \"public\"\n }\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/agent_builder/converse\n{\n \"input\": \"What is Elasticsearch?\",\n \"agent_id\": \"elastic-ai-agent\",\n \"access_control\": {\n \"access_mode\": \"public\"\n }\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/converse/async": {
"post": {
"tags": [
"agent builder"
],
"summary": "Send chat message (streaming)",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSend a message to an agent and receive real-time streaming events. This asynchronous endpoint provides live updates as the agent processes your request, allowing you to see intermediate steps and progress. Use this for interactive experiences where you want to monitor the agent's thinking process.\n\n## Event types\n\nThe endpoint emits Server-Sent Events (SSE) with the following custom event types:\n\n`conversation_id_set`\n\nSets the conversation ID.\n\nSchema:\n```json\n{\n \"conversation_id\": \"uuid\"\n}\n```\n\n---\n\n`conversation_created`\n\nFires when a new conversation is persisted and assigned an ID.\n\nSchema:\n```json\n{\n \"conversation_id\": \"uuid\",\n \"title\": \"conversation title\"\n}\n```\n\n---\n\n`conversation_updated`\n\nFires when a conversation is updated.\n\nSchema:\n```json\n{\n \"conversation_id\": \"uuid\",\n \"title\": \"updated conversation title\"\n}\n```\n\n---\n\n`reasoning`\n\nHandles reasoning-related data.\n\nSchema:\n```json\n{\n \"reasoning\": \"plain text reasoning content\",\n \"transient\": false\n}\n```\n\n---\n\n`tool_call`\n\nTriggers when a tool is invoked.\n\nSchema:\n```json\n{\n \"tool_call_id\": \"uuid\",\n \"tool_id\": \"tool_name\",\n \"params\": {}\n}\n```\n\n---\n\n`tool_progress`\n\nReports progress of a running tool.\n\nSchema:\n```json\n{\n \"tool_call_id\": \"uuid\",\n \"message\": \"progress message\"\n}\n```\n\n---\n\n`tool_result`\n\nReturns results from a completed tool call.\n\nSchema:\n```json\n{\n \"tool_call_id\": \"uuid\",\n \"tool_id\": \"tool_name\",\n \"results\": []\n}\n```\n\n**Note:** `results` is an array of `ToolResult` objects.\n\n---\n\n`message_chunk`\n\nStreams partial text chunks.\n\nSchema:\n```json\n{\n \"message_id\": \"uuid\",\n \"text_chunk\": \"partial text\"\n}\n```\n\n---\n\n`message_complete`\n\nIndicates message stream is finished.\n\nSchema:\n```json\n{\n \"message_id\": \"uuid\",\n \"message_content\": \"full text content of the message\"\n}\n```\n\n---\n\n`thinking_complete`\n\nMarks the end of the thinking/reasoning phase.\n\nSchema:\n```json\n{\n \"time_to_first_token\": 0\n}\n```\n\n**Note:** `time_to_first_token` is in milliseconds.\n\n---\n\n`round_complete`\n\nMarks end of one conversation round.\n\nSchema:\n```json\n{\n \"round\": {}\n}\n```\n\n**Note:** `round` contains the full round json object.\n\n---\n\n## Event flow\n\nA typical conversation round emits events in this sequence:\n\n1. `reasoning` (potentially multiple, some transient)\n2. `tool_call` (if tools are used)\n3. `tool_progress` (zero or more progress updates)\n4. `tool_result` (when tool completes)\n5. `thinking_complete`\n6. `message_chunk` (multiple, as text streams)\n7. `message_complete`\n8. `round_complete`\n\n
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-converse-async",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"_execution_mode": {
"enum": [
"local",
"task_manager"
],
"type": "string",
"description": "define how to execute the agent (local execution or via task_manager)",
"x-state": "Experimental; added in 9.4.0"
},
"access_control": {
"required": [
"access_mode"
],
"type": "object",
"properties": {
"access_mode": {
"enum": [
"private",
"public"
],
"type": "string",
"description": "Access mode to apply when creating a new conversation. Set to public to make the conversation visible to other users who can access the underlying agent. This setting is ignored when continuing an existing conversation."
}
},
"additionalProperties": false,
"description": "Optional conversation access control. Defaults to private.",
"x-state": "Generally available; added in 9.5.0"
},
"action": {
"enum": [
"regenerate"
],
"type": "string",
"description": "Deprecated and ignored. The \"regenerate\" action has been removed; the field is still accepted for backward compatibility.",
"deprecated": true
},
"agent_id": {
"type": "string",
"description": "The ID of the agent to chat with. Defaults to the default Elastic AI agent.",
"default": "elastic-ai-agent"
},
"attachments": {
"type": "array",
"items": {
"required": [
"type"
],
"type": "object",
"properties": {
"data": {
"type": "object",
"additionalProperties": { },
"description": "Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time)."
},
"description": {
"maxLength": 1024,
"type": "string",
"description": "Human-readable label for the attachment."
},
"group_id": {
"maxLength": 256,
"type": "string",
"description": "Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity."
},
"hidden": {
"type": "boolean",
"description": "When true, the attachment will not be displayed in the UI."
},
"id": {
"type": "string",
"description": "Optional id for the attachment."
},
"origin": {
"type": "string",
"description": "Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook."
},
"type": {
"type": "string",
"description": "Type of the attachment."
}
},
"additionalProperties": false
},
"description": "Optional attachments to send with the message.",
"x-state": "Technical Preview; added in 9.3.0"
},
"browser_api_tools": {
"type": "array",
"items": {
"required": [
"id",
"description",
"schema"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Description of what the browser API tool does."
},
"id": {
"type": "string",
"description": "Unique identifier for the browser API tool."
},
"schema": {
"description": "JSON Schema defining the tool parameters (JsonSchema7Type)."
}
},
"additionalProperties": false
},
"description": "Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side."
},
"configuration_overrides": {
"type": "object",
"properties": {
"enable_elastic_capabilities": {
"type": "boolean",
"description": "Whether to enable built-in Elastic skills for this execution."
},
"instructions": {
"type": "string",
"description": "Custom instructions for the agent."
},
"skill_ids": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Skill IDs to enable for this execution, replacing the stored skill list. Note: only fully restricts the available skill set when enable_elastic_capabilities is also set to false."
},
"tools": {
"type": "array",
"items": {
"required": [
"tool_ids"
],
"type": "object",
"properties": {
"tool_ids": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
"description": "Tool selection to enable for this execution."
}
},
"additionalProperties": false,
"description": "Runtime configuration overrides. These override the stored agent configuration for this execution only."
},
"connector_id": {
"type": [
"null",
"string"
],
"description": "Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one."
},
"conversation_id": {
"maxLength": 256,
"type": "string",
"description": "Optional existing conversation ID to continue a previous conversation."
},
"execution_id": {
"type": "string",
"description": "Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID."
},
"inference_id": {
"type": [
"null",
"string"
],
"description": "Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`."
},
"input": {
"maxLength": 100000,
"type": "string",
"description": "The user input message to send to the agent."
},
"project_routing": {
"maxLength": 2048,
"type": "string",
"description": "Cross-project search routing expression resolved from the header project picker, applied to the run's searches. Serverless (CPS) only; ignored elsewhere."
},
"prompts": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"required": [
"allow"
],
"type": "object",
"properties": {
"allow": {
"type": "boolean"
}
},
"additionalProperties": false
},
{
"required": [
"authorized"
],
"type": "object",
"properties": {
"authorized": {
"type": "boolean"
}
},
"additionalProperties": false
},
{
"required": [
"answers"
],
"type": "object",
"properties": {
"answers": {
"maxItems": 100,
"type": "array",
"items": {
"type": "object",
"properties": {
"choice": {
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
"custom": {
"maxLength": 20000,
"minLength": 1,
"type": "string"
},
"skipped": {
"type": "boolean"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false,
"description": "Answers to an `ask_user_question` prompt; one entry per question, in order.",
"x-state": "Technical Preview"
}
]
},
"description": "Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt."
},
"read_only": {
"type": "boolean",
"description": "When true, the created conversation is presented as read-only in the UI: its history is shown but no message input is offered. This carries no authorization meaning — the conversation can still be continued through the API. This setting is ignored when continuing an existing conversation.",
"x-state": "Technical Preview; added in 9.6.0"
},
"reasoning_level": {
"enum": [
"none",
"minimal",
"low",
"medium",
"high",
"xhigh"
],
"type": "string",
"description": "Reasoning effort level for the LLM. One of: none, minimal, low, medium, high, xhigh. Support depends on the underlying model and provider.",
"x-state": "Experimental; added in 9.6.0"
}
},
"additionalProperties": false
},
"examples": {
"converseAsyncPublicRequestExample": {
"description": "Example request to create a public conversation",
"value": {
"access_control": {
"access_mode": "public"
},
"agent_id": "elastic-ai-agent",
"input": "Hello"
}
},
"converseAsyncRequestExample": {
"description": "Example request to send a message to the agent as a part of the conversation",
"value": {
"agent_id": "elastic-ai-agent",
"conversation_id": "c250305b-1929-4248-b568-b9e3f065fda5",
"input": "Hello"
}
},
"converseAsyncRequestInferenceExample": {
"description": "Example using inference_id (mutually exclusive with connector_id)",
"value": {
"agent_id": "elastic-ai-agent",
"inference_id": "my-inference-endpoint-id",
"input": "Hello"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"text/event-stream": {
"examples": {
"converseAsyncResponseExample": {
"description": "Example stream containing the chain of events representing a conversation with the agent",
"value": [
{
"data": {
"data": {
"conversation_id": "c250305b-1929-4248-b568-b9e3f065fda5"
}
},
"event": "conversation_id_set"
},
{
"data": {
"data": {
"reasoning": "Starting with a general search to understand what content is available."
}
},
"event": "reasoning"
},
{
"data": {
"data": {
"params": {
"query": "latest documents"
},
"tool_call_id": "tooluse__2aJELgyRYqD8SDOKSiwtg",
"tool_id": "platform.core.search"
}
},
"event": "tool_call"
},
{
"data": {
"data": {
"results": [
{
"data": {
"message": "Could not figure out which index to use"
},
"type": "error"
}
],
"tool_call_id": "tooluse__2aJELgyRYqD8SDOKSiwtg"
}
},
"event": "tool_result"
},
{
"data": {
"data": {
"round": {
"id": "a5692d54-bc06-4a6e-aea1-412779c73f66",
"input": {
"message": "Hello"
},
"response": {
"message": "Hello! How can I help you today?"
}
}
}
},
"event": "round_complete"
},
{
"data": {
"data": {
"access_control": {
"access_mode": "private"
},
"conversation_id": "c250305b-1929-4248-b568-b9e3f065fda5",
"title": "Hello"
}
},
"event": "conversation_created"
}
]
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/converse/async\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"input\": \"Hello again let us have an async chat\",\n \"agent_id\": \"elastic-ai-agent\",\n \"conversation_id\": \"\"\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/agent_builder/converse/async\n{\n \"input\": \"Hello again let's have an async chat\",\n \"agent_id\": \"elastic-ai-agent\",\n \"conversation_id\": \"\"\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/mcp": {
"post": {
"tags": [
"agent builder"
],
"summary": "MCP server",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/agent_builder/mcp
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n> warn\n> This endpoint is designed for MCP clients (Claude Desktop, Cursor, VS Code, etc.) and should not be used directly via REST APIs. Use MCP Inspector or native MCP clients instead.\nTo learn more about the Agent Builder MCP server, refer to the [MCP documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-mcp",
"parameters": [
{
"name": "namespace",
"in": "query",
"description": "Comma-separated list of namespaces to filter tools. Only tools matching the specified namespaces will be returned.",
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": { },
"examples": {
"mcpInitializeRequestExample": {
"description": "WARNING: DO NOT USE THIS ENDPOINT VIA REST API. These examples are auto-generated and should not be run. Integrate with MCP using MCP Inspector or native MCP clients (Claude Desktop, Cursor, VS Code) instead.",
"value": {
"id": 1,
"jsonrpc": "2.0",
"method": "initialize",
"params": {
"capabilities": { },
"clientInfo": {
"name": "test-client",
"version": "1.0.0"
},
"protocolVersion": "2024-11-05"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"mcpInitializeResponseExample": {
"description": "Example response showing the successful result of communication initialisation over MCP protocol",
"value": {
"id": 1,
"jsonrpc": "2.0",
"result": {
"capabilities": {
"tools": {
"listChanged": true
}
},
"protocolVersion": "2024-11-05",
"serverInfo": {
"name": "elastic-mcp-server",
"version": "0.0.1"
}
}
}
}
}
}
}
}
},
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/plugins": {
"get": {
"tags": [
"agent builder"
],
"summary": "List plugins",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/agent_builder/plugins
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all installed plugins and their managed assets. Plugins are installable packages that bundle agent capabilities such as skills, following the [Claude agent plugin specification](https://code.claude.com/docs/en/plugins). To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an installed plugin by ID. This action cannot be undone. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).
[Required authorization] Route required privileges: agentBuilder:write.",
"operationId": "delete-agent-builder-plugins-pluginid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "pluginId",
"in": "path",
"description": "The unique identifier of the plugin.",
"required": true,
"schema": {
"type": "string"
}
},
{
"name": "force",
"in": "query",
"description": "If true, removes the plugin skills from agents that use them and then deletes the plugin. If false and any agent uses the plugin skills, the request returns 409 Conflict with the list of agents.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"deletePluginResponseExample": {
"description": "Example response showing that deletion of the plugin has been successful",
"value": {
"success": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X DELETE \"${KIBANA_URL}/api/agent_builder/plugins/{id}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn://api/agent_builder/plugins/{id}\n"
}
],
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"agent builder"
],
"summary": "Get a plugin by id",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a specific plugin by ID. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall a plugin from a [GitHub Claude plugin URL](https://code.claude.com/docs/en/plugins) or a direct ZIP URL. Plugins bundle agent capabilities such as skills. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).
[Required authorization] Route required privileges: agentBuilder:write.",
"operationId": "post-agent-builder-plugins-install",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"url"
],
"type": "object",
"properties": {
"plugin_name": {
"type": "string",
"description": "Optional name override for the plugin. Defaults to the manifest name."
},
"url": {
"type": "string",
"description": "URL to install the plugin from (GitHub URL or direct zip URL)."
}
},
"additionalProperties": false
},
"examples": {
"installPluginFromGithubExample": {
"description": "Example request for installing a plugin from a GitHub URL",
"value": {
"url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis"
}
},
"installPluginFromZipExample": {
"description": "Example request for installing a plugin from a direct zip URL",
"value": {
"url": "https://my-server.example.com/my-plugin.zip"
}
},
"installPluginWithNameOverrideExample": {
"description": "Example request for installing a plugin with a custom name",
"value": {
"plugin_name": "my-custom-plugin-name",
"url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"installPluginResponseExample": {
"description": "Example response returning the definition of the installed plugin",
"value": {
"created_at": "2025-01-01T00:00:00.000Z",
"description": "Financial analysis tools and skills for Claude",
"id": "financial-analysis",
"manifest": {
"author": {
"name": "Anthropic",
"url": "https://www.anthropic.com"
},
"keywords": [
"finance",
"analysis"
],
"repository": "https://github.com/anthropics/financial-services-plugins"
},
"name": "financial-analysis",
"skill_ids": [
"financial-analysis-analyze-portfolio"
],
"source_url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis",
"unmanaged_assets": {
"agents": [ ],
"hooks": [ ],
"lsp_servers": [ ],
"mcp_servers": [ ],
"output_styles": [ ]
},
"updated_at": "2025-01-01T00:00:00.000Z",
"version": "1.0.0"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/plugins/install\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"url\": \"https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis\"\n}'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/agent_builder/plugins/install\n{\n \"url\": \"https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis\"\n}\n"
}
],
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/skills": {
"get": {
"tags": [
"agent builder"
],
"summary": "List skills",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/agent_builder/skills
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all available skills (built-in and user-created). To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-skills",
"parameters": [
{
"name": "include_plugins",
"in": "query",
"description": "Set to true to include skills from plugins.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"listSkillsResponseExample": {
"description": "Example response returning a list of skills",
"value": {
"results": [
{
"description": "A built-in skill provided by the platform.",
"experimental": false,
"id": "built-in-skill-id",
"name": "Built-in Skill",
"readonly": true,
"referenced_content_count": 0
},
{
"description": "A user-created skill for data analysis.",
"experimental": false,
"id": "custom-skill-id",
"name": "Custom Skill",
"readonly": false,
"referenced_content_count": 1,
"tool_ids": [
"platform.core.search"
]
}
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/agent_builder/skills\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/agent_builder/skills\n"
}
],
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"agent builder"
],
"summary": "Create a skill",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/agent_builder/skills
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new user-defined skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).
[Required authorization] Route required privileges: agentBuilder:manageSkills.",
"operationId": "post-agent-builder-skills",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name",
"description",
"content"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "Skill instructions content (markdown)."
},
"description": {
"type": "string",
"description": "Description of what the skill does."
},
"id": {
"type": "string",
"description": "Unique identifier for the skill."
},
"name": {
"type": "string",
"description": "Human-readable name for the skill."
},
"referenced_content": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"relativePath",
"content"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "Content of the reference."
},
"name": {
"type": "string",
"description": "Name of the referenced content."
},
"relativePath": {
"type": "string",
"description": "Relative path of the referenced content."
}
},
"additionalProperties": false
}
},
"tool_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Tool ID from the tool registry."
},
"description": "Tool IDs from the tool registry that this skill references.",
"default": [ ]
}
},
"additionalProperties": false
},
"examples": {
"createSkillRequestExample": {
"description": "Example request to create a user-defined skill",
"value": {
"content": "You are an expert data analyst. Use the available tools to query and analyze data.",
"description": "A skill for performing custom data analysis.",
"id": "my-custom-skill",
"name": "Custom Analysis Skill",
"tool_ids": [
"platform.core.search"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"createSkillResponseExample": {
"description": "Example response returning the created skill",
"value": {
"content": "You are an expert data analyst. Use the available tools to query and analyze data.",
"description": "A skill for performing custom data analysis.",
"experimental": false,
"id": "my-custom-skill",
"name": "Custom Analysis Skill",
"readonly": false,
"tool_ids": [
"platform.core.search"
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"https://${KIBANA_URL}/api/agent_builder/skills\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"id\": \"my-custom-skill\",\n \"name\": \"Custom Analysis Skill\",\n \"description\": \"A skill for performing custom data analysis.\",\n \"content\": \"You are an expert data analyst.\",\n \"tool_ids\": [\"platform.core.search\"]\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn:/api/agent_builder/skills\n{\n \"id\": \"my-custom-skill\",\n \"name\": \"Custom Analysis Skill\",\n \"description\": \"A skill for performing custom data analysis.\",\n \"content\": \"You are an expert data analyst.\",\n \"tool_ids\": [\"platform.core.search\"]\n}\n"
}
],
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/skills/{skillId}": {
"delete": {
"tags": [
"agent builder"
],
"summary": "Delete a skill",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a user-created skill by ID. If agents still reference the skill, the request returns 409 unless force=true, which removes the skill from agents first. Built-in skills cannot be deleted. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).
[Required authorization] Route required privileges: agentBuilder:manageSkills.",
"operationId": "delete-agent-builder-skills-skillid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "skillId",
"in": "path",
"description": "The unique identifier of the skill.",
"required": true,
"schema": {
"maxLength": 512,
"minLength": 1,
"type": "string"
}
},
{
"name": "force",
"in": "query",
"description": "If true, removes the skill from agents that use it and then deletes it. If false and any agent uses the skill, the request returns 409 Conflict with the list of agents.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"deleteSkillResponseExample": {
"description": "Example response showing that the deletion operation was successful",
"value": {
"success": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X DELETE \"https://${KIBANA_URL}/api/agent_builder/skills/{skillId}?force=false\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn:/api/agent_builder/skills/{skillId}\n"
}
],
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"agent builder"
],
"summary": "Get a skill by id",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a specific skill by ID. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-skills-skillid",
"parameters": [
{
"name": "skillId",
"in": "path",
"description": "The unique identifier of the skill.",
"required": true,
"schema": {
"maxLength": 512,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"getSkillResponseExample": {
"description": "Example response returning a skill by ID",
"value": {
"content": "You are an expert data analyst. Use the available tools to query and analyze data.",
"description": "A skill for performing custom data analysis.",
"experimental": false,
"id": "my-custom-skill",
"name": "Custom Analysis Skill",
"readonly": false,
"tool_ids": [
"platform.core.search"
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/agent_builder/skills/{skillId}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/agent_builder/skills/{skillId}\n"
}
],
"x-state": "Experimental; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"agent builder"
],
"summary": "Update a skill",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing user-created skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all available tools. Use this endpoint to retrieve complete tool definitions including their schemas and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-tools",
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"listToolsResponseExample": {
"description": "Example response returning a list of existing tools",
"value": {
"results": [
{
"configuration": { },
"description": "A powerful tool for searching and analyzing data within your Elasticsearch cluster.\nIt supports both full-text relevance searches and structured analytical queries.\n\nUse this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.\n\nExamples of queries:\n- \"find articles about serverless architecture\"\n- \"search for support tickets mentioning 'billing issue' or 'refund request'\"\n- \"what is our policy on parental leave?\"\n- \"list all products where the category is 'electronics'\"\n- \"show me the last 5 documents from that index\"\n- \"show me the sales over the last year break down by month\"\n\nNote:\n- The 'index' parameter can be used to specify which index to search against.\n If not provided, the tool will decide itself which is the best index to use.\n- It is perfectly fine not to specify the 'index' parameter. It should only be specified when you already\n know about the index and fields you want to search on, e.g. if the user explicitly specified it.",
"id": "platform.core.search",
"readonly": true,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"index": {
"description": "(optional) Index to search against. If not provided, will automatically select the best index to use based on the query.",
"type": "string"
},
"query": {
"description": "A natural language query expressing the search request",
"type": "string"
}
},
"required": [
"query"
]
},
"tags": [ ],
"type": "builtin"
},
{
"configuration": { },
"description": "Retrieve the full content (source) of an Elasticsearch document based on its ID and index name.",
"id": "platform.core.get_document_by_id",
"readonly": true,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"id": {
"description": "ID of the document to retrieve",
"type": "string"
},
"index": {
"description": "Name of the index to retrieve the document from",
"type": "string"
}
},
"required": [
"id",
"index"
]
},
"tags": [ ],
"type": "builtin"
},
{
"configuration": { },
"description": "Execute an ES|QL query and return the results in a tabular format.\n\n**IMPORTANT**: This tool only **runs** queries; it does not write them.\nThink of this as the final step after a query has been prepared.\n\nYou **must** get the query from one of two sources before calling this tool:\n1. The output of the `platform.core.generate_esql` tool (if the tool is available).\n2. A verbatim query provided directly by the user.\n\nUnder no circumstances should you invent, guess, or modify a query yourself for this tool.\nIf you need a query, use the `platform.core.generate_esql` tool first.",
"id": "platform.core.execute_esql",
"readonly": true,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"query": {
"description": "The ES|QL query to execute",
"type": "string"
}
},
"required": [
"query"
]
},
"tags": [ ],
"type": "builtin"
},
{
"configuration": {
"params": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"type": "date"
}
},
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit"
},
"description": "Example ES|QL query tool for analyzing financial trades with time filtering",
"id": "example-esql-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"description": "Parameters needed to execute the query",
"type": "object",
"properties": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"format": "date-time",
"type": "string"
}
},
"required": [
"startTime",
"limit"
]
},
"tags": [
"analytics",
"finance"
],
"type": "esql"
},
{
"configuration": {
"pattern": "financial_*"
},
"description": "Search tool specifically for financial data analysis and reporting",
"id": "example-index-search-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"nlQuery": {
"description": "A natural language query expressing the search request",
"type": "string"
}
},
"required": [
"nlQuery"
]
},
"tags": [
"search",
"finance"
],
"type": "index_search"
}
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/agent_builder/tools\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/agent_builder/tools\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"agent builder"
],
"summary": "Create a tool",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/agent_builder/tools
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new tool. Use this endpoint to define a custom tool with specific functionality and configuration for use by agents. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).
[Required authorization] Route required privileges: agentBuilder:manageTools.",
"operationId": "post-agent-builder-tools",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id",
"type",
"configuration"
],
"type": "object",
"properties": {
"configuration": {
"type": "object",
"additionalProperties": { },
"description": "Tool-specific configuration parameters. See examples for details."
},
"confirmation": {
"type": "object",
"properties": {
"askUser": {
"enum": [
"once",
"always",
"never"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Optional tool call policy to control tool call confirmation behavior"
},
"description": {
"type": "string",
"description": "Description of what the tool does.",
"default": ""
},
"id": {
"type": "string",
"description": "Unique identifier for the tool."
},
"tags": {
"type": "array",
"items": {
"type": "string",
"description": "Tag for categorizing the tool."
},
"description": "Optional tags for categorizing and organizing tools.",
"default": [ ]
},
"type": {
"enum": [
"esql",
"index_search",
"workflow",
"mcp"
],
"type": "string",
"description": "The type of tool to create (e.g., esql, index_search)."
}
},
"additionalProperties": false
},
"examples": {
"createEsqlToolRequest": {
"description": "Example request to create an ESQL query tool with a pre-defined query",
"value": {
"configuration": {
"params": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"type": "date"
}
},
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit"
},
"description": "Example ES|QL query tool for analyzing financial trades with time filtering",
"id": "example-esql-tool",
"tags": [
"analytics",
"finance"
],
"type": "esql"
}
},
"createIndexSearchToolRequest": {
"description": "Example request to create an index_search tool with a pre-defined index pattern",
"value": {
"configuration": {
"pattern": "financial_*"
},
"description": "Search tool specifically for financial data analysis and reporting",
"id": "example-index-search-tool",
"tags": [
"search",
"finance"
],
"type": "index_search"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"createEsqlToolExample": {
"description": "Example response returning a definition of ESQL tool created",
"value": {
"configuration": {
"params": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"type": "date"
}
},
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit"
},
"description": "Example ES|QL query tool for analyzing financial trades with time filtering",
"id": "example-esql-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"description": "Parameters needed to execute the query",
"type": "object",
"properties": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"format": "date-time",
"type": "string"
}
},
"required": [
"startTime",
"limit"
]
},
"tags": [
"analytics",
"finance"
],
"type": "esql"
}
},
"createIndexSearchToolExample": {
"description": "Example response returning a definition of search tool tool created",
"value": {
"configuration": {
"pattern": "financial_*"
},
"description": "Search tool specifically for financial data analysis and reporting",
"id": "example-index-search-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"nlQuery": {
"description": "A natural language query expressing the search request",
"type": "string"
}
},
"required": [
"nlQuery"
]
},
"tags": [
"search",
"finance"
],
"type": "index_search"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"https://${KIBANA_URL}/api/agent_builder/tools\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"id\": \"example-esql-tool\",\n \"type\": \"esql\",\n \"description\": \"Example ES|QL query tool for analyzing financial trades with time filtering\",\n \"tags\": [\"analytics\", \"finance\"],\n \"configuration\": {\n \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n \"params\": {\n \"startTime\": {\n \"type\": \"date\",\n \"description\": \"Start time for the analysis in ISO format\"\n },\n \"limit\": {\n \"type\": \"integer\",\n \"description\": \"Maximum number of results to return\"\n }\n }\n }\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn:/api/agent_builder/tools\n{\n \"id\": \"example-esql-tool\",\n \"type\": \"esql\",\n \"description\": \"An ES|QL query tool for analyzing financial trades with time filtering\",\n \"tags\": [\"analytics\", \"finance\", \"updated\"],\n \"configuration\": {\n \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n \"params\": {\n \"startTime\": {\n \"type\": \"date\",\n \"description\": \"Start time for the analysis in ISO format\"\n },\n \"limit\": {\n \"type\": \"integer\",\n \"description\": \"Maximum number of results to return\"\n }\n }\n }\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/tools/_execute": {
"post": {
"tags": [
"agent builder"
],
"summary": "Run a tool",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRun a tool with parameters. Use this endpoint to run a tool directly with specified inputs and optional external connector integration. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-agent-builder-tools-execute",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"tool_id",
"tool_params"
],
"type": "object",
"properties": {
"approvals": {
"type": "object",
"properties": {
"auto_approved_apis": {
"type": "object",
"properties": {
"elasticsearch": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Elasticsearch APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `indices.create`), a namespace wildcard (for example `indices.*`), or `*` for every Elasticsearch API."
},
"kibana": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Kibana APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `alerting.delete-alerting-rule-id`), a namespace wildcard (for example `alerting.*`), or `*` for every Kibana API."
}
},
"additionalProperties": false,
"description": "Destructive Elasticsearch or Kibana APIs the tool may call without a user confirmation, keyed by backend. A tool run has no live user to answer the confirmation prompt, so a destructive API is refused unless it is listed here."
}
},
"additionalProperties": false,
"description": "Actions the tool run may take that would otherwise need a live user to approve them. Applies to this run and any sub-agents it spawns."
},
"connector_id": {
"type": "string",
"description": "Optional connector ID for tools that require external integrations."
},
"tool_id": {
"type": "string",
"description": "The ID of the tool to execute."
},
"tool_params": {
"type": "object",
"additionalProperties": { },
"description": "Parameters to pass to the tool execution. See examples for details"
}
},
"additionalProperties": false
},
"examples": {
"executeBuiltinEsqlToolRequest": {
"description": "Example request executing platform.core.execute_esql tool",
"value": {
"tool_id": "platform.core.execute_esql",
"tool_params": {
"query": "FROM financial_trades | LIMIT 3"
}
}
},
"executeBuiltinToolRequest": {
"description": "Example request executing platform.core.get_document_by_id tool",
"value": {
"tool_id": "platform.core.get_document_by_id",
"tool_params": {
"id": "TRD-20250805-0820a89f",
"index": "financial_trades"
}
}
},
"executeCustomEsqlToolRequest": {
"description": "Example request executing custom example-esql-tool tool",
"value": {
"tool_id": "example-esql-tool",
"tool_params": {
"limit": 3,
"startTime": "2024-01-01T00:00:00Z"
}
}
},
"executeIndexSearchToolRequest": {
"description": "Example request executing custom example-index-search-tool tool",
"value": {
"tool_id": "example-index-search-tool",
"tool_params": {
"nlQuery": "find trades with high execution prices above 100"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"executeBuiltinEsqlToolExample": {
"description": "Example response calling built-in platform.core.execute_esql tool",
"value": {
"results": [
{
"data": {
"esql": "FROM financial_trades | LIMIT 3"
},
"type": "query"
},
{
"data": {
"columns": [
{
"name": "account_id",
"type": "keyword"
},
{
"name": "execution_price",
"type": "double"
},
{
"name": "symbol",
"type": "keyword"
},
{
"name": "trade_type",
"type": "keyword"
}
],
"query": "FROM financial_trades | LIMIT 3",
"source": "esql",
"values": [
[
"ACC00179-1f91",
43.77000045776367,
"CVX",
"sell"
],
[
"ACC00407-0bbb",
660.4199829101562,
"V",
"buy"
],
[
"ACC00179-1f91",
440.3599853515625,
"KO",
"buy"
]
]
},
"tool_result_id": "xTpT",
"type": "esql_results"
}
]
}
},
"executeBuiltinToolExample": {
"description": "Example response calling built-in platform.core.get_document_by_id tool",
"value": {
"results": [
{
"data": {
"content": {
"account_id": "ACC00271-fb5c",
"execution_price": 488.54,
"execution_timestamp": "2025-08-05T08:04:11.649855",
"last_updated": "2025-09-15T13:23:36",
"order_status": "executed",
"order_type": "market",
"quantity": 131,
"status_reason": "fully_filled",
"symbol": "EWL",
"trade_cost": 63998.74,
"trade_id": "TRD-20250805-0820a89f",
"trade_type": "sell"
},
"partial": false,
"reference": {
"id": "TRD-20250805-0820a89f",
"index": "financial_trades"
}
},
"type": "resource"
}
]
}
},
"executeCustomEsqlToolExample": {
"description": "Example response calling custom example-esql-tool tool",
"value": {
"results": [
{
"data": {
"columns": [
{
"name": "trade_count",
"type": "long"
},
{
"name": "avg_price",
"type": "double"
},
{
"name": "symbol",
"type": "keyword"
}
],
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
"source": "esql",
"values": [
[
2115,
89.33911587329621,
"US_T_BOND_20YR"
],
[
2112,
104.20854155945055,
"INTL_CORP_ASIA_D"
],
[
2105,
89.93244177666526,
"INTL_CORP_EU_B"
]
]
},
"tool_result_id": "Voy8",
"type": "esql_results"
}
]
}
},
"executeIndexSearchToolExample": {
"description": "Example response calling custom example-index-search-tool tool",
"value": {
"results": [
{
"data": {
"esql": "FROM financial_trades\n| WHERE execution_price > 100\n| LIMIT 100"
},
"type": "query"
},
{
"data": {
"columns": [
{
"name": "account_id",
"type": "keyword"
},
{
"name": "execution_price",
"type": "double"
},
{
"name": "execution_timestamp",
"type": "date"
},
{
"name": "symbol",
"type": "keyword"
},
{
"name": "trade_type",
"type": "keyword"
}
],
"query": "FROM financial_trades\n| WHERE execution_price > 100\n| LIMIT 100",
"source": "esql",
"values": [
[
"ACC00407-0bbb",
660.4199829101562,
"2020-09-25T11:06:08.687Z",
"V",
"buy"
],
[
"ACC00179-1f91",
440.3599853515625,
"2025-08-07T21:56:45.377Z",
"KO",
"buy"
],
[
"ACC00407-0bbb",
132.8800048828125,
"2020-11-19T04:39:13.655Z",
"JAP_JGB_10YR",
"sell"
]
]
},
"tool_result_id": "uE8y",
"type": "esql_results"
}
]
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"https://${KIBANA_URL}/api/agent_builder/tools/_execute\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"tool_id\": \"platform.core.search\",\n \"tool_params\": {\n \"query\": \"can you find john doe's email from the employee index?\"}\n }\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn:/api/agent_builder/tools/_execute\n{\n \"tool_id\": \"platform.core.search\",\n \"tool_params\": {\n \"query\": \"can you find john doe's email from the employee index?\"\n }\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/agent_builder/tools/{toolId}": {
"delete": {
"tags": [
"agent builder"
],
"summary": "Delete a tool",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a tool by ID. This action cannot be undone. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).
[Required authorization] Route required privileges: agentBuilder:manageTools.",
"operationId": "delete-agent-builder-tools-toolid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "toolId",
"in": "path",
"description": "The unique identifier of the tool to delete.",
"required": true,
"schema": {
"type": "string"
}
},
{
"name": "force",
"in": "query",
"description": "If true, removes the tool from agents that use it and then deletes it. If false and any agent uses the tool, the request returns 409 Conflict with the list of agents.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"deleteAgentResponseExample": {
"description": "Example response showing that the deletion operation was successful",
"value": {
"success": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X DELETE \"https://${KIBANA_URL}/api/agent_builder/tools/{toolId}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn:/api/agent_builder/tools/{toolId}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"agent builder"
],
"summary": "Get a tool by id",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/agent_builder/tools/{toolId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a specific tool by ID. Use this endpoint to retrieve the complete tool definition including its schema and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "get-agent-builder-tools-toolid",
"parameters": [
{
"name": "toolId",
"in": "path",
"description": "The unique identifier of the tool to retrieve.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"getBuiltinToolExample": {
"description": "Example response returning built-in platform.core.search tool",
"value": {
"configuration": { },
"description": "A powerful tool for searching and analyzing data within your Elasticsearch cluster.\nIt supports both full-text relevance searches and structured analytical queries.\n\nUse this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.\n\nExamples of queries:\n- \"find articles about serverless architecture\"\n- \"search for support tickets mentioning 'billing issue' or 'refund request'\"\n- \"what is our policy on parental leave?\"\n- \"list all products where the category is 'electronics'\"\n- \"show me the last 5 documents from that index\"\n- \"show me the sales over the last year break down by month\"\n\nNote:\n- The 'index' parameter can be used to specify which index to search against.\n If not provided, the tool will decide itself which is the best index to use.\n- It is perfectly fine not to specify the 'index' parameter. It should only be specified when you already\n know about the index and fields you want to search on, e.g. if the user explicitly specified it.",
"id": "platform.core.search",
"readonly": true,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"index": {
"description": "(optional) Index to search against. If not provided, will automatically select the best index to use based on the query.",
"type": "string"
},
"query": {
"description": "A natural language query expressing the search request",
"type": "string"
}
},
"required": [
"query"
]
},
"tags": [ ],
"type": "builtin"
}
},
"getEsqlToolExample": {
"description": "Example response returning custom example-esql-tool tool",
"value": {
"configuration": {
"params": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"type": "date"
}
},
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit"
},
"description": "Example ES|QL query tool for analyzing financial trades with time filtering",
"id": "example-esql-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"description": "Parameters needed to execute the query",
"type": "object",
"properties": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"format": "date-time",
"type": "string"
}
},
"required": [
"startTime",
"limit"
]
},
"tags": [
"analytics",
"finance"
],
"type": "esql"
}
},
"getIndexSearchToolExample": {
"description": "Example response returning custom example-index-search-tool tool",
"value": {
"configuration": {
"pattern": "financial_*"
},
"description": "Search tool specifically for financial data analysis and reporting",
"id": "example-index-search-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"nlQuery": {
"description": "A natural language query expressing the search request",
"type": "string"
}
},
"required": [
"nlQuery"
]
},
"tags": [
"search",
"finance"
],
"type": "index_search"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/agent_builder/tools/{toolId}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/agent_builder/tools/{toolId}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"agent builder"
],
"summary": "Update a tool",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/agent_builder/tools/{toolId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing tool. Use this endpoint to modify any aspect of the tool's configuration or metadata. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).
[Required authorization] Route required privileges: agentBuilder:manageTools.",
"operationId": "put-agent-builder-tools-toolid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "toolId",
"in": "path",
"description": "The unique identifier of the tool to update.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"configuration": {
"type": "object",
"additionalProperties": { },
"description": "Updated tool-specific configuration parameters. See examples for details."
},
"confirmation": {
"type": "object",
"properties": {
"askUser": {
"enum": [
"once",
"always",
"never"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Updated tool call policy to control tool call confirmation behavior"
},
"description": {
"type": "string",
"description": "Updated description of what the tool does."
},
"tags": {
"type": "array",
"items": {
"type": "string",
"description": "Updated tag for categorizing the tool."
},
"description": "Updated tags for categorizing and organizing tools."
}
},
"additionalProperties": false
},
"examples": {
"updateEsqlToolRequest": {
"description": "Example request to update the custom ESQL tool",
"value": {
"configuration": {
"params": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"type": "date"
},
"symbolPattern": {
"description": "Pattern to filter symbols (e.g., 'US_*' for US instruments)",
"type": "keyword"
}
},
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime AND symbol LIKE ?symbolPattern | STATS trade_count=COUNT(*), avg_price=AVG(execution_price), total_volume=SUM(quantity) BY symbol | SORT trade_count DESC | LIMIT ?limit"
},
"description": "Updated ES|QL query tool for comprehensive financial analysis with enhanced filtering",
"tags": [
"analytics",
"finance",
"reporting"
]
}
},
"updateIndexSearchToolRequest": {
"description": "Example request to update the custom Search tool",
"value": {
"description": "Updated search tool for comprehensive financial data analysis, reporting, and compliance monitoring",
"tags": [
"search",
"finance",
"compliance",
"reporting"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"updateEsqlToolExample": {
"description": "Example response showing the updated ESQL tool",
"value": {
"configuration": {
"params": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"type": "date"
},
"symbolPattern": {
"description": "Pattern to filter symbols (e.g., 'US_*' for US instruments)",
"type": "keyword"
}
},
"query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime AND symbol LIKE ?symbolPattern | STATS trade_count=COUNT(*), avg_price=AVG(execution_price), total_volume=SUM(quantity) BY symbol | SORT trade_count DESC | LIMIT ?limit"
},
"description": "Updated ES|QL query tool for comprehensive financial analysis with enhanced filtering",
"id": "example-esql-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"description": "Parameters needed to execute the enhanced query",
"type": "object",
"properties": {
"limit": {
"description": "Maximum number of results to return",
"type": "integer"
},
"startTime": {
"description": "Start time for the analysis in ISO format",
"format": "date-time",
"type": "string"
},
"symbolPattern": {
"description": "Pattern to filter symbols (e.g., 'US_*' for US instruments)",
"type": "string"
}
},
"required": [
"startTime",
"symbolPattern",
"limit"
]
},
"tags": [
"analytics",
"finance",
"reporting"
],
"type": "esql"
}
},
"updateIndexSearchToolExample": {
"description": "Example response showing the updated Search tool",
"value": {
"configuration": {
"pattern": "financial_*"
},
"description": "Updated search tool for comprehensive financial data analysis, reporting, and compliance monitoring",
"id": "example-index-search-tool",
"readonly": false,
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"type": "object",
"properties": {
"nlQuery": {
"description": "A natural language query expressing the search request",
"type": "string"
}
},
"required": [
"nlQuery"
]
},
"tags": [
"search",
"finance",
"compliance",
"reporting"
],
"type": "index_search"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X PUT \"https://${KIBANA_URL}/api/agent_builder/tools/{toolId}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"description\": \"Updated ES|QL query tool for analyzing financial trades with time filtering\",\n \"tags\": [\"analytics\", \"finance\", \"updated\"],\n \"configuration\": {\n \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n \"params\": {\n \"startTime\": {\n \"type\": \"date\",\n \"description\": \"Start time for the analysis in ISO format\"\n },\n \"limit\": {\n \"type\": \"integer\",\n \"description\": \"Maximum number of results to return\"\n }\n }\n }\n }'\n"
},
{
"lang": "Console",
"source": "PUT kbn:/api/agent_builder/tools/{toolId}\n{\n \"description\": \"Updated ES|QL query tool for analyzing financial trades with time filtering\",\n \"tags\": [\"analytics\", \"finance\", \"updated\"],\n \"configuration\": {\n \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n \"params\": {\n \"startTime\": {\n \"type\": \"date\",\n \"description\": \"Start time for the analysis in ISO format\"\n },\n \"limit\": {\n \"type\": \"integer\",\n \"description\": \"Maximum number of results to return\"\n }\n }\n }\n}\n"
}
],
"x-state": "Added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/_health": {
"get": {
"tags": [
"alerting"
],
"summary": "Get the alerting framework health",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/alerting/_health
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Management > Stack Rules** feature or for at least one of the **Analytics > Discover**, **Analytics > Machine Learning**, **Observability**, or **Security** features.\n",
"operationId": "getAlertingHealth",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"alerting_framework_health": {
"type": "object",
"properties": {
"decryption_health": {
"type": "object",
"properties": {
"status": {
"enum": [
"error",
"ok",
"warn"
],
"type": "string",
"example": "ok"
},
"timestamp": {
"type": "string",
"format": "date-time",
"example": "2023-01-13T01:28:00.280Z"
}
},
"description": "The timestamp and status of the rule decryption."
},
"execution_health": {
"type": "object",
"properties": {
"status": {
"enum": [
"error",
"ok",
"warn"
],
"type": "string",
"example": "ok"
},
"timestamp": {
"type": "string",
"format": "date-time",
"example": "2023-01-13T01:28:00.280Z"
}
},
"description": "The timestamp and status of the rule run."
},
"read_health": {
"type": "object",
"properties": {
"status": {
"enum": [
"error",
"ok",
"warn"
],
"type": "string",
"example": "ok"
},
"timestamp": {
"type": "string",
"format": "date-time",
"example": "2023-01-13T01:28:00.280Z"
}
},
"description": "The timestamp and status of the rule reading events."
}
},
"description": "Three substates identify the health of the alerting framework: `decryption_health`, `execution_health`, and `read_health`.\n"
},
"has_permanent_encryption_key": {
"type": "boolean",
"description": "If `false`, the encrypted saved object plugin does not have a permanent encryption key.",
"example": true
},
"is_sufficiently_secure": {
"type": "boolean",
"description": "If `false`, security is enabled but TLS is not.",
"example": true
}
}
},
"examples": {
"getAlertingHealthResponse": {
"$ref": "#/components/examples/Alerting_get_health_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Alerting_401_response"
},
"examples": {
"healthUnauthorizedResponse": {
"$ref": "#/components/examples/Alerting_401_health_response"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule_types": {
"get": {
"tags": [
"alerting"
],
"summary": "Get the rule types",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/alerting/rule_types
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nIf you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the **Management > Stack Rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, and **Security** features. To get rule types associated with the **Stack Monitoring** feature, use the `monitoring_user` built-in role.\n",
"operationId": "getRuleTypes",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_groups": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"description": "An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.\n"
},
"action_variables": {
"type": "object",
"properties": {
"context": {
"type": "array",
"items": {
"type": "object",
"properties": {
"description": {
"type": "string"
},
"name": {
"type": "string"
},
"useWithTripleBracesInTemplates": {
"type": "boolean"
}
}
}
},
"params": {
"type": "array",
"items": {
"type": "object",
"properties": {
"description": {
"type": "string"
},
"name": {
"type": "string"
}
}
}
},
"state": {
"type": "array",
"items": {
"type": "object",
"properties": {
"description": {
"type": "string"
},
"name": {
"type": "string"
}
}
}
}
},
"description": "A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.\n"
},
"alerts": {
"type": "object",
"properties": {
"context": {
"enum": [
"ml.anomaly-detection",
"observability.apm",
"observability.logs",
"observability.metrics",
"observability.slo",
"observability.threshold",
"observability.uptime",
"security",
"stack"
],
"type": "string",
"description": "The namespace for this rule type.\n"
},
"dynamic": {
"enum": [
"false",
"runtime",
"strict",
"true"
],
"type": "string",
"description": "Indicates whether new fields are added dynamically."
},
"isSpaceAware": {
"type": "boolean",
"description": "Indicates whether the alerts are space-aware. If true, space-specific alert indices are used.\n"
},
"mappings": {
"type": "object",
"properties": {
"fieldMap": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Alerting_fieldmap_properties"
},
"description": "Mapping information for each field supported in alerts as data documents for this rule type. For more information about mapping parameters, refer to the Elasticsearch documentation.\n"
}
}
},
"secondaryAlias": {
"type": "string",
"description": "A secondary alias. It is typically used to support the signals alias for detection rules.\n"
},
"shouldWrite": {
"type": "boolean",
"description": "Indicates whether the rule should write out alerts as data.\n"
},
"useEcs": {
"type": "boolean",
"description": "Indicates whether to include the ECS component template for the alerts.\n"
},
"useLegacyAlerts": {
"type": "boolean",
"description": "Indicates whether to include the legacy component template for the alerts.\n",
"default": false
}
},
"description": "Details for writing alerts as data documents for this rule type.\n"
},
"authorized_consumers": {
"type": "object",
"properties": {
"alerts": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"apm": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"discover": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"infrastructure": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"logs": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"ml": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"monitoring": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"siem": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"slo": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"stackAlerts": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
},
"uptime": {
"type": "object",
"properties": {
"all": {
"type": "boolean"
},
"read": {
"type": "boolean"
}
}
}
},
"description": "The list of the plugins IDs that have access to the rule type."
},
"category": {
"enum": [
"management",
"observability",
"securitySolution"
],
"type": "string",
"description": "The rule category, which is used by features such as category-specific maintenance windows."
},
"default_action_group_id": {
"type": "string",
"description": "The default identifier for the rule type group."
},
"does_set_recovery_context": {
"type": "boolean",
"description": "Indicates whether the rule passes context variables to its recovery action."
},
"enabled_in_license": {
"type": "boolean",
"description": "Indicates whether the rule type is enabled or disabled based on the subscription."
},
"has_alerts_mappings": {
"type": "boolean",
"description": "Indicates whether the rule type has custom mappings for the alert data."
},
"has_fields_for_a_a_d": {
"type": "boolean"
},
"id": {
"type": "string",
"description": "The unique identifier for the rule type."
},
"is_exportable": {
"type": "boolean",
"description": "Indicates whether the rule type is exportable in **Stack Management > Saved Objects**."
},
"minimum_license_required": {
"type": "string",
"description": "The subscriptions required to use the rule type.",
"example": "basic"
},
"name": {
"type": "string",
"description": "The descriptive name of the rule type."
},
"producer": {
"type": "string",
"description": "An identifier for the application that produces this rule type.",
"example": "stackAlerts"
},
"recovery_action_group": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"description": "An action group to use when an alert goes from an active state to an inactive one."
},
"rule_task_timeout": {
"type": "string",
"example": "5m"
}
}
}
},
"examples": {
"getRuleTypesResponse": {
"$ref": "#/components/examples/Alerting_get_rule_types_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Alerting_401_response"
},
"examples": {
"ruleTypesUnauthorizedResponse": {
"$ref": "#/components/examples/Alerting_401_rule_types_response"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}": {
"delete": {
"tags": [
"alerting"
],
"summary": "Delete a rule",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/alerting/rule/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "delete-alerting-rule-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"alerting"
],
"summary": "Get rule details",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/alerting/rule/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "get-alerting-rule-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_response"
},
"examples": {
"getRuleResponse": {
"summary": "Get an index threshold rule",
"description": "A response that contains information about an index threshold rule.",
"value": {
"actions": [ ],
"api_key_owner": "elastic",
"consumer": "alerts",
"created_at": "2022-12-05T23:40:33.132Z",
"created_by": "elastic",
"enabled": true,
"id": "3583a470-74f6-11ed-9801-35303b735aef",
"mute_all": false,
"muted_alert_ids": [ ],
"name": "my alert",
"notify_when": "onActionGroupChange",
"params": {
"aggField": "sheet.version",
"aggType": "avg",
"groupBy": "top",
"index": [
"test-index"
],
"termField": "name.keyword",
"termSize": 6,
"threshold": [
1000
],
"thresholdComparator": ">",
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m"
},
"revision": 0,
"rule_type_id": ".index-threshold",
"schedule": {
"interval": "1m"
},
"tags": [
"cpu"
],
"throttle": "null",
"updated_at": "2022-12-05T23:40:33.132Z",
"updated_by": "elastic"
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"alerting"
],
"summary": "Create a rule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "put-alerting-rule-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_update_rule"
},
"examples": {
"updateRuleRequest": {
"summary": "Index threshold rule",
"description": "Update an index threshold rule that uses a server log connector to send notifications when the threshold is met.",
"value": {
"actions": [
{
"frequency": {
"notify_when": "onActionGroupChange",
"summary": false
},
"group": "threshold met",
"id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
}
}
],
"name": "new name",
"params": {
"aggField": "sheet.version",
"aggType": "avg",
"groupBy": "top",
"index": [
".updated-index"
],
"termField": "name.keyword",
"termSize": 6,
"threshold": [
1000
],
"thresholdComparator": ">",
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m"
},
"schedule": {
"interval": "1m"
},
"tags": [ ]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_response"
},
"examples": {
"updateRuleResponse": {
"summary": "Index threshold rule",
"description": "The response for successfully updating an index threshold rule.",
"value": {
"actions": [
{
"connector_type_id": ".server-log",
"frequency": {
"notify_when": "onActionGroupChange",
"summary": false,
"throttle": "null"
},
"group": "threshold met",
"id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}"
},
"uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d"
}
],
"api_key_created_by_user": false,
"api_key_owner": "elastic",
"consumer": "alerts",
"created_at": "2024-03-26T23:13:20.985Z",
"created_by": "elastic",
"enabled": true,
"execution_status": {
"last_duration": 52,
"last_execution_date": "2024-03-26T23:22:51.390Z",
"status": "ok"
},
"id": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74",
"last_run": {
"alerts_count": {
"active": 0,
"ignored": 0,
"new": 0,
"recovered": 0
},
"outcome": "succeeded",
"outcome_msg": "null",
"warning": "null"
},
"mute_all": false,
"muted_alert_ids": [ ],
"name": "new name",
"next_run": "2024-03-26T23:23:51.316Z",
"params": {
"aggField": "sheet.version",
"aggType": "avg",
"groupBy": "top",
"index": [
".updated-index"
],
"termField": "name.keyword",
"termSize": 6,
"threshold": [
1000
],
"thresholdComparator": ">",
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m"
},
"revision": 1,
"rule_type_id": ".index-threshold",
"running": false,
"schedule": {
"interval": "1m"
},
"scheduled_task_id": "4c5eda00-e74f-11ec-b72f-5b18752ff9ea",
"tags": [ ],
"throttle": "null",
"updated_at": "2024-03-26T23:22:59.949Z",
"updated_by": "elastic"
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
},
"409": {
"description": "Indicates that the rule has already been updated by another user."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}/_disable": {
"post": {
"tags": [
"alerting"
],
"summary": "Disable a rule",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/alerting/rule/{id}/_disable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-id-disable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": [
"null",
"object"
],
"properties": {
"untrack": {
"type": "boolean",
"description": "Defines whether this rule's alerts should be untracked."
}
},
"additionalProperties": false,
"default": "null"
},
"examples": {
"disableRuleRequest": {
"summary": "Disable a rule and untrack its alerts",
"description": "A request that disables a rule and untracks all alerts that were generated by the rule.",
"value": {
"untrack": true
}
}
}
}
}
},
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}/_enable": {
"post": {
"tags": [
"alerting"
],
"summary": "Enable a rule",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/alerting/rule/{id}/_enable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-id-enable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}/_mute_all": {
"post": {
"tags": [
"alerting"
],
"summary": "Mute all alerts",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-id-mute-all",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}/_unmute_all": {
"post": {
"tags": [
"alerting"
],
"summary": "Unmute all alerts",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-id-unmute-all",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}/_update_api_key": {
"post": {
"tags": [
"alerting"
],
"summary": "Update the API key for a rule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-id-update-api-key",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule with the given ID does not exist."
},
"409": {
"description": "Indicates that the rule has already been updated by another user."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{id}/query_inspector": {
"get": {
"tags": [
"alerting"
],
"summary": "Get the Elasticsearch query for a rule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-rule-id-alert-alert-id-mute",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "rule_id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"type": "string"
}
},
{
"name": "alert_id",
"in": "path",
"description": "The identifier for the alert.",
"required": true,
"schema": {
"type": "string"
}
},
{
"name": "validate_alerts_existence",
"in": "query",
"description": "Whether to validate the existence of the alert.",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a rule or alert with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{rule_id}/alert/{alert_id}/_snooze": {
"post": {
"tags": [
"alerting"
],
"summary": "Snooze an alert",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "post-alerting-rule-rule-id-alert-alert-id-snooze",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "rule_id",
"in": "path",
"description": "The identifier for the rule.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
},
{
"name": "alert_id",
"in": "path",
"description": "The identifier for the alert.",
"required": true,
"schema": {
"maxLength": 1000,
"type": "string"
}
},
{
"name": "validate_alerts_existence",
"in": "query",
"description": "Set to `true` to validate that the specified alert exists. If a `400` error is returned, the specified alert does not exist. Defaults to `true`.",
"schema": {
"type": "boolean"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"condition_operator": {
"enum": [
"any",
"all"
],
"type": "string",
"description": "Logical operator applied to the conditions array. \"any\" expires the snooze when at least one condition is met; \"all\" requires every condition to be met. When conditions are provided but this field is omitted, defaults to \"any\"."
},
"conditions": {
"maxItems": 10,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"type",
"field"
],
"type": "object",
"properties": {
"field": {
"maxLength": 1000,
"type": "string",
"description": "The alert field to watch, written as a dot-notation path. When the value of the specified alert field changes, the snooze expires"
},
"type": {
"enum": [
"field_change"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Expires the snooze when the value of the specified alert field changes."
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"severity_change"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Expires the snooze when the severity of the specified alert changes."
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"severity_equals"
],
"type": "string"
},
"value": {
"enum": [
"critical",
"major",
"high",
"medium",
"minor",
"low",
"warning",
"info"
],
"type": "string",
"description": "The target severity level: critical, major, high, medium, minor, low, warning, or info."
}
},
"additionalProperties": false,
"description": "Expires the snooze when the severity of the specified alert equals a target level."
}
]
},
"description": "One or more conditions that, when met, automatically expire the snooze. Supported types: `field_change`, `severity_change`, `severity_equals`."
},
"expires_at": {
"maxLength": 30,
"type": "string",
"description": "The datetime at which the snooze expires, in ISO 8601 format (`YYYY-MM-DDTHH:mm:ss.sssZ`). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met."
}
},
"additionalProperties": false
}
}
}
},
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates the specified rule or alert doesn't exist."
}
},
"x-state": "Generally available; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute": {
"post": {
"tags": [
"alerting"
],
"summary": "Unmute an alert",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "delete-alerting-rules-backfill-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the backfill.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a backfill with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"alerting"
],
"summary": "Get a backfill by ID",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/alerting/rules/backfill/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "get-alerting-rules-backfill-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The identifier for the backfill.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_backfill_response"
},
"examples": {
"getBackfillResponse": {
"summary": "Get a backfill for an index threshold rule",
"value": {
"created_at": "2024-01-30T00:00:00.000Z",
"duration": "12h",
"enabled": true,
"id": "85bdf571-f4fb-4666-a8d2-e05e1220ebc6",
"initiator": "user",
"rule": {
"api_key_owner": "elastic",
"consumer": "alerts",
"created_at": "2022-12-05T23:40:33.132Z",
"created_by": "elastic",
"enabled": true,
"id": "3583a470-74f6-11ed-9801-35303b735aef",
"name": "my alert",
"params": {
"aggField": "sheet.version",
"aggType": "avg",
"groupBy": "top",
"index": [
"test-index"
],
"termField": "name.keyword",
"termSize": 6,
"threshold": [
1000
],
"thresholdComparator": ">",
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m"
},
"revision": 0,
"rule_type_id": ".index-threshold",
"schedule": {
"interval": "1m"
},
"tags": [
"cpu"
],
"updated_at": "2022-12-05T23:40:33.132Z",
"updated_by": "elastic"
},
"schedule": [
{
"interval": "12h",
"run_at": "2024-01-01T12:00:00.000Z",
"status": "pending"
},
{
"interval": "12h",
"run_at": "2024-01-02T00:00:00.000Z",
"status": "pending"
}
],
"space_id": "default",
"start": "2024-01-01T00:00:00.000Z",
"status": "pending"
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a backfill with the given ID does not exist."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/action_policies": {
"get": {
"tags": [
"alerting-v2"
],
"summary": "List action policies",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/alerting/v2/action_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a paginated list of action policies with optional filtering and sorting.
[Required authorization] Route required privileges: read_alerting-v2-action-policies.",
"operationId": "get-alerting-v2-action-policies",
"parameters": [
{
"name": "page",
"in": "query",
"description": "The page number to return. Defaults to 1.",
"schema": {
"maximum": 10000,
"minimum": 1,
"type": "integer"
}
},
{
"name": "per_page",
"in": "query",
"description": "The number of action policies to return per page. Defaults to 20.",
"schema": {
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
{
"name": "filter",
"in": "query",
"description": "A KQL filter to apply to the action policies. Supported fields: id, name, description, enabled.",
"schema": {
"maxLength": 4096,
"type": "string"
}
},
{
"name": "search",
"in": "query",
"description": "A text string to search across action policy fields.",
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"name": "sort_field",
"in": "query",
"description": "The field to sort action policies by.",
"schema": {
"enum": [
"name",
"created_at",
"updated_at"
],
"type": "string"
}
},
{
"name": "sort_order",
"in": "query",
"description": "The sort direction.",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Returns a paginated list of action policies.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_list_response"
},
"examples": {
"listActionPoliciesResponse": {
"summary": "A page of action policies",
"value": {
"items": [
{
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"enabled": true,
"grouping": {
"mode": "per_alert"
},
"id": "action-policy-1",
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"throttle": {
"strategy": "on_status_change"
},
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
}
}
],
"page": 1,
"per_page": 20,
"total": 1
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"errors": [ ],
"properties": {
"page": {
"errors": [
"Too small: expected number to be >=1"
]
}
}
}
},
"error": "Bad Request",
"message": "page: Too small: expected number to be >=1"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"alerting-v2"
],
"summary": "Create an action policy",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/alerting/v2/action_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates an action policy with a server-generated identifier. To create or replace an action policy with a client-supplied identifier, use PUT /api/alerting/v2/action_policies/{id}/.
[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.",
"operationId": "post-alerting-v2-action-policies",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_new_action_policy"
},
"examples": {
"createActionPolicyRequest": {
"summary": "Notification for alerts from rules with the production tag",
"value": {
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"grouping": {
"mode": "per_alert"
},
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"throttle": {
"strategy": "on_status_change"
}
}
}
}
}
}
},
"responses": {
"201": {
"description": "Returns the newly created action policy.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response"
},
"examples": {
"createActionPolicyResponse": {
"summary": "Newly created action policy",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"enabled": true,
"grouping": {
"mode": "per_alert"
},
"id": "action-policy-1",
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"throttle": {
"strategy": "on_status_change"
},
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
}
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "INVALID_ACTION_POLICY_DATA",
"details": {
"context": "create",
"errors": {
"errors": [ ],
"properties": {
"name": {
"errors": [
"Invalid input: expected string, received undefined"
]
}
}
}
},
"error": "Bad Request",
"message": "Error validating create action policy data - name: Invalid input: expected string, received undefined"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyLicenseNotSupported": {
"summary": "The current license does not support action policies",
"value": {
"code": "ACTION_POLICY_LICENSE_NOT_SUPPORTED",
"details": {
"current_license": "basic",
"license_status": "active",
"required_license": "enterprise"
},
"error": "Forbidden",
"message": "Action policies require an active enterprise license"
}
},
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/action_policies/_bulk_delete": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Delete action policies in bulk by ID",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes the action policy whose ID you include in the URL path. Use the `id` returned when you created the policy, or from get or list. This request has no body.
[Required authorization] Route required privileges: manage_alerting-v2-action-policies.",
"operationId": "delete-alerting-v2-action-policies-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"responses": {
"204": {
"description": "The action policy was deleted successfully."
},
"400": {
"description": "Indicates the request failed schema validation.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"errors": [ ],
"properties": {
"page": {
"errors": [
"Too small: expected number to be >=1"
]
}
}
}
},
"error": "Bad Request",
"message": "page: Too small: expected number to be >=1"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates an action policy with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyNotFound": {
"summary": "Indicates an action policy with the given ID does not exist.",
"value": {
"code": "ACTION_POLICY_NOT_FOUND",
"details": {
"action_policy_id": "action-policy-1"
},
"error": "Not Found",
"message": "Action policy with ID \"action-policy-1\" not found"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"alerting-v2"
],
"summary": "Get an action policy",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a partial update. A field you omit keeps its stored value, and that applies at every level: send `{\"matcher\": {\"tags\": [\"prod\"]}}` to change one leaf while leaving its siblings alone. Send `null` to clear a field, again at any level: `{\"matcher\": {\"expression\": null}}` clears a single leaf, while `{\"matcher\": null}` clears a whole object. Lists and variant objects are replaced as a unit rather than merged, since a partly-sent variant could never be valid. The merged result is validated as a whole, so a patch that would leave the resource invalid is rejected with a `400` and nothing is stored.
[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.",
"operationId": "patch-alerting-v2-action-policies-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_update_action_policy"
},
"examples": {
"updateActionPolicyRequest": {
"summary": "Rename the policy and clear the matcher expression, keeping its tags",
"value": {
"description": "Updated description.",
"matcher": {
"expression": "null",
"tags": [
"production"
]
},
"name": "Notify on production alerts (updated)"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the updated action policy.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response"
},
"examples": {
"updateActionPolicyResponse": {
"summary": "Updated action policy",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"description": "Updated description.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"enabled": true,
"grouping": {
"mode": "per_alert"
},
"id": "action-policy-1",
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts (updated)",
"throttle": {
"strategy": "on_status_change"
},
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
}
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "INVALID_ACTION_POLICY_DATA",
"details": {
"context": "update",
"errors": {
"errors": [ ],
"properties": {
"name": {
"errors": [
"Invalid input: expected string, received undefined"
]
}
}
}
},
"error": "Bad Request",
"message": "Error validating update action policy data - name: Invalid input: expected string, received undefined"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyLicenseNotSupported": {
"summary": "The current license does not support action policies",
"value": {
"code": "ACTION_POLICY_LICENSE_NOT_SUPPORTED",
"details": {
"current_license": "basic",
"license_status": "active",
"required_license": "enterprise"
},
"error": "Forbidden",
"message": "Action policies require an active enterprise license"
}
},
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates an action policy with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyNotFound": {
"summary": "Indicates an action policy with the given ID does not exist.",
"value": {
"code": "ACTION_POLICY_NOT_FOUND",
"details": {
"action_policy_id": "action-policy-1"
},
"error": "Not Found",
"message": "Action policy with ID \"action-policy-1\" not found"
}
}
}
}
}
},
"409": {
"description": "Indicates the action policy was concurrently updated by another caller.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyVersionConflict": {
"summary": "Indicates the action policy was concurrently updated by another caller.",
"value": {
"code": "ACTION_POLICY_VERSION_CONFLICT",
"details": {
"action_policy_id": "action-policy-1"
},
"error": "Conflict",
"message": "Action policy with ID \"action-policy-1\" has already been updated by another user"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"alerting-v2"
],
"summary": "Create or replace an action policy",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates an action policy with the given identifier, or fully replaces it if one already exists.
[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.",
"operationId": "put-alerting-v2-action-policies-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_put_action_policy"
},
"examples": {
"upsertActionPolicyRequest": {
"summary": "Action policy to create or replace at the given ID",
"value": {
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"grouping": {
"mode": "per_alert"
},
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"throttle": {
"strategy": "on_status_change"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the replaced action policy.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response"
},
"examples": {
"upsertActionPolicyReplacedResponse": {
"summary": "Replaced an existing action policy",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"enabled": true,
"grouping": {
"mode": "per_alert"
},
"id": "action-policy-1",
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"throttle": {
"strategy": "on_status_change"
},
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
}
}
}
}
}
}
},
"201": {
"description": "Returns the newly created action policy.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response"
},
"examples": {
"upsertActionPolicyCreatedResponse": {
"summary": "Created a new action policy",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"enabled": true,
"grouping": {
"mode": "per_alert"
},
"id": "action-policy-1",
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"throttle": {
"strategy": "on_status_change"
},
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
}
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "INVALID_ACTION_POLICY_DATA",
"details": {
"context": "upsert",
"errors": {
"errors": [ ],
"properties": {
"name": {
"errors": [
"Invalid input: expected string, received undefined"
]
}
}
}
},
"error": "Bad Request",
"message": "Error validating upsert action policy data - name: Invalid input: expected string, received undefined"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyLicenseNotSupported": {
"summary": "The current license does not support action policies",
"value": {
"code": "ACTION_POLICY_LICENSE_NOT_SUPPORTED",
"details": {
"current_license": "basic",
"license_status": "active",
"required_license": "enterprise"
},
"error": "Forbidden",
"message": "Action policies require an active enterprise license"
}
},
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"409": {
"description": "Indicates the action policy was created or updated concurrently by another caller.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyVersionConflict": {
"summary": "Indicates the action policy was concurrently updated by another caller.",
"value": {
"code": "ACTION_POLICY_VERSION_CONFLICT",
"details": {
"action_policy_id": "action-policy-1"
},
"error": "Conflict",
"message": "Action policy with ID \"action-policy-1\" has already been updated by another user"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/action_policies/{id}/_disable": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Disable an action policy",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSnooze an action policy until a specified time.
[Required authorization] Route required privileges: manage_alerting-v2-action-policies.",
"operationId": "post-alerting-v2-action-policies-id-snooze",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_snooze_action_policy_request"
},
"examples": {
"snoozeActionPolicyRequest": {
"summary": "Snooze until a specific timestamp",
"value": {
"snoozed_until": "2026-01-16T12:00:00.000Z"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the snoozed action policy.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response"
},
"examples": {
"snoozeActionPolicyResponse": {
"summary": "Snoozed action policy",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"description": "Sends notifications for alerts generated by rules with the production tag.",
"destinations": [
{
"id": "workflow-1",
"type": "workflow"
}
],
"enabled": true,
"grouping": {
"mode": "per_alert"
},
"id": "action-policy-1",
"matcher": {
"tags": [
"production"
]
},
"name": "Notify on production alerts",
"snoozed_until": "2026-01-16T12:00:00.000Z",
"throttle": {
"strategy": "on_status_change"
},
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
}
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"errors": [ ],
"properties": {
"snoozed_until": {
"errors": [
"Invalid input: expected string, received undefined"
]
}
}
}
},
"error": "Bad Request",
"message": "snoozed_until: Invalid input: expected string, received undefined"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates an action policy with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyNotFound": {
"summary": "Indicates an action policy with the given ID does not exist.",
"value": {
"code": "ACTION_POLICY_NOT_FOUND",
"details": {
"action_policy_id": "action-policy-1"
},
"error": "Not Found",
"message": "Action policy with ID \"action-policy-1\" not found"
}
}
}
}
}
},
"409": {
"description": "Indicates the action policy was concurrently updated by another caller.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"actionPolicyVersionConflict": {
"summary": "Indicates the action policy was concurrently updated by another caller.",
"value": {
"code": "ACTION_POLICY_VERSION_CONFLICT",
"details": {
"action_policy_id": "action-policy-1"
},
"error": "Conflict",
"message": "Action policy with ID \"action-policy-1\" has already been updated by another user"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/action_policies/{id}/_unsnooze": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Unsnooze an action policy",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the same action for multiple alert episodes in a single request.
[Required authorization] Route required privileges: manage_alerting-v2-alerts.",
"operationId": "post-alerting-v2-alerts-bulk-ack",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_ack_alerts_request"
},
"examples": {
"bulkAckEpisodeActionRequest": {
"summary": "Acknowledge two alert episodes",
"value": {
"items": [
{
"alert_id": "episode-1"
},
{
"alert_id": "episode-2"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the number of created actions and per-item errors for actions that were not created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkAckEpisodeActionResponse": {
"summary": "One action created, one episode not found",
"value": {
"affected_count": 1,
"errors": [
{
"error": {
"code": "ALERT_NOT_FOUND",
"message": "Alert with alert_id [episode-2] not found"
},
"id": "episode-2"
}
]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Items list is empty",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"At least one action must be provided"
]
}
},
"error": "Bad Request",
"message": "items: At least one action must be provided"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/alerts/_bulk_activate": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Bulk activate alert episodes",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the same action for multiple alert episodes in a single request.
[Required authorization] Route required privileges: manage_alerting-v2-alerts.",
"operationId": "post-alerting-v2-alerts-bulk-activate",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_activate_alerts_request"
},
"examples": {
"bulkActivateEpisodeActionRequest": {
"summary": "Reopen an alert episode with a reason",
"value": {
"items": [
{
"alert_id": "episode-1",
"reason": "manual reopen"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the number of created actions and per-item errors for actions that were not created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkActivateEpisodeActionResponse": {
"summary": "All actions created",
"value": {
"affected_count": 1,
"errors": [ ]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Items list is empty",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"At least one action must be provided"
]
}
},
"error": "Bad Request",
"message": "items: At least one action must be provided"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/alerts/_bulk_assign": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Bulk assign alert episodes",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the same action for multiple alert episodes in a single request.
[Required authorization] Route required privileges: manage_alerting-v2-alerts.",
"operationId": "post-alerting-v2-alerts-bulk-assign",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_assign_alerts_request"
},
"examples": {
"bulkAssignEpisodeActionRequest": {
"summary": "Assign one episode and clear the assignee of another",
"value": {
"items": [
{
"alert_id": "episode-1",
"assignee_uid": "u_abc123"
},
{
"alert_id": "episode-2",
"assignee_uid": "null"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the number of created actions and per-item errors for actions that were not created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkAssignEpisodeActionResponse": {
"summary": "All actions created",
"value": {
"affected_count": 2,
"errors": [ ]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Items list is empty",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"At least one action must be provided"
]
}
},
"error": "Bad Request",
"message": "items: At least one action must be provided"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/alerts/_bulk_deactivate": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Bulk deactivate alert episodes",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the same action for multiple alert episodes in a single request.
[Required authorization] Route required privileges: manage_alerting-v2-alerts.",
"operationId": "post-alerting-v2-alerts-bulk-deactivate",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_deactivate_alerts_request"
},
"examples": {
"bulkDeactivateEpisodeActionRequest": {
"summary": "Close an alert episode with a reason",
"value": {
"items": [
{
"alert_id": "episode-1",
"reason": "false positive"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the number of created actions and per-item errors for actions that were not created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkDeactivateEpisodeActionResponse": {
"summary": "All actions created",
"value": {
"affected_count": 1,
"errors": [ ]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Items list is empty",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"At least one action must be provided"
]
}
},
"error": "Bad Request",
"message": "items: At least one action must be provided"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/alerts/_bulk_tag": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Bulk tag alert episodes",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the same action for multiple alert episodes in a single request.
[Required authorization] Route required privileges: manage_alerting-v2-alerts.",
"operationId": "post-alerting-v2-alerts-bulk-tag",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_tag_alerts_request"
},
"examples": {
"bulkTagEpisodeActionRequest": {
"summary": "Tag two alert episodes with production",
"value": {
"items": [
{
"alert_id": "episode-1",
"tags": [
"production"
]
},
{
"alert_id": "episode-2",
"tags": [
"production"
]
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the number of created actions and per-item errors for actions that were not created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkTagEpisodeActionResponse": {
"summary": "All actions created",
"value": {
"affected_count": 2,
"errors": [ ]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Items list is empty",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"At least one action must be provided"
]
}
},
"error": "Bad Request",
"message": "items: At least one action must be provided"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/alerts/_bulk_unack": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Bulk unacknowledge alert episodes",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the same action for multiple alert episodes in a single request.
[Required authorization] Route required privileges: manage_alerting-v2-alerts.",
"operationId": "post-alerting-v2-alerts-bulk-unack",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unack_alerts_request"
},
"examples": {
"bulkUnackEpisodeActionRequest": {
"summary": "Unacknowledge two alert episodes",
"value": {
"items": [
{
"alert_id": "episode-1"
},
{
"alert_id": "episode-2"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the number of created actions and per-item errors for actions that were not created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkUnackEpisodeActionResponse": {
"summary": "All actions created",
"value": {
"affected_count": 2,
"errors": [ ]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Items list is empty",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"At least one action must be provided"
]
}
},
"error": "Bad Request",
"message": "items: At least one action must be provided"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/alerts/{id}/_ack": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Acknowledge an alert episode",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a paginated list of dispatcher summary events for action policies in the current space.
[Required authorization] Route required privileges: read_alerting-v2-execution-history.",
"operationId": "get-alerting-v2-execution-history-action-policies",
"parameters": [
{
"name": "page",
"in": "query",
"description": "Page number (1-indexed). Defaults to 1.",
"required": true,
"schema": {
"maximum": 10000,
"minimum": 1,
"type": "integer",
"default": 1
}
},
{
"name": "per_page",
"in": "query",
"description": "Number of events per page. Defaults to 20.",
"required": true,
"schema": {
"maximum": 100,
"minimum": 1,
"type": "integer",
"default": 20
}
},
{
"name": "from",
"in": "query",
"description": "Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.",
"schema": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
}
},
{
"name": "to",
"in": "query",
"description": "Inclusive ISO datetime upper bound on the event timestamp.",
"schema": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
}
},
{
"name": "alert_ids",
"in": "query",
"description": "Alert filter. Narrows events to those referencing at least one of the provided alert IDs.",
"schema": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 150,
"minLength": 1,
"type": "string"
}
}
},
{
"name": "sort_field",
"in": "query",
"description": "Sort field. Defaults to \"dispatched_at\".",
"required": true,
"schema": {
"enum": [
"dispatched_at"
],
"type": "string",
"default": "dispatched_at"
}
},
{
"name": "sort_order",
"in": "query",
"description": "Sort direction. Defaults to \"desc\".",
"required": true,
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc"
}
},
{
"name": "search",
"in": "query",
"description": "Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).",
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"name": "rule_ids",
"in": "query",
"description": "Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.",
"schema": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 150,
"minLength": 1,
"type": "string"
}
}
},
{
"name": "outcomes",
"in": "query",
"description": "Outcome filter. When omitted matches all outcomes. Pass one or more of \"success\", \"throttled\", \"failure\" to narrow.",
"schema": {
"maxItems": 3,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"success",
"throttled",
"failure"
],
"type": "string"
}
}
}
],
"responses": {
"200": {
"description": "Returns a paginated list of execution history events.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_response"
},
"examples": {
"listActionPolicyExecutionsResponse": {
"summary": "A page of action policy execution events",
"value": {
"items": [
{
"action_group_count": 1,
"alert_count": 1,
"alerts": [
{
"id": "episode-1"
}
],
"dispatched_at": "2026-01-15T12:05:00.000Z",
"outcome": "success",
"policy": {
"id": "action-policy-1",
"name": "Notify on production alerts"
},
"rule_count": 1,
"rules": [
{
"id": "rule-1",
"name": "Host CPU high"
}
],
"workflows": [
{
"id": "workflow-1",
"name": "Notify oncall"
}
]
}
],
"page": 1,
"per_page": 20,
"total": 1
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Exceeds the max result window",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"page": [
"page * per_page cannot exceed 10000."
]
}
},
"error": "Bad Request",
"message": "page * per_page cannot exceed 10000."
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/execution_history/rules": {
"get": {
"tags": [
"alerting-v2"
],
"summary": "List rule executions",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: read_alerting-v2-rules.",
"operationId": "get-alerting-v2-rules",
"parameters": [
{
"name": "page",
"in": "query",
"description": "The page number to return. Defaults to 1. `page * per_page` cannot exceed 10000.",
"schema": {
"maximum": 10000,
"minimum": 1,
"type": "integer"
}
},
{
"name": "per_page",
"in": "query",
"description": "The number of rules to return per page. Defaults to 20.",
"schema": {
"maximum": 100,
"minimum": 1,
"type": "integer"
}
},
{
"name": "filter",
"in": "query",
"description": "The filter to apply to the rules.",
"schema": {
"maxLength": 4096,
"type": "string"
}
},
{
"name": "sort_field",
"in": "query",
"description": "The field to sort rules by.",
"schema": {
"enum": [
"kind",
"enabled",
"name"
],
"type": "string"
}
},
{
"name": "sort_order",
"in": "query",
"description": "The direction to sort rules.",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string"
}
},
{
"name": "search",
"in": "query",
"description": "A text string to search across rule fields.",
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Returns a paginated list of rules.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_list_response"
},
"examples": {
"listRulesResponse": {
"summary": "Paginated list containing one matching rule",
"value": {
"items": [
{
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
],
"page": 1,
"per_page": 20,
"total": 1
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"errors": [ ],
"properties": {
"page": {
"errors": [
"Too small: expected number to be >=1"
]
}
}
}
},
"error": "Bad Request",
"message": "page: Too small: expected number to be >=1"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"alerting-v2"
],
"summary": "Create a rule",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/alerting/v2/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a rule with a server-generated identifier. To create or replace a rule with a client-supplied identifier, use PUT /api/alerting/v2/rules/{id}/.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "post-alerting-v2-rules",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule"
},
"examples": {
"createRuleRequest": {
"summary": "Create a host CPU threshold rule",
"value": {
"grouping": {
"fields": [
"host.name"
]
},
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp"
}
}
}
}
}
},
"responses": {
"201": {
"description": "Returns the newly created rule.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"examples": {
"createRuleResponse": {
"summary": "Created host CPU threshold rule",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Missing required rule metadata",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"metadata": [
"Required"
]
}
},
"error": "Bad Request",
"message": "metadata: Required"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/rules/_bulk_create": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Create rules in bulk",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates up to 100 rules in a single request. Each item can include a client-supplied `id`. Kibana generates an identifier when `id` is omitted. The request succeeds with HTTP 200 even when some rules fail. Created rules are returned in `items`. Failures are returned in `errors`. Check `errors` before treating the request as fully successful. To create a single rule, use POST /api/alerting/v2/rules.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "post-alerting-v2-rules-bulk-create",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rules_request"
},
"examples": {
"bulkCreateRulesRequest": {
"summary": "Create two rules, one of them disabled",
"value": {
"items": [
{
"grouping": {
"fields": [
"host.name"
]
},
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp"
},
{
"enabled": false,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-disabled",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high (disabled)",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Created rules are returned in `items`. Failures are returned in `errors`.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rules_response"
},
"examples": {
"bulkCreateRulesResponse": {
"summary": "Created both requested rules",
"value": {
"errors": [ ],
"items": [
{
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
},
{
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": false,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-disabled",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high (disabled)",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Request body is missing required items",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"items": [
"Required"
]
}
},
"error": "Bad Request",
"message": "items: Required"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/rules/_bulk_delete": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Delete rules in bulk by ID",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRotates each rule executor task API key to one derived from the current user’s credentials.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "post-alerting-v2-rules-bulk-update-api-key",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request"
},
"examples": {
"bulkUpdateApiKeyRequest": {
"summary": "Rotate API keys for two rules by ID",
"value": {
"ids": [
"rule-1",
"rule-2"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the result of the bulk update API key operation.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
},
"examples": {
"bulkUpdateApiKeyResponse": {
"summary": "Rotated API keys for both requested rules",
"value": {
"affected_count": 2,
"errors": [ ]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Request body is missing required rule ids",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"ids": [
"Required"
]
}
},
"error": "Bad Request",
"message": "ids: Required"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/rules/_delete_by_query": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Delete rules matching a query (dry-run by default)",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRotates each matching rule executor task API key to one derived from the current user’s credentials.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "post-alerting-v2-rules-update-api-key-by-query",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request"
},
"examples": {
"updateApiKeyByQueryRequest": {
"summary": "Rotate API keys for rules tagged production (dry-run by default, or set `force: true` to execute)",
"value": {
"filter": "tags: production"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns a dry-run preview by default, or the executed operation when `force` is true.",
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response"
}
]
},
"examples": {
"updateApiKeyByQueryDryRunResponse": {
"summary": "Dry-run preview of matching rules; set `force: true` on the request to execute",
"value": {
"match_count": 2,
"sample": [
"rule-1",
"rule-2"
]
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "By-query body omits filter, search, and match_all",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"": [
"At least one of filter, search, or match_all must be provided."
]
}
},
"error": "Bad Request",
"message": "At least one of filter, search, or match_all must be provided."
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/rules/{id}": {
"delete": {
"tags": [
"alerting-v2"
],
"summary": "Delete a rule",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/alerting/v2/rules/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "delete-alerting-v2-rules-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"responses": {
"204": {
"description": "The rule was deleted successfully."
},
"400": {
"description": "Indicates the request failed schema validation.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"errors": [ ],
"properties": {
"page": {
"errors": [
"Too small: expected number to be >=1"
]
}
}
}
},
"error": "Bad Request",
"message": "page: Too small: expected number to be >=1"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates a rule with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleNotFound": {
"summary": "No rule exists for the given ID",
"value": {
"code": "RULE_NOT_FOUND",
"details": {
"rule_id": "rule-1"
},
"error": "Not Found",
"message": "Rule with id \"rule-1\" not found"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"alerting-v2"
],
"summary": "Get a rule",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/alerting/v2/rules/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: read_alerting-v2-rules.",
"operationId": "get-alerting-v2-rules-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Returns the requested rule.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"examples": {
"getRuleResponse": {
"summary": "Retrieved host CPU threshold rule",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
}
}
}
}
},
"400": {
"description": "Indicates the request failed schema validation.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Indicates an invalid schema or parameters.",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"errors": [ ],
"properties": {
"page": {
"errors": [
"Too small: expected number to be >=1"
]
}
}
}
},
"error": "Bad Request",
"message": "page: Too small: expected number to be >=1"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates a rule with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleNotFound": {
"summary": "No rule exists for the given ID",
"value": {
"code": "RULE_NOT_FOUND",
"details": {
"rule_id": "rule-1"
},
"error": "Not Found",
"message": "Rule with id \"rule-1\" not found"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"alerting-v2"
],
"summary": "Update a rule",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/alerting/v2/rules/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a partial update. A field you omit keeps its stored value, and that applies at every level: send `{\"metadata\": {\"name\": \"Disk pressure\"}}` to change one leaf while leaving its siblings alone. Send `null` to clear a field, again at any level: `{\"metadata\": {\"description\": null}}` clears a single leaf, while `{\"grouping\": null}` clears a whole object. Lists and variant objects are replaced as a unit rather than merged, since a partly-sent variant could never be valid. The merged result is validated as a whole, so a patch that would leave the resource invalid is rejected with a `400` and nothing is stored.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "patch-alerting-v2-rules-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_update_rule"
},
"examples": {
"updateRuleRequest": {
"summary": "Rename a rule and clear its tags, leaving the rest of the metadata intact",
"value": {
"metadata": {
"description": "Updated description.",
"name": "Host CPU high (updated)",
"tags": "null"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the updated rule.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"examples": {
"updateRuleResponse": {
"summary": "Updated rule metadata",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Updated description.",
"name": "Host CPU high (updated)",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Update body includes an unrecognized field",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"unknownField": [
"Unrecognized key"
]
}
},
"error": "Bad Request",
"message": "Unrecognized key(s) in object: 'unknownField'"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates a rule with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleNotFound": {
"summary": "No rule exists for the given ID",
"value": {
"code": "RULE_NOT_FOUND",
"details": {
"rule_id": "rule-1"
},
"error": "Not Found",
"message": "Rule with id \"rule-1\" not found"
}
}
}
}
}
},
"409": {
"description": "Indicates the rule was concurrently updated by another caller.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleVersionConflict": {
"summary": "Indicates the rule was concurrently updated by another caller.",
"value": {
"code": "RULE_VERSION_CONFLICT",
"details": {
"rule_id": "rule-1"
},
"error": "Conflict",
"message": "Rule with id \"rule-1\" has already been updated by another user"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"alerting-v2"
],
"summary": "Create or replace a rule",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/alerting/v2/rules/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a rule with the given identifier, or fully replaces it if one already exists.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "put-alerting-v2-rules-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule"
},
"examples": {
"upsertRuleRequest": {
"summary": "Create or replace a host CPU threshold rule",
"value": {
"grouping": {
"fields": [
"host.name"
]
},
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Returns the replaced rule.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"examples": {
"upsertRuleReplacedResponse": {
"summary": "Replaced an existing rule",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
}
}
}
}
},
"201": {
"description": "Returns the newly created rule.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"examples": {
"upsertRuleCreatedResponse": {
"summary": "Created a new rule with the given ID",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"invalidRequest": {
"summary": "Upsert body is missing required rule metadata",
"value": {
"code": "BAD_REQUEST",
"details": {
"errors": {
"metadata": [
"Required"
]
}
},
"error": "Bad Request",
"message": "metadata: Required"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"409": {
"description": "Indicates the rule was created or updated concurrently, or the request changes immutable fields.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleVersionConflict": {
"summary": "Rule was changed concurrently by another caller",
"value": {
"code": "RULE_VERSION_CONFLICT",
"details": {
"rule_id": "rule-1"
},
"error": "Conflict",
"message": "Rule with id \"rule-1\" has already been updated by another user"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/rules/{id}/_disable": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Disable a rule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nEnable a rule by identifier.
[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "post-alerting-v2-rules-id-enable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Returns the enabled rule.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"examples": {
"enableRuleResponse": {
"summary": "Enabled host CPU threshold rule",
"value": {
"created_at": "2026-01-15T12:00:00.000Z",
"created_by": {
"profile_uid": "u_elastic_0"
},
"enabled": true,
"grouping": {
"fields": [
"host.name"
]
},
"id": "rule-1",
"kind": "alert",
"metadata": {
"description": "Alerts when average CPU usage exceeds a threshold.",
"name": "Host CPU high",
"routing_tags": [
"sre-oncall"
],
"tags": [
"production",
"infra"
]
},
"no_data": {
"strategy": "keep_last"
},
"query": {
"base": "FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name",
"breach": {
"segment": "WHERE avg_cpu > 0.9"
}
},
"recovery": {
"strategy": "no_breach"
},
"schedule": {
"every": "1m",
"lookback": "5m"
},
"state_transition": {
"pending": {
"count": 1
},
"recovering": {
"count": 1
}
},
"time_field": "@timestamp",
"updated_at": "2026-01-15T12:00:00.000Z",
"updated_by": {
"profile_uid": "u_elastic_0"
},
"version": 1
}
}
}
}
}
},
"400": {
"description": "Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"maxSchedulesPerMinuteExceeded": {
"summary": "Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.",
"value": {
"code": "MAX_SCHEDULES_PER_MINUTE_EXCEEDED",
"details": {
"interval": "1m",
"max_scheduled_per_minute": 400
},
"error": "Bad Request",
"message": "Rule schedule of \"1m\" would exceed the limit of 400 rule runs per minute"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates a rule with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleNotFound": {
"summary": "No rule exists for the given ID",
"value": {
"code": "RULE_NOT_FOUND",
"details": {
"rule_id": "rule-1"
},
"error": "Not Found",
"message": "Rule with id \"rule-1\" not found"
}
}
}
}
}
},
"409": {
"description": "Indicates the rule was concurrently updated by another caller.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleVersionConflict": {
"summary": "Indicates the rule was concurrently updated by another caller.",
"value": {
"code": "RULE_VERSION_CONFLICT",
"details": {
"rule_id": "rule-1"
},
"error": "Conflict",
"message": "Rule with id \"rule-1\" has already been updated by another user"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/alerting/v2/rules/{id}/_run": {
"post": {
"tags": [
"alerting-v2"
],
"summary": "Run a rule now",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/alerting/v2/rules/{id}/_run
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: manage_alerting-v2-rules.",
"operationId": "post-alerting-v2-rules-id-run",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.",
"required": true,
"schema": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
}
}
],
"responses": {
"202": {
"description": "The run was accepted: the rule is scheduled to run. Requests that arrive before the run starts are collapsed into a single run. Poll the rule execution history to observe the result."
},
"400": {
"description": "Indicates the rule is disabled and cannot be run.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleDisabled": {
"summary": "Indicates the rule is disabled and cannot be run.",
"value": {
"code": "RULE_DISABLED",
"details": {
"rule_id": "rule-1"
},
"error": "Bad Request",
"message": "Rule with id \"rule-1\" is disabled and cannot be run"
}
}
}
}
}
},
"401": {
"description": "Indicates the request was not authenticated.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"unauthorized": {
"summary": "Request was not authenticated",
"value": {
"code": "UNAUTHORIZED",
"error": "Unauthorized",
"message": "Authentication required to access this API."
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required privileges to perform the request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"forbidden": {
"summary": "Caller lacks required privileges",
"value": {
"code": "FORBIDDEN",
"error": "Forbidden",
"message": "The current user does not have the required privileges for this request."
}
}
}
}
}
},
"404": {
"description": "Indicates a rule with the given ID does not exist.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleNotFound": {
"summary": "No rule exists for the given ID",
"value": {
"code": "RULE_NOT_FOUND",
"details": {
"rule_id": "rule-1"
},
"error": "Not Found",
"message": "Rule with id \"rule-1\" not found"
}
}
}
}
}
},
"409": {
"description": "Indicates the rule is already running or the run request conflicted.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"ruleAlreadyRunning": {
"summary": "Indicates the rule is already running or the run request conflicted.",
"value": {
"code": "RULE_ALREADY_RUNNING",
"details": {
"rule_id": "rule-1"
},
"error": "Conflict",
"message": "Rule with id \"rule-1\" is already running"
}
}
}
}
}
},
"500": {
"description": "Indicates an unexpected server-side error.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"internalServerError": {
"summary": "Unexpected server-side error",
"value": {
"code": "INTERNAL_SERVER_ERROR",
"error": "Internal Server Error",
"message": "An unexpected error occurred."
}
}
}
}
}
},
"503": {
"description": "Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_error_response"
},
"examples": {
"alertingDisabled": {
"summary": "Alerting V2 is disabled",
"value": {
"code": "ALERTING_DISABLED",
"error": "Service Unavailable",
"message": "Alerting is disabled."
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/apm/agent_keys": {
"post": {
"tags": [
"APM agent keys"
],
"summary": "Create an APM agent key",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/apm/agent_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new agent key for APM.\nThe user creating an APM agent API key must have at least the `manage_own_api_key` cluster privilege and the APM application-level privileges that it wishes to grant.\nAfter it is created, you can copy the API key (Base64 encoded) and use it to to authorize requests from APM agents to the APM Server.\n",
"operationId": "createAgentKey",
"parameters": [
{
"$ref": "#/components/parameters/APM_UI_elastic_api_version"
},
{
"$ref": "#/components/parameters/APM_UI_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_agent_keys_object"
},
"examples": {
"createAgentKeyRequest1": {
"$ref": "#/components/examples/APM_UI_agent_keys_object_post_request1"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Agent key created successfully",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_agent_keys_response"
},
"examples": {
"createAgentKeyResponse1": {
"$ref": "#/components/examples/APM_UI_agent_keys_object_post_200_response1"
}
}
}
}
},
"400": {
"description": "Bad Request response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_400_response"
},
"examples": {
"badRequestResponse": {
"$ref": "#/components/examples/APM_UI_error_400_response"
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_401_response"
},
"examples": {
"unauthorizedResponse": {
"$ref": "#/components/examples/APM_UI_error_401_response"
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_403_response"
},
"examples": {
"forbiddenResponse": {
"$ref": "#/components/examples/APM_UI_error_403_response"
}
}
}
}
},
"500": {
"description": "Internal Server Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_500_response"
},
"examples": {
"internalServerErrorResponse": {
"$ref": "#/components/examples/APM_UI_error_500_response"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/apm/fleet/apm_server_schema": {
"post": {
"tags": [
"APM server schema"
],
"summary": "Save APM server schema",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/apm/fleet/apm_server_schema
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDEPRECATED: This endpoint is intended for internal use by Fleet integrations to push the APM Server configuration schema. Do not use for new integrations. It stores the provided schema object as a Kibana saved object. If Fleet migration is not available on the current deployment, the API returns a 404.\n",
"operationId": "saveApmServerSchema",
"parameters": [
{
"$ref": "#/components/parameters/APM_UI_elastic_api_version"
},
{
"$ref": "#/components/parameters/APM_UI_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"schema": {
"type": "object",
"description": "Schema object",
"example": {
"foo": "bar"
}
}
}
},
"examples": {
"saveApmServerSchemaRequest": {
"description": "An example request payload for `POST /api/apm/fleet/apm_server_schema`.",
"value": {
"schema": {
"foo": "bar"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object",
"additionalProperties": false,
"description": "The response body is intentionally empty for this endpoint."
},
"examples": {
"saveApmServerSchemaResponseExample1": {
"$ref": "#/components/examples/APM_UI_fleet_apm_server_schema_200_response1"
}
}
}
}
},
"400": {
"description": "Bad Request response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_400_response"
},
"examples": {
"badRequestResponse": {
"$ref": "#/components/examples/APM_UI_error_400_response"
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_401_response"
},
"examples": {
"unauthorizedResponse": {
"$ref": "#/components/examples/APM_UI_error_401_response"
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_403_response"
},
"examples": {
"forbiddenResponse": {
"$ref": "#/components/examples/APM_UI_error_403_response"
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/APM_UI_404_response"
},
"examples": {
"notFoundResponse": {
"$ref": "#/components/examples/APM_UI_error_404_response"
}
}
}
}
}
},
"deprecated": true,
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/apm/services/{serviceName}/annotation": {
"post": {
"tags": [
"APM annotations"
],
"summary": "Create a service annotation",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**Deprecated in 9.4.0.** Use the Entity Store APIs to unassign asset criticality for a specific entity.\n\nDelete the asset criticality record for a specific entity.\n",
"operationId": "DeleteAssetCriticalityRecord",
"parameters": [
{
"name": "id_value",
"in": "query",
"description": "The ID value of the asset.",
"required": true,
"schema": {
"type": "string"
},
"example": "my_host"
},
{
"name": "id_field",
"in": "query",
"description": "The field representing the ID.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_IdField"
},
"example": "host.name"
},
{
"name": "refresh",
"in": "query",
"description": "If 'wait_for' the request will wait for the index refresh.",
"schema": {
"enum": [
"wait_for"
],
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"deleted"
],
"type": "object",
"properties": {
"deleted": {
"type": "boolean",
"description": "True if the record was deleted or false if the record did not exist."
},
"record": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord"
}
}
}
}
}
},
"400": {
"description": "Invalid request"
}
},
"deprecated": true,
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Entity Analytics API"
],
"summary": "Get an asset criticality record",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/asset_criticality
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**Deprecated in 9.4.0.** Get the asset criticality record for a specific entity.",
"operationId": "GetAssetCriticalityRecord",
"parameters": [
{
"name": "id_value",
"in": "query",
"description": "The ID value of the asset.",
"required": true,
"schema": {
"type": "string"
},
"example": "my_host"
},
{
"name": "id_field",
"in": "query",
"description": "The field representing the ID.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_IdField"
},
"example": "host.name"
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord"
}
}
}
},
"400": {
"description": "Invalid request"
},
"404": {
"description": "Criticality record not found"
}
},
"deprecated": true,
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Entity Analytics API"
],
"summary": "Upsert an asset criticality record",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/asset_criticality
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**Deprecated in 9.4.0.** Use the Entity Store APIs to assign asset criticality to an entity.\n\nCreate or update an asset criticality record for a specific entity.\n\nIf a record already exists for the specified entity, that record is overwritten with the specified value. If a record doesn't exist for the specified entity, a new record is created.\n",
"operationId": "CreateAssetCriticalityRecord",
"requestBody": {
"content": {
"application/json": {
"schema": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord"
},
{
"type": "object",
"properties": {
"refresh": {
"enum": [
"wait_for"
],
"type": "string",
"description": "If 'wait_for' the request will wait for the index refresh."
}
}
}
],
"example": {
"criticality_level": "high_impact",
"id_field": "host.name",
"id_value": "my_host"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord"
}
}
}
},
"400": {
"description": "Invalid request"
}
},
"deprecated": true,
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/asset_criticality/bulk": {
"post": {
"tags": [
"Security Entity Analytics API"
],
"summary": "Bulk upsert asset criticality records",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/asset_criticality/bulk
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n**Deprecated in 9.4.0.** Use the Entity Store APIs to bulk assign asset criticality.\n\nBulk upsert up to 1000 asset criticality records.\n\nIf asset criticality records already exist for the specified entities, those records are overwritten with the specified values. If asset criticality records don't exist for the specified entities, new records are created.\n",
"operationId": "BulkUpsertAssetCriticalityRecords",
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"records"
],
"type": "object",
"properties": {
"records": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts"
},
{
"required": [
"criticality_level"
],
"type": "object",
"properties": {
"criticality_level": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload"
}
}
}
]
}
}
},
"example": {
"records": [
{
"criticality_level": "low_impact",
"id_field": "host.name",
"id_value": "host-1"
},
{
"criticality_level": "medium_impact",
"id_field": "host.name",
"id_value": "host-2"
}
]
}
}
}
}
},
"responses": {
"200": {
"description": "Bulk upload successful",
"content": {
"application/json": {
"schema": {
"required": [
"errors",
"stats"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem"
}
},
"stats": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats"
}
},
"example": {
"errors": [
{
"index": 0,
"message": "Invalid ID field"
}
],
"stats": {
"failed": 1,
"successful": 1,
"total": 2
}
}
}
}
}
},
"413": {
"description": "File too large"
}
},
"deprecated": true,
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/asset_criticality/list": {
"get": {
"tags": [
"Security Entity Analytics API"
],
"summary": "List asset criticality records",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPerforms bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.",
"operationId": "PostAttackDiscoveryBulk",
"requestBody": {
"description": "Bulk update parameters for Attack discoveries",
"content": {
"application/json": {
"schema": {
"required": [
"update"
],
"type": "object",
"properties": {
"update": {
"required": [
"ids"
],
"type": "object",
"properties": {
"enable_field_rendering": {
"type": "boolean",
"description": "Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.",
"default": false,
"example": false
},
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Array of Attack Discovery IDs to update",
"example": [
"c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
"5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
]
},
"kibana_alert_workflow_status": {
"enum": [
"open",
"acknowledged",
"closed"
],
"type": "string",
"description": "When provided, update the kibana.alert.workflow_status of the attack discovery alerts",
"example": "acknowledged"
},
"visibility": {
"enum": [
"not_shared",
"shared"
],
"type": "string",
"description": "When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field",
"example": "shared"
},
"with_replacements": {
"type": "boolean",
"description": "When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`.",
"default": true,
"example": true
}
},
"description": "Configuration object containing all parameters for the bulk update operation"
}
}
},
"examples": {
"PostAttackDiscoveryBulkRequestBodyExample": {
"summary": "Acknowledge two Attack discoveries in bulk.",
"value": {
"update": {
"enable_field_rendering": false,
"ids": [
"c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
"5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
],
"kibana_alert_workflow_status": "acknowledged",
"with_replacements": true
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert"
},
"description": "Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request."
}
}
},
"examples": {
"PostAttackDiscoveryBulkResponse200Example": {
"summary": "A successful bulk update response containing the modified Attack discoveries.",
"value": {
"data": [
{
"alert_ids": [
"alert-abc-1"
],
"alert_workflow_status": "acknowledged",
"connector_id": "gen-ai-connector",
"connector_name": "OpenAI GPT-4",
"details_markdown": "- **Host** `workstation-01` showed credential access patterns consistent with mimikatz.",
"generation_uuid": "550e8400-e29b-41d4-a716-446655440000",
"id": "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
"summary_markdown": "A user account was compromised using mimikatz to dump credentials.",
"timestamp": "2024-01-15T10:00:00.000Z",
"title": "Credential theft via mimikatz"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"required": [
"status_code",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Bad Request"
},
"message": {
"type": "string",
"description": "Human-readable error message describing what went wrong with the bulk update request",
"example": "Invalid request parameters."
},
"status_code": {
"type": "number",
"description": "HTTP status code",
"example": 400
}
}
},
"examples": {
"PostAttackDiscoveryBulkResponse400Example": {
"summary": "Bad Request error returned when the bulk update payload is invalid.",
"value": {
"error": "Bad Request",
"message": "Invalid request parameters.",
"status_code": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Example request",
"lang": "curl",
"source": "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_bulk' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data-raw '{\n \"update\": {\n \"ids\": [\n \"c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f\",\n \"5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7\"\n ],\n \"kibana_alert_workflow_status\": \"acknowledged\"\n }\n }'\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/attack_discovery/_find": {
"get": {
"tags": [
"Security Attack discovery API"
],
"summary": "Find Attack discoveries that match the search criteria",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/attack_discovery/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFind Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.",
"operationId": "AttackDiscoveryFind",
"parameters": [
{
"name": "alert_ids",
"in": "query",
"description": "Filter results to Attack discoveries that include any of the provided alert IDs",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "connector_names",
"in": "query",
"description": "Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. \"GPT-5 Chat\", which are distinct from `connector_id` values used to generate Attack discoveries.",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "enable_field_rendering",
"in": "query",
"description": "Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.",
"schema": {
"type": "boolean",
"default": false
},
"example": false
},
{
"name": "end",
"in": "query",
"description": "End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. \"now\", \"now-24h\").",
"schema": {
"type": "string"
},
"example": "now"
},
{
"name": "ids",
"in": "query",
"description": "Filter results to the Attack discoveries with the specified IDs",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "include_unique_alert_ids",
"in": "query",
"description": "If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries",
"schema": {
"type": "boolean"
},
"example": false
},
{
"name": "page",
"in": "query",
"description": "Page number to return (used for pagination). Defaults to 1.",
"schema": {
"minimum": 1,
"type": "integer",
"default": 1
},
"example": 1
},
{
"name": "per_page",
"in": "query",
"description": "Number of Attack discoveries to return per page (used for pagination). Defaults to 10.",
"schema": {
"minimum": 1,
"type": "integer",
"default": 10
},
"example": 10
},
{
"name": "search",
"in": "query",
"description": "Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)",
"schema": {
"type": "string"
},
"example": ""
},
{
"name": "shared",
"in": "query",
"description": "Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user. Mutually exclusive with `include_all_authors`.",
"schema": {
"type": "boolean"
}
},
{
"name": "include_all_authors",
"in": "query",
"description": "If `true`, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with `shared`.",
"schema": {
"type": "boolean"
}
},
{
"name": "scheduled",
"in": "query",
"description": "Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.",
"schema": {
"type": "boolean"
}
},
{
"name": "sort_field",
"in": "query",
"description": "Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.",
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryFindSortField"
},
"example": "@timestamp"
},
{
"name": "sort_order",
"in": "query",
"description": "Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.",
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_SortOrder"
},
"example": "desc"
},
{
"name": "start",
"in": "query",
"description": "Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. \"now-7d\").",
"schema": {
"type": "string"
},
"example": "now-24h"
},
{
"name": "status",
"in": "query",
"description": "Filter by alert workflow status. Provide one or more of the allowed workflow states.",
"schema": {
"type": "array",
"items": {
"enum": [
"acknowledged",
"closed",
"open"
],
"type": "string"
}
},
"example": [
"open",
"acknowledged"
]
},
{
"name": "with_replacements",
"in": "query",
"description": "When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.",
"schema": {
"type": "boolean",
"default": true
},
"example": true
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"connector_names",
"data",
"page",
"per_page",
"total",
"unique_alert_ids_count"
],
"type": "object",
"properties": {
"connector_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries."
},
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert"
},
"description": "Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema."
},
"page": {
"type": "integer",
"description": "Current page number of the paginated result set."
},
"per_page": {
"type": "integer",
"description": "Number of items requested per page."
},
"total": {
"type": "integer",
"description": "Total number of Attack discoveries matching the query (across all pages)."
},
"unique_alert_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request."
},
"unique_alert_ids_count": {
"type": "integer",
"description": "Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request."
}
}
},
"examples": {
"AttackDiscoveryFindResponse200Example": {
"summary": "Paginated list of Attack discoveries matching the search criteria.",
"value": {
"connector_names": [
"GPT-5 Chat"
],
"data": [
{
"connector_name": "GPT-5 Chat",
"id": "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
"title": "Suspicious process execution on host-01"
}
],
"page": 1,
"per_page": 10,
"total": 1,
"unique_alert_ids_count": 0
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Bad Request"
},
"message": {
"type": "string",
"description": "Human-readable error message",
"example": "Invalid request payload."
},
"status_code": {
"type": "number",
"description": "HTTP status code",
"example": 400
}
}
},
"examples": {
"AttackDiscoveryFindResponse400Example": {
"summary": "Bad Request error returned when find query parameters are invalid.",
"value": {
"error": "Bad Request",
"message": "Invalid request payload.",
"status_code": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Example request",
"lang": "curl",
"source": "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/_find?end=now&include_unique_alert_ids=false&page=1&per_page=10&search=&sort_field=%40timestamp&sort_order=desc&start=now-24h&status=open&status=acknowledged' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/attack_discovery/_generate": {
"post": {
"tags": [
"Security Attack discovery API"
],
"summary": "Generate attack discoveries from alerts",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI. This sets the generation's status to \"dismissed\" and affects how the generation appears in subsequent queries.",
"operationId": "PostAttackDiscoveryGenerationsDismiss",
"parameters": [
{
"name": "execution_uuid",
"in": "path",
"description": "The unique identifier for the Attack Discovery generation execution. This UUID is returned when an Attack Discovery generation is created and can be found in generation responses.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"example": "46b218d5-535d-4329-be56-d0f6af6986b7"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"connector_id",
"discoveries",
"execution_uuid",
"start",
"status"
],
"type": "object",
"properties": {
"alerts_context_count": {
"type": "number",
"description": "The number of alerts that were sent as context to the LLM for this generation.",
"example": 75
},
"connector_id": {
"type": "string",
"description": "The unique identifier of the connector used to generate the attack discoveries.",
"example": "chatGpt5_0ChatAzure"
},
"connector_stats": {
"type": "object",
"properties": {
"average_successful_duration_nanoseconds": {
"type": "number",
"description": "The average duration in nanoseconds for successful generations using this connector by the current user.",
"example": 47958500000
},
"successful_generations": {
"type": "number",
"description": "The total number of Attack discoveries successfully created for this generation",
"example": 2
}
},
"description": "Statistical information about the connector's performance for this user, providing insights into usage patterns and success rates."
},
"discoveries": {
"type": "number",
"description": "The number of attack discoveries that were generated during this execution.",
"example": 3
},
"end": {
"type": "string",
"description": "The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven't finished.",
"example": "2025-09-29T06:42:44.810Z"
},
"execution_uuid": {
"type": "string",
"description": "The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls.",
"example": "46b218d5-535d-4329-be56-d0f6af6986b7"
},
"loading_message": {
"type": "string",
"description": "A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing.",
"example": "AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries."
},
"reason": {
"type": "string",
"description": "Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process.",
"example": "Connection timeout to AI service"
},
"start": {
"type": "string",
"description": "The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis.",
"example": "2025-09-29T06:42:08.962Z"
},
"status": {
"enum": [
"canceled",
"dismissed",
"failed",
"started",
"succeeded"
],
"type": "string",
"description": "The current status of the attack discovery generation. After dismissing, this will be set to \"dismissed\".",
"example": "dismissed"
}
}
},
"examples": {
"PostAttackDiscoveryGenerationsDismissResponse200Example": {
"summary": "Successfully dismissed an Attack Discovery generation.",
"value": {
"alerts_context_count": 75,
"connector_id": "chatGpt5_0ChatAzure",
"discoveries": 3,
"end": "2025-09-29T06:42:44.810Z",
"execution_uuid": "46b218d5-535d-4329-be56-d0f6af6986b7",
"loading_message": "AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.",
"start": "2025-09-29T06:42:08.962Z",
"status": "dismissed"
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"required": [
"status_code",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type or category",
"example": "Bad Request"
},
"message": {
"type": "string",
"description": "Human-readable error message describing what went wrong with the request.",
"example": "Invalid request parameters."
},
"status_code": {
"type": "number",
"description": "HTTP status code indicating the type of client error",
"example": 400
}
}
},
"examples": {
"PostAttackDiscoveryGenerationsDismissResponse400Example": {
"summary": "Bad Request error returned when the dismiss request is invalid.",
"value": {
"error": "Bad Request",
"message": "Invalid request parameters.",
"status_code": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Example request",
"lang": "curl",
"source": "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/generations/46b218d5-535d-4329-be56-d0f6af6986b7/_dismiss' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/attack_discovery/schedules": {
"post": {
"tags": [
"Security Attack discovery API"
],
"summary": "Create Attack Discovery schedule",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/attack_discovery/schedules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.",
"operationId": "CreateAttackDiscoverySchedules",
"requestBody": {
"description": "Attack Discovery schedule configuration including name, parameters, schedule interval, and actions",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps"
},
"examples": {
"CreateAttackDiscoverySchedulesRequestBodyExample": {
"summary": "Create a daily Attack Discovery schedule that runs every 24 hours.",
"value": {
"actions": [ ],
"enabled": true,
"name": "Daily Security Analysis",
"params": {
"alerts_index_pattern": ".alerts-security.alerts-default",
"api_config": {
"actionTypeId": "bedrock",
"connectorId": "my-bedrock-connector",
"name": "Claude 3.5 Sonnet"
},
"end": "now",
"size": 100,
"start": "now-24h"
},
"schedule": {
"interval": "24h"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "The Attack Discovery schedule was successfully created.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule"
},
"examples": {
"CreateAttackDiscoverySchedulesResponse200Example": {
"summary": "A newly created Attack Discovery schedule.",
"value": {
"actions": [ ],
"created_at": "2023-10-31T10:00:00.000Z",
"created_by": "elastic",
"enabled": true,
"id": "12345678-1234-1234-1234-123456789012",
"name": "Daily Security Analysis",
"params": {
"alerts_index_pattern": ".alerts-security.alerts-default",
"api_config": {
"actionTypeId": "bedrock",
"connectorId": "my-bedrock-connector",
"name": "Claude 3.5 Sonnet"
},
"end": "now",
"size": 100,
"start": "now-24h"
},
"schedule": {
"interval": "24h"
},
"updated_at": "2023-10-31T10:00:00.000Z",
"updated_by": "elastic"
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError"
},
"examples": {
"CreateAttackDiscoverySchedulesResponse400Example": {
"summary": "Bad Request error returned when the create schedule payload is invalid.",
"value": {
"error": "Bad Request",
"message": "Invalid request parameters.",
"status_code": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Create an Attack Discovery schedule",
"lang": "curl",
"source": "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n \"name\": \"Daily Security Analysis\",\n \"enabled\": true,\n \"params\": {\n \"alerts_index_pattern\": \".alerts-security.alerts-default\",\n \"api_config\": {\n \"actionTypeId\": \"bedrock\",\n \"connectorId\": \"my-bedrock-connector\",\n \"name\": \"Claude 3.5 Sonnet\"\n },\n \"size\": 100,\n \"start\": \"now-24h\",\n \"end\": \"now\"\n },\n \"schedule\": {\n \"interval\": \"24h\"\n },\n \"actions\": [\n {\n \"action_type_id\": \".cases\",\n \"id\": \"system-connector-.cases\",\n \"params\": {\n \"subAction\": \"run\",\n \"subActionParams\": {\n \"timeWindow\": \"7d\",\n \"reopenClosedCases\": false,\n \"groupingBy\": [],\n \"templateId\": null\n }\n },\n \"uuid\": \"12345678-1234-1234-1234-123456789012\"\n }\n ]\n }'\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/attack_discovery/schedules/_bulk_delete": {
"post": {
"tags": [
"Security Attack discovery API"
],
"summary": "Bulk delete Attack Discovery schedules",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDisables an Attack Discovery schedule, preventing it from running according to its configured interval. The schedule configuration is preserved and can be re-enabled later. Any currently running executions will complete, but no new executions will be started.",
"operationId": "DisableAttackDiscoverySchedules",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier (UUID) of the Attack Discovery schedule to disable. This ID is returned when creating a schedule and can be found in schedule listings.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"example": "12345678-1234-1234-1234-123456789012"
}
],
"responses": {
"200": {
"description": "Successfully disabled Attack Discovery schedule, returning the schedule ID for confirmation",
"content": {
"application/json": {
"schema": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
}
}
},
"examples": {
"DisableAttackDiscoverySchedulesResponse200Example": {
"summary": "Confirmation returned after disabling an Attack Discovery schedule.",
"value": {
"id": "12345678-1234-1234-1234-123456789012"
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError"
},
"examples": {
"DisableAttackDiscoverySchedulesResponse400Example": {
"summary": "Bad Request error returned when the disable schedule request is invalid.",
"value": {
"error": "Bad Request",
"message": "Invalid request parameters.",
"status_code": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Disable an Attack Discovery schedule",
"lang": "curl",
"source": "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_disable' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/attack_discovery/schedules/{id}/_enable": {
"post": {
"tags": [
"Security Attack discovery API"
],
"summary": "Enable Attack Discovery schedule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nEnables a previously disabled Attack Discovery schedule, allowing it to run according to its configured interval. Once enabled, the schedule will begin executing at the next scheduled time based on its interval configuration.",
"operationId": "EnableAttackDiscoverySchedules",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier (UUID) of the Attack Discovery schedule to enable. This ID is returned when creating a schedule and can be found in schedule listings.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"example": "12345678-1234-1234-1234-123456789012"
}
],
"responses": {
"200": {
"description": "Successfully enabled Attack Discovery schedule, returning the schedule ID for confirmation",
"content": {
"application/json": {
"schema": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
}
}
},
"examples": {
"EnableAttackDiscoverySchedulesResponse200Example": {
"summary": "Confirmation returned after enabling an Attack Discovery schedule.",
"value": {
"id": "12345678-1234-1234-1234-123456789012"
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError"
},
"examples": {
"EnableAttackDiscoverySchedulesResponse400Example": {
"summary": "Bad Request error returned when the enable schedule request is invalid.",
"value": {
"error": "Bad Request",
"message": "Invalid request parameters.",
"status_code": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Enable an Attack Discovery schedule",
"lang": "curl",
"source": "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_enable' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases": {
"delete": {
"tags": [
"cases"
],
"summary": "Delete cases",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/cases
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n",
"operationId": "deleteCaseDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
},
{
"$ref": "#/components/parameters/Cases_ids"
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "curl",
"lang": "curl",
"source": "curl \\\n --request DELETE 'https://localhost:5601/api/cases?ids=%5B%22030e6e34-6470-4001-864f-b229511ad188%22%2C%22e662ff34-0493-4538-b9d1-6706ced02ff2%22%5D' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --header \"kbn-xsrf: true\"\n"
},
{
"label": "Console",
"lang": "console",
"source": "DELETE kbn:/api/cases?ids=[\"030e6e34-6470-4001-864f-b229511ad188\",\"e662ff34-0493-4538-b9d1-6706ced02ff2\"]\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"cases"
],
"summary": "Update cases",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/cases
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating.\n",
"operationId": "updateCaseDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_update_case_request"
},
"examples": {
"updateCaseRequest": {
"$ref": "#/components/examples/Cases_update_case_request"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_case_response_properties"
}
},
"examples": {
"updateCaseResponse": {
"$ref": "#/components/examples/Cases_update_case_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"cases"
],
"summary": "Create a case",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/cases
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating.\n",
"operationId": "createCaseDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_create_case_request"
},
"examples": {
"createCaseRequest": {
"$ref": "#/components/examples/Cases_create_case_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_case_response_properties"
},
"examples": {
"createCaseResponse": {
"$ref": "#/components/examples/Cases_create_case_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/_find": {
"get": {
"tags": [
"cases"
],
"summary": "Search cases",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n",
"operationId": "findCasesDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_assignees_filter"
},
{
"$ref": "#/components/parameters/Cases_category"
},
{
"$ref": "#/components/parameters/Cases_defaultSearchOperator"
},
{
"$ref": "#/components/parameters/Cases_from"
},
{
"$ref": "#/components/parameters/Cases_owner_filter"
},
{
"$ref": "#/components/parameters/Cases_page_index"
},
{
"$ref": "#/components/parameters/Cases_page_size"
},
{
"$ref": "#/components/parameters/Cases_reporters"
},
{
"$ref": "#/components/parameters/Cases_search"
},
{
"$ref": "#/components/parameters/Cases_searchFields"
},
{
"$ref": "#/components/parameters/Cases_severity"
},
{
"$ref": "#/components/parameters/Cases_sortField"
},
{
"$ref": "#/components/parameters/Cases_sort_order"
},
{
"$ref": "#/components/parameters/Cases_status"
},
{
"$ref": "#/components/parameters/Cases_tags"
},
{
"$ref": "#/components/parameters/Cases_to"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"cases": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_case_response_properties"
}
},
"count_closed_cases": {
"type": "integer"
},
"count_in_progress_cases": {
"type": "integer"
},
"count_open_cases": {
"type": "integer"
},
"page": {
"type": "integer"
},
"per_page": {
"type": "integer"
},
"total": {
"type": "integer"
}
}
},
"examples": {
"findCaseResponse": {
"$ref": "#/components/examples/Cases_find_case_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}": {
"get": {
"tags": [
"cases"
],
"summary": "Get case information",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/{caseId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n",
"operationId": "getCaseDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_case_response_get_case"
},
"examples": {
"getDefaultCaseResponse": {
"$ref": "#/components/examples/Cases_get_case_response"
},
"getDefaultObservabilityCaseResponse": {
"$ref": "#/components/examples/Cases_get_case_observability_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/alerts": {
"get": {
"tags": [
"cases"
],
"summary": "Get all alerts for a case",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/{caseId}/alerts
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n",
"operationId": "getCaseAlertsDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_alert_response_properties"
}
},
"examples": {
"getCaseAlertsResponse": {
"$ref": "#/components/examples/Cases_get_case_alerts_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/comments": {
"delete": {
"tags": [
"cases"
],
"summary": "Delete all case comments and alerts",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n",
"operationId": "deleteCaseCommentsDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
},
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "curl",
"lang": "curl",
"source": "curl \\\n --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"kbn-xsrf: true\"\n"
},
{
"label": "Console",
"lang": "console",
"source": "DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"cases"
],
"summary": "Update a case comment or alert",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.\n",
"operationId": "updateCaseCommentDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
},
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_update_case_comment_request"
},
"examples": {
"updateCaseCommentRequest": {
"$ref": "#/components/examples/Cases_update_comment_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_case_response_properties"
},
"examples": {
"updateCaseCommentResponse": {
"$ref": "#/components/examples/Cases_update_comment_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"cases"
],
"summary": "Add a case comment or alert",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.\n",
"operationId": "addCaseCommentDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
},
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_add_case_comment_request"
},
"examples": {
"createCaseCommentRequest": {
"$ref": "#/components/examples/Cases_add_comment_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_case_response_properties"
},
"examples": {
"createCaseCommentResponse": {
"$ref": "#/components/examples/Cases_add_comment_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/comments/_find": {
"get": {
"tags": [
"cases"
],
"summary": "Find case comments",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.\n",
"operationId": "findCaseCommentsDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_case_id"
},
{
"$ref": "#/components/parameters/Cases_page_index"
},
{
"$ref": "#/components/parameters/Cases_page_size"
},
{
"$ref": "#/components/parameters/Cases_sort_order"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_find_comments_response"
},
"examples": {
"findCaseCommentsResponse": {
"$ref": "#/components/examples/Cases_find_case_comments_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/comments/{commentId}": {
"delete": {
"tags": [
"cases"
],
"summary": "Delete a case comment or alert",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're pushing.\n",
"operationId": "pushCaseDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_case_id"
},
{
"$ref": "#/components/parameters/Cases_connector_id"
},
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": [
"null",
"object"
]
},
"examples": {
"pushCaseRequest": {
"summary": "Push a case to an external service. No request body is required.",
"value": "null"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_case_response_properties"
},
"examples": {
"pushCaseResponse": {
"$ref": "#/components/examples/Cases_push_case_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/fields": {
"get": {
"tags": [
"cases"
],
"summary": "Get the fields applicable to an existing case",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/{caseId}/fields
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the fields you can write to the case's `extended_fields`. The case determines the owner and any applied template. The response includes the owner's global fields (library-wide) and, if the case has a template, that template's fields. Requires the Cases feature to be enabled in the space.\n",
"operationId": "getCaseApplicableFieldsDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_applicable_fields_response"
},
"examples": {
"getCaseApplicableFieldsResponse": {
"$ref": "#/components/examples/Cases_get_case_applicable_fields_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have access to the case.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"404": {
"description": "The case was not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response404": {
"$ref": "#/components/examples/Cases_response_404"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/files": {
"post": {
"tags": [
"cases"
],
"summary": "Attach a file to a case",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/cases/{caseId}/files
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAttach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- The location of the file that is being uploaded.\n",
"operationId": "addCaseFileDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
},
{
"$ref": "#/components/parameters/Cases_case_id"
}
],
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"$ref": "#/components/schemas/Cases_add_case_file_request"
},
"examples": {
"addCaseFileRequest": {
"summary": "Attach a plain text file named \"my_attachment\".",
"value": {
"filename": "my_attachment"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_case_response_properties"
},
"examples": {
"addCaseFileResponse": {
"$ref": "#/components/examples/Cases_add_comment_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "curl",
"lang": "curl",
"source": "curl \\\n --request POST 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/files' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"kbn-xsrf: true\" \\\n --form \"file=@/path/to/my_attachment.txt\" \\\n --form \"filename=my_attachment\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/{caseId}/user_actions/_find": {
"get": {
"tags": [
"cases"
],
"summary": "Find case activity",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n",
"operationId": "findCaseActivityDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_case_id"
},
{
"$ref": "#/components/parameters/Cases_page_index"
},
{
"$ref": "#/components/parameters/Cases_page_size"
},
{
"$ref": "#/components/parameters/Cases_sort_order"
},
{
"$ref": "#/components/parameters/Cases_user_action_types"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"page": {
"type": "integer"
},
"perPage": {
"type": "integer"
},
"total": {
"type": "integer"
},
"userActions": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_user_actions_find_response_properties"
}
}
}
},
"examples": {
"findCaseActivityResponse": {
"$ref": "#/components/examples/Cases_find_case_activity_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/alerts/{alertId}": {
"get": {
"tags": [
"cases"
],
"summary": "Get cases for an alert",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/alerts/{alertId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n",
"operationId": "getCasesByAlertDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_alert_id"
},
{
"$ref": "#/components/parameters/Cases_owner_filter"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_related_case"
}
},
"examples": {
"getCasesByAlertResponse": {
"summary": "Cases associated with a given alert.",
"value": [
{
"createdAt": "2020-02-19T23:06:33.798Z",
"description": "Investigating suspicious activity",
"id": "06116b80-e1c3-11ec-be9b-9b1838238ee6",
"status": "open",
"title": "security_case",
"totals": {
"alerts": 1,
"events": 0,
"userComments": 0
}
}
]
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/configure": {
"get": {
"tags": [
"cases"
],
"summary": "Get case settings",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/configure
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.\n",
"operationId": "getCaseConfigurationDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_owner_filter"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "object",
"properties": {
"closure_type": {
"$ref": "#/components/schemas/Cases_closure_types"
},
"connector": {
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
}
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-06-01T17:07:17.767Z"
},
"created_by": {
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"defaultValue": {
"type": [
"boolean",
"string"
],
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
},
"key": {
"maxLength": 36,
"minLength": 1,
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
},
"label": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
}
}
},
"description": "Custom fields configuration details."
},
"error": {
"type": [
"null",
"string"
],
"example": "null"
},
"extractObservables": {
"type": "boolean",
"description": "Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.\n",
"example": true
},
"id": {
"type": "string",
"example": "4a97a440-e1cd-11ec-be9b-9b1838238ee6"
},
"mappings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_type": {
"type": "string",
"example": "overwrite"
},
"source": {
"type": "string",
"example": "title"
},
"target": {
"type": "string",
"example": "summary"
}
}
}
},
"observableTypes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The observable type key.",
"example": "d312efda-ec2b-42ec-9e2c-84981795c581"
},
"label": {
"type": "string",
"description": "The observable type label.",
"example": "My observable type"
}
}
},
"description": "Custom observable type configuration details."
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"templates": {
"$ref": "#/components/schemas/Cases_templates"
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "2022-06-01T19:58:48.169Z"
},
"updated_by": {
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"version": {
"type": "string",
"example": "WzIwNzMsMV0="
},
"workflowTags": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
},
"description": "Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.\n"
}
}
}
},
"examples": {
"getConfigurationResponse": {
"$ref": "#/components/examples/Cases_get_case_configuration_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"cases"
],
"summary": "Add case settings",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/cases/configure
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCase settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.\n",
"operationId": "setCaseConfigurationDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_set_case_configuration_request"
},
"examples": {
"setCaseConfigRequest": {
"$ref": "#/components/examples/Cases_set_case_configuration_request"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"closure_type": {
"$ref": "#/components/schemas/Cases_closure_types"
},
"connector": {
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
}
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-06-01T17:07:17.767Z"
},
"created_by": {
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"defaultValue": {
"type": [
"boolean",
"string"
],
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
},
"key": {
"maxLength": 36,
"minLength": 1,
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
},
"label": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
}
}
},
"description": "Custom fields configuration details."
},
"error": {
"type": [
"null",
"string"
],
"example": "null"
},
"extractObservables": {
"type": "boolean",
"description": "Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.\n",
"example": true
},
"id": {
"type": "string",
"example": "4a97a440-e1cd-11ec-be9b-9b1838238ee6"
},
"mappings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_type": {
"type": "string",
"example": "overwrite"
},
"source": {
"type": "string",
"example": "title"
},
"target": {
"type": "string",
"example": "summary"
}
}
}
},
"observableTypes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The observable type key.",
"example": "d312efda-ec2b-42ec-9e2c-84981795c581"
},
"label": {
"type": "string",
"description": "The observable type label.",
"example": "My observable type"
}
}
},
"description": "Custom observable type configuration details."
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"templates": {
"$ref": "#/components/schemas/Cases_templates"
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "2022-06-01T19:58:48.169Z"
},
"updated_by": {
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"version": {
"type": "string",
"example": "WzIwNzMsMV0="
},
"workflowTags": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
},
"description": "Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.\n"
}
}
},
"examples": {
"setCaseConfigResponse": {
"$ref": "#/components/examples/Cases_set_case_configuration_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/configure/{configurationId}": {
"patch": {
"tags": [
"cases"
],
"summary": "Update case settings",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the case was created.\n",
"operationId": "updateCaseConfigurationDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_kbn_xsrf"
},
{
"$ref": "#/components/parameters/Cases_configuration_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_update_case_configuration_request"
},
"examples": {
"updateCaseConfigurationRequest": {
"$ref": "#/components/examples/Cases_update_case_configuration_request"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"closure_type": {
"$ref": "#/components/schemas/Cases_closure_types"
},
"connector": {
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
}
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-06-01T17:07:17.767Z"
},
"created_by": {
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"defaultValue": {
"type": [
"boolean",
"string"
],
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
},
"key": {
"maxLength": 36,
"minLength": 1,
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
},
"label": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
}
}
},
"description": "Custom fields configuration details."
},
"error": {
"type": [
"null",
"string"
],
"example": "null"
},
"extractObservables": {
"type": "boolean",
"description": "Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.\n",
"example": true
},
"id": {
"type": "string",
"example": "4a97a440-e1cd-11ec-be9b-9b1838238ee6"
},
"mappings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_type": {
"type": "string",
"example": "overwrite"
},
"source": {
"type": "string",
"example": "title"
},
"target": {
"type": "string",
"example": "summary"
}
}
}
},
"observableTypes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The observable type key.",
"example": "d312efda-ec2b-42ec-9e2c-84981795c581"
},
"label": {
"type": "string",
"description": "The observable type label.",
"example": "My observable type"
}
}
},
"description": "Custom observable type configuration details."
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"templates": {
"$ref": "#/components/schemas/Cases_templates"
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "2022-06-01T19:58:48.169Z"
},
"updated_by": {
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"version": {
"type": "string",
"example": "WzIwNzMsMV0="
},
"workflowTags": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
},
"description": "Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.\n"
}
}
},
"examples": {
"updateCaseConfigurationResponse": {
"$ref": "#/components/examples/Cases_update_case_configuration_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/configure/connectors/_find": {
"get": {
"tags": [
"cases"
],
"summary": "Get case connectors",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n",
"operationId": "findCaseConnectorsDefaultSpace",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"properties": {
"actionTypeId": {
"$ref": "#/components/schemas/Cases_connector_types"
},
"config": {
"type": "object",
"properties": {
"apiUrl": {
"type": "string"
},
"projectKey": {
"type": "string"
}
}
},
"id": {
"type": "string"
},
"isDeprecated": {
"type": "boolean"
},
"isMissingSecrets": {
"type": "boolean"
},
"isPreconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"referencedByCount": {
"type": "integer"
}
}
}
},
"examples": {
"findConnectorResponse": {
"$ref": "#/components/examples/Cases_find_connector_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/field_definitions": {
"get": {
"tags": [
"cases"
],
"summary": "Get all field definitions",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/field_definitions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a paginated list of field definitions (field library entries) for the given owner. Requires the Cases feature to be enabled in the space.\n",
"operationId": "getCaseFieldDefinitionsDefaultSpace",
"parameters": [
{
"name": "owner",
"in": "query",
"description": "The application that owns the field definitions (for example `cases`, `observability`, or `securitySolution`). Required.\n",
"required": true,
"schema": {
"oneOf": [
{
"maxLength": 50,
"type": "string"
},
{
"maxItems": 10,
"type": "array",
"items": {
"maxLength": 50,
"type": "string"
}
}
]
}
},
{
"name": "isGlobal",
"in": "query",
"description": "When true, returns only global field definitions (rendered on every case). When false, returns all definitions. Omit to return all.\n",
"schema": {
"type": "boolean"
}
},
{
"$ref": "#/components/parameters/Cases_page_index"
},
{
"$ref": "#/components/parameters/Cases_page_size"
},
{
"name": "sortField",
"in": "query",
"description": "The field to sort by. When omitted, results are sorted by `fieldDefinitionId` ascending and `sortOrder` is ignored.\n",
"schema": {
"enum": [
"name",
"owner",
"isGlobal",
"displayOrder"
],
"type": "string"
}
},
{
"$ref": "#/components/parameters/Cases_sort_order"
},
{
"name": "search",
"in": "query",
"description": "A case-insensitive substring to match against each definition's `name` and `description` fields. Definitions where neither field contains the substring are excluded.\n",
"schema": {
"maxLength": 1000,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_get_case_field_definitions_response"
},
"examples": {
"getCaseFieldDefinitionsResponse": {
"$ref": "#/components/examples/Cases_get_case_field_definitions_response"
}
}
}
}
},
"400": {
"description": "The request is invalid. For example, the `owner` query parameter is missing or `page`/`perPage` are not integers.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response400": {
"$ref": "#/components/examples/Cases_response_400_invalid_template"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have permission to read field definitions for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"cases"
],
"summary": "Create a field definition",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/cases/field_definitions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a field definition in the field library. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space. Use `dry_run=true` to validate the request without writing anything.\n",
"operationId": "createCaseFieldDefinitionDefaultSpace",
"parameters": [
{
"name": "dry_run",
"in": "query",
"description": "When true, runs authorization, body, and name-uniqueness validation without creating the field definition. Returns `{ \"valid\": true }` on success.\n",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_field_definition_write_request"
},
"examples": {
"createCaseFieldDefinitionRequest": {
"$ref": "#/components/examples/Cases_field_definition_write_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call. Returns the created field definition, or `{ \"valid\": true }` when `dry_run=true`.\n",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_field_definition_response"
},
{
"required": [
"valid"
],
"type": "object",
"properties": {
"valid": {
"type": "boolean"
}
}
}
]
},
"examples": {
"createCaseFieldDefinitionResponse": {
"$ref": "#/components/examples/Cases_get_case_field_definition_response"
}
}
}
}
},
"400": {
"description": "The request body is invalid, the YAML definition is malformed, the `name` does not match the YAML definition's `name`, or the owner already has 200 field definitions.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response400": {
"$ref": "#/components/examples/Cases_response_400_invalid_template"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have the manage templates privilege for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"409": {
"description": "A field definition with the same name already exists for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response409": {
"$ref": "#/components/examples/Cases_response_409"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/field_definitions/{field_definition_id}": {
"delete": {
"tags": [
"cases"
],
"summary": "Delete a field definition",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes a field definition. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. A field definition cannot be deleted while it is referenced by an active template or linked to an active custom field in the Cases configuration. Requires the Cases feature to be enabled in the space.\n",
"operationId": "deleteCaseFieldDefinitionDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_field_definition_id"
}
],
"responses": {
"204": {
"description": "The field definition was deleted."
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have the manage templates privilege for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"404": {
"description": "The field definition was not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response404": {
"$ref": "#/components/examples/Cases_response_404"
}
}
}
}
},
"409": {
"description": "The field definition is referenced by one or more active templates, or is linked to an active custom field in the Cases configuration.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response409": {
"$ref": "#/components/examples/Cases_response_409"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"cases"
],
"summary": "Get a field definition by ID",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdates editable attributes of a field definition. Server-managed attributes (`displayOrder`, `legacyKey`) are preserved. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. A field's `name` and YAML `type` are immutable after creation — an attempt to change either returns `409` with `attributes.code = \"field_identity_immutable\"` and `attributes.changed` listing which identity attributes were modified. Setting `isGlobal` to `false` when the field is linked to an active custom field in the Cases configuration returns `409`; otherwise demotion is allowed. Requires the Cases feature to be enabled in the space. Use `dry_run=true` to validate the request without writing anything.\n",
"operationId": "updateCaseFieldDefinitionDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_field_definition_id"
},
{
"name": "dry_run",
"in": "query",
"description": "When true, runs authorization, body, and identity-immutability validation without updating the field definition. Returns `{ \"valid\": true }` on success.\n",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_field_definition_put_request"
},
"examples": {
"updateCaseFieldDefinitionRequest": {
"$ref": "#/components/examples/Cases_field_definition_write_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call. Returns the updated field definition, or `{ \"valid\": true }` when `dry_run=true`.\n",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_field_definition_response"
},
{
"required": [
"valid"
],
"type": "object",
"properties": {
"valid": {
"type": "boolean"
}
}
}
]
},
"examples": {
"updateCaseFieldDefinitionResponse": {
"$ref": "#/components/examples/Cases_get_case_field_definition_response"
}
}
}
}
},
"400": {
"description": "The request body is invalid, the YAML definition is malformed, the `name` does not match the YAML definition's `name`, or the owner would be changed.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response400": {
"$ref": "#/components/examples/Cases_response_400_invalid_template"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have the manage templates privilege for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"404": {
"description": "The field definition was not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response404": {
"$ref": "#/components/examples/Cases_response_404"
}
}
}
}
},
"409": {
"description": "A field's name or type cannot be changed after creation, or a global field cannot be demoted while linked to an active custom field.\n",
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"required": [
"statusCode",
"error",
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": {
"required": [
"code",
"changed"
],
"type": "object",
"properties": {
"changed": {
"type": "array",
"items": {
"type": "string"
}
},
"code": {
"enum": [
"field_identity_immutable"
],
"type": "string"
}
}
},
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer"
}
},
"description": "Identity-immutable conflict — name or type was changed."
},
{
"$ref": "#/components/schemas/Cases_response_4xx"
}
]
},
"examples": {
"response409": {
"$ref": "#/components/examples/Cases_response_409"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/fields": {
"get": {
"tags": [
"cases"
],
"summary": "Get the fields applicable to a case",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/fields
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the fields you can write to a case's `extended_fields` when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when `templateId` is supplied, that template's fields. Migrated legacy custom fields appear as `global` fields. Requires the Cases feature to be enabled in the space.\n",
"operationId": "getApplicableFieldsDefaultSpace",
"parameters": [
{
"name": "owner",
"in": "query",
"description": "The application that owns the cases (for example `cases`, `observability`, or `securitySolution`).",
"required": true,
"schema": {
"maxLength": 30,
"type": "string"
},
"example": "cases"
},
{
"name": "templateId",
"in": "query",
"description": "The identifier of a template to include the template's fields in the response.",
"schema": {
"maxLength": 36,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_applicable_fields_response"
},
"examples": {
"getCaseApplicableFieldsResponse": {
"$ref": "#/components/examples/Cases_get_case_applicable_fields_response"
}
}
}
}
},
"400": {
"description": "The request is invalid, for example when the `templateId` does not exist for the owner or its definition is invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response400": {
"$ref": "#/components/examples/Cases_response_400_invalid_template"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have access to the requested owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/reporters": {
"get": {
"tags": [
"cases"
],
"summary": "Get case creators",
"description": "Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.\n",
"operationId": "getCaseReportersDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_owner_filter"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
}
},
"examples": {
"getReportersResponse": {
"$ref": "#/components/examples/Cases_get_reporters_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/tags": {
"get": {
"tags": [
"cases"
],
"summary": "Get case tags",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n",
"operationId": "getCaseTagsDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_owner_filter"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
}
},
"examples": {
"getTagsResponse": {
"$ref": "#/components/examples/Cases_get_tags_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/templates": {
"get": {
"tags": [
"cases"
],
"summary": "Get all case templates",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/cases/templates
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a paginated list of case templates. Requires the Cases feature to be enabled in the space.\n",
"operationId": "getCaseTemplatesDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_page_index"
},
{
"$ref": "#/components/parameters/Cases_page_size"
},
{
"$ref": "#/components/parameters/Cases_template_sort_field"
},
{
"$ref": "#/components/parameters/Cases_sort_order"
},
{
"$ref": "#/components/parameters/Cases_search"
},
{
"$ref": "#/components/parameters/Cases_owner_filter"
},
{
"$ref": "#/components/parameters/Cases_template_tags"
},
{
"$ref": "#/components/parameters/Cases_template_author"
},
{
"$ref": "#/components/parameters/Cases_template_is_enabled"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_get_case_templates_response"
},
"examples": {
"getCaseTemplatesResponse": {
"$ref": "#/components/examples/Cases_get_case_templates_response"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"cases"
],
"summary": "Create a case template",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/cases/templates
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a case template from a YAML definition. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.\n",
"operationId": "createCaseTemplateDefaultSpace",
"parameters": [
{
"name": "dry_run",
"in": "query",
"description": "When true, validates the request without creating the template and returns `{\"valid\": true}`.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_template_write_request"
},
"examples": {
"createCaseTemplateRequest": {
"$ref": "#/components/examples/Cases_template_write_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call. Returns the created template, or `{\"valid\": true}` for a dry run.",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_template_v2_response"
},
{
"$ref": "#/components/schemas/Cases_template_dry_run_response"
}
]
},
"examples": {
"createCaseTemplateResponse": {
"$ref": "#/components/examples/Cases_get_case_template_response"
},
"dryRunResponse": {
"$ref": "#/components/examples/Cases_template_dry_run_response"
}
}
}
}
},
"400": {
"description": "The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response400": {
"$ref": "#/components/examples/Cases_response_400_template_limit"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have the manage templates privilege for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"409": {
"description": "A template with the same name already exists for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response409": {
"$ref": "#/components/examples/Cases_response_409"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/cases/templates/{template_id}": {
"delete": {
"tags": [
"cases"
],
"summary": "Delete a case template",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSoft-deletes a case template (all versions). Existing cases keep their pinned template reference; the template stops appearing in the case creation flow and in find responses. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space.\n",
"operationId": "deleteCaseTemplateDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_template_id"
}
],
"responses": {
"204": {
"description": "The template was deleted."
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have the manage templates privilege for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"404": {
"description": "The template was not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response404": {
"$ref": "#/components/examples/Cases_response_404"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"cases"
],
"summary": "Get a case template by ID",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the `version` query parameter of the get template API, and cases keep the version they were created with. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation without writing. Requires the Cases feature to be enabled in the space.\n",
"operationId": "updateCaseTemplateDefaultSpace",
"parameters": [
{
"$ref": "#/components/parameters/Cases_template_id"
},
{
"name": "dry_run",
"in": "query",
"description": "When true, validates the request without updating the template and returns `{\"valid\": true}`.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_template_write_request"
},
"examples": {
"updateCaseTemplateRequest": {
"$ref": "#/components/examples/Cases_template_write_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call. Returns the new template version, or `{\"valid\": true}` for a dry run.",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_template_v2_response"
},
{
"$ref": "#/components/schemas/Cases_template_dry_run_response"
}
]
},
"examples": {
"dryRunResponse": {
"$ref": "#/components/examples/Cases_template_dry_run_response"
},
"updateCaseTemplateResponse": {
"$ref": "#/components/examples/Cases_get_case_template_response"
}
}
}
}
},
"400": {
"description": "The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response400": {
"$ref": "#/components/examples/Cases_response_400_template_limit"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response401": {
"$ref": "#/components/examples/Cases_response_401"
}
}
}
}
},
"403": {
"description": "The user does not have the manage templates privilege for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response403": {
"$ref": "#/components/examples/Cases_response_403"
}
}
}
}
},
"404": {
"description": "The template was not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response404": {
"$ref": "#/components/examples/Cases_response_404"
}
}
}
}
},
"409": {
"description": "A template with the same name already exists for the owner.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Cases_response_4xx"
},
"examples": {
"response409": {
"$ref": "#/components/examples/Cases_response_409"
}
}
}
}
}
},
"x-state": "Technical preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/chat/message": {
"post": {
"tags": [
"agent builder"
],
"summary": "Send a message and get the answer",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/chat/message
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSend a message to an agent and get its text answer. Use this synchronous endpoint in scripts and command-line tools. The response contains only the answer and the conversation ID. To continue the conversation, include the returned `conversation_id` in the next request.\n\nThe agent runs without a user, so the endpoint declines every prompt that the agent raises, such as a tool confirmation, a question, or a destructive API approval. The `declined_prompts` property lists these prompts. This endpoint does not support attachments.\n\nThe `agentBuilder:experimentalFeatures` advanced setting must be enabled. If it is disabled, the endpoint returns a 404 response.
[Required authorization] Route required privileges: agentBuilder:read.",
"operationId": "post-chat-message",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"agent_id": {
"maxLength": 64,
"minLength": 1,
"type": "string",
"description": "The ID of the agent to send the message to. Defaults to the default Elastic AI agent.",
"default": "elastic-ai-agent"
},
"conversation_id": {
"maxLength": 256,
"type": "string",
"description": "The ID of an existing conversation to continue. Omit it to start a new conversation; the response carries the ID to reuse on the next call."
},
"message": {
"maxLength": 100000,
"minLength": 1,
"type": "string",
"description": "The user message to send to the agent."
}
},
"additionalProperties": false
},
"examples": {
"messageContinueConversationRequestExample": {
"description": "Continue a conversation with the `conversation_id` returned by a previous call",
"value": {
"agent_id": "elastic-ai-agent",
"conversation_id": "696ccd6d-4bff-4b26-a62e-522ccf2dcd16",
"message": "And how does it differ from Kibana?"
}
},
"messageRequestExample": {
"description": "Send a message to the default agent and start a new conversation.",
"value": {
"message": "What is Elasticsearch?"
}
},
"messageToAgentRequestExample": {
"description": "Send a message to a specific agent",
"value": {
"agent_id": "elastic-ai-agent",
"message": "What is Elasticsearch?"
}
}
}
}
}
},
"responses": {
"200": {
"description": "The agent answered. The response contains the answer and the ID of the conversation that stores the exchange.",
"content": {
"application/json": {
"schema": {
"required": [
"conversation_id",
"answer"
],
"type": "object",
"properties": {
"answer": {
"type": "string",
"description": "The agent's final text answer. Empty when the agent finished without a message."
},
"conversation_id": {
"type": "string",
"description": "The conversation the message was added to: the one requested, or the one created for it."
},
"declined_prompts": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"tool_id",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "The explanation the agent received in place of the prompt."
},
"tool_id": {
"type": "string",
"description": "The tool whose call was declined."
}
},
"additionalProperties": false
},
"description": "The prompts that the endpoint declined. In an interactive conversation, these prompts pause the agent until the user answers. Examples are tool confirmations, questions to the user, and destructive API approvals. This endpoint has no user, so it declines each prompt and tells the agent why. The property is absent if the agent raised no prompts."
}
},
"additionalProperties": false
},
"examples": {
"messageDeclinedPromptResponseExample": {
"description": "The agent tried to call a tool that requires user confirmation. There is no user to ask on this endpoint, so the call was declined and the agent answered with what it could",
"value": {
"answer": "I could not run the reindex because it requires confirmation, which is not available here. You can run it from a conversation in Kibana instead.",
"conversation_id": "696ccd6d-4bff-4b26-a62e-522ccf2dcd16",
"declined_prompts": [
{
"message": "Agent running in non-interactive mode, user input not available - execution was declined",
"tool_id": "reindex-logs"
}
]
}
},
"messageResponseExample": {
"description": "The agent's answer and the ID of the conversation it was stored in. `declined_prompts` is absent because the agent asked for nothing.",
"value": {
"answer": "Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease.",
"conversation_id": "696ccd6d-4bff-4b26-a62e-522ccf2dcd16"
}
}
}
}
}
},
"400": {
"description": "Bad Request: the request body is not valid. Possible causes are an empty or too long `message`, a `conversation_id` that is not a UUID, or an unsupported property such as `connector_id` or `attachments`.",
"content": {
"application/json": {
"examples": {
"messageEmptyExample": {
"description": "The `message` is empty",
"value": {
"error": "Bad Request",
"message": "[request body.message]: value has length [0] but it must have a minimum length of [1].",
"statusCode": 400
}
},
"messageUnexpectedKeyExample": {
"description": "The body carries a key this endpoint does not accept",
"value": {
"error": "Bad Request",
"message": "[request body.connector_id]: Additional properties are not allowed ('connector_id' was unexpected)",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found: the conversation or agent was not found. Possible causes are a `conversation_id` that does not exist, an `agent_id` that the caller cannot use, or a disabled `agentBuilder:experimentalFeatures` advanced setting. If the caller cannot use the agent, the error says that the conversation was not found. This prevents callers from discovering hidden agents.",
"content": {
"application/json": {
"examples": {
"messageNotFoundExample": {
"description": "The `conversation_id` is unknown, or the `agent_id` is unknown or not usable by the caller",
"value": {
"attributes": {
"trace_id": "8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e"
},
"error": "Not Found",
"message": "Conversation 696ccd6d-4bff-4b26-a62e-522ccf2dcd16 not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/chat/message\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"message\": \"What is Elasticsearch?\",\n \"agent_id\": \"elastic-ai-agent\"\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/chat/message\n{\n \"message\": \"What is Elasticsearch?\",\n \"agent_id\": \"elastic-ai-agent\"\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/context_engine/ai_index": {
"get": {
"tags": [
"context engine"
],
"summary": "List AI Indices",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/context_engine/ai_index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nLists up to 100 AI Indices in the current space that the caller can read. The response omits an AI Index when the caller cannot read its backing index. Empty AI Indices are still included. A caller with no read privilege on any index gets a 403 response.\n\nThe space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. It cannot be specified in any other way.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:read.",
"operationId": "get-context-engine-ai-index",
"responses": {
"200": {
"description": "The AI Indices available to the caller in the current space.",
"content": {
"application/json": {
"schema": {
"required": [
"ai_indices"
],
"type": "object",
"properties": {
"ai_indices": {
"type": "array",
"items": {
"required": [
"id",
"managed",
"memory_enabled",
"date_created",
"date_modified",
"dest",
"automations",
"sources",
"traces"
],
"type": "object",
"properties": {
"automations": {
"type": "array",
"items": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"workflow"
],
"type": "string"
},
"value": {
"type": "string",
"description": "The workflow ID."
}
},
"additionalProperties": false
},
"description": "Automations associated with the AI Index."
},
"date_created": {
"type": "string",
"description": "ISO 8601 timestamp of when the AI Index was created."
},
"date_modified": {
"type": "string",
"description": "ISO 8601 timestamp of when the AI Index was last modified."
},
"description": {
"type": "string",
"description": "Human-readable description of the AI Index."
},
"dest": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"data_stream",
"index"
],
"type": "string",
"description": "The type of the backing store."
},
"value": {
"type": "string",
"description": "The data stream or index the AI Index is attached to."
}
},
"additionalProperties": false,
"description": "The data stream or index that backs the AI Index."
},
"feedback_analysis": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"agent_id": {
"type": "string",
"description": "Agent Builder agent ID that runs the analysis."
},
"allowed_actions": {
"type": "array",
"items": {
"enum": [
"add_ki",
"edit_ki",
"remove_ki",
"add_workflow",
"edit_workflow",
"remove_workflow",
"add_source",
"edit_source",
"remove_source"
],
"type": "string",
"description": "Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`)."
},
"description": "Improvement actions the analysis may propose."
},
"enabled": {
"type": "boolean",
"description": "Whether the recurring feedback analysis is desired to run."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "How often to analyze, for example `1h`."
}
},
"additionalProperties": false,
"description": "When the analysis runs."
},
"signal_filter": {
"type": "string",
"description": "KQL narrowing which signals the analysis reads."
},
"signal_time_range": {
"anyOf": [
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"type": "string",
"description": "Date math relative to now, for example `now-30d`."
},
"type": {
"enum": [
"relative"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"type": "string",
"description": "ISO 8601 date to analyze signals since."
},
"type": {
"enum": [
"absolute"
],
"type": "string"
}
},
"additionalProperties": false
}
]
}
},
"additionalProperties": false,
"description": "The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index."
},
"id": {
"type": "string",
"description": "The unique identifier of the AI Index."
},
"managed": {
"type": "boolean",
"description": "Whether the AI Index is managed by a plugin and therefore immutable."
},
"memory_enabled": {
"type": "boolean",
"description": "Whether this AI Index accepts memory writes."
},
"sources": {
"type": "array",
"items": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"esql",
"connector"
],
"type": "string",
"description": "`esql` for an ES|QL query, or `connector` for a data connector."
},
"value": {
"type": "string",
"description": "An ES|QL query for `esql`, or a connector ID for `connector`."
}
},
"additionalProperties": false
},
"description": "Additional sources that provide context for the AI Index."
},
"traces": {
"type": "array",
"items": {
"required": [
"type",
"value",
"query"
],
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "The ES|QL query derived from this trace source at read time."
},
"type": {
"enum": [
"elastic_agent",
"index",
"esql"
],
"type": "string",
"description": "`elastic_agent` for an Agent Builder agent, `index` for an index or data stream name or pattern, or `esql` for an ES|QL query."
},
"value": {
"type": "string",
"description": "The trace source value."
}
},
"additionalProperties": false
},
"description": "Trace sources linked to this AI Index, each with its derived ES|QL query."
}
},
"additionalProperties": false
},
"description": "The AI Indices available to the caller in the current space."
}
},
"additionalProperties": false
},
"examples": {
"listAiIndicesResponseExample": {
"summary": "AI Indices the caller can read",
"description": "Example response listing the AI Indices the caller can read",
"value": {
"ai_indices": [
{
"automations": [ ],
"date_created": "2026-09-22T12:00:00.000Z",
"date_modified": "2026-09-22T12:00:00.000Z",
"description": "Knowledge about customer support cases.",
"dest": {
"type": "data_stream",
"value": "ai-index-ds-customer-support"
},
"id": "customer_support",
"managed": false,
"memory_enabled": true,
"sources": [
{
"type": "esql",
"value": "FROM support-cases | LIMIT 100"
}
],
"traces": [ ]
}
]
}
}
}
}
}
},
"403": {
"description": "The caller has no read privilege on any index, so Elasticsearch rejected the request.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"forbiddenExample": {
"summary": "No index read privileges",
"description": "The caller has no read privilege on any index",
"value": {
"error": "Forbidden",
"message": "security_exception\n\tRoot causes:\n\t\tsecurity_exception: action [indices:data/read/msearch] is unauthorized for user [jdoe] with effective roles [support_reader], this action is granted by the index privileges [read,all]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/context_engine/ai_index\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/context_engine/ai_index\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"context engine"
],
"summary": "Create an AI Index",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/context_engine/ai_index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates an AI Index record attached to a data stream or index. Fails with a 409 if an AI Index with the same ID already exists.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:write.",
"operationId": "post-context-engine-ai-index",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id",
"dest"
],
"type": "object",
"properties": {
"automations": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"workflow"
],
"type": "string"
},
"value": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "The workflow ID."
}
},
"additionalProperties": false
},
"description": "Automations associated with the AI Index. Defaults to an empty array when omitted.",
"default": [ ]
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Human-readable description of the AI Index."
},
"dest": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"data_stream",
"index"
],
"type": "string",
"description": "The type of the backing store. `data_stream` for a data stream, or `index` for an index."
},
"value": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "The data stream or index (e.g. `ai-index-ds-foo`, `ai-index-idx-foo`) the AI Index is attached to. Must name a single data stream or index (no wildcards or comma-separated lists), match `type`, and start with `ai-index-ds-` (for `data_stream`) or `ai-index-idx-` (for `index`). The rest of the value must be a valid AI Index ID. System indices are not allowed."
}
},
"additionalProperties": false,
"description": "The data stream or index that backs the AI Index."
},
"feedback_analysis": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"agent_id": {
"maxLength": 256,
"type": "string",
"description": "Agent Builder agent ID that runs this index’s feedback-loop analysis."
},
"allowed_actions": {
"maxItems": 9,
"type": "array",
"items": {
"enum": [
"add_ki",
"edit_ki",
"remove_ki",
"add_workflow",
"edit_workflow",
"remove_workflow",
"add_source",
"edit_source",
"remove_source"
],
"type": "string",
"description": "Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`)."
},
"description": "Improvement actions the analysis may propose. An empty list is observe-only.",
"default": [
"add_ki",
"edit_ki",
"remove_ki",
"add_workflow",
"edit_workflow",
"remove_workflow",
"add_source",
"edit_source",
"remove_source"
]
},
"enabled": {
"type": "boolean",
"description": "Desired state of the recurring analysis. The scheduler stays authoritative for whether it is actually running."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"maxLength": 16,
"type": "string",
"description": "How often to analyze, for example `1h` or `24h`. At least 15 minutes."
}
},
"additionalProperties": false,
"description": "When the analysis runs.",
"default": {
"interval": "24h"
}
},
"signal_filter": {
"maxLength": 4096,
"type": "string",
"description": "KQL narrowing which signals this index analyzes, for example `tags: query_error`."
},
"signal_time_range": {
"anyOf": [
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"maxLength": 64,
"type": "string",
"description": "Date math relative to now, for example `now-30d`."
},
"type": {
"enum": [
"relative"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"maxLength": 64,
"type": "string",
"description": "ISO 8601 date to analyze signals since."
},
"type": {
"enum": [
"absolute"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "Which signals the analysis reads. A read filter only.",
"default": {
"from": "now-30d",
"type": "relative"
}
}
},
"additionalProperties": false,
"description": "The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index."
},
"id": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The unique identifier of the AI Index."
},
"memory_enabled": {
"type": "boolean",
"description": "Whether this AI index accepts memory writes. Defaults to true when omitted."
},
"sources": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"esql"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "The source value; an ES|QL query when `type` is `esql`. Must be valid ES|QL."
}
},
"additionalProperties": false
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"connector"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "The source value; a connector ID when `type` is `connector`."
}
},
"additionalProperties": false
}
]
},
"description": "Additional sources that provide context for the AI Index. Defaults to an empty array when omitted.",
"default": [ ]
},
"traces": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"elastic_agent"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "The Agent Builder agent ID."
}
},
"additionalProperties": false
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"index"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "An index or data stream name or pattern to read traces from."
}
},
"additionalProperties": false
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"esql"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "An ES|QL query to select traces."
}
},
"additionalProperties": false
}
]
},
"description": "Trace sources linked to this AI Index. A write replaces the whole array. Defaults to an empty array when omitted.",
"default": [ ]
}
},
"additionalProperties": false
},
"examples": {
"createAiIndexRequestExample": {
"summary": "Create an AI Index",
"description": "Example request to create an AI Index attached to a data stream",
"value": {
"automations": [
{
"type": "workflow",
"value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f"
}
],
"description": "Knowledge about customer support cases.",
"dest": {
"type": "data_stream",
"value": "ai-index-ds-customer-support"
},
"id": "customer_support",
"sources": [
{
"type": "esql",
"value": "FROM support-cases | LIMIT 100"
}
],
"traces": [
{
"type": "elastic_agent",
"value": "elastic-ai-agent"
},
{
"type": "index",
"value": "traces-support"
}
]
}
}
}
}
}
},
"responses": {
"201": {
"description": "The AI Index was created.",
"content": {
"application/json": {
"schema": {
"required": [
"status"
],
"type": "object",
"properties": {
"status": {
"enum": [
"created"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Confirms that the AI Index was created."
},
"examples": {
"createAiIndexResponseExample": {
"summary": "AI Index created",
"description": "Example response after the AI Index is created",
"value": {
"status": "created"
}
}
}
}
}
},
"400": {
"description": "The request was invalid, for example a malformed `dest`, an invalid ES|QL source, or an unresolvable connector source or trace.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"invalidDestExample": {
"summary": "Invalid dest",
"description": "The dest value does not follow the naming convention",
"value": {
"error": "Bad Request",
"message": "dest.value 'support-cases' is not allowed: it must start with 'ai-index-ds-'",
"statusCode": 400
}
}
}
}
}
},
"403": {
"description": "Elasticsearch denied the `index` trace lookup outright; the caller lacks index privileges for it.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"forbiddenTraceExample": {
"summary": "Index trace lookup denied",
"description": "The caller lacks Elasticsearch index privileges to look up an index trace",
"value": {
"error": "Forbidden",
"message": "security_exception: action [indices:admin/resolve/index] is unauthorized for user [jdoe] with effective roles [support_reader] on indices [traces-support], this action is granted by the index privileges [view_index_metadata,manage,read,all]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
}
}
}
}
},
"409": {
"description": "An AI Index with the same ID already exists, or the write conflicted.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"alreadyExistsExample": {
"summary": "AI Index already exists",
"description": "An AI Index with the same ID already exists",
"value": {
"error": "Conflict",
"message": "AI index 'customer_support' already exists",
"statusCode": 409
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"https://${KIBANA_URL}/api/context_engine/ai_index\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"id\": \"customer_support\",\n \"description\": \"Knowledge about customer support cases.\",\n \"dest\": { \"type\": \"data_stream\", \"value\": \"ai-index-ds-customer-support\" },\n \"automations\": [{ \"type\": \"workflow\", \"value\": \"8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f\" }],\n \"sources\": [{ \"type\": \"esql\", \"value\": \"FROM support-cases | LIMIT 100\" }],\n \"traces\": [\n { \"type\": \"elastic_agent\", \"value\": \"elastic-ai-agent\" },\n { \"type\": \"index\", \"value\": \"traces-support\" }\n ]\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn:/api/context_engine/ai_index\n{\n \"id\": \"customer_support\",\n \"description\": \"Knowledge about customer support cases.\",\n \"dest\": { \"type\": \"data_stream\", \"value\": \"ai-index-ds-customer-support\" },\n \"automations\": [{ \"type\": \"workflow\", \"value\": \"8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f\" }],\n \"sources\": [{ \"type\": \"esql\", \"value\": \"FROM support-cases | LIMIT 100\" }],\n \"traces\": [\n { \"type\": \"elastic_agent\", \"value\": \"elastic-ai-agent\" },\n { \"type\": \"index\", \"value\": \"traces-support\" }\n ]\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/context_engine/ai_index/_query": {
"post": {
"tags": [
"context engine"
],
"summary": "Query AI Indices",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRuns an ES|QL query as the current user. The server applies a space filter and limits the response to at most 1000 rows.\n\nThe query determines which indices it reads. Elasticsearch index privileges limit which indices the current user can access.\n\nThe space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. The request body cannot change the space or replace the space filter.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:read.",
"operationId": "post-context-engine-ai-index-query",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"query"
],
"type": "object",
"properties": {
"limit": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"description": "Maximum rows to return. Defaults to 100; a trailing `LIMIT` in the query is capped to this value."
},
"params": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 4096,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
}
]
},
"description": "Values for `?name` placeholders in the query."
},
"query": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "The ES|QL query to run. Its FROM decides which Elasticsearch indices are read (normally `ai-index-*`); the server adds the space filter and a row limit."
}
},
"additionalProperties": false
},
"examples": {
"queryAiIndicesRequestExample": {
"summary": "Query with a parameter and a limit",
"description": "Example ES|QL query with a named parameter and a row limit",
"value": {
"limit": 10,
"params": {
"type": "faq"
},
"query": "FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10"
}
}
}
}
}
},
"responses": {
"200": {
"description": "The columns and rows returned by the ES|QL query.",
"content": {
"application/json": {
"schema": {
"required": [
"columns",
"values"
],
"type": "object",
"properties": {
"columns": {
"type": "array",
"items": {
"required": [
"name",
"type"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Column name."
},
"type": {
"type": "string",
"description": "Column ES|QL type."
}
}
},
"description": "Column metadata for the returned rows."
},
"values": {
"type": "array",
"items": {
"type": "array",
"items": { }
},
"description": "Row values, aligned positionally with `columns`, as Elasticsearch returns them. A multi-valued field is an array; `_source` and `flattened` columns are objects."
}
},
"additionalProperties": false
},
"examples": {
"queryAiIndicesResponseExample": {
"summary": "Columns and rows",
"description": "Example response with column metadata and matching rows. `flattened` columns such as `attributes` are returned as objects.",
"value": {
"columns": [
{
"name": "title",
"type": "text"
},
{
"name": "type",
"type": "keyword"
},
{
"name": "attributes",
"type": "flattened"
}
],
"values": [
[
"How to reset a password",
"faq",
{
"source": "zendesk"
}
],
[
"Billing cycle explained",
"faq",
{
"source": "zendesk"
}
]
]
}
}
}
}
}
},
"400": {
"description": "The ES|QL query was invalid, or its response exceeded the size limit.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"invalidQueryExample": {
"summary": "Unknown column",
"description": "The ES|QL query references a column that does not exist",
"value": {
"error": "Bad Request",
"message": "verification_exception\n\tRoot causes:\n\t\tverification_exception: Found 1 problem\nline 1:46: Unknown column [titel], did you mean [title]?",
"statusCode": 400
}
}
}
}
}
},
"403": {
"description": "Elasticsearch rejected the read; the caller lacks index privileges.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"forbiddenExample": {
"summary": "Missing index privileges",
"description": "The caller lacks Elasticsearch index privileges",
"value": {
"error": "Forbidden",
"message": "security_exception\n\tRoot causes:\n\t\tsecurity_exception: action [indices:data/read/esql] is unauthorized for user [jdoe] with effective roles [support_reader], this action is granted by the index privileges [read_cross_cluster,read,all]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"https://${KIBANA_URL}/api/context_engine/ai_index/_query\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"query\": \"FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10\",\n \"params\": { \"type\": \"faq\" },\n \"limit\": 10\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn:/api/context_engine/ai_index/_query\n{\n \"query\": \"FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10\",\n \"params\": { \"type\": \"faq\" },\n \"limit\": 10\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/context_engine/ai_index/{aiIndexId}": {
"delete": {
"tags": [
"context engine"
],
"summary": "Delete an AI Index",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes an AI Index by ID.\n\nBy default, the API preserves the backing data stream or index, its Knowledge Indicators, and attached workflow automations. Set `delete_knowledge_indicators` to `true` to delete the backing data stream or index and its Knowledge Indicators. Set `delete_automations` to `true` to delete the attached workflow automations.\n\nThe API does not delete the backing data stream or index when another AI Index uses the same destination.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:write. Extended privileges (optional, expand functionality when granted): workflowsManagement:delete.",
"operationId": "delete-context-engine-ai-index-aiindexid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "aiIndexId",
"in": "path",
"description": "The unique identifier of the AI Index.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"name": "delete_knowledge_indicators",
"in": "query",
"description": "When true, also delete the backing data stream/index, which removes its Knowledge Indicators. Skipped when another AI Index still uses the same dest. Defaults to false.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "delete_automations",
"in": "query",
"description": "When true, also delete the attached workflow automations. Defaults to false.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "The AI Index entry was deleted. `errors` lists any best-effort cleanup failures.",
"content": {
"application/json": {
"schema": {
"required": [
"acknowledged",
"errors"
],
"type": "object",
"properties": {
"acknowledged": {
"type": "boolean",
"description": "Whether the AI Index entry was deleted."
},
"errors": {
"type": "array",
"items": {
"type": "string"
},
"description": "Best-effort cleanup errors after the entry was deleted, if any."
}
},
"additionalProperties": false
},
"examples": {
"deleteAiIndexPartialFailureExample": {
"summary": "Deleted with a cleanup error",
"description": "The entry was deleted but a best-effort cleanup step failed",
"value": {
"acknowledged": true,
"errors": [
"Failed to delete automations: Workflows management is unavailable."
]
}
},
"deleteAiIndexResponseExample": {
"summary": "AI Index deleted",
"description": "Example response after the AI Index entry is deleted",
"value": {
"acknowledged": true,
"errors": [ ]
}
}
}
}
}
},
"404": {
"description": "No AI Index with the given ID exists in the current space, or Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
},
"notFoundExample": {
"summary": "AI Index not found",
"description": "No AI Index with the given ID exists in the current space",
"value": {
"error": "Not Found",
"message": "AI index 'customer_support' not found",
"statusCode": 404
}
}
}
}
}
},
"409": {
"description": "The AI Index is managed and cannot be deleted.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"managedExample": {
"summary": "Managed AI Index",
"description": "The AI Index is managed by a plugin and cannot be deleted",
"value": {
"error": "Conflict",
"message": "AI index 'customer_support' is managed and cannot be modified via the API",
"statusCode": 409
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X DELETE \"https://${KIBANA_URL}/api/context_engine/ai_index/customer_support?delete_knowledge_indicators=true\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn:/api/context_engine/ai_index/customer_support?delete_knowledge_indicators=true\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"context engine"
],
"summary": "Get an AI Index",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFetches an AI Index by ID from the current space, including the ES|QL query derived from each trace.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:read.",
"operationId": "get-context-engine-ai-index-aiindexid",
"parameters": [
{
"name": "aiIndexId",
"in": "path",
"description": "The unique identifier of the AI Index.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The requested AI Index.",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"managed",
"memory_enabled",
"date_created",
"date_modified",
"dest",
"automations",
"sources",
"traces"
],
"type": "object",
"properties": {
"automations": {
"type": "array",
"items": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"workflow"
],
"type": "string"
},
"value": {
"type": "string",
"description": "The workflow ID."
}
},
"additionalProperties": false
},
"description": "Automations associated with the AI Index."
},
"date_created": {
"type": "string",
"description": "ISO 8601 timestamp of when the AI Index was created."
},
"date_modified": {
"type": "string",
"description": "ISO 8601 timestamp of when the AI Index was last modified."
},
"description": {
"type": "string",
"description": "Human-readable description of the AI Index."
},
"dest": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"data_stream",
"index"
],
"type": "string",
"description": "The type of the backing store."
},
"value": {
"type": "string",
"description": "The data stream or index the AI Index is attached to."
}
},
"additionalProperties": false,
"description": "The data stream or index that backs the AI Index."
},
"feedback_analysis": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"agent_id": {
"type": "string",
"description": "Agent Builder agent ID that runs the analysis."
},
"allowed_actions": {
"type": "array",
"items": {
"enum": [
"add_ki",
"edit_ki",
"remove_ki",
"add_workflow",
"edit_workflow",
"remove_workflow",
"add_source",
"edit_source",
"remove_source"
],
"type": "string",
"description": "Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`)."
},
"description": "Improvement actions the analysis may propose."
},
"enabled": {
"type": "boolean",
"description": "Whether the recurring feedback analysis is desired to run."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "How often to analyze, for example `1h`."
}
},
"additionalProperties": false,
"description": "When the analysis runs."
},
"signal_filter": {
"type": "string",
"description": "KQL narrowing which signals the analysis reads."
},
"signal_time_range": {
"anyOf": [
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"type": "string",
"description": "Date math relative to now, for example `now-30d`."
},
"type": {
"enum": [
"relative"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"type": "string",
"description": "ISO 8601 date to analyze signals since."
},
"type": {
"enum": [
"absolute"
],
"type": "string"
}
},
"additionalProperties": false
}
]
}
},
"additionalProperties": false,
"description": "The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index."
},
"id": {
"type": "string",
"description": "The unique identifier of the AI Index."
},
"managed": {
"type": "boolean",
"description": "Whether the AI Index is managed by a plugin and therefore immutable."
},
"memory_enabled": {
"type": "boolean",
"description": "Whether this AI Index accepts memory writes."
},
"sources": {
"type": "array",
"items": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"esql",
"connector"
],
"type": "string",
"description": "`esql` for an ES|QL query, or `connector` for a data connector."
},
"value": {
"type": "string",
"description": "An ES|QL query for `esql`, or a connector ID for `connector`."
}
},
"additionalProperties": false
},
"description": "Additional sources that provide context for the AI Index."
},
"traces": {
"type": "array",
"items": {
"required": [
"type",
"value",
"query"
],
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "The ES|QL query derived from this trace source at read time."
},
"type": {
"enum": [
"elastic_agent",
"index",
"esql"
],
"type": "string",
"description": "`elastic_agent` for an Agent Builder agent, `index` for an index or data stream name or pattern, or `esql` for an ES|QL query."
},
"value": {
"type": "string",
"description": "The trace source value."
}
},
"additionalProperties": false
},
"description": "Trace sources linked to this AI Index, each with its derived ES|QL query."
}
},
"additionalProperties": false
},
"examples": {
"getAiIndexResponseExample": {
"summary": "An AI Index",
"description": "Example response returning an AI Index by ID",
"value": {
"automations": [
{
"type": "workflow",
"value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f"
}
],
"date_created": "2026-09-22T12:00:00.000Z",
"date_modified": "2026-09-22T12:00:00.000Z",
"description": "Knowledge about customer support cases.",
"dest": {
"type": "data_stream",
"value": "ai-index-ds-customer-support"
},
"id": "customer_support",
"managed": false,
"memory_enabled": true,
"sources": [
{
"type": "esql",
"value": "FROM support-cases | LIMIT 100"
}
],
"traces": [
{
"query": "FROM traces-agent_builder.otel-default\n| WHERE attributes.gen_ai.agent.id IN (\"elastic-ai-agent\")",
"type": "elastic_agent",
"value": "elastic-ai-agent"
}
]
}
}
}
}
}
},
"404": {
"description": "No AI Index with the given ID exists in the current space, or Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
},
"notFoundExample": {
"summary": "AI Index not found",
"description": "No AI Index with the given ID exists in the current space",
"value": {
"error": "Not Found",
"message": "AI index 'customer_support' not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/context_engine/ai_index/customer_support\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/context_engine/ai_index/customer_support\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"context engine"
],
"summary": "Create or update an AI Index",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates an AI Index with the given ID, or replaces an existing one. The request body replaces the whole record: omitted fields are removed, and omitted arrays become empty. A managed AI Index cannot be replaced and returns a 409.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:write.",
"operationId": "put-context-engine-ai-index-aiindexid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "aiIndexId",
"in": "path",
"description": "The unique identifier of the AI Index.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"dest"
],
"type": "object",
"properties": {
"automations": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"workflow"
],
"type": "string"
},
"value": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "The workflow ID."
}
},
"additionalProperties": false
},
"description": "Automations associated with the AI Index. Defaults to an empty array when omitted.",
"default": [ ]
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Human-readable description of the AI Index."
},
"dest": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"data_stream",
"index"
],
"type": "string",
"description": "The type of the backing store. `data_stream` for a data stream, or `index` for an index."
},
"value": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "The data stream or index (e.g. `ai-index-ds-foo`, `ai-index-idx-foo`) the AI Index is attached to. Must name a single data stream or index (no wildcards or comma-separated lists), match `type`, and start with `ai-index-ds-` (for `data_stream`) or `ai-index-idx-` (for `index`). The rest of the value must be a valid AI Index ID. System indices are not allowed."
}
},
"additionalProperties": false,
"description": "The data stream or index that backs the AI Index."
},
"feedback_analysis": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"agent_id": {
"maxLength": 256,
"type": "string",
"description": "Agent Builder agent ID that runs this index’s feedback-loop analysis."
},
"allowed_actions": {
"maxItems": 9,
"type": "array",
"items": {
"enum": [
"add_ki",
"edit_ki",
"remove_ki",
"add_workflow",
"edit_workflow",
"remove_workflow",
"add_source",
"edit_source",
"remove_source"
],
"type": "string",
"description": "Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`)."
},
"description": "Improvement actions the analysis may propose. An empty list is observe-only.",
"default": [
"add_ki",
"edit_ki",
"remove_ki",
"add_workflow",
"edit_workflow",
"remove_workflow",
"add_source",
"edit_source",
"remove_source"
]
},
"enabled": {
"type": "boolean",
"description": "Desired state of the recurring analysis. The scheduler stays authoritative for whether it is actually running."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"maxLength": 16,
"type": "string",
"description": "How often to analyze, for example `1h` or `24h`. At least 15 minutes."
}
},
"additionalProperties": false,
"description": "When the analysis runs.",
"default": {
"interval": "24h"
}
},
"signal_filter": {
"maxLength": 4096,
"type": "string",
"description": "KQL narrowing which signals this index analyzes, for example `tags: query_error`."
},
"signal_time_range": {
"anyOf": [
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"maxLength": 64,
"type": "string",
"description": "Date math relative to now, for example `now-30d`."
},
"type": {
"enum": [
"relative"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type",
"from"
],
"type": "object",
"properties": {
"from": {
"maxLength": 64,
"type": "string",
"description": "ISO 8601 date to analyze signals since."
},
"type": {
"enum": [
"absolute"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "Which signals the analysis reads. A read filter only.",
"default": {
"from": "now-30d",
"type": "relative"
}
}
},
"additionalProperties": false,
"description": "The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index."
},
"memory_enabled": {
"type": "boolean",
"description": "Whether this AI index accepts memory writes. Defaults to true when omitted."
},
"sources": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"esql"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "The source value; an ES|QL query when `type` is `esql`. Must be valid ES|QL."
}
},
"additionalProperties": false
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"connector"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "The source value; a connector ID when `type` is `connector`."
}
},
"additionalProperties": false
}
]
},
"description": "Additional sources that provide context for the AI Index. Defaults to an empty array when omitted.",
"default": [ ]
},
"traces": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"elastic_agent"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "The Agent Builder agent ID."
}
},
"additionalProperties": false
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"index"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "An index or data stream name or pattern to read traces from."
}
},
"additionalProperties": false
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"esql"
],
"type": "string"
},
"value": {
"maxLength": 10240,
"minLength": 1,
"type": "string",
"description": "An ES|QL query to select traces."
}
},
"additionalProperties": false
}
]
},
"description": "Trace sources linked to this AI Index. A write replaces the whole array. Defaults to an empty array when omitted.",
"default": [ ]
}
},
"additionalProperties": false
},
"examples": {
"putAiIndexRequestExample": {
"summary": "Create or replace an AI Index",
"description": "Example request to create or fully replace an AI Index",
"value": {
"automations": [
{
"type": "workflow",
"value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f"
}
],
"description": "Knowledge about customer support cases.",
"dest": {
"type": "data_stream",
"value": "ai-index-ds-customer-support"
},
"sources": [
{
"type": "esql",
"value": "FROM support-cases | LIMIT 100"
}
],
"traces": [
{
"type": "index",
"value": "traces-support"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "The AI Index was updated.",
"content": {
"application/json": {
"schema": {
"required": [
"status"
],
"type": "object",
"properties": {
"status": {
"enum": [
"updated"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Confirms that the AI Index was updated."
},
"examples": {
"putAiIndexUpdatedExample": {
"summary": "AI Index updated",
"description": "Example response after an existing AI Index is replaced",
"value": {
"status": "updated"
}
}
}
}
}
},
"201": {
"description": "The AI Index was created.",
"content": {
"application/json": {
"schema": {
"required": [
"status"
],
"type": "object",
"properties": {
"status": {
"enum": [
"created"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Confirms that the AI Index was created."
},
"examples": {
"putAiIndexCreatedExample": {
"summary": "AI Index created",
"description": "Example response after a new AI Index is created",
"value": {
"status": "created"
}
}
}
}
}
},
"400": {
"description": "The request was invalid, for example a malformed `dest`, an invalid ES|QL source, or an unresolvable connector source or trace.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"invalidDestExample": {
"summary": "Invalid dest",
"description": "The dest value does not follow the naming convention",
"value": {
"error": "Bad Request",
"message": "dest.value 'support-cases' is not allowed: it must start with 'ai-index-ds-'",
"statusCode": 400
}
}
}
}
}
},
"403": {
"description": "Elasticsearch denied the `index` trace lookup outright; the caller lacks index privileges for it.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"forbiddenTraceExample": {
"summary": "Index trace lookup denied",
"description": "The caller lacks Elasticsearch index privileges to look up an index trace",
"value": {
"error": "Forbidden",
"message": "security_exception: action [indices:admin/resolve/index] is unauthorized for user [jdoe] with effective roles [support_reader] on indices [traces-support], this action is granted by the index privileges [view_index_metadata,manage,read,all]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
}
}
}
}
},
"409": {
"description": "The AI Index is managed and immutable, or the write conflicted.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"managedExample": {
"summary": "Managed AI Index",
"description": "The AI Index is managed by a plugin and cannot be replaced",
"value": {
"error": "Conflict",
"message": "AI index 'customer_support' is managed and cannot be modified via the API",
"statusCode": 409
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X PUT \"https://${KIBANA_URL}/api/context_engine/ai_index/customer_support\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"description\": \"Knowledge about customer support cases.\",\n \"dest\": { \"type\": \"data_stream\", \"value\": \"ai-index-ds-customer-support\" },\n \"automations\": [{ \"type\": \"workflow\", \"value\": \"8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f\" }],\n \"sources\": [{ \"type\": \"esql\", \"value\": \"FROM support-cases | LIMIT 100\" }],\n \"traces\": [{ \"type\": \"index\", \"value\": \"traces-support\" }]\n }'\n"
},
{
"lang": "Console",
"source": "PUT kbn:/api/context_engine/ai_index/customer_support\n{\n \"description\": \"Knowledge about customer support cases.\",\n \"dest\": { \"type\": \"data_stream\", \"value\": \"ai-index-ds-customer-support\" },\n \"automations\": [{ \"type\": \"workflow\", \"value\": \"8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f\" }],\n \"sources\": [{ \"type\": \"esql\", \"value\": \"FROM support-cases | LIMIT 100\" }],\n \"traces\": [{ \"type\": \"index\", \"value\": \"traces-support\" }]\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/context_engine/ai_index/{aiIndexId}/_describe": {
"get": {
"tags": [
"context engine"
],
"summary": "Describe an AI Index",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a free-form text context block for an agent. The block describes the AI Index and its ES|QL target. It also includes up to 500 fields exposed by the backing indices, identifies which fields are semantic, provides knowledge item type and tag counts for the current space, and includes example ES|QL queries.\n\nThe API reads data as the current user. Elasticsearch index privileges limit which indices the current user can access. A caller who cannot read the backing indices gets a 403 response.\n\nThe space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. It cannot be specified in any other way.\n\nReturns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).\n\n**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**
[Required authorization] Route required privileges: contextEngine:read.",
"operationId": "get-context-engine-ai-index-aiindexid-describe",
"parameters": [
{
"name": "aiIndexId",
"in": "path",
"description": "The unique identifier of the AI Index.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A free-form text context block describing the AI Index.",
"content": {
"application/json": {
"schema": {
"required": [
"response"
],
"type": "object",
"properties": {
"response": {
"type": "string",
"description": "Free-form text context block describing the AI Index for an agent."
}
},
"additionalProperties": false
},
"examples": {
"describeAiIndexResponseExample": {
"summary": "Context block for an agent",
"description": "Example response with a context block for an agent",
"value": {
"response": "AI index: customer_support\nKnowledge about customer support cases.\nQuery with ES|QL against: ai-index-ds-customer-support\n\nFields\n@timestamp: date, searchable, aggregatable\ncontent: text, searchable\ncontent.semantic: semantic_text, searchable\ndescription: text, searchable\ndescription.semantic: semantic_text, searchable\ntags: keyword, searchable, aggregatable\ntitle: text, searchable\ntitle.semantic: semantic_text, searchable\ntype: keyword, searchable, aggregatable\n\nSemantic fields\ncontent.semantic\ndescription.semantic\ntitle.semantic\n\nKnowledge item types\n\"faq\": 12\n\"runbook\": 4\n\nTags\n\"billing\": 7\n\"password\": 5\n\nExample queries (adapt field names for non-canonical indices)\n\nFull text search, lexical and semantic fused together (?query)\nFROM ai-index-ds-customer-support METADATA _id, _index, _score\n| FORK\n ( WHERE MATCH(title, ?query) OR MATCH(description, ?query) OR MATCH(content, ?query) | SORT _score DESC | LIMIT 20 )\n ( WHERE MATCH(title.semantic, ?query) OR MATCH(description.semantic, ?query) OR MATCH(content.semantic, ?query) | SORT _score DESC | LIMIT 20 )\n| FUSE\n| SORT _score DESC, _id ASC\n| KEEP title, description, content, type, tags\n| LIMIT 5\n\nFilter by knowledge item type and tag (?type, ?tag; tags is multi-valued, so MATCH)\nFROM ai-index-ds-customer-support\n| WHERE type == ?type AND MATCH(tags, ?tag)\n| KEEP title, description, content, type, tags\n| LIMIT 20\n\nCount by type\nFROM ai-index-ds-customer-support\n| STATS count = COUNT(*) BY type\n| SORT count DESC\n| LIMIT 20"
}
}
}
}
}
},
"400": {
"description": "The description response exceeded the size limit.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"tooLargeExample": {
"summary": "Response too large",
"description": "The field metadata for the backing indices exceeded the size limit",
"value": {
"error": "Bad Request",
"message": "Field metadata for the AI index exceeded the maximum allowed size of 20MB. Point the AI index at fewer or smaller indices.",
"statusCode": 400
}
}
}
}
}
},
"403": {
"description": "The caller cannot read the backing indices. Describing an AI Index requires the `read` and `view_index_metadata` index privileges on them.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"forbiddenExample": {
"summary": "Missing view_index_metadata privilege",
"description": "The caller can read the backing indices but cannot read their mappings",
"value": {
"error": "Forbidden",
"message": "security_exception\n\tRoot causes:\n\t\tsecurity_exception: action [indices:admin/mappings/get] is unauthorized for user [jdoe] with effective roles [support_reader] on indices [ai-index-ds-customer-support], this action is granted by the index privileges [view_index_metadata,manage,all]",
"statusCode": 403
}
},
"notReadableExample": {
"summary": "Backing indices not readable",
"description": "The caller cannot read the backing indices of the AI Index",
"value": {
"error": "Forbidden",
"message": "AI index 'customer_support' is not readable. Reading it needs the Elasticsearch 'read' and 'view_index_metadata' privileges on its backing indices.",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "No AI Index with the given ID exists in the current space, or Context Engine is turned off in this space.",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The HTTP status text."
},
"message": {
"type": "string",
"description": "A human-readable error message."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code."
}
},
"additionalProperties": false,
"description": "Generic error response."
},
"examples": {
"contextEngineDisabledExample": {
"summary": "Context Engine turned off",
"description": "Context Engine is turned off in this space",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
},
"notFoundExample": {
"summary": "AI Index not found",
"description": "No AI Index with the given ID exists in the current space",
"value": {
"error": "Not Found",
"message": "AI index 'customer_support' not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"https://${KIBANA_URL}/api/context_engine/ai_index/customer_support/_describe\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn:/api/context_engine/ai_index/customer_support/_describe\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/dashboards": {
"get": {
"tags": [
"Dashboards"
],
"summary": "Search dashboards",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**\n",
"operationId": "search-dashboards",
"responses": {
"200": {
"description": "See the full Dashboards API reference for detailed response schemas."
}
}
},
"post": {
"tags": [
"Dashboards"
],
"summary": "Create a dashboard",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**\n",
"operationId": "create-dashboard",
"responses": {
"200": {
"description": "See the full Dashboards API reference for detailed response schemas."
}
}
}
},
"/api/dashboards/{id}": {
"get": {
"tags": [
"Dashboards"
],
"summary": "Get a dashboard",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**\n",
"operationId": "get-dashboard",
"responses": {
"200": {
"description": "See the full Dashboards API reference for detailed response schemas."
}
}
},
"put": {
"tags": [
"Dashboards"
],
"summary": "Upsert a dashboard",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**\n",
"operationId": "upsert-dashboard",
"responses": {
"200": {
"description": "See the full Dashboards API reference for detailed response schemas."
}
}
},
"delete": {
"tags": [
"Dashboards"
],
"summary": "Delete a dashboard",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**\n",
"operationId": "delete-dashboard",
"responses": {
"200": {
"description": "See the full Dashboards API reference for detailed response schemas."
}
}
}
},
"/api/data_views": {
"get": {
"tags": [
"data views"
],
"summary": "Get all data views",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/data_views
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a list of all data views. Use this endpoint to identify available data views in the current Kibana space.\n",
"operationId": "getAllDataViewsDefault",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data_view": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"namespaces": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"typeMeta": {
"type": "object"
}
}
}
}
}
},
"examples": {
"getAllDataViewsResponse": {
"$ref": "#/components/examples/Data_views_get_data_views_response"
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Data_views_400_response"
},
"examples": {
"getAllDataViewsBadRequest": {
"$ref": "#/components/examples/Data_views_error_400_response"
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/data_views\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/data_views\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/data_views/data_view": {
"post": {
"tags": [
"data views"
],
"summary": "Create a data view",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/data_views/data_view
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the [data views documentation](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views).\n",
"operationId": "createDataViewDefaultw",
"parameters": [
{
"$ref": "#/components/parameters/Data_views_kbn_xsrf"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Data_views_create_data_view_request_object"
},
"examples": {
"createDataViewRequest": {
"$ref": "#/components/examples/Data_views_create_data_view_request"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Data_views_data_view_response_object"
},
"examples": {
"createDataViewResponse": {
"$ref": "#/components/examples/Data_views_create_data_view_response"
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Data_views_400_response"
},
"examples": {
"createDataViewBadRequest": {
"$ref": "#/components/examples/Data_views_error_400_response"
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/data_views/data_view\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"data_view\":{\"title\":\"logstash-*\",\"name\":\"My Logstash data view\"}}'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/data_views/data_view\n{\"data_view\":{\"title\":\"logstash-*\",\"name\":\"My Logstash data view\"}}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/data_views/data_view/{viewId}": {
"delete": {
"tags": [
"data views"
],
"summary": "Delete a data view",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a single data view by its identifier. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the [data views documentation](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views).\n",
"operationId": "getDataViewDefault",
"parameters": [
{
"$ref": "#/components/parameters/Data_views_view_id"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Data_views_data_view_response_object"
},
"examples": {
"getDataViewResponse": {
"$ref": "#/components/examples/Data_views_get_data_view_response"
}
}
}
}
},
"404": {
"description": "Object is not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Data_views_404_response"
},
"examples": {
"getDataViewNotFound": {
"$ref": "#/components/examples/Data_views_error_404_response"
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/data_views/data_view/{viewId}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"data views"
],
"summary": "Update a data view",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd tags to attack discovery alerts, and remove them from alerts, by attack IDs in a single request. Optionally cascade tag changes to related detection alerts.",
"operationId": "SetAttacksTags",
"requestBody": {
"description": "An object containing tags to add or remove and attack ids the changes will be applied to",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SetAttacksTagsByIds"
},
"examples": {
"add": {
"value": {
"ids": [
"80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
],
"tags": {
"tags_to_add": [
"investigation"
],
"tags_to_remove": [ ]
}
}
},
"remove": {
"value": {
"ids": [
"80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
],
"tags": {
"tags_to_add": [ ],
"tags_to_remove": [
"investigation"
]
}
}
},
"withRelatedAlerts": {
"value": {
"ids": [
"80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
],
"tags": {
"tags_to_add": [
"investigation"
],
"tags_to_remove": [ ]
},
"update_related_alerts": true
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object",
"description": "Elasticsearch update by query response"
},
"examples": {
"success": {
"value": {
"batches": 1,
"deleted": 0,
"failures": [ ],
"noops": 0,
"requests_per_second": -1,
"retries": {
"bulk": 0,
"search": 0
},
"throttled_millis": 0,
"throttled_until_millis": 0,
"timed_out": false,
"took": 68,
"total": 1,
"updated": 1,
"version_conflicts": 0
}
}
}
}
}
},
"400": {
"description": "Invalid input data response",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"message": [
"Duplicate tags [\"duplicate\"] were found in the tags_to_add and tags_to_remove parameters."
],
"status_code": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-state": "added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/index": {
"delete": {
"tags": [
"Security Detections API"
],
"summary": "Delete an alerts index",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/detection_engine/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPermanently deletes the Elastic Security alerts backing index in the current space, including the alerts\nstored in it. Use with caution; prefer lifecycle policies or the UI when available.\nCall `GET /api/detection_engine/index` first to confirm the index that will be removed.\n",
"operationId": "DeleteAlertsIndex",
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"acknowledged"
],
"type": "object",
"properties": {
"acknowledged": {
"type": "boolean"
}
}
},
"examples": {
"acknowledged": {
"value": {
"acknowledged": true
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Not enough permissions response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"message": "API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.",
"status_code": 403
}
}
}
}
}
},
"404": {
"description": "Index does not exist response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "The Elastic Security alerts index to delete was not found.",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Detections API"
],
"summary": "Reads the alert index name if it exists",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/detection_engine/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and\nwhether its mapping is outdated. Use this to verify that an alert index is provisioned before creating\nor running rules that write alerts to it.\n",
"operationId": "ReadAlertsIndex",
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"name",
"index_mapping_outdated"
],
"type": "object",
"properties": {
"index_mapping_outdated": {
"type": [
"null",
"boolean"
]
},
"name": {
"type": "string"
}
}
},
"examples": {
"success": {
"value": {
"index_mapping_outdated": false,
"name": ".alerts-security.alerts-default"
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Not enough permissions response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"message": "API [GET /api/detection_engine/index] is unauthorized for the current user. Check Security and Kibana feature privileges (detection engine / alerts) for the space.",
"status_code": 403
}
}
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "Elastic Security alert index is not found for the current space.",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Detections API"
],
"summary": "Create an alerts index",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/detection_engine/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates an index for Elastic Security alerts. Calling this API is not\nrequired for the detection engine to function properly. You can create\nrules and alerts without calling this API.\n",
"operationId": "CreateAlertsIndex",
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"acknowledged"
],
"type": "object",
"properties": {
"acknowledged": {
"type": "boolean"
}
}
},
"examples": {
"acknowledged": {
"value": {
"acknowledged": true
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Not enough permissions response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"message": "API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.",
"status_code": 403
}
}
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "A prerequisite resource required to create the alerts index was not found.",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/privileges": {
"get": {
"tags": [
"Security Detections API"
],
"summary": "Returns user privileges for the Kibana space",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/detection_engine/privileges
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieves whether or not the user is authenticated, and the user's Kibana\nspace and index privileges, which determine if the user can create an\nindex for the Elastic Security alerts generated by\ndetection engine rules.\n",
"operationId": "ReadPrivileges",
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"is_authenticated",
"has_encryption_key"
],
"type": "object",
"properties": {
"has_encryption_key": {
"type": "boolean"
},
"is_authenticated": {
"type": "boolean"
}
}
},
"examples": {
"success": {
"value": {
"application": { },
"cluster": {
"all": true,
"manage": true,
"manage_api_key": true,
"manage_index_templates": true,
"manage_ml": true,
"manage_own_api_key": true,
"manage_pipeline": true,
"manage_security": true,
"manage_transform": true,
"monitor": true,
"monitor_ml": true,
"monitor_transform": true
},
"has_all_requested": true,
"has_encryption_key": true,
"index": {
".alerts-security.alerts-default": {
"all": true,
"create": true,
"create_doc": true,
"create_index": true,
"delete": true,
"delete_index": true,
"index": true,
"maintenance": true,
"manage": true,
"monitor": true,
"read": true,
"view_index_metadata": true,
"write": true
}
},
"is_authenticated": true,
"username": "elastic"
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules": {
"delete": {
"tags": [
"Security Detections API"
],
"summary": "Delete a detection rule",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `DELETE /api/detection_engine/rules?id=`\n* `rule_id`- `DELETE /api/detection_engine/rules?rule_id=`\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n",
"operationId": "DeleteRule",
"parameters": [
{
"name": "id",
"in": "query",
"description": "The rule's `id` value.",
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
}
},
{
"name": "rule_id",
"in": "query",
"description": "The rule's `rule_id` value.",
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
},
"examples": {
"deletedRule": {
"summary": "Response shape after a rule is deleted",
"value": {
"actions": [ ],
"created_at": "2020-02-03T11:19:04.259Z",
"created_by": "elastic",
"description": "Process started by MS Office program in user folder",
"enabled": false,
"false_positives": [ ],
"from": "now-4200s",
"id": "c41d170b-8ba6-4de6-b8ec-76440a35ace3",
"immutable": false,
"interval": "1h",
"language": "kuery",
"max_signals": 100,
"name": "MS Office child process",
"query": "event.action:Process*",
"references": [ ],
"risk_score": 50,
"rule_id": "process_started_by_ms_office_user_folder",
"severity": "low",
"tags": [
"tag"
],
"throttle": "null",
"to": "now",
"type": "query",
"updated_at": "2020-02-03T11:19:04.462Z",
"updated_by": "elastic",
"version": 3
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "cURL",
"source": "curl \\\n --request DELETE https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Detections API"
],
"summary": "Retrieve a detection rule",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `GET /api/detection_engine/rules?id=`\n* `rule_id` - `GET /api/detection_engine/rules?rule_id=`\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n",
"operationId": "ReadRule",
"parameters": [
{
"name": "id",
"in": "query",
"description": "The rule's `id` value.",
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
}
},
{
"name": "rule_id",
"in": "query",
"description": "The rule's `rule_id` value.",
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.\n> info\n> These fields are under development and their usage or schema may change: execution_summary.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
},
"examples": {
"example1": {
"summary": "Example response for a retrieved rule",
"value": {
"created_at": "2020-02-03T11:19:04.259Z",
"created_by": "elastic",
"description": "Process started by MS Office program in user folder",
"enabled": false,
"execution_summary": {
"last_execution": {
"date": "2022-03-23T16:06:12.787Z",
"message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
"metrics": {
"execution_gap_duration_s": 0,
"total_indexing_duration_ms": 15,
"total_search_duration_ms": 135
},
"status": "partial failure",
"status_order": 20
}
},
"false_positives": [ ],
"filters": [
{
"query": {
"match": {
"event.action": {
"query": "Process Create (rule: ProcessCreate)",
"type": "phrase"
}
}
}
}
],
"from": "now-4200s",
"id": "c41d170b-8ba6-4de6-b8ec-76440a35ace3",
"immutable": false,
"interval": "1h",
"language": "kuery",
"max_signals": 100,
"name": "MS Office child process",
"query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "process.name",
"type": "keyword"
},
{
"ecs": true,
"name": "process.parent.name",
"type": "keyword"
}
],
"risk_score": 21,
"rule_id": "process_started_by_ms_office_user_folder",
"setup": "",
"severity": "low",
"tags": [
"child process",
"ms office"
],
"threat": [
{
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0001",
"name": "Initial Access",
"reference": "https://attack.mitre.org/tactics/TA0001"
},
"technique": [
{
"id": "T1193",
"name": "Spearphishing Attachment",
"reference": "https://attack.mitre.org/techniques/T1193"
}
]
}
],
"to": "now-300s",
"type": "query",
"updated_at": "2020-02-03T11:19:04.462Z",
"updated_by": "elastic",
"version": 1
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "cURL",
"source": "curl \\\n --request GET https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"Security Detections API"
],
"summary": "Patch a detection rule",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing detection rule using the `rule_id` or `id` field.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n",
"operationId": "PatchRule",
"requestBody": {
"description": "> info\n> You cannot modify the `id` or `rule_id` values.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RulePatchProps"
},
"examples": {
"example1": {
"summary": "Patch query rule",
"value": {
"id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76",
"name": "New name"
}
},
"example2": {
"summary": "Patch EQL rule",
"value": {
"rule_id": "process_started_by_ms_office_program_possible_payload",
"threat": [
{
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0001",
"name": "Initial Access",
"reference": "https://attack.mitre.org/tactics/TA0001"
},
"technique": [
{
"id": "T1193",
"name": "Spearphishing Attachment",
"reference": "https://attack.mitre.org/techniques/T1193"
}
]
}
]
}
},
"example3": {
"summary": "Patch threshold rule",
"value": {
"id": "005d2c4f-51ca-493d-a2bd-20ef076339b1",
"query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"",
"threshold": {
"cardinality": [ ],
"field": [ ],
"value": 600
}
}
},
"example4": {
"summary": "Patch new terms rule",
"value": {
"history_window_start": "now-3d",
"id": "569aac91-40dc-4807-a8ae-a2c8698089c4",
"new_terms_fields": [
"Endpoint.policy.applied.artifacts.global.identifiers.name"
]
}
},
"example5": {
"summary": "Patch esql rule",
"value": {
"id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd",
"query": "FROM logs-abc*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp)\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) \n| KEEP event_rate\n"
}
},
"example6": {
"summary": "Patch indicator match rule",
"value": {
"id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd",
"threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"false\""
}
},
"example7": {
"summary": "Patch machine learning rule",
"value": {
"anomaly_threshold": 50,
"id": "60b13926-289b-41b1-a537-197ef1fa5059",
"machine_learning_job_id": [
"auth_high_count_logon_events_ea"
]
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
},
"examples": {
"example1": {
"summary": "Example response for an updated rule",
"value": {
"actions": [ ],
"created_at": "2020-04-07T14:51:09.755Z",
"created_by": "elastic",
"description": "Updated description for the rule.",
"enabled": false,
"false_positives": [ ],
"filters": [
{
"query": "null"
}
],
"from": "now-70m",
"id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
"immutable": false,
"interval": "1h",
"language": "kuery",
"max_signals": 100,
"name": "Updated Rule Name",
"query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
"references": [ ],
"related_integrations": [
{
"package": "o365"
}
],
"required_fields": [
{
"name": "process.parent.name"
}
],
"risk_score": 50,
"rule_id": "process_started_by_ms_office_program",
"setup": "",
"severity": "low",
"tags": [
"child process",
"ms office"
],
"threat": [ ],
"to": "now",
"type": "query",
"updated_at": "2020-04-07T14:51:09.970Z",
"updated_by": "elastic",
"version": 2
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Detections API"
],
"summary": "Create a detection rule",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new detection rule.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n\nYou can create the following types of rules:\n\n* **Custom query**: Searches the defined indices and creates an alert when a document matches the rule's KQL query.\n* **Event correlation**: Searches the defined indices and creates an alert when results match an [Event Query Language (EQL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) query.\n* **Threshold**: Searches the defined indices and creates an alert when the number of times the specified field's value meets the threshold during a single execution. When there are multiple values that meet the threshold, an alert is generated for each value.\n For example, if the threshold `field` is `source.ip` and its `value` is `10`, an alert is generated for every source IP address that appears in at least 10 of the rule's search results. If you're interested, see [Terms Aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) for more information.\n* **Indicator match**: Creates an alert when fields match values defined in the specified [Elasticsearch index](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html). For example, you can create an index for IP addresses and use this index to create an alert whenever an event's `destination.ip` equals a value in the index. The index's field mappings should be [ECS-compliant](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html).\n* **New terms**: Generates an alert for each new term detected in source documents within a specified time range.\n* **ES|QL**: Uses [Elasticsearch Query Language (ES|QL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html) to find events and aggregate search results.\n* **Machine learning rules**: Creates an alert when a machine learning job discovers an anomaly above the defined threshold.\n> info\n> To create machine learning rules, you must have the [appropriate license](https://www.elastic.co/subscriptions) or use a [cloud deployment](https://cloud.elastic.co/registration). Additionally, for the machine learning rule to function correctly, the associated machine learning job must be running.\n\nTo retrieve machine learning job IDs, which are required to create machine learning jobs, call the [Elasticsearch Get jobs API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-job.html). Machine learning jobs that contain `siem` in the `groups` field can be used to create rules:\n\n```json\n...\n\"job_id\": \"linux_anomalous_network_activity_ecs\",\n\"job_type\": \"anomaly_detector\",\n\"job_version\": \"7.7.0\",\n\"groups\": [\n \"auditbeat\",\n \"process\",\n \"siem\"\n],\n...\n```\n\nAdditionally, you can set up notifications for when rules create alerts. The notifications use the [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting). Each action type requires a connector. Connectors store the information required to send notifications via external systems. The following connector types are supported for rule notifications:\n\n* Slack\n* Email\n* PagerDuty\n* Webhook\n* Microsoft Teams\n* IBM Resilient\n* Jira\n* ServiceNow ITSM\n> info\n> For more information on PagerDuty fields, see [Send a v2 Event](https://developer.pagerduty.com/docs/events-api-v2/trigger-events/).\n\nTo retrieve connector IDs, which are required to configure rule notifications, call the [Find objects API](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findsavedobjects) with `\"type\": \"action\"` in the request payload.\n\nFor detailed information on Kibana actions and alerting, and additional API calls, see:\n\n* [Alerting API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting)\n* [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting)\n* [Connectors API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-connectors)\n",
"operationId": "CreateRule",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleCreateProps"
},
"examples": {
"example1": {
"summary": "Query rule",
"description": "Query rule that searches for processes started by MS Office",
"value": {
"description": "Process started by MS Office program - possible payload",
"enabled": false,
"filters": [
{
"query": {
"match": {
"event.action": {
"query": "Process Create (rule: ProcessCreate)",
"type": "phrase"
}
}
}
}
],
"from": "now-70m",
"interval": "1h",
"language": "kuery",
"name": "MS Office child process",
"query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"name": "process.parent.name",
"type": "keyword"
}
],
"risk_score": 50,
"rule_id": "process_started_by_ms_office_program",
"severity": "low",
"tags": [
"child process",
"ms office"
],
"type": "query"
}
},
"example2": {
"summary": "Threshold rule",
"description": "Threshold rule that detects multiple failed login attempts to a Windows host from the same external source IP address",
"value": {
"description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.",
"enabled": true,
"exceptions_list": [
{
"id": "int-ips",
"namespace_type": "single",
"type": "detection"
}
],
"from": "now-180s",
"index": [
"winlogbeat-*"
],
"interval": "2m",
"name": "Windows server prml-19",
"query": "host.name:prml-19 and event.category:authentication and event.outcome:failure",
"required_fields": [
{
"name": "source.ip",
"type": "ip"
}
],
"risk_score": 30,
"rule_id": "liv-win-ser-logins",
"severity": "low",
"severity_mapping": [
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "low",
"value": "Manchester"
},
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "medium",
"value": "London"
},
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "high",
"value": "Birmingham"
},
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "critical",
"value": "Wallingford"
}
],
"tags": [
"Brute force"
],
"threshold": {
"field": "source.ip",
"value": 20
},
"type": "threshold"
}
},
"example3": {
"summary": "Machine learning rule",
"description": "Machine learning rule that creates alerts, and sends Slack notifications, when the linux_anomalous_network_activity_ecs machine learning job discovers anomalies with a threshold of 70 or above.",
"value": {
"actions": [
{
"action_type_id": ".slack",
"group": "default",
"id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5",
"params": {
"message": "Urgent: {{context.rule.description}}"
}
}
],
"anomaly_threshold": 70,
"description": "Generates alerts when the job discovers anomalies over 70",
"enabled": true,
"from": "now-6m",
"interval": "5m",
"machine_learning_job_id": "linux_anomalous_network_activity_ecs",
"name": "Anomalous Linux network activity",
"note": "Shut down the internet.",
"risk_score": 70,
"rule_id": "ml_linux_network_high_threshold",
"setup": "This rule requires data coming in from Elastic Defend.",
"severity": "high",
"tags": [
"machine learning",
"Linux"
],
"type": "machine_learning"
}
},
"example4": {
"summary": "EQL rule",
"description": "Event correlation rule that creates alerts when the Windows rundll32.exe process makes unusual network connections",
"value": {
"description": "Unusual rundll32.exe network connection",
"language": "eql",
"name": "rundll32.exe network connection",
"query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]",
"required_fields": [
{
"name": "event.type",
"type": "keyword"
},
{
"name": "process.args",
"type": "keyword"
},
{
"name": "process.args_count",
"type": "long"
},
{
"name": "process.entity_id",
"type": "keyword"
},
{
"name": "process.name",
"type": "keyword"
},
{
"name": "process.pe.original_file_name",
"type": "keyword"
}
],
"risk_score": 21,
"rule_id": "eql-outbound-rundll32-connections",
"severity": "low",
"tags": [
"EQL",
"Windows",
"rundll32.exe"
],
"type": "eql"
}
},
"example5": {
"summary": "Indicator match rule",
"description": "Indicator match rule that creates an alert when one of the following is true: The event's destination IP address and port number matches destination IP and port values in the threat_index index; The event's source IP address matches a host IP address value in the threat_index index.\n",
"value": {
"actions": [ ],
"description": "Checks for bad IP addresses listed in the ip-threat-list index",
"index": [
"packetbeat-*"
],
"name": "Bad IP threat match",
"query": "destination.ip:* or host.ip:*",
"required_fields": [
{
"name": "destination.ip",
"type": "ip"
},
{
"name": "destination.port",
"type": "long"
},
{
"name": "host.ip",
"type": "ip"
}
],
"risk_score": 50,
"severity": "medium",
"threat_index": [
"ip-threat-list"
],
"threat_mapping": [
{
"entries": [
{
"field": "destination.ip",
"type": "mapping",
"value": "destination.ip"
},
{
"field": "destination.port",
"type": "mapping",
"value": "destination.port"
}
]
},
{
"entries": [
{
"field": "source.ip",
"type": "mapping",
"value": "host.ip"
}
]
}
],
"threat_query": "*:*",
"type": "threat_match"
}
},
"example6": {
"summary": "New terms rule",
"description": "New terms rule that creates alerts a new IP address is detected for a user",
"value": {
"description": "Detects a user associated with a new IP address",
"history_window_start": "now-30d",
"index": [
"auditbeat*"
],
"language": "kuery",
"name": "New User IP Detected",
"new_terms_fields": [
"user.id",
"source.ip"
],
"query": "*",
"required_fields": [
{
"name": "user.id",
"type": "keyword"
},
{
"name": "source.ip",
"type": "ip"
}
],
"risk_score": 21,
"severity": "medium",
"type": "new_terms"
}
},
"example7": {
"summary": "Esql rule",
"description": "esql rule that creates alerts from events that match an Excel parent process",
"value": {
"description": "Find Excel events",
"enabled": false,
"from": "now-360s",
"interval": "5m",
"language": "esql",
"name": "Find Excel events",
"query": "from auditbeat-8.10.2 METADATA _id, _version, _index | where process.parent.name == \"EXCEL.EXE\"",
"required_fields": [
{
"name": "process.parent.name",
"type": "keyword"
}
],
"risk_score": 21,
"severity": "low",
"tags": [ ],
"to": "now",
"type": "esql"
}
},
"example8": {
"summary": "Query rule 2",
"description": "Query rule that searches for processes started by MS Office and suppresses alerts by the process.parent.name field within a 5-hour time period",
"value": {
"alert_suppression": {
"duration": {
"unit": "h",
"value": 5
},
"group_by": [
"process.parent.name"
],
"missing_fields_strategy": "suppress"
},
"description": "Process started by MS Office program - possible payload",
"enabled": false,
"filters": [
{
"query": {
"match": {
"event.action": {
"query": "Process Create (rule: ProcessCreate)",
"type": "phrase"
}
}
}
}
],
"from": "now-70m",
"interval": "1h",
"language": "kuery",
"name": "MS Office child process",
"query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
"risk_score": 50,
"rule_id": "process_started_by_ms_office_program",
"severity": "low",
"tags": [
"child process",
"ms office"
],
"type": "query"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
},
"examples": {
"example1": {
"summary": "Query rule response",
"description": "Example response for a query rule",
"value": {
"actions": [ ],
"created_at": "2020-04-07T14:51:09.755Z",
"created_by": "elastic",
"description": "Process started by MS Office program - possible payload",
"enabled": false,
"false_positives": [ ],
"filters": [
{
"query": {
"match": {
"event.action": {
"query": "Process Create (rule: ProcessCreate)",
"type": "phrase"
}
}
}
}
],
"from": "now-70m",
"id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
"immutable": false,
"interval": "1h",
"language": "kuery",
"max_signals": 100,
"name": "MS Office child process",
"query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
},
{
"integration": "graphactivitylogs",
"package": "azure",
"version": "^1.11.4"
}
],
"required_fields": [
{
"ecs": true,
"name": "process.parent.name",
"type": "keyword"
}
],
"risk_score": 50,
"rule_id": "process_started_by_ms_office_program",
"setup": "",
"severity": "low",
"tags": [
"child process",
"ms office"
],
"threat": [ ],
"to": "now",
"type": "query",
"updated_at": "2020-04-07T14:51:09.970Z",
"updated_by": "elastic",
"version": 1
}
},
"example2": {
"summary": "Machine learning response",
"description": "Example response for a machine learning job rule",
"value": {
"actions": [
{
"action_type_id": ".slack",
"frequency": {
"notifyWhen": "onActiveAlert",
"summary": true,
"throttle": "null"
},
"group": "default",
"id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5",
"params": {
"message": "Urgent: {{context.rule.description}}"
}
}
],
"anomaly_threshold": 70,
"created_at": "2020-04-07T14:45:15.679Z",
"created_by": "elastic",
"description": "Generates alerts when the job discovers anomalies over 70",
"enabled": true,
"false_positives": [ ],
"from": "now-6m",
"id": "83876f66-3a57-4a99-bf37-416494c80f3b",
"immutable": false,
"interval": "5m",
"machine_learning_job_id": "linux_anomalous_network_activity_ecs",
"max_signals": 100,
"name": "Anomalous Linux network activity",
"note": "Shut down the internet.",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"risk_score": 70,
"rule_id": "ml_linux_network_high_threshold",
"setup": "",
"severity": "high",
"status": "going to run",
"status_date": "2020-04-07T14:45:21.685Z",
"tags": [
"machine learning",
"Linux"
],
"threat": [ ],
"to": "now",
"type": "machine_learning",
"updated_at": "2020-04-07T14:45:15.892Z",
"updated_by": "elastic",
"version": 1
}
},
"example3": {
"summary": "Threshold rule response",
"description": "Example response for a threshold rule",
"value": {
"actions": [ ],
"author": [ ],
"created_at": "2020-07-22T10:27:23.486Z",
"created_by": "elastic",
"description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.",
"enabled": true,
"exceptions_list": [
{
"id": "int-ips",
"namespace_type": "single",
"type": "detection"
}
],
"false_positives": [ ],
"from": "now-180s",
"id": "15dbde26-b627-4d74-bb1f-a5e0ed9e4993",
"immutable": false,
"index": [
"winlogbeat-*"
],
"interval": "2m",
"language": "kuery",
"max_signals": 100,
"name": "Windows server prml-19",
"query": "host.name:prml-19 and event.category:authentication and event.outcome:failure",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "source.ip",
"type": "ip"
}
],
"risk_score": 30,
"risk_score_mapping": [ ],
"rule_id": "liv-win-ser-logins",
"setup": "",
"severity": "low",
"severity_mapping": [
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "low",
"value": "Manchester"
},
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "medium",
"value": "London"
},
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "high",
"value": "Birmingham"
},
{
"field": "source.geo.city_name",
"operator": "equals",
"severity": "critical",
"value": "Wallingford"
}
],
"tags": [
"Brute force"
],
"threat": [ ],
"threshold": {
"field": "source.ip",
"value": 20
},
"to": "now",
"type": "threshold",
"updated_at": "2020-07-22T10:27:23.673Z",
"updated_by": "elastic",
"version": 1
}
},
"example4": {
"summary": "EQL rule response",
"description": "Example response for an EQL rule",
"value": {
"author": [ ],
"created_at": "2020-10-05T09:06:16.392Z",
"created_by": "elastic",
"description": "Unusual rundll32.exe network connection",
"enabled": true,
"exceptions_list": [ ],
"false_positives": [ ],
"from": "now-6m",
"id": "93808cae-b05b-4dc9-8479-73574b50f8b1",
"immutable": false,
"interval": "5m",
"language": "eql",
"max_signals": 100,
"name": "rundll32.exe network connection",
"query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "event.type",
"type": "keyword"
},
{
"ecs": true,
"name": "process.args",
"type": "keyword"
},
{
"ecs": true,
"name": "process.args_count",
"type": "long"
},
{
"ecs": true,
"name": "process.entity_id",
"type": "keyword"
},
{
"ecs": true,
"name": "process.name",
"type": "keyword"
},
{
"ecs": true,
"name": "process.pe.original_file_name",
"type": "keyword"
}
],
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "eql-outbound-rundll32-connections",
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [
"EQL",
"Windows",
"rundll32.exe"
],
"threat": [ ],
"throttle": "no_actions",
"to": "now",
"type": "eql",
"updated_at": "2020-10-05T09:06:16.403Z",
"updated_by": "elastic",
"version": 1
}
},
"example5": {
"summary": "Indicator match rule response",
"description": "Example response for an indicator match rule",
"value": {
"author": [ ],
"created_at": "2020-10-06T07:07:58.227Z",
"created_by": "elastic",
"description": "Checks for bad IP addresses listed in the ip-threat-list index",
"enabled": true,
"exceptions_list": [ ],
"false_positives": [ ],
"from": "now-6m",
"id": "d5daa13f-81fb-4b13-be2f-31011e1d9ae1",
"immutable": false,
"index": [
"packetbeat-*"
],
"interval": "5m",
"language": "kuery",
"max_signals": 100,
"name": "Bad IP threat match",
"query": "destination.ip:* or host.ip:*",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "destination.ip",
"type": "ip"
},
{
"ecs": true,
"name": "destination.port",
"type": "long"
},
{
"ecs": true,
"name": "host.ip",
"type": "ip"
}
],
"risk_score": 50,
"risk_score_mapping": [ ],
"rule_id": "608501e4-c768-4f64-9326-cec55b5d439b",
"setup": "",
"severity": "medium",
"severity_mapping": [ ],
"tags": [ ],
"threat": [ ],
"threat_index": [
"ip-threat-list"
],
"threat_mapping": [
{
"entries": [
{
"field": "destination.ip",
"type": "mapping",
"value": "destination.ip"
},
{
"field": "destination.port",
"type": "mapping",
"value": "destination.port"
}
]
},
{
"entries": [
{
"field": "source.ip",
"type": "mapping",
"value": "host.ip"
}
]
}
],
"threat_query": "*:*",
"to": "now",
"type": "threat_match",
"updated_at": "2020-10-06T07:07:58.237Z",
"updated_by": "elastic",
"version": 1
}
},
"example6": {
"summary": "New terms rule response",
"description": "Example response for a new terms rule",
"value": {
"author": [ ],
"created_at": "2020-10-06T07:07:58.227Z",
"created_by": "elastic",
"description": "Detects a user associated with a new IP address",
"enabled": true,
"exceptions_list": [ ],
"false_positives": [ ],
"from": "now-6m",
"history_window_start": "now-30d",
"id": "eb7225c0-566b-11ee-8b4f-bbf3afdeb9f4",
"immutable": false,
"index": [
"auditbeat*"
],
"interval": "5m",
"language": "kuery",
"max_signals": 100,
"name": "New User IP Detected",
"new_terms_fields": [
"user.id",
"source.ip"
],
"query": "*",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "user.id",
"type": "keyword"
},
{
"ecs": true,
"name": "source.ip",
"type": "ip"
}
],
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "c6f5d0bc-7be9-47d4-b2f3-073d22641e30",
"setup": "",
"severity": "medium",
"severity_mapping": [ ],
"tags": [ ],
"threat": [ ],
"to": "now",
"type": "new_terms",
"updated_at": "2020-10-06T07:07:58.237Z",
"updated_by": "elastic",
"version": 1
}
},
"example7": {
"summary": "Esql rule response",
"description": "Example response for an Esql rule",
"value": {
"actions": [ ],
"author": [ ],
"created_at": "2023-10-18T10:55:14.269Z",
"created_by": "elastic",
"description": "Find Excel events",
"enabled": false,
"exceptions_list": [ ],
"false_positives": [ ],
"from": "now-360s",
"id": "d0f20490-6da4-11ee-b85e-09e9b661f2e2",
"immutable": false,
"interval": "5m",
"language": "esql",
"max_signals": 100,
"name": "Find Excel events",
"output_index": "",
"query": "from auditbeat-8.10.2 METADATA _id | where process.parent.name == \"EXCEL.EXE\"",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "process.parent.name",
"type": "keyword"
}
],
"revision": 0,
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "e4b53a89-debd-4a0d-a3e3-20606952e589",
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [ ],
"threat": [ ],
"to": "now",
"type": "esql",
"updated_at": "2023-10-18T10:55:14.269Z",
"updated_by": "elastic",
"version": 1
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"Security Detections API"
],
"summary": "Update a detection rule",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n",
"operationId": "UpdateRule",
"requestBody": {
"description": "> info\n> All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleUpdateProps"
},
"examples": {
"example1": {
"summary": "Update query rule",
"value": {
"description": "A new description",
"id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76",
"name": "A new name for the rule",
"risk_score": 22,
"severity": "medium",
"type": "query"
}
},
"example2": {
"summary": "Update EQL rule",
"value": {
"description": "eql rule test",
"id": "9b684efb-acf9-4323-9bff-8335b3867d14",
"index": [
"apm-*-transaction*"
],
"language": "eql",
"name": "New name for EQL rule",
"query": "process where process.name == \"regsvr32.exe\"",
"risk_score": 21,
"severity": "low",
"type": "eql"
}
},
"example3": {
"summary": "Update threshold rule",
"value": {
"description": "Description of threat rule test",
"id": "005d2c4f-51ca-493d-a2bd-20ef076339b1",
"language": "kuery",
"name": "New name for threat rule",
"query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"",
"risk_score": 21,
"severity": "low",
"tags": [
"new_tag"
],
"threshold": {
"cardinality": [ ],
"field": [ ],
"value": 400
},
"type": "threshold"
}
},
"example4": {
"summary": "Update new terms rule",
"value": {
"description": "New description",
"history_window_start": "now-7d",
"id": "569aac91-40dc-4807-a8ae-a2c8698089c4",
"interval": "5m",
"name": "New terms rule name",
"new_terms_fields": [
"Endpoint.policy.applied.artifacts.global.identifiers.name"
],
"query": "agent.version : \"9.1.0\"",
"risk_score": 21,
"severity": "low",
"type": "new_terms"
}
},
"example5": {
"summary": "Update esql rule",
"value": {
"description": "New description for esql rule",
"id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd",
"language": "esql",
"name": "New name for esql rule",
"query": "FROM logs*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */\n| KEEP event_rate\n",
"risk_score": 21,
"severity": "low",
"type": "esql"
}
},
"example6": {
"summary": "Update indicator match rule",
"value": {
"description": "New description",
"id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd",
"name": "New name for Indicator Match rule",
"query": "source.ip:* or destination.ip:*\\n",
"risk_score": 99,
"severity": "critical",
"threat_index": [
"filebeat-*",
"logs-ti_*"
],
"threat_mapping": [
{
"entries": [
{
"field": "source.ip",
"type": "mapping",
"value": "threat.indicator.ip"
}
]
},
{
"entries": [
{
"field": "destination.ip",
"type": "mapping",
"value": "threat.indicator.ip"
}
]
}
],
"threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"",
"type": "threat_match"
}
},
"example7": {
"summary": "Update machine learning rule",
"value": {
"anomaly_threshold": 50,
"description": "New description of ml rule",
"id": "60b13926-289b-41b1-a537-197ef1fa5059",
"machine_learning_job_id": [
"auth_high_count_logon_events_ea"
],
"name": "New name of ml rule",
"risk_score": 21,
"severity": "low",
"type": "machine_learning"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
},
"examples": {
"example1": {
"summary": "Example response for an updated rule",
"value": {
"actions": [ ],
"created_at": "2020-04-07T14:51:09.755Z",
"created_by": "elastic",
"description": "Updated description for the rule.",
"enabled": false,
"false_positives": [ ],
"filters": [
{
"query": "null"
}
],
"from": "now-70m",
"id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1",
"immutable": false,
"interval": "1h",
"language": "kuery",
"max_signals": 100,
"name": "Updated Rule Name",
"query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
"references": [ ],
"related_integrations": [
{
"package": "o365"
}
],
"required_fields": [
{
"name": "process.parent.name"
}
],
"risk_score": 50,
"rule_id": "process_started_by_ms_office_program",
"setup": "",
"severity": "low",
"tags": [
"child process",
"ms office"
],
"threat": [ ],
"to": "now",
"type": "query",
"updated_at": "2020-04-07T14:51:09.970Z",
"updated_by": "elastic",
"version": 2
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/_bulk_action": {
"post": {
"tags": [
"Security Detections API"
],
"summary": "Apply a bulk action to detection rules",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.\n\nThe edit action allows you to add, delete, or set tags, index patterns, investigation fields, rule actions and schedules for multiple rules at once. \nThe edit action is idempotent, meaning that if you add a tag to a rule that already has that tag, no changes are made. The same is true for other edit actions, for example removing an index pattern that is not specified in a rule will not result in any changes. The only exception is the `add_rule_actions` and `set_rule_actions` action, which is non-idempotent. This means that if you add or set a rule action to a rule that already has that action, a new action is created with a new unique ID.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n",
"operationId": "PerformRulesBulkAction",
"parameters": [
{
"name": "dry_run",
"in": "query",
"description": "Enables dry run mode for the request call.\n\nEnable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.\n\nTo enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.\n> info\n> Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.\n",
"schema": {
"type": "boolean"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_BulkDeleteRules"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkDisableRules"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkEnableRules"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkExportRules"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkDuplicateRules"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkManualRuleRun"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkManualRuleFillGaps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkEditRules"
}
]
},
"examples": {
"example01": {
"summary": "Enable - Enable all rules with the test tag",
"description": "The following request activates all rules with the test tag.",
"value": {
"action": "enable",
"query": "alert.attributes.tags: \"test\""
}
},
"example02": {
"summary": "Enable - Enable a specific rule by ID.",
"description": "The following request enables the rule with the specified ID.",
"value": {
"action": "enable",
"ids": [
"748694f0-6977-4ea5-8384-cd2e39730779"
]
}
},
"example03": {
"summary": "Disable - Disable a specific rule by ID",
"description": "The following request disables the rule with the specified ID.",
"value": {
"action": "disable",
"ids": [
"748694f0-6977-4ea5-8384-cd2e39730779"
]
}
},
"example04": {
"summary": "Duplicate - Duplicate rules with specific IDs",
"description": "The following request duplicates rules with the specified IDs, including exceptions but not expired exceptions.",
"value": {
"action": "duplicate",
"duplicate": {
"include_exceptions": true,
"include_expired_exceptions": false
},
"ids": [
"748694f0-6977-4ea5-8384-cd2e39730779",
"461a4c22-416e-4009-a9a7-cf79656454bf"
]
}
},
"example05": {
"summary": "Delete - Delete a specific rule by ID",
"description": "The following request deletes the rule with the specified ID.",
"value": {
"action": "delete",
"ids": [
"cf4abfd1-7c37-4519-ab0f-5ea5c75fac60"
]
}
},
"example06": {
"summary": "Run - Run a specific rule by ID",
"description": "The following request runs the rule with the specified ID within the given date range.",
"value": {
"action": "run",
"ids": [
"748694f0-6977-4ea5-8384-cd2e39730779"
],
"run": {
"end_date": "2025-03-10T23:59:59.999Z",
"start_date": "2025-03-01T00:00:00.000Z"
}
}
},
"example07": {
"summary": "Export - Export specific rules by ID",
"description": "The following request exports the rules with the specified IDs.",
"value": {
"action": "export",
"ids": [
"748694f0-6977-4ea5-8384-cd2e39730779"
]
}
},
"example08": {
"summary": "Edit - dry run - Validate add_index_patterns bulk action",
"description": "The following request will validate that the add_index_patterns bulk action can be successfully applied to three rules. The dry_run parameter is specified in query parameters, e.g. POST api/detection_engine/rules/_bulk_action?dry_run=true",
"value": {
"action": "edit",
"edit": [
{
"type": "add_index_patterns",
"value": [
"test-*"
]
}
],
"ids": [
"81aa0480-06af-11ed-94fb-dd1a0597d8d2",
"dc015d10-0831-11ed-ac8b-05a222bd8d4a",
"de8f5af0-0831-11ed-ac8b-05a222bd8d4a"
]
}
},
"example09": {
"summary": "Edit - Add a tag to rules (idempotent)",
"description": "The following request adds the tag \"tag-1\" to the rules with the specified IDs. If the tag already exists for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_tags",
"value": [
"tag-1"
]
}
],
"ids": [
"8bc7dad0-9320-11ec-9265-8b772383a08d",
"8e5c1a40-9320-11ec-9265-8b772383a08d"
]
}
},
"example10": {
"summary": "Edit - Add two tags to rules (idempotent)",
"description": "The following request adds two tags at the same time, tag-1 and tag-2, to the rules that have the IDs sent in the payload. If the tags already exist for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_tags",
"value": [
"tag-1",
"tag-2"
]
}
],
"ids": [
"8bc7dad0-9320-11ec-9265-8b772383a08d",
"8e5c1a40-9320-11ec-9265-8b772383a08d"
]
}
},
"example11": {
"summary": "Edit - Delete a tag from rules (idempotent)",
"description": "The following request removes the tag \"tag-1\" from the rules with the specified IDs. If the tag does not exist for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "delete_tags",
"value": [
"tag-1"
]
}
],
"ids": [
"8bc7dad0-9320-11ec-9265-8b772383a08d",
"8e5c1a40-9320-11ec-9265-8b772383a08d"
]
}
},
"example12": {
"summary": "Edit - Set (overwrite existing) tags for rules (idempotent)",
"description": "The following request sets the tags \"tag-1\" and \"tag-2\" for the rules with the specified IDs, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_tags",
"value": [
"tag-1",
"tag-2"
]
}
],
"ids": [
"8bc7dad0-9320-11ec-9265-8b772383a08d",
"8e5c1a40-9320-11ec-9265-8b772383a08d"
]
}
},
"example13": {
"summary": "Edit - Add index patterns to rules (idempotent)",
"description": "The following request adds the index pattern \"test-*\" to the rules with the specified IDs. If the index pattern already exists for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_index_patterns",
"value": [
"test-*"
]
}
],
"ids": [
"81aa0480-06af-11ed-94fb-dd1a0597d8d2",
"dc015d10-0831-11ed-ac8b-05a222bd8d4a"
]
}
},
"example14": {
"summary": "Edit - Remove index patterns from rules (idempotent)",
"description": "The following request removes the index pattern \"test-*\" from the rules with the specified IDs. If the index pattern does not exist for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "delete_index_patterns",
"value": [
"test-*"
]
}
],
"ids": [
"81aa0480-06af-11ed-94fb-dd1a0597d8d2",
"dc015d10-0831-11ed-ac8b-05a222bd8d4a"
]
}
},
"example15": {
"summary": "Edit - Set (overwrite existing) index patterns for rules patterns (idempotent)",
"description": "The following request sets the index patterns \"test-*\" and \"prod-*\" for the rules with the specified IDs, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_index_patterns",
"value": [
"test-*"
]
}
],
"ids": [
"81aa0480-06af-11ed-94fb-dd1a0597d8d2",
"dc015d10-0831-11ed-ac8b-05a222bd8d4a"
]
}
},
"example16": {
"summary": "Edit - Add investigation field to rules",
"description": "The following request adds investigation field to the rules with the specified IDs.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_investigation_fields",
"value": {
"field_names": [
"alert.status"
]
}
}
],
"ids": [
"12345678-1234-1234-1234-1234567890ab",
"87654321-4321-4321-4321-0987654321ba"
]
}
},
"example17": {
"summary": "Edit - Delete investigation fields from rules (idempotent)",
"description": "The following request deletes investigation fields from the rules with the specified IDs. If the field does not exist for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "delete_investigation_fields"
}
],
"ids": [
"12345678-1234-1234-1234-1234567890ab",
"87654321-4321-4321-4321-0987654321ba"
],
"value": [
"field1",
"field2"
]
}
},
"example18": {
"summary": "Edit - Set (overwrite existing) investigation fields for rules (idempotent)",
"description": "The following request sets investigation fields for the rules with the specified IDs, overwriting any existing investigation fields. If the set of investigation fields is the same as the existing investigation fields, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_investigation_fields",
"value": [
"field1",
"field2"
]
}
],
"ids": [
"12345678-1234-1234-1234-1234567890ab",
"87654321-4321-4321-4321-0987654321ba"
]
}
},
"example19": {
"summary": "Edit - Set (overwrite existing) timeline template for rules (idempotent)",
"description": "The following request sets a timeline template for the rules with the specified IDs. If the same timeline template is already set for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_timeline",
"value": {
"timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd",
"timeline_title": "Alerts Involving a Single User Timeline"
}
}
],
"ids": [
"eacdfc95-e007-41c9-986e-4b2cbdfdc71b"
]
}
},
"example20": {
"summary": "Edit - Set (overwrite existing) schedule for rules (idempotent)",
"description": "The following request sets a schedule for the rules with the specified IDs. If the same schedule is already set for a rule, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_schedule",
"value": {
"interval": "1h",
"lookback": "30m"
}
}
],
"ids": [
"99887766-5544-3322-1100-aabbccddeeff"
]
}
},
"example21": {
"summary": "Edit - Add rule actions to rules (non-idempotent)",
"description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_rule_actions",
"value": {
"actions": [
{
"group": "default",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"body": "The message body"
}
}
]
}
}
],
"ids": [
"9e946bfc-3118-4c77-bb25-67d781191928"
]
}
},
"example22": {
"summary": "Edit - Set (overwrite existing) rule actions for rules (non-idempotent)",
"description": "The following request sets rule actions for the rules with the specified IDs. Each action receives its own unique ID.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_rule_actions",
"value": {
"actions": [
{
"group": "default",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"body": "The message body"
}
}
]
}
}
],
"ids": [
"9e946bfc-3118-4c77-bb25-67d781191928"
]
}
},
"example23": {
"summary": "Edit - Add rule actions to rules for a webhook connector",
"description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_rule_actions",
"value": {
"actions": [
{
"group": "default3",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"body": "The message body"
}
}
]
}
}
],
"ids": [
"9e946bfc-3118-4c77-bb25-67d781191921"
]
}
},
"example24": {
"summary": "Edit - Add rule actions to rules for an email connector",
"description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_rule_actions",
"value": {
"actions": [
{
"group": "default3",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"message": "The message body",
"subject": "Subject",
"to": "address@domain.com"
}
}
]
}
}
],
"ids": [
"9e946bfc-3118-4c77-bb25-67d781191921"
]
}
},
"example25": {
"summary": "Edit - Add rule actions to rules for a slack connector",
"description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_rule_actions",
"value": {
"actions": [
{
"group": "default3",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"message": "The content of the message"
}
}
]
}
}
],
"ids": [
"9e946bfc-3118-4c77-bb25-67d781191921"
]
}
},
"example26": {
"summary": "Edit - Add rule actions to rules for a PagerDuty connector",
"description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.",
"value": {
"action": "edit",
"edit": [
{
"type": "add_rule_actions",
"value": {
"actions": [
{
"group": "default3",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"eventAction": "trigger",
"severity": "critical",
"summary": "The message body",
"timestamp": "2023-10-31T00:00:00Z"
}
}
]
}
}
],
"ids": [
"9e946bfc-3118-4c77-bb25-67d781191921"
]
}
},
"example27": {
"summary": "Edit - Set alert suppression to rules (idempotent)",
"description": "The following request set alert suppression to the rules with the specified IDs.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_alert_suppression",
"value": {
"duration": {
"unit": "h",
"value": 1
},
"group_by": [
"source.ip"
],
"missing_fields_strategy": "suppress"
}
}
],
"ids": [
"12345678-1234-1234-1234-1234567890ab",
"87654321-4321-4321-4321-0987654321ba"
]
}
},
"example28": {
"summary": "Edit - Set alert suppression to threshold rules (idempotent)",
"description": "The following request set alert suppression to threshold rules with the specified IDs.",
"value": {
"action": "edit",
"edit": [
{
"type": "set_alert_suppression_for_threshold",
"value": {
"duration": {
"unit": "h",
"value": 1
}
}
}
],
"ids": [
"12345678-1234-1234-1234-1234567890ab",
"87654321-4321-4321-4321-0987654321ba"
]
}
},
"example29": {
"summary": "Edit - Removes alert suppression from rules (idempotent)",
"description": "The following request removes alert suppression from the rules with the specified IDs. If the rules do not have alert suppression, no changes are made.",
"value": {
"action": "edit",
"edit": [
{
"type": "delete_alert_suppression"
}
],
"ids": [
"12345678-1234-1234-1234-1234567890ab",
"87654321-4321-4321-4321-0987654321ba"
]
}
},
"example30": {
"summary": "Fill Gaps - Manually trigger the filling of gaps for specified rules",
"description": "The following request triggers the filling of gaps for the specified rule ids and time range",
"value": {
"action": "fill_gaps",
"ids": [
"748694f0-6977-4ea5-8384-cd2e39730779",
"164d0918-f720-4c9f-9f5c-c5122587cf19"
],
"run": {
"end_date": "2025-03-10T23:59:59.999Z",
"start_date": "2025-03-01T00:00:00.000Z"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_BulkEditActionResponse"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkExportActionResponse"
}
]
},
"examples": {
"example01": {
"summary": "Successful response",
"description": "In this response one rule was updated and one was skipped. Objects returned in attributes.results.skipped will only include rules' id, name, and skip_reason.",
"value": {
"attributes": {
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [
{
"id": "51658332-a15e-4c9e-912a-67214e2e2359",
"name": "Skipped rule",
"skip_reason": "RULE_NOT_MODIFIED"
}
],
"updated": [
{
"anomaly_threshold": 50,
"author": [
"Elastic"
],
"created_at": "2022-02-21T14:14:13.801Z",
"created_by": "elastic",
"description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.",
"enabled": true,
"exceptions_list": [ ],
"execution_summary": {
"last_execution": {
"date": "2022-03-23T16:06:12.787Z",
"message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
"metrics": {
"execution_gap_duration_s": 0,
"total_indexing_duration_ms": 15,
"total_search_duration_ms": 135
},
"status": "partial failure",
"status_order": 20
}
},
"false_positives": [
"DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded."
],
"from": "now-45m",
"id": "8bc7dad0-9320-11ec-9265-8b772383a08d",
"immutable": false,
"interval": "15m",
"license": "Elastic License v2",
"machine_learning_job_id": [
"dns_tunneling_ea"
],
"max_signals": 100,
"name": "DNS Tunneling [Duplicate]",
"references": [
"https://www.elastic.co/docs/reference/machine-learning/ootb-ml-jobs-siem"
],
"related_integrations": [ ],
"required_fields": [ ],
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "7289bf08-4e91-4c70-bf01-e04c4c5d7756",
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [
"Elastic",
"Network",
"Threat Detection",
"ML"
],
"threat": [ ],
"to": "now",
"type": "machine_learning",
"updated_at": "2022-02-21T17:05:50.883Z",
"updated_by": "elastic",
"version": 6
}
]
},
"summary": {
"failed": 0,
"skipped": 1,
"succeeded": 1,
"total": 2
}
},
"rules_count": 1,
"success": true
}
},
"example02": {
"summary": "Partial failure",
"description": "If processing of any rule fails, a partial error outputs the ID and/or name of the affected rule and the corresponding error, as well as successfully processed rules (in the same format as a successful 200 request).",
"value": {
"value": {
"attributes": {
"errors": [
{
"message": "Index patterns can't be added. Machine learning rule doesn't have index patterns property",
"rules": [
{
"id": "8bc7dad0-9320-11ec-9265-8b772383a08d",
"name": "DNS Tunneling [Duplicate]"
}
],
"status_code": 500
}
],
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [ ],
"updated": [
{
"actions": [ ],
"author": [
"Elastic"
],
"created_at": "2022-02-21T14:14:17.883Z",
"created_by": "elastic",
"description": "Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.",
"enabled": true,
"exceptions_list": [ ],
"execution_summary": {
"last_execution": {
"date": "2022-03-23T16:06:12.787Z",
"message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
"metrics": {
"execution_gap_duration_s": 0,
"total_indexing_duration_ms": 15,
"total_search_duration_ms": 135
},
"status": "partial failure",
"status_order": 20
}
},
"false_positives": [ ],
"from": "now-6m",
"id": "8e5c1a40-9320-11ec-9265-8b772383a08d",
"immutable": false,
"index": [
"apm-*-transaction*",
"traces-apm*",
"auditbeat-*",
"filebeat-*",
"logs-*",
"packetbeat-*",
"winlogbeat-*",
"added-by-id-*"
],
"interval": "5m",
"language": "kuery",
"license": "Elastic License v2",
"max_signals": 10000,
"name": "External Alerts [Duplicate]",
"query": "event.kind:alert and not event.module:(endgame or endpoint)\n",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"risk_score": 47,
"risk_score_mapping": [
{
"field": "event.risk_score",
"operator": "equals",
"value": ""
}
],
"rule_id": "941faf98-0cdc-4569-b16d-4af962914d61",
"rule_name_override": "message",
"setup": "",
"severity": "medium",
"severity_mapping": [
{
"field": "event.severity",
"operator": "equals",
"severity": "low",
"value": "21"
},
{
"field": "event.severity",
"operator": "equals",
"severity": "medium",
"value": "47"
},
{
"field": "event.severity",
"operator": "equals",
"severity": "high",
"value": "73"
},
{
"field": "event.severity",
"operator": "equals",
"severity": "critical",
"value": "99"
}
],
"tags": [
"Elastic",
"Network",
"Windows",
"APM",
"macOS",
"Linux"
],
"threat": [ ],
"timestamp_override": "event.ingested",
"to": "now",
"type": "query",
"updated_at": "2022-02-21T16:56:22.818Z",
"updated_by": "elastic",
"version": 5
}
]
},
"summary": {
"failed": 1,
"skipped": 0,
"succeeded": 1,
"total": 2
}
},
"message": "Bulk edit partially failed",
"rules_count": 2,
"status_code": 500,
"success": false
}
}
},
"example03": {
"summary": "Dry run",
"description": "The attributes.errors section of the response shows that two rules failed to update and one succeeded. The same results would be returned if you ran the request without dry run mode enabled. Notice that there are no arrays in attributes.results. In dry run mode, rule updates are not applied and saved to Elasticsearch, so the endpoint wouldn’t return results for rules that have been updated, created, or deleted.",
"value": {
"attributes": {
"errors": [
{
"err_code": "IMMUTABLE",
"message": "Elastic rule can't be edited",
"rules": [
{
"id": "81aa0480-06af-11ed-94fb-dd1a0597d8d2",
"name": "Unusual AWS Command for a User"
}
],
"status_code": 500
},
{
"err_code": "MACHINE_LEARNING_INDEX_PATTERN",
"message": "Machine learning rule doesn't have index patterns",
"rules": [
{
"id": "dc015d10-0831-11ed-ac8b-05a222bd8d4a",
"name": "Suspicious Powershell Script [Duplicate]"
}
],
"status_code": 500
}
],
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [ ],
"updated": [ ]
},
"summary": {
"failed": 2,
"skipped": 0,
"succeeded": 1,
"total": 3
}
},
"message": "Bulk edit partially failed",
"status_code": 500
}
},
"example04": {
"summary": "Set tags successsully for 2 rules",
"description": "This example presents the successful setting of tags for 2 rules. There was a difference between the set of tags that were being added and the tags that were already set in the rules, that's why the rules were updated.",
"value": {
"attributes": {
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [ ],
"updated": [
{
"actions": [ ],
"author": [ ],
"created_at": "2025-03-25T11:46:41.899Z",
"created_by": "elastic",
"description": "test",
"enabled": false,
"exceptions_list": [ ],
"false_positives": [ ],
"filters": [ ],
"from": "now-6m",
"id": "738112cd-6cfa-414a-8457-2a658845d6ba",
"immutable": false,
"index": [
"apm-*-transaction*",
"auditbeat-*",
"endgame-*",
"filebeat-*",
"logs-*",
"packetbeat-*",
"traces-apm*",
"winlogbeat-*",
"-*elastic-cloud-logs-*"
],
"interval": "5m",
"language": "kuery",
"license": "",
"max_signals": 100,
"meta": {
"kibana_siem_app_url": "http://localhost:5601/kbn/app/security"
},
"name": "Rule 1",
"output_index": "",
"query": "*",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"revision": 1,
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "6fb746a0-dfe5-40fa-b03f-5cbb84f3e32e",
"rule_source": {
"type": "internal"
},
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [
"tag-1",
"tag-2"
],
"threat": [ ],
"to": "now",
"type": "query",
"updated_at": "2025-03-25T11:47:11.350Z",
"updated_by": "elastic",
"version": 2
},
{
"actions": [
{
"action_type_id": ".webhook",
"frequency": {
"notifyWhen": "onActiveAlert",
"summary": true,
"throttle": "null"
},
"group": "default",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"body": "Hello"
},
"uuid": "580e2e16-5e91-411c-999b-7b75a11ed441"
}
],
"author": [ ],
"created_at": "2025-03-25T09:49:08.343Z",
"created_by": "elastic",
"description": "test",
"enabled": false,
"exceptions_list": [ ],
"false_positives": [ ],
"filters": [ ],
"from": "now-360s",
"id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b",
"immutable": false,
"index": [
"apm-*-transaction*",
"auditbeat-*",
"endgame-*",
"filebeat-*",
"logs-*",
"packetbeat-*",
"traces-apm*",
"winlogbeat-*",
"-*elastic-cloud-logs-*"
],
"interval": "3m",
"investigation_fields": {
"field_names": [
"alert.status",
"Endpoint.policy.applied.artifacts.global.channel"
]
},
"language": "kuery",
"license": "",
"max_signals": 100,
"meta": {
"from": "3m",
"kibana_siem_app_url": "http://localhost:5601/kbn/app/security"
},
"name": "Rule 2",
"output_index": "",
"query": "*",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"revision": 33,
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "43250a55-53a3-4ddd-96cb-82a1bd720180",
"rule_source": {
"type": "internal"
},
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [
"tag-1",
"tag-2"
],
"threat": [ ],
"timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd",
"timeline_title": "Alerts Involving a Single User Timeline",
"to": "now",
"type": "query",
"updated_at": "2025-03-25T11:47:11.357Z",
"updated_by": "elastic",
"version": 24
}
]
},
"summary": {
"failed": 0,
"skipped": 0,
"succeeded": 2,
"total": 2
}
},
"rules_count": 2,
"success": true
}
},
"example05": {
"summary": "Idempotent behavior of set_tags",
"description": "This example presents the idempotent behavior of the edit action with set_tags request. Both rules already had exactly the same tags that were being added, so no changes were made in any of them.",
"value": {
"attributes": {
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [
{
"id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b",
"name": "Rule 1",
"skip_reason": "RULE_NOT_MODIFIED"
},
{
"id": "738112cd-6cfa-414a-8457-2a658845d6ba",
"name": "Rule 2",
"skip_reason": "RULE_NOT_MODIFIED"
}
],
"updated": [ ]
},
"summary": {
"failed": 0,
"skipped": 2,
"succeeded": 0,
"total": 2
}
},
"rules_count": 2,
"success": true
}
},
"example06": {
"summary": "Idempotent behavior of add_tags",
"description": "This example presents the idempotent behavior of the edit action with add_tags request. One rule was updated and one was skipped. The rule that was skipped already had all the tags that were being added.",
"value": {
"attributes": {
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [
{
"id": "738112cd-6cfa-414a-8457-2a658845d6ba",
"name": "Test Rule 2",
"skip_reason": "RULE_NOT_MODIFIED"
}
],
"updated": [
{
"actions": [
{
"action_type_id": ".webhook",
"frequency": {
"notifyWhen": "onActiveAlert",
"summary": true,
"throttle": "null"
},
"group": "default",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"body": "Hello"
},
"uuid": "580e2e16-5e91-411c-999b-7b75a11ed441"
}
],
"author": [ ],
"created_at": "2025-03-25T09:49:08.343Z",
"created_by": "elastic",
"description": "test",
"enabled": false,
"exceptions_list": [ ],
"false_positives": [ ],
"filters": [ ],
"from": "now-360s",
"id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b",
"immutable": false,
"index": [
"apm-*-transaction*",
"auditbeat-*",
"endgame-*",
"filebeat-*",
"logs-*",
"packetbeat-*",
"traces-apm*",
"winlogbeat-*",
"-*elastic-cloud-logs-*"
],
"interval": "3m",
"investigation_fields": {
"field_names": [
"alert.status",
"Endpoint.policy.applied.artifacts.global.channel"
]
},
"language": "kuery",
"license": "",
"max_signals": 100,
"meta": {
"from": "3m",
"kibana_siem_app_url": "http://localhost:5601/kbn/app/security"
},
"name": "Test rule",
"output_index": "",
"query": "*",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"revision": 34,
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "43250a55-53a3-4ddd-96cb-82a1bd720180",
"rule_source": {
"type": "internal"
},
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [
"tag-1",
"tag-2",
"tag-4"
],
"threat": [ ],
"timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd",
"timeline_title": "Alerts Involving a Single User Timeline",
"to": "now",
"type": "query",
"updated_at": "2025-03-25T11:55:12.752Z",
"updated_by": "elastic",
"version": 25
}
]
},
"summary": {
"failed": 0,
"skipped": 1,
"succeeded": 1,
"total": 2
}
},
"rules_count": 2,
"success": true
}
},
"example07": {
"summary": "Non-idempotent behavior for set_rule_actions",
"description": "This example shows a non-idempotent nature of the set_rule_actions requests. Regardless if the actions are the same as the existing actions for a rule, the actions are always set in the rule and receive a new unique ID.",
"value": {
"attributes": {
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [ ],
"updated": [
{
"actions": [
{
"action_type_id": ".webhook",
"frequency": {
"notifyWhen": "onActiveAlert",
"summary": true,
"throttle": "null"
},
"group": "default",
"id": "20fbf986-a270-460e-80f3-7b83c08b430f",
"params": {
"body": "Hello"
},
"uuid": "e48428e5-efac-4856-b8ad-b271c14eaa91"
}
],
"author": [ ],
"created_at": "2025-03-25T09:49:08.343Z",
"created_by": "elastic",
"description": "test",
"enabled": false,
"exceptions_list": [ ],
"false_positives": [ ],
"filters": [ ],
"from": "now-360s",
"id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b",
"immutable": false,
"index": [
"apm-*-transaction*",
"auditbeat-*",
"endgame-*",
"filebeat-*",
"logs-*",
"packetbeat-*",
"traces-apm*",
"winlogbeat-*",
"-*elastic-cloud-logs-*"
],
"interval": "3m",
"investigation_fields": {
"field_names": [
"alert.status",
"Endpoint.policy.applied.artifacts.global.channel"
]
},
"language": "kuery",
"license": "",
"max_signals": 100,
"meta": {
"from": "3m",
"kibana_siem_app_url": "http://localhost:5601/kbn/app/security"
},
"name": "Test rule",
"output_index": "",
"query": "*",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"revision": 39,
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "43250a55-53a3-4ddd-96cb-82a1bd720180",
"rule_source": {
"type": "internal"
},
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [
"tag-1",
"tag-2",
"tag-4"
],
"threat": [ ],
"timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd",
"timeline_title": "Alerts Involving a Single User Timeline",
"to": "now",
"type": "query",
"updated_at": "2025-03-25T12:17:40.528Z",
"updated_by": "elastic",
"version": 30
}
]
},
"summary": {
"failed": 0,
"skipped": 0,
"succeeded": 1,
"total": 1
}
},
"rules_count": 1,
"success": true
}
},
"example08": {
"summary": "Non-idempotent behavior for add_rule_actions",
"description": "This example shows a non-idempotent nature of the add_rule_actions requests. Regardless if the added action is the same as another existing action for a rule, the new action is added to the rule and receives a new unique ID.",
"value": {
"attributes": {
"results": {
"created": [ ],
"deleted": [ ],
"skipped": [ ],
"updated": [
{
"actions": [
{
"action_type_id": ".webhook",
"frequency": {
"notifyWhen": "onActiveAlert",
"summary": true,
"throttle": "null"
},
"group": "default",
"id": "76af173d-38d8-4a9a-b2cc-a3c695b845b4",
"params": {
"body": "Message body"
},
"uuid": "0309347e-3954-429c-9168-5da2663389af"
},
{
"action_type_id": ".webhook",
"frequency": {
"notifyWhen": "onActiveAlert",
"summary": true,
"throttle": "null"
},
"group": "default",
"id": "76af173d-38d8-4a9a-b2cc-a3c695b845b4",
"params": {
"body": "Message body"
},
"uuid": "49ddaa94-d63d-410e-90dc-8c1bad9552bd"
}
],
"author": [ ],
"created_at": "2025-04-02T12:42:03.400Z",
"created_by": "elastic",
"description": "test",
"enabled": false,
"exceptions_list": [ ],
"false_positives": [ ],
"filters": [ ],
"from": "now-6m",
"id": "0d3eb0cd-88c4-4651-ac87-6d9f0cb87217",
"immutable": false,
"index": [
"apm-*-transaction*",
"auditbeat-*",
"endgame-*",
"filebeat-*",
"logs-*",
"packetbeat-*",
"traces-apm*",
"winlogbeat-*",
"-*elastic-cloud-logs-*"
],
"interval": "5m",
"language": "kuery",
"license": "",
"max_signals": 100,
"meta": {
"kibana_siem_app_url": "http://localhost:5601/kbn/app/security"
},
"name": "Jacek test rule",
"output_index": "",
"query": "*",
"references": [ ],
"related_integrations": [ ],
"required_fields": [ ],
"revision": 2,
"risk_score": 21,
"risk_score_mapping": [ ],
"rule_id": "2684c020-1370-4719-ac27-eafe6428fe10",
"rule_source": {
"type": "internal"
},
"setup": "",
"severity": "low",
"severity_mapping": [ ],
"tags": [ ],
"threat": [ ],
"to": "now",
"type": "query",
"updated_at": "2025-04-02T12:51:40.215Z",
"updated_by": "elastic",
"version": 2
}
]
},
"summary": {
"failed": 0,
"skipped": 0,
"succeeded": 1,
"total": 1
}
},
"rules_count": 1,
"success": true
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/_export": {
"post": {
"tags": [
"Security Detections API"
],
"summary": "Export detection rules",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:\n- Actions\n- Exception lists\n> info\n> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.\n\n> You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.\n\n> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.\n",
"operationId": "ExportRules",
"parameters": [
{
"name": "exclude_export_details",
"in": "query",
"description": "Determines whether a summary of the exported rules is returned.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "file_name",
"in": "query",
"description": "File name for saving the exported rules.\n> info\n> When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.\n",
"schema": {
"type": "string",
"default": "export.ndjson"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"objects"
],
"type": [
"null",
"object"
],
"properties": {
"objects": {
"type": "array",
"items": {
"required": [
"rule_id"
],
"type": "object",
"properties": {
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
}
}
},
"description": "Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified."
}
}
},
"examples": {
"exportByRuleIds": {
"summary": "Request body to export a subset of rules",
"value": {
"objects": [
{
"rule_id": "343580b5-c811-447c-8d2d-2ccf052c6900"
},
{
"rule_id": "2938c9fa-53eb-4c04-b79c-33cbf041b18d"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/ndjson": {
"schema": {
"type": "string",
"description": "An `.ndjson` file containing the returned rules.\n\nEach line in the file represents an object (a rule, exception list parent container, or exception list item), and the last line includes a summary of what was exported.\n",
"format": "binary"
},
"examples": {
"sampleNdjson": {
"value": "{\"rule_id\":\"343580b5-c811-447c-8d2d-2ccf052c6900\",\"name\":\"Example rule\",\"type\":\"query\",\"enabled\":true}\n{\"exception_list\":true}\n{\"export_summary\":{\"total_rules\":1,\"exceptions_count\":0}}\n"
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "cURL",
"source": "curl -X POST \"localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson\" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'\n{\n \"objects\": [\n {\n \"rule_id\":\"343580b5-c811-447c-8d2d-2ccf052c6900\"\n },\n {\n \"rule_id\":\"2938c9fa-53eb-4c04-b79c-33cbf041b18d\"\n }\n ]\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/_find": {
"get": {
"tags": [
"Security Detections API"
],
"summary": "List all detection rules",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/detection_engine/rules/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.",
"operationId": "FindRules",
"parameters": [
{
"name": "fields",
"in": "query",
"description": "List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).\nIf omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or\nuse comma-separated values when supported by your client.\n",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "filter",
"in": "query",
"description": "Search query\n\nFilters the returned results according to the value of the specified field, using the alert.attributes.: syntax, where can be:\n- name\n- enabled\n- tags\n- createdBy\n- interval\n- updatedBy\n> info\n> Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.\n",
"schema": {
"type": "string"
}
},
{
"name": "sort_field",
"in": "query",
"description": "Field to sort by",
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_FindRulesSortField"
}
},
{
"name": "sort_order",
"in": "query",
"description": "Sort order",
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SortOrder"
}
},
{
"name": "page",
"in": "query",
"description": "Page number",
"schema": {
"minimum": 1,
"type": "integer",
"default": 1
}
},
{
"name": "per_page",
"in": "query",
"description": "Rules per page",
"schema": {
"minimum": 0,
"type": "integer",
"default": 20
}
},
{
"name": "gaps_range_start",
"in": "query",
"description": "Gaps range start",
"schema": {
"type": "string"
}
},
{
"name": "gaps_range_end",
"in": "query",
"description": "Gaps range end",
"schema": {
"type": "string"
}
},
{
"name": "gap_fill_statuses",
"in": "query",
"description": "Gap fill statuses",
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
}
}
},
{
"name": "gap_auto_fill_scheduler_id",
"in": "query",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response\n> info\n> These fields are under development and their usage or schema may change: execution_summary.\n",
"content": {
"application/json": {
"schema": {
"required": [
"page",
"perPage",
"total",
"data"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
}
},
"page": {
"type": "integer"
},
"perPage": {
"type": "integer"
},
"total": {
"type": "integer"
},
"warnings": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_WarningSchema"
}
}
}
},
"examples": {
"example1": {
"value": {
"data": [
{
"created_at": "2020-02-02T10:05:19.613Z",
"created_by": "elastic",
"description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.",
"enabled": false,
"execution_summary": {
"last_execution": {
"date": "2022-03-23T16:06:12.787Z",
"message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
"metrics": {
"execution_gap_duration_s": 0,
"total_indexing_duration_ms": 15,
"total_search_duration_ms": 135
},
"status": "partial failure",
"status_order": 20
}
},
"false_positives": [ ],
"from": "now-6m",
"id": "89761517-fdb0-4223-b67b-7621acc48f9e",
"immutable": true,
"index": [
"winlogbeat-*"
],
"interval": "5m",
"language": "kuery",
"max_signals": 33,
"name": "Windows Script Executing PowerShell",
"query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"",
"references": [ ],
"related_integrations": [
{
"package": "o365",
"version": "^2.3.2"
}
],
"required_fields": [
{
"ecs": true,
"name": "event.action",
"type": "keyword"
},
{
"ecs": true,
"name": "process.name",
"type": "keyword"
},
{
"ecs": true,
"name": "process.parent.name",
"type": "keyword"
}
],
"risk_score": 21,
"rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc",
"setup": "",
"severity": "low",
"tags": [
"Elastic",
"Windows"
],
"threat": [
{
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0002",
"name": "Execution",
"reference": "https://attack.mitre.org/tactics/TA0002/"
},
"technique": [
{
"id": "T1193",
"name": "Spearphishing Attachment",
"reference": "https://attack.mitre.org/techniques/T1193/"
}
]
}
],
"to": "now",
"type": "query",
"updated_at": "2020-02-02T10:05:19.830Z",
"updated_by": "elastic"
}
],
"page": 1,
"perPage": 5,
"total": 4
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "cURL",
"source": "curl -X GET \"localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows\" -H 'kbn-xsrf: true'\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/_import": {
"post": {
"tags": [
"Security Detections API"
],
"summary": "Import detection rules",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport detection rules from an `.ndjson` file, including actions and exception lists. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- A link to the `.ndjson` file containing the rules.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n> info\n> To import rules with actions, you need at least Read privileges for the Action and Connectors feature. To overwrite or add new connectors, you need All privileges for the Actions and Connectors feature. To import rules without actions, you don’t need Actions and Connectors privileges. Refer to [Enable and access detections](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges) for more information.\n\n> info\n> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.\n\n> You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.\n\n> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.\n",
"operationId": "ImportRules",
"parameters": [
{
"name": "overwrite",
"in": "query",
"description": "Determines whether existing rules with the same `rule_id` are overwritten.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "overwrite_exceptions",
"in": "query",
"description": "Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "overwrite_action_connectors",
"in": "query",
"description": "Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "as_new_list",
"in": "query",
"description": "Generates a new list ID for each imported exception list.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"file": {
"type": "string",
"description": "The `.ndjson` file containing the rules.",
"format": "binary"
}
}
},
"examples": {
"rulesFile": {
"summary": "Multipart part containing a rule export",
"value": {
"file": "rules_import.ndjson"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"exceptions_success",
"exceptions_success_count",
"exceptions_errors",
"rules_count",
"success",
"success_count",
"errors",
"action_connectors_errors",
"action_connectors_warnings",
"action_connectors_success",
"action_connectors_success_count"
],
"type": "object",
"properties": {
"action_connectors_errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ErrorSchema"
}
},
"action_connectors_success": {
"type": "boolean"
},
"action_connectors_success_count": {
"minimum": 0,
"type": "integer"
},
"action_connectors_warnings": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_WarningSchema"
}
},
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ErrorSchema"
}
},
"exceptions_errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ErrorSchema"
}
},
"exceptions_success": {
"type": "boolean"
},
"exceptions_success_count": {
"minimum": 0,
"type": "integer"
},
"rules_count": {
"minimum": 0,
"type": "integer"
},
"success": {
"type": "boolean"
},
"success_count": {
"minimum": 0,
"type": "integer"
}
},
"additionalProperties": false
},
"examples": {
"example1": {
"summary": "Import rules with success",
"value": {
"errors": [ ],
"exceptions_errors": [ ],
"exceptions_success": true,
"exceptions_success_count": 0,
"rules_count": 1,
"success": true,
"success_count": 1
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "cURL",
"source": "curl -X POST \"/api/detection_engine/rules/_import\"\n-u : -H 'kbn-xsrf: true'\n-H 'Content-Type: multipart/form-data'\n--form \"file=@\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/{id}/exceptions": {
"post": {
"tags": [
"Security Exceptions API"
],
"summary": "Create rule exception items",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall and update all Elastic prebuilt detection rules and Timelines.\n\nThis endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. \nWhen you call this endpoint, it will:\n- Install any new prebuilt detection rules that are not currently installed in your system.\n- Update any existing prebuilt detection rules that have been modified or improved by Elastic.\n- Install any new prebuilt Timelines that are not currently installed in your system.\n- Update any existing prebuilt Timelines that have been modified or improved by Elastic.\n\nThis ensures that your detection engine is always up-to-date with the latest rules and Timelines, \nproviding you with the most current and effective threat detection capabilities.\n",
"operationId": "InstallPrebuiltRulesAndTimelines",
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"required": [
"rules_installed",
"rules_updated",
"timelines_installed",
"timelines_updated"
],
"type": "object",
"properties": {
"rules_installed": {
"minimum": 0,
"type": "integer",
"description": "The number of rules installed"
},
"rules_updated": {
"minimum": 0,
"type": "integer",
"description": "The number of rules updated"
},
"timelines_installed": {
"minimum": 0,
"type": "integer",
"description": "The number of timelines installed"
},
"timelines_updated": {
"minimum": 0,
"type": "integer",
"description": "The number of timelines updated"
}
},
"additionalProperties": false
},
"examples": {
"example1": {
"value": {
"rules_installed": 112,
"rules_updated": 0,
"timelines_installed": 5,
"timelines_updated": 2
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/prepackaged/_status": {
"get": {
"tags": [
"Security Detections API"
],
"summary": "Retrieve the status of prebuilt detection rules and Timelines",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve the status of all Elastic prebuilt detection rules and Timelines. \n\nThis endpoint provides detailed information about the number of custom rules, installed prebuilt rules, available prebuilt rules that are not installed, outdated prebuilt rules, installed prebuilt timelines, available prebuilt timelines that are not installed, and outdated prebuilt timelines.\n",
"operationId": "ReadPrebuiltRulesAndTimelinesStatus",
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"required": [
"rules_custom_installed",
"rules_installed",
"rules_not_installed",
"rules_not_updated",
"timelines_installed",
"timelines_not_installed",
"timelines_not_updated"
],
"type": "object",
"properties": {
"rules_custom_installed": {
"minimum": 0,
"type": "integer",
"description": "The total number of custom rules"
},
"rules_installed": {
"minimum": 0,
"type": "integer",
"description": "The total number of installed prebuilt rules"
},
"rules_not_installed": {
"minimum": 0,
"type": "integer",
"description": "The total number of available prebuilt rules that are not installed"
},
"rules_not_updated": {
"minimum": 0,
"type": "integer",
"description": "The total number of outdated prebuilt rules"
},
"timelines_installed": {
"minimum": 0,
"type": "integer",
"description": "The total number of installed prebuilt timelines"
},
"timelines_not_installed": {
"minimum": 0,
"type": "integer",
"description": "The total number of available prebuilt timelines that are not installed"
},
"timelines_not_updated": {
"minimum": 0,
"type": "integer",
"description": "The total number of outdated prebuilt timelines"
}
},
"additionalProperties": false
},
"examples": {
"example1": {
"value": {
"rules_custom_installed": 0,
"rules_installed": 0,
"rules_not_installed": 112,
"rules_not_updated": 0,
"timelines_installed": 0,
"timelines_not_installed": 0,
"timelines_not_updated": 0
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/rules/preview": {
"post": {
"tags": [
"Security Detections API"
],
"summary": "Preview rule alerts generated on specified time range",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request.\n> info\n> You cannot add and remove the same alert tag in the same request.\n",
"operationId": "SetAlertTags",
"requestBody": {
"description": "An object containing tags to add or remove and alert ids the changes will be applied",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SetAlertTagsBody"
},
"examples": {
"add": {
"$ref": "#/components/examples/Security_Detections_API_SetAlertTagsBodyAdd"
},
"remove": {
"$ref": "#/components/examples/Security_Detections_API_SetAlertTagsBodyRemove"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object",
"description": "Elasticsearch update by query response"
},
"examples": {
"success": {
"value": {
"batches": "1,",
"deleted": "0,",
"failures": [ ],
"noops": "0,",
"requests_per_second": "-1,",
"retries": {
"bulk": "0,",
"search": 0
},
"throttled_millis": "0,",
"throttled_until_millis": "0,",
"timed_out": "false,",
"took": "68,",
"total": "1,",
"updated": "1,",
"version_conflicts": "0,"
}
}
}
}
}
},
"400": {
"description": "Invalid input data response",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"error": "Bad Request",
"message": "[request body].tags: cannot add and remove the same tag in a single request",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/detection_engine/tags": {
"get": {
"tags": [
"Security Detections API"
],
"summary": "List all detection rule tags",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/detection_engine/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all unique tags from all detection rules.",
"operationId": "ReadTags",
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"examples": {
"example1": {
"value": [
"zeek",
"suricata",
"windows",
"linux",
"network",
"initial access",
"remote access",
"phishing"
]
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/encrypted_saved_objects/_rotate_key": {
"post": {
"tags": [
"saved objects"
],
"summary": "Rotate a key for encrypted saved objects",
"description": "Superuser role required.\n\nIf a saved object cannot be decrypted using the primary encryption key, then Kibana will attempt to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.\n\nThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n",
"operationId": "rotateEncryptionKey",
"parameters": [
{
"name": "batch_size",
"in": "query",
"description": "Specifies a maximum number of saved objects that Kibana can process in a single batch. Bulk key rotation is an iterative process since Kibana may not be able to fetch and process all required saved objects in one go and splits processing into consequent batches. By default, the batch size is 10000, which is also a maximum allowed value.\n",
"schema": {
"type": "number",
"default": 10000
}
},
{
"name": "type",
"in": "query",
"description": "Limits encryption key rotation only to the saved objects with the specified type. By default, Kibana tries to rotate the encryption key for all saved object types that may contain encrypted attributes.\n",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"failed": {
"type": "number",
"description": "Indicates the number of the saved objects that were still encrypted with one of the old encryption keys that Kibana failed to re-encrypt with the primary key.\n"
},
"successful": {
"type": "number",
"description": "Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.\n\nNOTE: In most cases, `total` will be greater than `successful` even if `failed` is zero. The reason is that Kibana may not need or may not be able to rotate encryption keys for all encrypted saved objects.\n"
},
"total": {
"type": "number",
"description": "Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.\n"
}
}
},
"examples": {
"rotateEncryptionKeyResponse": {
"$ref": "#/components/examples/Saved_objects_key_rotation_response"
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Saved_objects_400_response"
}
}
}
},
"429": {
"description": "Already in progress.",
"content": {
"application/json": {
"schema": {
"type": "object"
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/endpoint_list": {
"post": {
"tags": [
"Security Endpoint Exceptions API"
],
"summary": "Create an Elastic Endpoint rule exception list",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/endpoint_list
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the exception list for Elastic Endpoint rule exceptions. When you create the exception list, it will have a `list_id` of `endpoint_list`. If the Elastic Endpoint exception list already exists, your request will return an empty response.",
"operationId": "CreateEndpointList",
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_EndpointList"
},
"examples": {
"alreadyExists": {
"summary": "Endpoint exception list already exists (empty response)",
"value": { }
},
"newList": {
"summary": "Endpoint exception list created",
"value": {
"created_at": "2025-01-01T00:00:00.000Z",
"created_by": "elastic",
"description": "Endpoint Security Exception List",
"id": "2e23a8c4-ef7e-4c10-adfa-3eae4e4b4b8b",
"immutable": false,
"list_id": "endpoint_list",
"name": "Endpoint Security Exception List",
"namespace_type": "agnostic",
"os_types": [ ],
"tags": [ ],
"tie_breaker_id": "e3c5a8e0-5b6a-4b4b-8b3a-2e23a8c4ef7e",
"type": "endpoint",
"updated_at": "2025-01-01T00:00:00.000Z",
"updated_by": "elastic",
"version": 1
}
}
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"error": "Bad Request",
"message": "[request body]: expected value of type [object] but got [undefined]",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Insufficient privileges",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"error": "Forbidden",
"message": "API [POST /api/endpoint_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
}
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/endpoint_list/items": {
"delete": {
"tags": [
"Security Endpoint Exceptions API"
],
"summary": "Delete an Elastic Endpoint exception list item",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/endpoint_list/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.",
"operationId": "DeleteEndpointListItem",
"parameters": [
{
"name": "id",
"in": "query",
"description": "Either `id` or `item_id` must be specified",
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId"
}
},
{
"name": "item_id",
"in": "query",
"description": "Either `id` or `item_id` must be specified",
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem"
},
"examples": {
"deleted": {
"summary": "Deleted endpoint exception list item",
"value": {
"comments": [ ],
"created_at": "2025-01-01T12:00:00.000Z",
"created_by": "elastic",
"description": "Blocks a known malicious file by its hash",
"entries": [
{
"field": "file.hash.sha256",
"operator": "included",
"type": "match",
"value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}
],
"id": "d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e",
"item_id": "block-malicious-file",
"list_id": "endpoint_list",
"name": "Block malicious file",
"namespace_type": "agnostic",
"os_types": [
"windows"
],
"tags": [ ],
"tie_breaker_id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890",
"type": "simple",
"updated_at": "2025-01-01T12:00:00.000Z",
"updated_by": "elastic"
}
}
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"error": "Bad Request",
"message": "Either \"item_id\" or \"id\" needs to be defined in the request",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Insufficient privileges",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"error": "Forbidden",
"message": "API [DELETE /api/endpoint_list/items?item_id=block-malicious-file] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Endpoint list item not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "exception list item item_id: \"block-malicious-file\" does not exist",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Endpoint Exceptions API"
],
"summary": "Get an Elastic Endpoint rule exception list item",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/endpoint_list/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.",
"operationId": "ReadEndpointListItem",
"parameters": [
{
"name": "id",
"in": "query",
"description": "Either `id` or `item_id` must be specified",
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId"
}
},
{
"name": "item_id",
"in": "query",
"description": "Either `id` or `item_id` must be specified",
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem"
},
"examples": {
"item": {
"summary": "Endpoint exception list item",
"value": {
"comments": [ ],
"created_at": "2025-01-01T12:00:00.000Z",
"created_by": "elastic",
"description": "Blocks a known malicious file by its hash",
"entries": [
{
"field": "file.hash.sha256",
"operator": "included",
"type": "match",
"value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}
],
"id": "d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e",
"item_id": "block-malicious-file",
"list_id": "endpoint_list",
"name": "Block malicious file",
"namespace_type": "agnostic",
"os_types": [
"windows"
],
"tags": [
"policy:all"
],
"tie_breaker_id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890",
"type": "simple",
"updated_at": "2025-01-01T12:00:00.000Z",
"updated_by": "elastic"
}
}
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"error": "Bad Request",
"message": "id or item_id required",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Insufficient privileges",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"error": "Forbidden",
"message": "API [GET /api/endpoint_list/items?item_id=block-malicious-file] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Endpoint list item not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "exception list item item_id: \"block-malicious-file\" does not exist",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Endpoint Exceptions API"
],
"summary": "Create an Elastic Endpoint rule exception list item",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet information for the specified response action file download.\n",
"operationId": "EndpointFileInfo",
"parameters": [
{
"name": "action_id",
"in": "path",
"description": "The ID of the response action that generated the file.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"name": "file_id",
"in": "path",
"description": "The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"properties": {
"data": {
"type": "object",
"properties": {
"actionId": {
"type": "string",
"description": "The response action ID."
},
"agentId": {
"type": "string",
"description": "The agent ID that generated the file."
},
"agentType": {
"type": "string",
"description": "The type of agent that generated the file."
},
"created": {
"type": "string",
"description": "The date and time the file was created.",
"format": "date-time"
},
"id": {
"type": "string",
"description": "The unique file identifier."
},
"mimeType": {
"type": "string",
"description": "The MIME type of the file."
},
"name": {
"type": "string",
"description": "The file name."
},
"size": {
"type": "number",
"description": "The file size in bytes."
},
"status": {
"enum": [
"AWAITING_UPLOAD",
"UPLOADING",
"READY",
"UPLOAD_ERROR",
"DELETED"
],
"type": "string",
"description": "The file upload status."
}
}
}
}
},
"examples": {
"fileInfo": {
"summary": "File information for a response action upload",
"value": {
"data": {
"actionId": "233db9ea-6733-4849-9226-5a7039c7161d",
"agentId": "ed518850-681a-4d60-bb98-e22640cae2a8",
"agentType": "endpoint",
"created": "2025-02-26T13:37:30.452Z",
"id": "233db9ea-6733-4849-9226-5a7039c7161d.ed518850-681a-4d60-bb98-e22640cae2a8",
"mimeType": "application/zip",
"name": "memory_dump.zip",
"size": 1048576,
"status": "READY"
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/endpoint/action/{action_id}/file/{file_id}/download": {
"get": {
"tags": [
"Security Endpoint Management API"
],
"summary": "Download a file",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDownload a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.\n> info\n> Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system's password.\n",
"operationId": "EndpointFileDownload",
"parameters": [
{
"name": "action_id",
"in": "path",
"description": "The ID of the response action that generated the file.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"name": "file_id",
"in": "path",
"description": "The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/octet-stream": {
"schema": {
"type": "string",
"format": "binary"
},
"examples": {
"fileDownload": {
"summary": "Password-protected ZIP archive containing the response action file",
"value": "binary file content (password-protected .zip)"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/endpoint/action/cancel": {
"post": {
"tags": [
"Security Endpoint Management API"
],
"summary": "Cancel a response action",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/endpoint/action/cancel
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCancel a running or pending response action (Applies only to some agent types).",
"operationId": "CancelAction",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody"
},
"examples": {
"ElasticDefend": {
"summary": "Cancel a response action on an Elastic Defend host",
"value": {
"agent_type": "endpoint",
"comment": "Cancelling action due to change in requirements",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"force": true,
"id": "7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d"
}
}
},
"MicrosoftDefenderEndpoint": {
"summary": "Cancel a response action on a Microsoft Defender for Endpoint host",
"value": {
"agent_type": "microsoft_defender_endpoint",
"comment": "Cancelling action due to change in requirements",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"id": "7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse"
},
"examples": {
"CancelSuccess": {
"summary": "Cancel action successfully created",
"value": {
"data": {
"agents": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"agentState": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"isCompleted": false,
"wasSuccessful": false
}
},
"agentType": "microsoft_defender_endpoint",
"command": "cancel",
"createdBy": "elastic",
"hosts": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"name": "gke-node-1235412"
}
},
"id": "233db9ea-6733-4849-9226-5a7039c7161d",
"isCompleted": false,
"isExpired": false,
"outputs": { },
"parameters": {
"id": "7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d"
},
"startedAt": "2022-07-29T19:08:49.126Z",
"status": "pending",
"wasSuccessful": false
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/endpoint/action/execute": {
"post": {
"tags": [
"Security Endpoint Management API"
],
"summary": "Run a command",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the auto-upgrade status for agents assigned to an agent policy.
[Required authorization] Route required privileges: fleet-agents-read.",
"operationId": "get-fleet-agent-policies-agentpolicyid-auto-upgrade-agents-status",
"parameters": [
{
"name": "agentPolicyId",
"in": "path",
"description": "The ID of the agent policy",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"currentVersions",
"totalAgents"
],
"type": "object",
"properties": {
"currentVersions": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"version",
"agents",
"failedUpgradeAgents",
"inProgressUpgradeAgents"
],
"type": "object",
"properties": {
"agents": {
"type": "number",
"description": "Number of agents that upgraded to this version"
},
"failedUpgradeActionIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "List of action IDs related to failed upgrades"
},
"failedUpgradeAgents": {
"type": "number",
"description": "Number of agents that failed to upgrade to this version"
},
"inProgressUpgradeActionIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "List of action IDs related to in-progress upgrades"
},
"inProgressUpgradeAgents": {
"type": "number",
"description": "Number of agents that are upgrading to this version"
},
"version": {
"type": "string",
"description": "Agent version"
}
},
"additionalProperties": false
}
},
"totalAgents": {
"type": "number"
}
},
"additionalProperties": false
},
"examples": {
"getAutoUpgradeAgentsStatusExample": {
"description": "Auto-upgrade status for agents in the policy",
"value": {
"agentsCount": 5,
"currentVersion": "8.16.0",
"failedAgentsCount": 0,
"upgradedAgentsCount": 3,
"upgradingAgentsCount": 1
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/agent_policies/{agentPolicyId}/copy": {
"post": {
"tags": [
"Elastic Agent policies"
],
"summary": "Copy an agent policy",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of outputs associated with agent policy by policy id.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of outputs associated with agent policies.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the data streams that an agent is actively sending data to.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated. Use `POST /api/fleet/managed_integrations/_upgrade` instead. Upgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy's saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.",
"operationId": "post-fleet-agentless-policies-upgrade",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request"
},
"examples": {
"upgradeManagedIntegrationsRequestExample": {
"description": "Bulk upgrade managed integrations to their installed package version",
"value": {
"policyIds": [
"d52a7812-5736-4fdc-aed8-72152afa1ffa",
"aws-policy-12345"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item's `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch.",
"content": {
"application/json": {
"schema": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result"
}
},
"examples": {
"upgradeManagedIntegrationsPartialFailureResponseExample": {
"description": "Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)",
"value": [
{
"id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
"name": "ess_billing-1",
"success": true
},
{
"body": {
"message": "Agentless policy aws-policy-12345 not found"
},
"id": "aws-policy-12345",
"statusCode": 404,
"success": false
}
]
},
"upgradeManagedIntegrationsResponseExample": {
"description": "Example response where every policy was upgraded",
"value": [
{
"id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
"name": "ess_billing-1",
"success": true
},
{
"id": "aws-policy-12345",
"name": "cspm-aws-policy",
"success": true
}
]
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/agentless_policies/_upgrade/dryrun": {
"post": {
"tags": [
"Fleet agentless policies"
],
"summary": "Deprecated: Preview a managed integrations upgrade",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated. Use `PUT /api/fleet/managed_integrations/{policyId}` instead. Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is cleared or reset to its default. The integration package name is immutable and the runtime-managed `cluster_id` is preserved from the existing policy.",
"operationId": "put-fleet-agentless-policies-policyid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "policyId",
"in": "path",
"description": "The ID of the managed integration to update.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request"
},
"examples": {
"updateManagedIntegrationAttachAWSCloudConnectorRequestExample": {
"description": "Example request to attach an AWS cloud connector to a managed integration on update. Because `PUT` is full-replace, the `cloud_connector` block must be present on every subsequent update or the connector is detached.",
"value": {
"cloud_connector": {
"enabled": true,
"target_csp": "aws"
},
"description": "CSPM integration for AWS with cloud connector",
"inputs": {
"cspm-cloudbeat/cis_aws": {
"enabled": true,
"streams": {
"cloud_security_posture.findings": {
"enabled": true,
"vars": {
"aws.account_type": "organization-account",
"aws.credentials.type": "cloud_connector",
"aws.supports_cloud_connectors": true,
"external_id": {
"id": "ABCDEFGHIJKLMNOPQRST",
"isSecretRef": true
},
"role_arn": "arn:aws:iam::123456789012:role/TestRole"
}
}
},
"vars": {
"cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
}
},
"cspm-cloudbeat/cis_azure": {
"enabled": false
},
"cspm-cloudbeat/cis_gcp": {
"enabled": false
}
},
"name": "cspm-aws-policy",
"namespace": "default",
"package": {
"name": "cloud_security_posture",
"version": "3.1.1"
},
"vars": {
"deployment": "aws",
"posture": "cspm"
}
}
},
"updateManagedIntegrationClearFieldsRequestExample": {
"description": "Example showing full-replace clearing semantics. Compared to the prior state, this request omits `description` (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is dropped from the resulting policy.",
"value": {
"inputs": {
"ESS Billing-cel": {
"enabled": true,
"streams": {
"ess_billing.billing": {
"enabled": true
},
"ess_billing.credits": {
"enabled": true
}
},
"vars": {
"api_key": "",
"organization_id": "1234"
}
}
},
"name": "ess_billing-1",
"namespace": "default",
"package": {
"name": "ess_billing",
"version": "1.6.0"
}
}
},
"updateManagedIntegrationRequestExample": {
"description": "Example request to update a managed integration. `PUT` uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting `description` clears it, omitting `vars` or `global_data_tags` removes them, and omitting `cloud_connector` detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using `PUT`: the integration `package.name` is immutable, and the runtime-managed `cluster_id` is preserved from the existing agent policy.",
"value": {
"description": "updated description",
"inputs": {
"ESS Billing-cel": {
"enabled": true,
"streams": {
"ess_billing.billing": {
"enabled": true,
"vars": {
"hide_sensitive": true,
"http_client_timeout": "30s",
"lookbehind": 180,
"tags": [
"forwarded",
"billing"
]
}
},
"ess_billing.credits": {
"enabled": true
}
},
"vars": {
"api_key": "",
"organization_id": "1234"
}
}
},
"name": "ess_billing-1",
"namespace": "default",
"package": {
"name": "ess_billing",
"version": "1.6.0"
}
}
},
"updateManagedIntegrationReuseAWSCloudConnectorRequestExample": {
"description": "Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one.",
"value": {
"cloud_connector": {
"cloud_connector_id": "existing-aws-connector-id",
"enabled": true,
"target_csp": "aws"
},
"description": "CSPM integration for AWS reusing existing cloud connector",
"inputs": {
"cspm-cloudbeat/cis_aws": {
"enabled": true,
"streams": {
"cloud_security_posture.findings": {
"enabled": true,
"vars": {
"aws.account_type": "organization-account",
"aws.credentials.type": "cloud_connector",
"aws.supports_cloud_connectors": true,
"external_id": {
"id": "ABCDEFGHIJKLMNOPQRST",
"isSecretRef": true
},
"role_arn": "arn:aws:iam::123456789012:role/TestRole"
}
}
},
"vars": {
"cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
}
},
"cspm-cloudbeat/cis_azure": {
"enabled": false
},
"cspm-cloudbeat/cis_gcp": {
"enabled": false
}
},
"name": "cspm-aws-policy",
"namespace": "default",
"package": {
"name": "cloud_security_posture",
"version": "3.1.1"
},
"vars": {
"deployment": "aws",
"posture": "cspm"
}
}
},
"updateManagedIntegrationVersionChangeRequestExample": {
"description": "Example request to update a managed integration to a different package version. The package name is immutable, but the version may change.",
"value": {
"description": "bumped to a newer package version",
"inputs": {
"ESS Billing-cel": {
"enabled": true,
"streams": {
"ess_billing.billing": {
"enabled": true
},
"ess_billing.credits": {
"enabled": false
}
},
"vars": {
"api_key": "",
"organization_id": "1234"
}
}
},
"name": "ess_billing-1",
"namespace": "default",
"package": {
"name": "ess_billing",
"version": "1.7.0"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_managed_integration_response"
},
"examples": {
"updateManagedIntegrationResponseExample": {
"description": "Example response for updating a managed integration",
"value": {
"item": {
"created_at": "2025-11-06T18:27:43.541Z",
"created_by": "test_user",
"description": "updated description",
"id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
"inputs": {
"ESS Billing-cel": {
"enabled": true,
"streams": {
"ess_billing.billing": {
"enabled": true,
"vars": {
"hide_sensitive": true,
"http_client_timeout": "30s",
"lookbehind": 180,
"tags": [
"forwarded",
"billing"
]
}
},
"ess_billing.credits": {
"enabled": true
}
},
"vars": {
"api_key": {
"id": "QY1sWpoBbWcMW-edr0Ee",
"isSecretRef": true
},
"organization_id": "1234",
"url": "https://billing.elastic-cloud.com"
}
}
},
"name": "ess_billing-1",
"namespace": "default",
"package": {
"name": "ess_billing",
"title": "Elasticsearch Service Billing",
"version": "1.6.0"
},
"updated_at": "2025-11-07T09:14:02.118Z",
"updated_by": "test_user"
}
}
},
"updateManagedIntegrationWithAWSCloudConnectorResponseExample": {
"description": "Example response after attaching an AWS cloud connector on update",
"value": {
"item": {
"cloud_connector": {
"cloud_connector_id": "aws-connector-67890",
"enabled": true
},
"created_at": "2025-11-06T18:27:43.541Z",
"created_by": "test_user",
"description": "CSPM integration for AWS with cloud connector",
"id": "aws-policy-12345",
"inputs": {
"cspm-cloudbeat/cis_aws": {
"enabled": true,
"streams": {
"cloud_security_posture.findings": {
"enabled": true,
"vars": {
"aws.account_type": "organization-account",
"aws.credentials.type": "cloud_connector",
"external_id": {
"id": "secret-external-id-123",
"isSecretRef": true
},
"role_arn": "arn:aws:iam::123456789012:role/TestRole"
}
}
},
"vars": {
"cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
}
},
"cspm-cloudbeat/cis_azure": {
"enabled": false
},
"cspm-cloudbeat/cis_gcp": {
"enabled": false
}
},
"name": "cspm-aws-policy",
"namespace": "default",
"package": {
"name": "cloud_security_posture",
"title": "Cloud Security Posture Management",
"version": "3.1.1"
},
"updated_at": "2025-11-07T09:14:02.118Z",
"updated_by": "test_user",
"vars": {
"deployment": "aws",
"posture": "cspm"
}
}
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
},
"packageNameChangeErrorResponseExample": {
"description": "The integration package name cannot be changed on update",
"value": {
"error": "Bad Request",
"message": "Cannot change the integration package of an agentless policy (from \"ess_billing\" to \"cloud_security_posture\").",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"notFoundErrorResponseExample": {
"description": "Example of a not found error response",
"value": {
"message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}
}
}
}
}
},
"409": {
"description": "Conflict — for example, the requested name is already used by another integration policy.",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"conflictErrorResponseExample": {
"description": "Example of a name-conflict error response",
"value": {
"error": "Conflict",
"message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
"statusCode": 409
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/agents": {
"get": {
"tags": [
"Elastic Agents"
],
"summary": "Get agents",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/agents
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList agents, with optional filtering and pagination.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve agents associated with specific action IDs.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nChange the privilege level of a single agent to unprivileged.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRemove a specific OpAMP collector from the Fleet agents list. Marks the collector as unenrolled. This action does not invalidate API keys, so the collector can reconnect on its own.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRequest a diagnostics bundle from a specific agent.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRestart an Elastic Agent. The request fails when the agent is inactive, on a version earlier than 9.6.0, or enrolled in a hosted agent policy.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUnenroll a specific agent, optionally revoking its enrollment API key.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of files uploaded by a specific agent.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the current status of recent agent actions.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of Elastic Agent versions available for upgrade.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nChange multiple agents' privilege level to unprivileged.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReassign multiple agents to a different agent policy.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRemove multiple OpAMP collectors from the Fleet agents list. Marks the collectors as unenrolled. This action does not invalidate API keys, so collectors can reconnect on their own.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRequest diagnostics bundles from multiple agents.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRestart multiple Elastic Agents. Agents that are enrolled in a hosted policy or are on a version earlier than 9.6.0 are excluded from the action and receive individual error results.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRollback multiple agents to the previous version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUnenroll multiple agents, optionally revoking their enrollment API keys.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpgrade multiple agents to a newer version, with optional rollout controls.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the current Fleet setup status, including whether Fleet is ready to enroll agents and which requirements or optional features are missing.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInitialize Fleet. This endpoint is used by Elastic Agents to trigger Fleet setup. Safe to call multiple times; subsequent calls are idempotent.
[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.",
"operationId": "post-fleet-agents-setup",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"responses": {
"200": {
"description": "Fleet setup completed",
"content": {
"application/json": {
"schema": {
"required": [
"isInitialized",
"nonFatalErrors"
],
"type": "object",
"properties": {
"isInitialized": {
"type": "boolean"
},
"nonFatalErrors": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"name",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false,
"description": "A summary of the result of Fleet's `setup` lifecycle. If `isInitialized` is true, Fleet is ready to accept agent enrollment. `nonFatalErrors` may include useful insight into non-blocking issues with Fleet setup."
},
"examples": {
"agentsSetupSuccessExample": {
"description": "Fleet setup initialized successfully with no non-fatal errors",
"value": {
"isInitialized": true,
"nonFatalErrors": [ ]
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/agents/tags": {
"get": {
"tags": [
"Elastic Agents"
],
"summary": "Get agent tags",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/agents/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all tags used across enrolled agents.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a cloud connector by ID. Use the `force` query parameter to delete even if package policies are still using it.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of package policies that are using a given cloud connector.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new Fleet cloud onboarding deployment.
[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.",
"operationId": "post-fleet-cloud-onboarding-deployments",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"provider",
"mechanisms",
"services"
],
"type": "object",
"properties": {
"agentPolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 255,
"type": "string"
},
"description": "Agent policy IDs for agent_based existing-policy deploys. Provided on create so that a mid-deploy tab-close leaves a record that hydrates back into existing mode."
},
"authMethod": {
"enum": [
"identity_federation",
"static_keys",
"temporary_keys",
"shared_credentials",
"assume_role"
],
"type": "string",
"description": "Authentication method. Allowed values depend on the delivery mechanism:\n\n- managed_integration: identity_federation | static_keys\n- agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role"
},
"connectorId": {
"maxLength": 255,
"minLength": 1,
"type": "string",
"description": "ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments."
},
"dataFormat": {
"enum": [
"ecs",
"otel"
],
"type": "string",
"description": "Data format: ecs or otel."
},
"globalRegion": {
"maxLength": 64,
"type": "string",
"description": "Global AWS region from the Service Settings step."
},
"mechanisms": {
"maxItems": 10,
"type": "array",
"items": {
"enum": [
"managed_integration",
"ecf",
"agent_based"
],
"type": "string",
"description": "Delivery mechanism: managed_integration, ecf, or agent_based."
},
"description": "Delivery mechanisms active in this deployment."
},
"provider": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string",
"description": "Cloud provider."
},
"services": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string"
},
"description": "Service IDs to be covered by this deployment."
},
"serviceVars": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": { }
},
"description": "Per-service config keyed by instance ID."
}
},
"additionalProperties": false
},
"examples": {
"postCloudOnboardingDeploymentAgentBasedRequestExample": {
"description": "Create a new AWS cloud onboarding deployment using an Elastic Agent (agent-based)",
"value": {
"authMethod": "assume_role",
"mechanisms": [
"agent_based"
],
"provider": "aws",
"services": [
"cloudwatch_metrics"
],
"serviceVars": {
"cloudwatch_metrics": {
"namespace": "AWS/EC2",
"regions": [
"us-east-1"
]
}
}
}
},
"postCloudOnboardingDeploymentEcfRequestExample": {
"description": "Create a new AWS cloud onboarding deployment using Elastic Cloud Forwarder (ECF)",
"value": {
"connectorId": "cloud-connector-id-1",
"mechanisms": [
"ecf"
],
"provider": "aws",
"services": [
"cloudfront_logs"
],
"serviceVars": {
"cloudfront_logs": {
"regions": [
"us-east-1"
],
"s3_bucket_arn": "arn:aws:s3:::my-cloudfront-bucket"
}
}
}
},
"postCloudOnboardingDeploymentRequestExample": {
"description": "Create a new AWS cloud onboarding deployment using identity federation (managed integration)",
"value": {
"connectorId": "cloud-connector-id-1",
"mechanisms": [
"managed_integration"
],
"provider": "aws",
"services": [
"cloudwatch_metrics",
"cloudtrail"
],
"serviceVars": {
"cloudtrail": {
"regions": [
"us-east-1"
],
"s3_bucket_arn": "arn:aws:s3:::my-cloudtrail-bucket"
},
"cloudwatch_metrics": {
"namespace": "AWS/EC2",
"regions": [
"us-east-1",
"eu-west-1"
]
}
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"required": [
"id",
"provider",
"mechanisms",
"services",
"status",
"attemptCount"
],
"type": "object",
"properties": {
"agentPolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies."
},
"apiKeyId": {
"type": "string",
"description": "Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation."
},
"attemptCount": {
"minimum": 1,
"type": "number",
"description": "Number of deployment attempts, including the current one."
},
"authMethod": {
"enum": [
"identity_federation",
"static_keys",
"temporary_keys",
"shared_credentials",
"assume_role"
],
"type": "string",
"description": "Authentication method. Allowed values depend on the delivery mechanism:\n\n- managed_integration: identity_federation | static_keys\n- agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role"
},
"connectorId": {
"type": "string",
"description": "ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments."
},
"dataFormat": {
"enum": [
"ecs",
"otel"
],
"type": "string",
"description": "Data format: ecs or otel."
},
"deploymentId": {
"type": "string",
"description": "Opaque deployment identifier; for AWS, the CFN stack ARN."
},
"deploymentName": {
"type": "string",
"description": "Opaque deployment name; for AWS, the CFN stack name."
},
"ecfStacks": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"family",
"stackName",
"templateVersion"
],
"type": "object",
"properties": {
"family": {
"enum": [
"unified",
"otel",
"crowdstrike"
],
"type": "string",
"description": "ECF template family."
},
"stackName": {
"maxLength": 128,
"minLength": 1,
"type": "string",
"description": "CloudFormation stack name (128-char AWS limit)."
},
"templateVersion": {
"maxLength": 32,
"minLength": 1,
"type": "string",
"description": "ECF semantic version resolved at launch time, e.g. \"1.10.0\"."
}
},
"additionalProperties": false
},
"description": "ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch."
},
"globalRegion": {
"type": "string",
"description": "Global AWS region from the Service Settings step."
},
"id": {
"type": "string"
},
"mechanisms": {
"maxItems": 10,
"type": "array",
"items": {
"enum": [
"managed_integration",
"ecf",
"agent_based"
],
"type": "string",
"description": "Delivery mechanism: managed_integration, ecf, or agent_based."
}
},
"packagePolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "Package policy IDs created for this deployment (managed_integration and agent_based)."
},
"policyIdsByInstance": {
"type": "object",
"additionalProperties": {
"maxLength": 255,
"type": "string"
},
"description": "instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed."
},
"provider": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string",
"description": "Cloud provider."
},
"services": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "Service IDs covered by this deployment."
},
"serviceVars": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": { }
},
"description": "Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step."
},
"status": {
"enum": [
"pending",
"deploying",
"succeeded",
"failed"
],
"type": "string",
"description": "Deployment status."
},
"statusMessage": {
"type": "string",
"description": "Error context when status is failed."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"examples": {
"postCloudOnboardingDeploymentAgentBasedExample": {
"description": "Agent-based deployment — agentPolicyIds set after the agent policy is selected or created",
"value": {
"item": {
"agentPolicyIds": [
"agent-policy-id-1"
],
"attemptCount": 1,
"authMethod": "assume_role",
"id": "onboarding-deployment-id-2",
"mechanisms": [
"agent_based"
],
"provider": "aws",
"services": [
"cloudwatch_metrics"
],
"serviceVars": {
"cloudwatch_metrics": {
"namespace": "AWS/EC2",
"regions": [
"us-east-1"
]
}
},
"status": "pending"
}
}
},
"postCloudOnboardingDeploymentEcfExample": {
"description": "ECF deployment — apiKeyId set after the Elasticsearch API key is created for the ECF service",
"value": {
"item": {
"apiKeyId": "es-api-key-id-1",
"attemptCount": 1,
"connectorId": "cloud-connector-id-1",
"id": "onboarding-deployment-id-3",
"mechanisms": [
"ecf"
],
"provider": "aws",
"services": [
"cloudfront_logs"
],
"serviceVars": {
"cloudfront_logs": {
"regions": [
"us-east-1"
],
"s3_bucket_arn": "arn:aws:s3:::my-cloudfront-bucket"
}
},
"status": "pending"
}
}
},
"postCloudOnboardingDeploymentExample": {
"description": "Managed integration deployment — packagePolicyIds set after deployment completes",
"value": {
"item": {
"attemptCount": 1,
"connectorId": "cloud-connector-id-1",
"id": "onboarding-deployment-id-1",
"mechanisms": [
"managed_integration"
],
"packagePolicyIds": [
"package-policy-id-1"
],
"provider": "aws",
"services": [
"cloudwatch_metrics",
"cloudtrail"
],
"serviceVars": {
"cloudtrail": {
"regions": [
"us-east-1"
],
"s3_bucket_arn": "arn:aws:s3:::my-cloudtrail-bucket"
},
"cloudwatch_metrics": {
"namespace": "AWS/EC2",
"regions": [
"us-east-1",
"eu-west-1"
]
}
},
"status": "pending"
}
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/cloud_onboarding_deployments/{id}": {
"delete": {
"tags": [
"Fleet cloud onboarding deployments"
],
"summary": "Delete cloud onboarding deployment",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all cloud onboarding deployments for a given connector ID.
[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.",
"operationId": "get-fleet-cloud-onboarding-deployments-connector-connectorid",
"parameters": [
{
"name": "connectorId",
"in": "path",
"description": "The fleet-cloud-connector ID to list deployments for.",
"required": true,
"schema": {
"maxLength": 255,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"id",
"provider",
"mechanisms",
"services",
"status",
"attemptCount"
],
"type": "object",
"properties": {
"agentPolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies."
},
"apiKeyId": {
"type": "string",
"description": "Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation."
},
"attemptCount": {
"minimum": 1,
"type": "number",
"description": "Number of deployment attempts, including the current one."
},
"authMethod": {
"enum": [
"identity_federation",
"static_keys",
"temporary_keys",
"shared_credentials",
"assume_role"
],
"type": "string",
"description": "Authentication method. Allowed values depend on the delivery mechanism:\n\n- managed_integration: identity_federation | static_keys\n- agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role"
},
"connectorId": {
"type": "string",
"description": "ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments."
},
"dataFormat": {
"enum": [
"ecs",
"otel"
],
"type": "string",
"description": "Data format: ecs or otel."
},
"deploymentId": {
"type": "string",
"description": "Opaque deployment identifier; for AWS, the CFN stack ARN."
},
"deploymentName": {
"type": "string",
"description": "Opaque deployment name; for AWS, the CFN stack name."
},
"ecfStacks": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"family",
"stackName",
"templateVersion"
],
"type": "object",
"properties": {
"family": {
"enum": [
"unified",
"otel",
"crowdstrike"
],
"type": "string",
"description": "ECF template family."
},
"stackName": {
"maxLength": 128,
"minLength": 1,
"type": "string",
"description": "CloudFormation stack name (128-char AWS limit)."
},
"templateVersion": {
"maxLength": 32,
"minLength": 1,
"type": "string",
"description": "ECF semantic version resolved at launch time, e.g. \"1.10.0\"."
}
},
"additionalProperties": false
},
"description": "ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch."
},
"globalRegion": {
"type": "string",
"description": "Global AWS region from the Service Settings step."
},
"id": {
"type": "string"
},
"mechanisms": {
"maxItems": 10,
"type": "array",
"items": {
"enum": [
"managed_integration",
"ecf",
"agent_based"
],
"type": "string",
"description": "Delivery mechanism: managed_integration, ecf, or agent_based."
}
},
"packagePolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "Package policy IDs created for this deployment (managed_integration and agent_based)."
},
"policyIdsByInstance": {
"type": "object",
"additionalProperties": {
"maxLength": 255,
"type": "string"
},
"description": "instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed."
},
"provider": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string",
"description": "Cloud provider."
},
"services": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "Service IDs covered by this deployment."
},
"serviceVars": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": { }
},
"description": "Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step."
},
"status": {
"enum": [
"pending",
"deploying",
"succeeded",
"failed"
],
"type": "string",
"description": "Deployment status."
},
"statusMessage": {
"type": "string",
"description": "Error context when status is failed."
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"examples": {
"getCloudOnboardingDeploymentsByConnectorIdExample": {
"description": "List of cloud onboarding deployments for a connector",
"value": {
"items": [
{
"agentPolicyIds": [
"agent-policy-id-1"
],
"attemptCount": 1,
"connectorId": "cloud-connector-id-1",
"deploymentId": "arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc",
"deploymentName": "elastic-aws-onboarding",
"id": "onboarding-deployment-id-1",
"mechanisms": [
"managed_integration"
],
"packagePolicyIds": [
"package-policy-id-1"
],
"provider": "aws",
"services": [
"cloudwatch_metrics"
],
"status": "succeeded"
},
{
"attemptCount": 1,
"connectorId": "cloud-connector-id-1",
"id": "onboarding-deployment-id-2",
"mechanisms": [
"managed_integration",
"ecf"
],
"provider": "aws",
"services": [
"cloudfront_logs"
],
"serviceVars": {
"cloudfront_logs": {
"regions": [
"us-east-1"
],
"s3_bucket_arn": "arn:aws:s3:::my-cloudfront-logs-bucket"
}
},
"status": "deploying"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/data_streams": {
"get": {
"tags": [
"Data streams"
],
"summary": "Get data streams",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/data_streams
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all Fleet-managed data streams with metadata including package, namespace, size, and last activity.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCheck whether one or more data stream index patterns contain any documents indexed at or after the given start time.
[Required authorization] Route required privileges: fleet-read.",
"operationId": "get-fleet-data-streams-data",
"parameters": [
{
"name": "dataStreams",
"in": "query",
"description": "A comma-separated list of data stream index patterns to check. Each pattern must be of the form `logs--` or `metrics--`, where `` is `*` or a concrete namespace.",
"required": true,
"schema": {
"maxLength": 4096,
"type": "string"
}
},
{
"name": "start",
"in": "query",
"description": "An ISO 8601 timestamp. Only documents with an `@timestamp` at or after this time are considered.",
"required": true,
"schema": {
"maxLength": 64,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"results"
],
"type": "object",
"properties": {
"results": {
"type": "object",
"additionalProperties": {
"type": "boolean"
},
"description": "One entry per requested index pattern. `true` when the pattern matched at least one document, `false` when it matched none or the pattern resolved to no index."
}
},
"additionalProperties": false
},
"examples": {
"getDataStreamsHasDataExample": {
"description": "One entry per requested index pattern",
"value": {
"results": {
"logs-aws.cloudtrail-*": true,
"metrics-aws.ec2-*": false
}
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"getDataStreamsHasDataInvalidPatternExample": {
"description": "A requested pattern is not a supported data stream wildcard",
"value": {
"error": "Bad Request",
"message": "Invalid index pattern: \".security-7\"",
"statusCode": 400
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/enrollment_api_keys": {
"get": {
"tags": [
"Fleet enrollment API keys"
],
"summary": "Get enrollment API keys",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/enrollment_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all enrollment API keys.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate an enrollment API key for a given agent policy.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRevoke or delete an enrollment API key by ID. Use `forceDelete=true` to remove the document.
[Required authorization] Route required privileges: fleet-agents-all.",
"operationId": "delete-fleet-enrollment-api-keys-keyid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "keyId",
"in": "path",
"description": "The ID of the enrollment API key",
"required": true,
"schema": {
"type": "string"
}
},
{
"name": "forceDelete",
"in": "query",
"description": "When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "includeHidden",
"in": "query",
"description": "When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_delete_enrollment_api_key_response"
},
"examples": {
"deleteEnrollmentApiKeyExample": {
"description": "The enrollment API key was successfully revoked",
"value": {
"action": "deleted"
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"description": "No enrollment API key was found with the given ID",
"value": {
"error": "Not Found",
"message": "EnrollmentAPIKey key-id-1 not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Fleet enrollment API keys"
],
"summary": "Get an enrollment API key",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve multiple Kibana saved object assets by their IDs and types.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new custom integration package with user-defined data streams.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the datasets of an existing custom integration package.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of data streams created by installed integration packages.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of integration packages available in the registry.
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.",
"operationId": "get-fleet-epm-packages",
"parameters": [
{
"name": "category",
"in": "query",
"description": "Filter packages by category",
"schema": {
"type": "string"
}
},
{
"name": "prerelease",
"in": "query",
"description": "When true, include prerelease packages in the results",
"schema": {
"type": "boolean"
}
},
{
"name": "excludeInstallStatus",
"in": "query",
"description": "When true, exclude the install status from the response",
"schema": {
"type": "boolean"
}
},
{
"name": "withPackagePoliciesCount",
"in": "query",
"description": "When true, include the number of package policies per package",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_get_packages_response"
},
"examples": {
"getPackagesExample": {
"description": "List of available integration packages",
"value": {
"items": [
{
"categories": [
"cloud"
],
"description": "Collect logs and metrics from Amazon Web Services",
"id": "aws",
"name": "aws",
"status": "not_installed",
"title": "AWS",
"version": "2.10.0"
}
],
"searchExcluded": 0,
"total": 1
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Elastic Package Manager (EPM)"
],
"summary": "Install a package by upload",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/fleet/epm/packages
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall a package by uploading a .zip or .tar.gz archive (max 100MB).\n\nArchives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.\n\nThe following asset types require the corresponding Kibana API privilege:\n\n- `security_rule`: `rules-all`\n- `security_rule` with type `machine_learning`: `rules-all` and `ml:canCreateJob`\n- `security_ai_prompt`: `elasticAssistant`\n\nIf any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to [Upload an integration to Kibana](https://www.elastic.co/docs/extend/integrations/upload-new-integration).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall multiple packages from the Elastic Package Registry in a single request.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nEnable or disable namespace-level index template customization for a list of packages in one call. Use this for IaC-style declarative flows.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRollback multiple packages to their previous versions.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the status and results of a bulk package rollback operation.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUninstall multiple packages in a single operation.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the status and results of a bulk package uninstall operation.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpgrade multiple packages to their latest versions.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the status and results of a bulk package upgrade operation.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall the latest version of a package from the Elastic Package Registry.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate settings for a package, such as whether policies are kept up to date automatically.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUninstall a specific version of a package and remove all its assets.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall a specific version of a package from the Elastic Package Registry.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate settings for a specific version of a package.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the contents of a specific file from a package.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete datastream assets for a specific package, by data stream name.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the list of packages that a specific package depends on.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete Kibana assets (dashboards, visualizations, etc.) for a specific package version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall Kibana assets (dashboards, visualizations, etc.) for a specific package version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall Kibana alert rule assets for a specific package version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReview and accept or reject a pending policy upgrade for a package that contains deprecations.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRollback a package to its previously installed version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet usage statistics for a specific package, such as the number of agent policies using it.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all currently installed integration packages.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the list of packages that cannot be uninstalled (e.g. elastic_agent, fleet_server).
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet an inputs template for a package, used to pre-populate package policy forms.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the GPG key ID used to verify the signatures of packages from the Elastic Package Registry.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCheck the health status of a Fleet Server instance by its host ID. Returns the server status and name if available.
[Required authorization] Route required privileges: fleet-settings-all.",
"operationId": "post-fleet-health-check",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"postHealthCheckRequestExample": {
"description": "Check the health of a Fleet Server instance by its host ID",
"value": {
"id": "fleet-server-host-id-1"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Successful health check response",
"content": {
"application/json": {
"schema": {
"required": [
"status"
],
"type": "object",
"properties": {
"host_id": {
"type": "string"
},
"name": {
"type": "string"
},
"status": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"postHealthCheckHealthyExample": {
"description": "Fleet Server is online and healthy",
"value": {
"name": "fleet-server-1",
"status": "ONLINE"
}
},
"postHealthCheckUnreachableExample": {
"description": "Fleet Server host is not reachable (request timed out or aborted)",
"value": {
"host_id": "fleet-server-host-id-1",
"status": "OFFLINE"
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"badRequestExample": {
"description": "The host ID exists but has no associated host URLs configured",
"value": {
"error": "Bad Request",
"message": "The requested host id fleet-server-host-id-1 does not have associated host urls.",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"notFoundExample": {
"description": "No Fleet Server host was found with the given ID",
"value": {
"error": "Not Found",
"message": "The requested host id fleet-server-host-id-1 does not exist.",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/kubernetes": {
"get": {
"tags": [
"Elastic Agent policies"
],
"summary": "Get a full K8s agent manifest",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/kubernetes
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the Kubernetes manifest for deploying Elastic Agent.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDownload the Kubernetes manifest for deploying Elastic Agent.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGenerate an API key for Logstash to use with a Fleet output.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy's saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.",
"operationId": "post-fleet-managed-integrations-upgrade",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request"
},
"examples": {
"upgradeManagedIntegrationsRequestExample": {
"description": "Bulk upgrade managed integrations to their installed package version",
"value": {
"policyIds": [
"d52a7812-5736-4fdc-aed8-72152afa1ffa",
"aws-policy-12345"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item's `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch.",
"content": {
"application/json": {
"schema": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result"
}
},
"examples": {
"upgradeManagedIntegrationsPartialFailureResponseExample": {
"description": "Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)",
"value": [
{
"id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
"name": "ess_billing-1",
"success": true
},
{
"body": {
"message": "Agentless policy aws-policy-12345 not found"
},
"id": "aws-policy-12345",
"statusCode": 404,
"success": false
}
]
},
"upgradeManagedIntegrationsResponseExample": {
"description": "Example response where every policy was upgraded",
"value": [
{
"id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
"name": "ess_billing-1",
"success": true
},
{
"id": "aws-policy-12345",
"name": "cspm-aws-policy",
"success": true
}
]
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/managed_integrations/_upgrade/dryrun": {
"post": {
"tags": [
"Fleet managed integrations"
],
"summary": "Preview a managed integrations upgrade",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing `acknowledge=true` as a query parameter.
[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.",
"operationId": "post-fleet-message-signing-service-rotate-key-pair",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "acknowledge",
"in": "query",
"description": "Set to true to confirm you understand the risks of rotating the key pair",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "Key pair rotated successfully",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"rotateKeyPairSuccessExample": {
"description": "The key pair was rotated. All agents must be re-enrolled to receive the new signing key.",
"value": {
"message": "Key pair rotated successfully."
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"acknowledgeRequiredExample": {
"description": "Request was rejected because the acknowledge query parameter was not set to true",
"value": {
"error": "Bad Request",
"message": "Warning: this API will cause a key pair to rotate and should not be necessary in normal operation. If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters. For more information, reach out to your administrator.",
"statusCode": 400
}
}
}
}
}
},
"500": {
"description": "Internal Server Error",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"serviceUnavailableExample": {
"description": "The message signing service is not available",
"value": {
"error": "Internal Server Error",
"message": "Failed to rotate key pair. Message signing service is unavailable!",
"statusCode": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/outputs": {
"get": {
"tags": [
"Fleet outputs"
],
"summary": "Get outputs",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/outputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all Fleet outputs.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the latest health status of an output by ID.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpgrade a package policy to a newer package version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPreview the changes that would be applied by upgrading a package policy to a newer package version.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the synchronization status of remote integrations for a specific output by its ID.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the synchronization status of all remote integrations across connected remote clusters.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Fleet Server service token. The token is used to enroll Fleet Server instances with Kibana.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInitialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. Safe to call multiple times (idempotent). Returns the initialization status and any non-fatal errors encountered during setup.
[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.",
"operationId": "post-fleet-setup",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"responses": {
"200": {
"description": "Fleet setup completed",
"content": {
"application/json": {
"schema": {
"required": [
"isInitialized",
"nonFatalErrors"
],
"type": "object",
"properties": {
"isInitialized": {
"type": "boolean"
},
"nonFatalErrors": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"name",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false,
"description": "A summary of the result of Fleet's `setup` lifecycle. If `isInitialized` is true, Fleet is ready to accept agent enrollment. `nonFatalErrors` may include useful insight into non-blocking issues with Fleet setup."
},
"examples": {
"fleetSetupSuccessExample": {
"description": "Fleet initialized successfully with no non-fatal errors",
"value": {
"isInitialized": true,
"nonFatalErrors": [ ]
}
},
"fleetSetupWithNonFatalErrorsExample": {
"description": "Fleet initialized but encountered non-fatal errors during setup",
"value": {
"isInitialized": true,
"nonFatalErrors": [
{
"message": "Package fleet_server not found in registry",
"name": "PackageNotFoundError"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
}
}
}
}
},
"500": {
"description": "Internal Server Error",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Internal Server Error"
},
"examples": {
"internalErrorResponseExample": {
"description": "Example of an internal server error response",
"value": {
"error": "Internal Server Error",
"message": "An error message describing what went wrong",
"statusCode": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/space_settings": {
"get": {
"tags": [
"Fleet internals"
],
"summary": "Get space settings",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/fleet/space_settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the Fleet settings for the current Kibana space.",
"operationId": "get-fleet-space-settings",
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"required": [
"allowed_namespace_prefixes"
],
"type": "object",
"properties": {
"allowed_namespace_prefixes": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"managed_by": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"examples": {
"getSpaceSettingsExample": {
"description": "The Fleet settings for the current Kibana space",
"value": {
"item": {
"allowed_namespace_prefixes": [
"team-a",
"team-b"
]
}
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.1.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"Fleet internals"
],
"summary": "Create space settings",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/fleet/space_settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate or update Fleet settings for the current Kibana space.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList the metadata for the latest uninstall tokens per agent policy.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRotate the uninstall token for an agent policy. Only applicable to policies with tamper protection enabled.
[Required authorization] Route required privileges: fleet-agents-all.",
"operationId": "post-fleet-uninstall-tokens-agentpolicyid-rotate",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "agentPolicyId",
"in": "path",
"description": "The ID of the agent policy whose uninstall token should be rotated",
"required": true,
"schema": {
"maxLength": 255,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"rotateUninstallTokenExample": {
"description": "Uninstall token rotated successfully for the given agent policy",
"value": {
"message": "Uninstall token rotated successfully."
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"genericErrorResponseExample": {
"description": "Example of a generic error response",
"value": {
"error": "Bad Request",
"message": "An error message describing what went wrong",
"statusCode": 400
}
},
"notProtectedExample": {
"description": "Agent policy does not have tamper protection enabled",
"value": {
"error": "Bad Request",
"message": "Agent policy [policy-id-1] does not have tamper protection enabled. Uninstall tokens can only be rotated for protected policies.",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Not Found",
"content": {
"application/json": {
"schema": {
"required": [
"message",
"attributes"
],
"type": "object",
"properties": {
"attributes": { },
"error": {
"type": "string"
},
"errorType": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false,
"description": "Generic Error"
},
"examples": {
"notFoundExample": {
"description": "No agent policy was found with the given ID",
"value": {
"error": "Not Found",
"message": "Agent policy not found with id policy-id-1",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/fleet/uninstall_tokens/{uninstallTokenId}": {
"get": {
"tags": [
"Fleet uninstall tokens"
],
"summary": "Get a decrypted uninstall token",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a paginated list of links library items. Each result includes title, description, and metadata. Use `GET /api/links/{id}` to retrieve the complete state.",
"operationId": "get-links",
"parameters": [
{
"name": "page",
"in": "query",
"description": "The page of results to return.",
"schema": {
"minimum": 1,
"type": "number",
"default": 1
}
},
{
"name": "per_page",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"default": 20
}
},
{
"name": "query",
"in": "query",
"description": "Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.",
"schema": {
"type": "string"
}
},
{
"name": "tags",
"in": "query",
"description": "A tag ID to include. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are included.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this dashboard.",
"default": [ ]
}
},
{
"name": "excluded_tags",
"in": "query",
"description": "A tag ID to exclude. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are excluded.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this dashboard.",
"default": [ ]
}
},
{
"name": "tag_names",
"in": "query",
"description": "A tag name to include. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are included. If the same name is shared by multiple tags, items matching any of those tags are included.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"x-state": "Generally available; added in 9.6.0"
}
},
{
"name": "excluded_tag_names",
"in": "query",
"description": "A tag name to exclude. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are excluded. If the same name is shared by multiple tags, items matching any of those tags are excluded.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"x-state": "Generally available; added in 9.6.0"
}
}
],
"responses": {
"200": {
"description": "success",
"content": {
"application/json": {
"schema": {
"required": [
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"maxItems": 1000,
"minItems": 0,
"type": "array",
"items": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"title"
],
"type": "object",
"properties": {
"description": {
"maxLength": 10000,
"type": "string",
"description": "A short description of the links library item."
},
"title": {
"maxLength": 1000,
"type": "string",
"description": "The links library item title."
}
},
"additionalProperties": false
},
"id": {
"maxLength": 250,
"type": "string"
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"description": "List of links library items matching the query."
},
"meta": {
"required": [
"total"
],
"type": "object",
"properties": {
"page": {
"minimum": 1,
"type": "number",
"description": "The returned page of results.",
"default": 1
},
"per_page": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"description": "The number of results returned per page.",
"default": 20
},
"total": {
"type": "number",
"description": "The total number of results matching the query."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"examples": {
"searchLinks": {
"summary": "Search links library items response",
"description": "Returns a paginated list of links library items. Each result includes title, description, and metadata. Use `GET /api/links/{id}` to retrieve the complete state.",
"value": {
"data": [
{
"data": {
"description": "A collection of important links",
"title": "Important Resources"
},
"id": "0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3",
"meta": {
"created_at": "2026-06-03T23:33:39.979Z",
"created_by": "u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0",
"managed": false,
"updated_at": "2026-06-03T23:33:39.979Z",
"updated_by": "u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0",
"version": "WzEwNywxXQ=="
}
}
],
"meta": {
"page": 1,
"per_page": 20,
"total": 1
}
}
}
}
}
}
},
"403": {
"description": "forbidden"
}
},
"x-codeSamples": [
{
"label": "Search links library items - cURL",
"lang": "cURL",
"source": "curl -X GET \"${KIBANA_URL}/api/links?query=welcome&per_page=10\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"label": "Search links library items - Console",
"lang": "Console",
"source": "GET kbn:/api/links?query=welcome&per_page=10\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Links"
],
"summary": "Create a links library item",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/links
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a new links library item and returns its ID, full state, and metadata.",
"operationId": "post-links",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"links",
"title"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"layout": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Whether to display the links in a horizontal or vertical layout."
},
"links": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"dashboardLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink",
"externalLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
}
},
"description": "The list of links to display."
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this library item.",
"default": [ ]
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"createLinks": {
"summary": "Create a links library item",
"value": {
"description": "A collection of important links",
"layout": "horizontal",
"links": [
{
"destination": "dashboard-abc-123",
"label": "Overview",
"type": "dashboardLink"
},
{
"destination": "https://www.elastic.co/docs",
"label": "Elastic Documentation",
"type": "externalLink"
}
],
"title": "Important Resources"
}
}
}
}
}
},
"responses": {
"201": {
"description": "created",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"links",
"title"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"layout": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Whether to display the links in a horizontal or vertical layout."
},
"links": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"dashboardLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink",
"externalLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
}
},
"description": "The list of links to display."
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this library item.",
"default": [ ]
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The unique ID of the links library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"createLinks": {
"summary": "Create links library item response",
"description": "Creates a new links library item and returns its ID, full state, and metadata.",
"value": {
"data": {
"description": "A collection of important links",
"layout": "horizontal",
"links": [
{
"destination": "dashboard-abc-123",
"label": "Overview",
"options": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
},
"type": "dashboardLink"
},
{
"destination": "https://www.elastic.co/docs",
"label": "Elastic Documentation",
"options": {
"encode_url": true,
"open_in_new_tab": true
},
"type": "externalLink"
}
],
"title": "Important Resources"
},
"id": "0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3",
"meta": {
"created_at": "2026-06-03T23:33:39.979Z",
"created_by": "u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0",
"managed": false,
"updated_at": "2026-06-03T23:33:39.979Z",
"updated_by": "u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0",
"version": "WzEwNywxXQ=="
}
}
}
}
}
}
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
}
},
"x-codeSamples": [
{
"label": "Create a links library item - cURL",
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/links\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"title\": \"Important Resources\",\n \"description\": \"A collection of important links\",\n \"links\": [\n {\n \"label\": \"Overview\",\n \"type\": \"dashboardLink\",\n \"destination\": \"dashboard-abc-123\"\n },\n {\n \"label\": \"Elastic Documentation\",\n \"type\": \"externalLink\",\n \"destination\": \"https://www.elastic.co/docs\"\n }\n ],\n \"layout\": \"horizontal\"\n}'"
},
{
"label": "Create a links library item - Console",
"lang": "Console",
"source": "POST kbn:/api/links\n{\n \"summary\": \"Create a links library item\",\n \"value\": {\n \"title\": \"Important Resources\",\n \"description\": \"A collection of important links\",\n \"links\": [\n {\n \"label\": \"Overview\",\n \"type\": \"dashboardLink\",\n \"destination\": \"dashboard-abc-123\"\n },\n {\n \"label\": \"Elastic Documentation\",\n \"type\": \"externalLink\",\n \"destination\": \"https://www.elastic.co/docs\"\n }\n ],\n \"layout\": \"horizontal\"\n }\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/links/{id}": {
"delete": {
"tags": [
"Links"
],
"summary": "Delete a links library item",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/links/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPermanently deletes a links library item by ID.",
"operationId": "delete-links-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The unique ID of the links library item, as returned by the create or search endpoints.",
"required": true,
"schema": {
"maxLength": 250,
"type": "string"
}
}
],
"responses": {
"204": {
"description": "No content, the links library item was successfully deleted."
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
},
"404": {
"description": "A links library item with the given ID was not found."
}
},
"x-codeSamples": [
{
"label": "Delete a links library item - cURL",
"lang": "cURL",
"source": "curl -X DELETE \"${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"label": "Delete a links library item - Console",
"lang": "Console",
"source": "DELETE kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Links"
],
"summary": "Get a links library item by ID",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/links/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the complete state of a links library item by ID.",
"operationId": "get-links-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique ID of the links library item, as returned by the create or search endpoints.",
"required": true,
"schema": {
"maxLength": 250,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "success",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"links",
"title"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"layout": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Whether to display the links in a horizontal or vertical layout."
},
"links": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"dashboardLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink",
"externalLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
}
},
"description": "The list of links to display."
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this library item.",
"default": [ ]
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"id": {
"maxLength": 250,
"type": "string",
"description": "The unique ID of the links library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"getLinksResponse": {
"summary": "Get links library item response",
"description": "The full links library item state including `links`, `layout`, `title`, `description`, and metadata.",
"value": {
"data": {
"description": "A collection of important links",
"layout": "horizontal",
"links": [
{
"destination": "dashboard-abc-123",
"label": "Overview",
"options": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
},
"type": "dashboardLink"
},
{
"destination": "https://www.elastic.co/docs",
"label": "Elastic Documentation",
"options": {
"encode_url": true,
"open_in_new_tab": true
},
"type": "externalLink"
}
],
"title": "Important Resources"
},
"id": "0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}
}
}
}
}
},
"403": {
"description": "forbidden"
},
"404": {
"description": "A links library item with the given ID was not found."
}
},
"x-codeSamples": [
{
"label": "Get a links library item - cURL",
"lang": "cURL",
"source": "curl -X GET \"${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"label": "Get a links library item - Console",
"lang": "Console",
"source": "GET kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"Links"
],
"summary": "Upsert links library item",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/links/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReplaces the full state of a links library item. Partial updates are not supported.\nTo make incremental changes, retrieve the item first, modify the fields you need, then send the complete object back.\n\nIf no item exists with the specified ID, a new one is created.",
"operationId": "put-links-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The unique ID of the links library item to be created or updated",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"links",
"title"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"layout": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Whether to display the links in a horizontal or vertical layout."
},
"links": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"dashboardLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink",
"externalLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
}
},
"description": "The list of links to display."
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this library item.",
"default": [ ]
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"upsertLinks": {
"summary": "Upsert a links library item",
"value": {
"description": "A collection of important links",
"layout": "vertical",
"links": [
{
"destination": "dashboard-abc-123",
"label": "Overview",
"options": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
},
"type": "dashboardLink"
},
{
"destination": "https://www.elastic.co/docs",
"label": "Elastic Documentation",
"options": {
"encode_url": true,
"open_in_new_tab": true
},
"type": "externalLink"
}
],
"title": "Important Resources"
}
}
}
}
}
},
"responses": {
"200": {
"description": "updated",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_LinksItemResponse"
},
"examples": {
"upsertLinks": {
"summary": "Update links library item response",
"description": "The complete updated links library item state after a full replacement. PUT replaces the entire item, so any fields omitted from the request are reset to their defaults.",
"value": {
"data": {
"description": "A collection of important links",
"layout": "vertical",
"links": [
{
"destination": "dashboard-abc-123",
"label": "Overview",
"options": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
},
"type": "dashboardLink"
},
{
"destination": "https://www.elastic.co/docs",
"label": "Elastic Documentation",
"options": {
"encode_url": true,
"open_in_new_tab": true
},
"type": "externalLink"
}
],
"title": "Important Resources"
},
"id": "0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T11:00:00.000Z",
"version": "WzYwLDFd"
}
}
}
}
}
}
},
"201": {
"description": "created",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_LinksItemResponse"
},
"examples": {
"createdLinks": {
"summary": "Create links library item response (via upsert)",
"description": "Returned when the upsert created a new item because no item existed with the specified ID.",
"value": {
"data": {
"description": "A collection of important links",
"layout": "horizontal",
"links": [
{
"destination": "dashboard-abc-123",
"label": "Overview",
"options": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
},
"type": "dashboardLink"
},
{
"destination": "https://www.elastic.co/docs",
"label": "Elastic Documentation",
"options": {
"encode_url": true,
"open_in_new_tab": true
},
"type": "externalLink"
}
],
"title": "Important Resources"
},
"id": "0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}
}
}
}
}
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
},
"409": {
"description": "conflict"
}
},
"x-codeSamples": [
{
"label": "Upsert a links library item - cURL",
"lang": "curl",
"source": "curl \\\n -X PUT \"${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"title\": \"Important Resources\",\n \"description\": \"A collection of important links\",\n \"links\": [\n {\n \"label\": \"Overview\",\n \"type\": \"dashboardLink\",\n \"destination\": \"dashboard-abc-123\",\n \"options\": {\n \"open_in_new_tab\": false,\n \"use_time_range\": true,\n \"use_filters\": true\n }\n },\n {\n \"label\": \"Elastic Documentation\",\n \"type\": \"externalLink\",\n \"destination\": \"https://www.elastic.co/docs\",\n \"options\": {\n \"encode_url\": true,\n \"open_in_new_tab\": true\n }\n }\n ],\n \"layout\": \"vertical\"\n}'"
},
{
"label": "Upsert a links library item - Console",
"lang": "Console",
"source": "PUT kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\n{\n \"title\": \"Important Resources\",\n \"description\": \"A collection of important links\",\n \"links\": [\n {\n \"label\": \"Overview\",\n \"type\": \"dashboardLink\",\n \"destination\": \"dashboard-abc-123\",\n \"options\": {\n \"open_in_new_tab\": false,\n \"use_time_range\": true,\n \"use_filters\": true\n }\n },\n {\n \"label\": \"Elastic Documentation\",\n \"type\": \"externalLink\",\n \"destination\": \"https://www.elastic.co/docs\",\n \"options\": {\n \"encode_url\": true,\n \"open_in_new_tab\": true\n }\n }\n ],\n \"layout\": \"vertical\"\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/lists": {
"delete": {
"tags": [
"Security Lists API"
],
"summary": "Delete a value list",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a value list using the list ID.\n> info\n> When you delete a list, all of its list items are also deleted.\n",
"operationId": "DeleteList",
"parameters": [
{
"name": "id",
"in": "query",
"description": "Value list identifier to delete, including all of its list items.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_ListId"
}
},
{
"name": "deleteReferences",
"in": "query",
"description": "Determines whether exception items referencing this value list should be deleted.",
"schema": {
"type": "boolean",
"default": false,
"example": false
}
},
{
"name": "ignoreReferences",
"in": "query",
"description": "Determines whether to delete value list without performing any additional checks of where this list may be utilized.",
"schema": {
"type": "boolean",
"default": false,
"example": false
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_List"
},
"examples": {
"ipList": {
"value": {
"_version": "WzIsMV0=",
"@timestamp": "2025-01-08T04:47:34.273Z",
"created_at": "2025-01-08T04:47:34.273Z",
"created_by": "elastic",
"description": "List of bad internet ips.",
"id": "21b01cfb-058d-44b9-838c-282be16c91cd",
"immutable": false,
"name": "Bad ips",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899",
"type": "ip",
"updated_at": "2025-01-08T05:39:39.292Z",
"updated_by": "elastic",
"version": 3
}
}
}
}
}
},
"400": {
"description": "Invalid input data response",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"error": "Bad Request",
"message": "[request query]: id: Required",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Not enough privileges response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"error": "Forbidden",
"message": "API [DELETE /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "List not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "list id: \\\"ip_list\\\" was not found",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Lists API"
],
"summary": "Get value list details",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a value list using the list ID.",
"operationId": "ReadList",
"parameters": [
{
"name": "id",
"in": "query",
"description": "Value list identifier (`id`) returned when the list was created.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_ListId"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_List"
},
"examples": {
"ip": {
"value": {
"_version": "WzEsMV0=",
"@timestamp": "2025-01-08T04:47:34.273Z",
"created_at": "2025-01-08T04:47:34.273Z",
"created_by": "elastic",
"description": "This list describes bad internet ip",
"id": "ip_list",
"immutable": false,
"name": "My bad ips",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899",
"type": "ip",
"updated_at": "2025-01-08T05:21:53.843Z",
"updated_by": "elastic",
"version": 1
}
}
}
}
}
},
"400": {
"description": "Invalid input data response",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse"
},
{
"$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse"
}
]
},
"examples": {
"badRequest": {
"value": {
"error": "Bad Request",
"message": "[request query]: id: Required",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unsuccessful authentication response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse"
},
"examples": {
"unauthorized": {
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Not enough privileges response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse"
},
"examples": {
"forbidden": {
"value": {
"error": "Forbidden",
"message": "API [GET /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "List not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse"
},
"examples": {
"notFound": {
"value": {
"message": "list id: \\\"foo\\\" not found",
"status_code": 404
}
}
}
}
}
},
"500": {
"description": "Internal server error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse"
},
"examples": {
"serverError": {
"value": {
"message": "Internal Server Error",
"status_code": 500
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"Security Lists API"
],
"summary": "Patch a value list",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window.",
"operationId": "post-maintenance-window-id-unarchive",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The identifier for the maintenance window to be unarchived.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response"
},
"examples": {
"unarchiveMaintenanceWindowResponse": {
"summary": "Unarchive a maintenance window response",
"description": "The response returned when a maintenance window is successfully unarchived.\n",
"value": {
"created_at": "2025-02-25T10:00:00.000Z",
"created_by": "elastic",
"enabled": true,
"id": "f0cb1780-537a-4e34-8adf-3b4336862858",
"schedule": {
"custom": {
"duration": "2h",
"recurring": {
"every": "1w",
"occurrences": 10,
"onWeekDay": [
"MO",
"WE"
]
},
"start": "2025-03-01T08:00:00.000Z",
"timezone": "Europe/Amsterdam"
}
},
"scope": {
"alerting": {
"query": {
"kql": "kibana.alert.tags: \"infra\""
}
}
},
"status": "upcoming",
"title": "Weekly Maintenance Window",
"updated_at": "2025-02-25T10:00:00.000Z",
"updated_by": "elastic"
}
}
}
}
}
},
"400": {
"description": "Indicates an invalid schema or parameters."
},
"403": {
"description": "Indicates that this call is forbidden."
},
"404": {
"description": "Indicates a maintenance window with the given ID does not exist."
}
},
"x-state": "Generally available; added in 9.1.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/markdowns": {
"get": {
"tags": [
"Markdowns"
],
"summary": "List markdown library items",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/markdowns
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a paginated list of markdown library items. Each result includes title, description, and metadata, but not the content. Use `GET /api/markdowns/{id}` to retrieve the complete state.",
"operationId": "get-markdowns",
"parameters": [
{
"name": "page",
"in": "query",
"description": "The page of results to return.",
"schema": {
"minimum": 1,
"type": "number",
"default": 1
}
},
{
"name": "per_page",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"default": 20
}
},
{
"name": "query",
"in": "query",
"description": "Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "success",
"content": {
"application/json": {
"schema": {
"required": [
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"maxItems": 1000,
"minItems": 0,
"type": "array",
"items": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"title"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"title": {
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The markdown library item ID."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"description": "List of markdown library items matching the query."
},
"meta": {
"required": [
"total"
],
"type": "object",
"properties": {
"page": {
"minimum": 1,
"type": "number",
"description": "The returned page of results.",
"default": 1
},
"per_page": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"description": "The number of results returned per page.",
"default": 20
},
"total": {
"type": "number",
"description": "The total number of results matching the query."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"examples": {
"searchMarkdownsResponse": {
"summary": "Search markdown library items response",
"description": "Paginated list of markdown library item summaries. Each item includes the ID, a subset of state fields (`title` and `description`), and metadata. The full `content` is not included; use `GET /api/markdowns/{id}` to retrieve a specific item.",
"value": {
"data": [
{
"data": {
"description": "Intro and context for the web logs dashboard.",
"title": "Web logs overview"
},
"id": "5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}
],
"meta": {
"page": 1,
"per_page": 20,
"total": 1
}
}
}
}
}
}
},
"403": {
"description": "forbidden"
}
},
"x-codeSamples": [
{
"label": "Search markdown library items - cURL",
"lang": "cURL",
"source": "curl -X GET \"${KIBANA_URL}/api/markdowns?query=welcome&per_page=10\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"label": "Search markdown library items - Console",
"lang": "Console",
"source": "GET kbn:/api/markdowns?query=welcome&per_page=10\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Markdowns"
],
"summary": "Create a markdown library item",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/markdowns
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a new markdown library item and returns its ID, full state, and metadata.",
"operationId": "post-markdowns",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"content",
"title"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"minLength": 1,
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"examples": {
"createMarkdown": {
"summary": "Create a markdown library item",
"value": {
"content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
"description": "Intro and context for the web logs dashboard.",
"settings": {
"open_links_in_new_tab": true
},
"title": "Web logs overview"
}
}
}
}
}
},
"responses": {
"201": {
"description": "created",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"content",
"title"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"minLength": 1,
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The unique ID of the markdown library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"createMarkdownResponse": {
"summary": "Create markdown library item response",
"description": "Response to creating a markdown library item. Returns the generated ID, the full item state in `data`, and metadata.",
"value": {
"data": {
"content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
"description": "Intro and context for the web logs dashboard.",
"settings": {
"open_links_in_new_tab": true
},
"title": "Web logs overview"
},
"id": "5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}
}
}
}
}
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
}
},
"x-codeSamples": [
{
"label": "Create a markdown library item - cURL",
"lang": "cURL",
"source": "curl -X POST \"${KIBANA_URL}/api/markdowns\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"title\": \"Web logs overview\",\n \"description\": \"Intro and context for the web logs dashboard.\",\n \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n \"settings\": {\n \"open_links_in_new_tab\": true\n }\n}'\n"
},
{
"label": "Create a markdown library item - Console",
"lang": "Console",
"source": "POST kbn:/api/markdowns\n{\n \"title\": \"Web logs overview\",\n \"description\": \"Intro and context for the web logs dashboard.\",\n \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n \"settings\": {\n \"open_links_in_new_tab\": true\n }\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/markdowns/{id}": {
"delete": {
"tags": [
"Markdowns"
],
"summary": "Delete a markdown library item",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/markdowns/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPermanently deletes a markdown library item by ID.",
"operationId": "delete-markdowns-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The markdown library item ID, as returned by the create or search endpoints.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "No content, the markdown library item was successfully deleted."
},
"403": {
"description": "forbidden"
},
"404": {
"description": "not found"
}
},
"x-codeSamples": [
{
"label": "Delete a markdown library item - cURL",
"lang": "cURL",
"source": "curl -X DELETE \"${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\"\n"
},
{
"label": "Delete a markdown library item - Console",
"lang": "Console",
"source": "DELETE kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Markdowns"
],
"summary": "Get a markdown library item by ID",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/markdowns/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the complete state of a markdown library item by ID.",
"operationId": "get-markdowns-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The markdown library item ID, as returned by the create or search endpoints.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "success",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"content",
"title"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"minLength": 1,
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The unique ID of the markdown library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"getMarkdownResponse": {
"summary": "Get markdown library item response",
"description": "The full markdown library item state including `content`, `settings`, and metadata.",
"value": {
"data": {
"content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
"description": "Intro and context for the web logs dashboard.",
"settings": {
"open_links_in_new_tab": true
},
"title": "Web logs overview"
},
"id": "5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}
}
}
}
}
},
"403": {
"description": "forbidden"
},
"404": {
"description": "not found"
}
},
"x-codeSamples": [
{
"label": "Get a markdown library item - cURL",
"lang": "cURL",
"source": "curl -X GET \"${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"label": "Get a markdown library item - Console",
"lang": "Console",
"source": "GET kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"Markdowns"
],
"summary": "Upsert a markdown library item",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/markdowns/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReplaces the full state of a markdown library item. Partial updates are not supported.\nTo make incremental changes, retrieve the item first, modify the fields you need, then send the complete object back.\n\nIf no item exists with the specified ID, a new one is created.\n",
"operationId": "put-markdowns-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The unique ID of the markdown library item to be created or updated.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"content",
"title"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"minLength": 1,
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"examples": {
"upsertMarkdown": {
"summary": "Upsert a markdown library item",
"value": {
"content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n- _New:_ error rate broken down by status code\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
"description": "Intro and context for the web logs dashboard.",
"settings": {
"open_links_in_new_tab": true
},
"title": "Web logs overview"
}
}
}
}
}
},
"responses": {
"200": {
"description": "updated",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"content",
"title"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"minLength": 1,
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The unique ID of the markdown library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"updatedMarkdownResponse": {
"summary": "Update markdown library item response",
"description": "The complete updated markdown library item state after a full replacement. PUT replaces the entire item, so any fields omitted from the request are reset to their defaults.",
"value": {
"data": {
"content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n- _New:_ error rate broken down by status code\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
"description": "Intro and context for the web logs dashboard.",
"settings": {
"open_links_in_new_tab": true
},
"title": "Web logs overview"
},
"id": "5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T11:00:00.000Z",
"version": "WzYwLDFd"
}
}
}
}
}
}
},
"201": {
"description": "created",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"content",
"title"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the markdown library item."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"minLength": 1,
"type": "string",
"description": "The markdown library item title."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The unique ID of the markdown library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"createdMarkdownResponse": {
"summary": "Create markdown library item response (via upsert)",
"description": "Returned when the upsert created a new item because no item existed with the specified ID.",
"value": {
"data": {
"content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
"description": "Intro and context for the web logs dashboard.",
"settings": {
"open_links_in_new_tab": true
},
"title": "Web logs overview"
},
"id": "web-logs-overview",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}
}
}
}
}
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
}
},
"x-codeSamples": [
{
"label": "Upsert a markdown library item - cURL",
"lang": "cURL",
"source": "curl -X PUT \"${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"title\": \"Web logs overview\",\n \"description\": \"Intro and context for the web logs dashboard.\",\n \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n- _New:_ error rate broken down by status code\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n \"settings\": {\n \"open_links_in_new_tab\": true\n }\n}'\n"
},
{
"label": "Upsert a markdown library item - Console",
"lang": "Console",
"source": "PUT kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\n{\n \"title\": \"Web logs overview\",\n \"description\": \"Intro and context for the web logs dashboard.\",\n \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n- _New:_ error rate broken down by status code\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n \"settings\": {\n \"open_links_in_new_tab\": true\n }\n}\n"
}
],
"x-state": "Experimental; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/ml/saved_objects/sync": {
"get": {
"tags": [
"ml"
],
"summary": "Sync saved objects in the default space",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/ml/saved_objects/sync
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSynchronizes Kibana saved objects for machine learning jobs and trained models in the default space. You must have `all` privileges for the **Machine Learning** feature in the **Analytics** section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.\n",
"operationId": "mlSync",
"parameters": [
{
"$ref": "#/components/parameters/Machine_learning_APIs_simulateParam"
}
],
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSync200Response"
},
"examples": {
"syncExample": {
"$ref": "#/components/examples/Machine_learning_APIs_mlSyncExample"
}
}
}
}
},
"401": {
"description": "Authorization information is missing or invalid.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSync4xxResponse"
},
"examples": {
"syncExample": {
"$ref": "#/components/examples/Machine_learning_APIs_mlSync401Example"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/ml/saved_objects/update_jobs_spaces": {
"post": {
"tags": [
"ml"
],
"summary": "Update jobs spaces",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a list of trained models to add and/or remove them from given spaces.",
"operationId": "mlUpdateTrainedModelsSpaces",
"requestBody": {
"content": {
"application/json": {
"examples": {
"updateTrainedModelsSpacesRequest": {
"value": {
"modelIds": [
"test-model"
],
"spacesToAdd": [
"default"
],
"spacesToRemove": [
"*"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"examples": {
"successTMResponse": {
"value": {
"test-model": {
"success": true,
"type": "trained-model\""
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/note": {
"delete": {
"tags": [
"Security Timeline API"
],
"summary": "Delete one or more notes",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes notes by saved object ID. Send either `noteId` (single ID) or `noteIds` (array of IDs) in the JSON body.\n\nThe response has HTTP 200 with an empty body on success.\n\nRequires the **Timeline and Notes** write privilege (`notes_write`).\n",
"operationId": "DeleteNote",
"requestBody": {
"description": "Exactly one shape: `{ \"noteId\": \"\" }` for a single delete, or `{ \"noteIds\": [\"\", ...] }` for bulk delete.\n`noteIds` may be null in some clients; prefer an empty array or omit unused fields when possible.\n",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"required": [
"noteId"
],
"type": [
"null",
"object"
],
"properties": {
"noteId": {
"type": "string",
"description": "Saved object ID of the note to delete."
}
}
},
{
"required": [
"noteIds"
],
"type": [
"null",
"object"
],
"properties": {
"noteIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Saved object IDs of the notes to delete."
}
}
}
]
},
"examples": {
"deleteOne": {
"summary": "Delete a single note by id",
"value": {
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "The notes were deleted successfully. Response body is empty."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Timeline API"
],
"summary": "Get notes",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns Security Timeline notes as saved objects.\n\n**Query modes (mutually exclusive branches on the server):**\n\n1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).\n\n2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.\n\n3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.\n\nRequires the **Timeline and Notes** read privilege (`notes_read`).\n",
"operationId": "GetNotes",
"parameters": [
{
"name": "documentIds",
"in": "query",
"description": "Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.\n",
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_DocumentIds"
},
"examples": {
"multiple": {
"summary": "Multiple document ids (array)",
"value": [
"id-one",
"id-two"
]
},
"single": {
"summary": "Single document id",
"value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b"
}
}
},
{
"name": "savedObjectIds",
"in": "query",
"description": "Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.\n",
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_SavedObjectIds"
},
"examples": {
"singleTimeline": {
"summary": "Single timeline id",
"value": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
},
{
"name": "page",
"in": "query",
"description": "Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.\n",
"schema": {
"type": [
"null",
"string"
]
},
"example": "1"
},
{
"name": "perPage",
"in": "query",
"description": "Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.\n",
"schema": {
"type": [
"null",
"string"
]
},
"example": "20"
},
{
"name": "search",
"in": "query",
"description": "Search string for saved-objects find (list mode only).",
"schema": {
"type": [
"null",
"string"
]
}
},
{
"name": "sortField",
"in": "query",
"description": "Field to sort by for saved-objects find (list mode only).",
"schema": {
"type": [
"null",
"string"
]
}
},
{
"name": "sortOrder",
"in": "query",
"description": "Sort order (`asc` or `desc`) for saved-objects find (list mode only).",
"schema": {
"type": [
"null",
"string"
]
},
"example": "desc"
},
{
"name": "filter",
"in": "query",
"description": "Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).\n",
"schema": {
"type": [
"null",
"string"
]
}
},
{
"name": "createdByFilter",
"in": "query",
"description": "Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).\n",
"schema": {
"type": [
"null",
"string"
]
},
"example": "f1c2d3e4-5b6a-7890-abcd-ef1234567890"
},
{
"name": "associatedFilter",
"in": "query",
"description": "Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.\n",
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_AssociatedFilterType"
}
}
],
"responses": {
"200": {
"description": "Notes and total count for the requested mode.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_GetNotesResult"
},
"examples": {
"notesPage": {
"summary": "Paged notes for a timeline",
"value": {
"notes": [
{
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "Escalated to tier-2 analyst",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"version": "WzQ2LDFd"
}
],
"totalCount": 1
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"Security Timeline API"
],
"summary": "Add or update a note",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a new note or updates an existing one.\n\n**Create:** Send `note` and omit `noteId` to create a new saved object.\n\n**Update:** Send `note` with the changed fields and set `noteId` to the note's saved object ID. Optionally include `version` for optimistic concurrency when the client has it from a prior read.\n\nRequires the **Timeline and Notes** write privilege (`notes_write`).\n",
"externalDocs": {
"description": "Add or update a note on a Timeline",
"url": "https://www.elastic.co/guide/en/security/current/timeline-api-update.html"
},
"operationId": "PersistNoteRoute",
"requestBody": {
"description": "Body must include the `note` object. For updates, include `noteId` (and optionally `version`).\nTo attach a note to a specific event, set `note.eventId` to that event's document `_id`; for a timeline-wide note, omit or clear `eventId` per product rules.\n",
"content": {
"application/json": {
"schema": {
"required": [
"note"
],
"type": "object",
"properties": {
"note": {
"$ref": "#/components/schemas/Security_Timeline_API_BareNote"
},
"noteId": {
"type": [
"null",
"string"
],
"description": "The `savedObjectId` of the note to update. Omit when creating a new note.",
"example": "709f99c6-89b6-4953-9160-35945c8e174e"
},
"version": {
"type": [
"null",
"string"
],
"description": "Saved object version string from a previous read; optional on update.",
"example": "WzQ2LDFd"
}
}
},
"examples": {
"addNote": {
"summary": "Add a note on an event",
"value": {
"note": {
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "Escalated to tier-2 analyst",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "The persisted note, including `noteId` and `version`.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_ResponseNote"
},
"examples": {
"persisted": {
"summary": "Persisted note wrapper",
"value": {
"note": {
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "Escalated to tier-2 analyst",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"version": "WzQ2LDFd"
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/observability_ai_assistant/chat/complete": {
"post": {
"tags": [
"observability_ai_assistant"
],
"summary": "Generate a chat completion",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new chat completion by using the Observability AI Assistant.\n\nThe API returns the model's response based on the current conversation context.\n\nIt also handles any tool requests within the conversation, which may trigger multiple calls to the underlying large language model (LLM).\n\nThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n",
"operationId": "observability-ai-assistant-chat-complete",
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"messages",
"connectorId",
"persist"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Observability_AI_Assistant_API_Function"
}
},
"connectorId": {
"type": "string",
"description": "A unique identifier for the connector."
},
"conversationId": {
"type": "string",
"description": "A unique identifier for the conversation if you are continuing an existing conversation."
},
"disableFunctions": {
"type": "boolean",
"description": "Flag indicating whether all function calls should be disabled for the conversation. If true, no calls to functions will be made."
},
"instructions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Observability_AI_Assistant_API_Instruction"
},
"description": "An array of instruction objects, which can be either simple strings or detailed objects."
},
"messages": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Observability_AI_Assistant_API_Message"
},
"description": "An array of message objects containing the conversation history."
},
"persist": {
"type": "boolean",
"description": "Indicates whether the conversation should be saved to storage. If true, the conversation will be saved and will be available in Kibana."
},
"title": {
"type": "string",
"description": "A title for the conversation."
}
}
},
"examples": {
"chatCompleteRequestExample": {
"$ref": "#/components/examples/Observability_AI_Assistant_API_ChatCompleteRequestExample"
}
}
}
}
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"chatCompleteResponseExample": {
"$ref": "#/components/examples/Observability_AI_Assistant_API_ChatCompleteResponseExample"
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "cURL",
"source": "curl --request POST 'localhost:5601/api/observability_ai_assistant/chat/complete' -u : -H 'kbn-xsrf: true' -H \"Content-Type: application/json\" --data '\n{\n\"connectorId\": \"\",\n\"disableFunctions\": false,\n \"messages\": [\n {\n \"@timestamp\": \"2025-06-25T23:45:00.000Z\",\n \"message\": {\n \"role\": \"user\",\n \"content\": \"Is my Elasticsearch cluster healthy right now?\"\n }\n }\n ],\n\"persist\": false,\n\"actions\": [\n {\n \"name\": \"get_cluster_health\",\n \"description\": \"Fetch the current Elasticsearch cluster-health status and key metrics.\",\n \"parameters\": {\n \"type\": \"object\",\n \"properties\": {\n \"includeShardStats\": {\n \"type\": \"boolean\",\n \"default\": false\n }\n }\n }\n }\n],\n\"instructions\": [\"When the user asks about Elasticsearch cluster health, use the get_cluster_health tool to retrieve cluster health, then summarize the response in plain English.\"]\n}'\n"
}
],
"x-state": "Technical Preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/osquery/history": {
"get": {
"tags": [
"Security Osquery API"
],
"summary": "Get unified query history",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/osquery/history
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.\n",
"operationId": "OsqueryGetUnifiedHistory",
"parameters": [
{
"name": "pageSize",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"maximum": 100,
"minimum": 1,
"type": "integer",
"description": "The number of results to return per page.",
"default": 20
}
},
{
"name": "nextPage",
"in": "query",
"description": "A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.",
"schema": {
"type": "string",
"description": "A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page."
}
},
{
"name": "kuery",
"in": "query",
"description": "A search string to filter history entries by pack name, query text, or query ID.",
"schema": {
"type": "string",
"description": "A search string to filter history entries by pack name, query text, or query ID."
}
},
{
"name": "userIds",
"in": "query",
"description": "Comma-separated list of user IDs to filter live query history.",
"schema": {
"type": "string",
"description": "Comma-separated list of user IDs to filter live query history.",
"example": "elastic,admin"
}
},
{
"name": "sourceFilters",
"in": "query",
"description": "Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.",
"schema": {
"type": "string",
"description": "Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.",
"example": "live,scheduled"
}
},
{
"name": "startDate",
"in": "query",
"description": "The start of the time range filter (ISO 8601).",
"schema": {
"type": "string",
"description": "The start of the time range filter (ISO 8601).",
"example": "2024-01-01T00:00:00Z"
}
},
{
"name": "endDate",
"in": "query",
"description": "The end of the time range filter (ISO 8601).",
"schema": {
"type": "string",
"description": "The end of the time range filter (ISO 8601).",
"example": "2024-12-31T23:59:59Z"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_GetUnifiedHistoryResponse"
},
"examples": {
"unifiedHistoryExample": {
"summary": "Example unified history response",
"value": {
"data": [
{
"actionId": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agentCount": 5,
"errorCount": 0,
"id": "3c42c847-eb30-4452-80e0-728584042334",
"queryName": "uptime_query",
"queryText": "select * from uptime;",
"source": "Live",
"sourceType": "live",
"successCount": 5,
"timestamp": "2024-07-26T09:59:32.220Z",
"totalRows": 42,
"userId": "elastic"
},
{
"agentCount": 10,
"errorCount": 1,
"executionCount": 3,
"id": "pack_my_pack_uptime_3",
"packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
"packName": "My Pack",
"plannedTime": "2024-07-26T09:00:00.000Z",
"queryName": "uptime",
"queryText": "select * from uptime;",
"scheduleId": "pack_my_pack_uptime",
"source": "Scheduled",
"sourceType": "scheduled",
"successCount": 9,
"timestamp": "2024-07-26T09:00:00.000Z",
"totalRows": 100
}
],
"hasMore": true,
"nextPage": "eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3..."
}
}
}
}
}
}
},
"x-state": "Generally available; Added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/osquery/live_queries": {
"get": {
"tags": [
"Security Osquery API"
],
"summary": "Get live queries",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all live queries.",
"operationId": "OsqueryFindLiveQueries",
"parameters": [
{
"name": "kuery",
"in": "query",
"description": "A KQL search string to filter live queries.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_KueryOrUndefined"
}
},
{
"name": "page",
"in": "query",
"description": "The page number to return.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined"
}
},
{
"name": "pageSize",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined"
}
},
{
"name": "sort",
"in": "query",
"description": "The field to sort results by.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined"
}
},
{
"name": "sortOrder",
"in": "query",
"description": "The sort order.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_FindLiveQueryResponse"
},
"examples": {
"liveQueriesList": {
"summary": "A list of recent live queries",
"value": {
"data": {
"items": [
{
"_source": {
"@timestamp": "2023-10-31T00:00:00Z",
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"expiration": "2023-10-31T00:00:00Z",
"queries": [
{
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
"query": "select * from uptime;",
"saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d"
}
],
"user_id": "elastic"
}
}
],
"total": 1
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Osquery API"
],
"summary": "Create a live query",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and run a live query.",
"operationId": "OsqueryCreateLiveQuery",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody"
},
"examples": {
"singleQueryAllAgents": {
"summary": "Run a single query on all agents",
"value": {
"agent_all": true,
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"query": "select * from uptime;"
}
},
"targetedQuery": {
"summary": "Run a query against specific agents",
"value": {
"agent_ids": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"query": "select * from processes;"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse"
},
"examples": {
"liveQueryCreated": {
"summary": "Live query created",
"value": {
"data": {
"@timestamp": "2022-07-26T09:59:32.220Z",
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
"agent_all": true,
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"expiration": "2022-07-26T10:04:32.220Z",
"input_type": "osquery",
"queries": [
{
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
"query": "select * from uptime;",
"timeout": 120
}
],
"type": "INPUT_ACTION",
"user_id": "elastic"
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/osquery/live_queries/{id}": {
"get": {
"tags": [
"Security Osquery API"
],
"summary": "Get live query details",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/osquery/live_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a live query using the query ID.",
"operationId": "OsqueryGetLiveQueryDetails",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The ID of the live query.",
"required": true,
"schema": {
"type": "string",
"description": "The ID of the live query result you want to retrieve.",
"example": "3c42c847-eb30-4452-80e0-728584042334"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse"
},
"examples": {
"liveQueryDetails": {
"summary": "Live query details with execution status",
"value": {
"data": {
"@timestamp": "2022-07-26T09:59:32.220Z",
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"expiration": "2022-07-26T10:04:32.220Z",
"queries": [
{
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"docs": 1,
"failed": 0,
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
"pending": 0,
"query": "select * from uptime;",
"responded": 1,
"status": "completed",
"successful": 1
}
],
"status": "completed",
"user_id": "elastic"
}
}
}
}
}
}
},
"404": {
"description": "No live query with this `id` exists in the current space. Live queries issued from another space also return 404.\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string",
"example": "Action not found"
}
}
},
"examples": {
"actionNotFound": {
"summary": "The live query does not exist in the current space",
"value": {
"message": "Action not found"
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/osquery/live_queries/{id}/results/{actionId}": {
"get": {
"tags": [
"Security Osquery API"
],
"summary": "Get live query results",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the results of a live query using the query action ID.",
"operationId": "OsqueryGetLiveQueryResults",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The ID of the live query.",
"required": true,
"schema": {
"type": "string",
"description": "The ID of the live query result you want to retrieve.",
"example": "3c42c847-eb30-4452-80e0-728584042334"
}
},
{
"name": "actionId",
"in": "path",
"description": "The ID of the query action.",
"required": true,
"schema": {
"type": "string",
"description": "The ID of the query action that generated the live query results.",
"example": "609c4c66-ba3d-43fa-afdd-53e244577aa0"
}
},
{
"name": "kuery",
"in": "query",
"description": "A KQL search string to filter results.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_KueryOrUndefined"
}
},
{
"name": "page",
"in": "query",
"description": "The page number to return.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined"
}
},
{
"name": "pageSize",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined"
}
},
{
"name": "sort",
"in": "query",
"description": "The field to sort results by.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined"
}
},
{
"name": "sortOrder",
"in": "query",
"description": "The sort order.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse"
},
"examples": {
"liveQueryResults": {
"summary": "Result rows from a live query execution",
"value": {
"data": {
"edges": [
{
"_id": "doc1",
"_source": {
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agent": {
"id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
},
"osquery": {
"total_seconds": "12345"
}
}
},
{
"_id": "doc2",
"_source": {
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agent": {
"id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
},
"osquery": {
"total_seconds": "67890"
}
}
}
],
"total": 2
}
}
}
}
}
}
},
"404": {
"description": "Either no live query with this `id` exists in the current space (`Action not found`; live queries issued from another space also return 404), or it has no query whose `action_id` matches `{actionId}` (`Live query action not found`).\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string",
"example": "Action not found"
}
}
},
"examples": {
"actionNotFound": {
"summary": "The live query does not exist in the current space",
"value": {
"message": "Action not found"
}
},
"queryActionNotFound": {
"summary": "The id/actionId pair refers to different queries",
"value": {
"message": "Live query action not found"
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/osquery/live_queries/{id}/results/{actionId}/_export": {
"post": {
"tags": [
"Security Osquery API"
],
"summary": "Export live query results",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.\n",
"operationId": "OsqueryExportLiveQueryResults",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The ID of the live query (parent action ID).",
"required": true,
"schema": {
"type": "string",
"description": "The ID of the live query.",
"example": "3c42c847-eb30-4452-80e0-728584042334"
}
},
{
"name": "actionId",
"in": "path",
"description": "The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.",
"required": true,
"schema": {
"type": "string",
"description": "The ID of the query action.",
"example": "609c4c66-ba3d-43fa-afdd-53e244577aa0"
}
},
{
"name": "format",
"in": "query",
"description": "The output format of the exported file.",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_ExportFormat"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_ExportRequestBody"
},
"examples": {
"filteredExport": {
"summary": "Export only rows matching a KQL filter",
"value": {
"kuery": "user.name: \"root\""
}
}
}
}
}
},
"responses": {
"200": {
"description": "A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.\n",
"headers": {
"Content-Disposition": {
"description": "Attachment disposition with a generated filename, e.g. `attachment; filename=\"osquery-results-{actionId}-{timestamp}.ndjson\"`.",
"schema": {
"type": "string",
"example": "attachment; filename=\"osquery-results-609c4c66-ba3d-43fa-afdd-53e244577aa0-2026-04-30T09-12-00-000Z.ndjson\""
}
}
},
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_ExportJsonResponse"
},
"examples": {
"jsonExport": {
"summary": "JSON export with metadata and results",
"value": {
"_meta": {
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"exported_by": "elastic",
"format": "json",
"query": "SELECT * FROM users;",
"timestamp": "2026-04-30T09:12:00.000Z",
"total_results": 2
},
"results": [
{
"@timestamp": "2026-04-30T09:11:58.321Z",
"agent": {
"id": "980a6b73-0b03-4d1e-8915-67c202e4a980",
"name": "prod-host-1"
},
"user": {
"id": "1000",
"name": "ubuntu"
}
}
]
}
}
}
},
"application/ndjson": {
"schema": {
"type": "string",
"description": "Newline-delimited JSON stream. The first line is a metadata object; each subsequent line is a result row.\n",
"format": "binary"
},
"examples": {
"ndjsonExport": {
"summary": "NDJSON export with a leading metadata line",
"value": "{\"_meta\":{\"action_id\":\"609c4c66-ba3d-43fa-afdd-53e244577aa0\",\"query\":\"SELECT * FROM users;\",\"timestamp\":\"2026-04-30T09:12:00.000Z\",\"exported_by\":\"elastic\",\"format\":\"ndjson\",\"total_results\":2}}\n{\"@timestamp\":\"2026-04-30T09:11:58.321Z\",\"agent\":{\"id\":\"980a6b73-0b03-4d1e-8915-67c202e4a980\",\"name\":\"prod-host-1\"},\"user\":{\"id\":\"1000\",\"name\":\"ubuntu\"}}\n{\"@timestamp\":\"2026-04-30T09:11:58.456Z\",\"agent\":{\"id\":\"980a6b73-0b03-4d1e-8915-67c202e4a980\",\"name\":\"prod-host-1\"},\"user\":{\"id\":\"0\",\"name\":\"root\"}}\n"
}
}
},
"text/csv": {
"schema": {
"type": "string",
"description": "CSV file with a header row derived from the ECS mapping of the originating query (when available). No metadata block is included in CSV output.\n",
"format": "binary"
},
"examples": {
"csvExport": {
"summary": "CSV export with a header row",
"value": "agent.name,agent.id,user.id,user.name\nprod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,1000,ubuntu\nprod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,0,root\n"
}
}
}
}
},
"400": {
"description": "Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string",
"example": "Export limited to 500,000 results. Found 500,001. Please add filters to narrow results."
}
}
},
"examples": {
"rowLimitExceeded": {
"summary": "Result count exceeds the export limit",
"value": {
"message": "Export limited to 500,000 results. Found 500,001. Please add filters to narrow results."
}
}
}
}
}
},
"403": {
"description": "The authenticated user does not have the `osquery-readLiveQueries` privilege required to export live query results.\n"
},
"404": {
"description": "The parent live query action `{id}` was found but does not contain a query whose `action_id` matches `{actionId}`. This typically means the `id` and `actionId` URL parameters refer to different queries.\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string",
"example": "Live query action not found"
}
}
},
"examples": {
"actionNotFound": {
"summary": "The id/actionId pair refers to different queries",
"value": {
"message": "Live query action not found"
}
}
}
}
}
}
},
"x-state": "Generally available; Added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/osquery/packs": {
"get": {
"tags": [
"Security Osquery API"
],
"summary": "Get packs",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all query packs.",
"operationId": "OsqueryFindPacks",
"parameters": [
{
"name": "page",
"in": "query",
"description": "The page number to return.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined"
}
},
{
"name": "pageSize",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined"
}
},
{
"name": "sort",
"in": "query",
"description": "The field to sort results by.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined"
}
},
{
"name": "sortOrder",
"in": "query",
"description": "The sort order.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_FindPacksResponse"
},
"examples": {
"packsList": {
"summary": "A list of query packs",
"value": {
"data": [
{
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "My pack",
"enabled": true,
"name": "my_pack",
"queries": [
{
"id": "ports",
"interval": 60,
"query": "SELECT * FROM listening_ports;",
"removed": false,
"snapshot": true,
"timeout": 120
}
],
"saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic",
"version": 1
}
],
"page": 1,
"per_page": 20,
"total": 1
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Osquery API"
],
"summary": "Create a pack",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet paginated query result rows (the actual osquery output data) for a specific scheduled query execution.\n",
"operationId": "OsqueryGetScheduledQueryResults",
"parameters": [
{
"name": "scheduleId",
"in": "path",
"description": "The schedule ID of the scheduled query.",
"required": true,
"schema": {
"type": "string",
"description": "The schedule ID of the scheduled query.",
"example": "pack_my_pack_uptime"
}
},
{
"name": "executionCount",
"in": "path",
"description": "The execution count for this scheduled query run.",
"required": true,
"schema": {
"type": "integer",
"description": "The execution count for this scheduled query run.",
"example": 3
}
},
{
"name": "kuery",
"in": "query",
"description": "The kuery to filter the results by.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_KueryOrUndefined"
}
},
{
"name": "page",
"in": "query",
"description": "The page number to return. The default is 1.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined"
}
},
{
"name": "pageSize",
"in": "query",
"description": "The number of results to return per page. The default is 20.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined"
}
},
{
"name": "sort",
"in": "query",
"description": "The field that is used to sort the results.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined"
}
},
{
"name": "sortOrder",
"in": "query",
"description": "Specifies the sort order.",
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined"
}
},
{
"name": "startDate",
"in": "query",
"description": "The start date filter (ISO 8601) to narrow down results.",
"schema": {
"type": "string",
"description": "The start date filter (ISO 8601) to narrow down results.",
"example": "2024-01-01T00:00:00Z"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Osquery_API_GetScheduledQueryResultsResponse"
},
"examples": {
"scheduledQueryResultsExample": {
"summary": "Example scheduled query results response",
"value": {
"data": {
"edges": [
{
"_id": "row-001",
"fields": {
"host.uptime": [
"12345"
]
}
},
{
"_id": "row-002",
"fields": {
"host.uptime": [
"67890"
]
}
}
],
"total": 2
}
}
}
}
}
}
}
},
"x-state": "Generally available; Added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/pinned_event": {
"patch": {
"tags": [
"Security Timeline API"
],
"summary": "Pin/unpin an event",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/pinned_event
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPin/unpin an event to/from an existing Timeline.",
"operationId": "PersistPinnedEventRoute",
"requestBody": {
"description": "The pinned event to add or unpin, along with additional metadata.",
"content": {
"application/json": {
"schema": {
"required": [
"eventId",
"timelineId"
],
"type": "object",
"properties": {
"eventId": {
"type": "string",
"description": "The `_id` of the associated event for this pinned event.",
"example": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc"
},
"pinnedEventId": {
"type": [
"null",
"string"
],
"description": "The `savedObjectId` of the pinned event you want to unpin.",
"example": "10r1929b-0af7-42bd-85a8-56e234f98h2f3"
},
"timelineId": {
"type": "string",
"description": "The `savedObjectId` of the timeline that you want this pinned event unpinned from.",
"example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
},
"examples": {
"pinEvent": {
"summary": "Pin an event",
"value": {
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_PersistPinnedEventResponse"
},
"examples": {
"pinnedSaved": {
"summary": "Pinned event saved object",
"value": {
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"version": "WzQ2LDFe"
}
},
"unpinned": {
"summary": "Unpin response",
"value": {
"unpinned": true
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/profiling/setup/es_resources": {
"get": {
"tags": [
"Universal Profiling"
],
"summary": "Get Universal Profiling setup status",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/profiling/setup/es_resources
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCheck if Universal Profiling has been set up and configured properly
[Required authorization] Route required privileges: profiling.",
"operationId": "get-profiling-setup-es-resources",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_profiling_setup_status_response"
},
"examples": {
"notSetUp": {
"summary": "Not set up yet",
"description": "The Elasticsearch profiling plugin is enabled, but the required resources have not been created. Call `POST /api/profiling/setup/es_resources` to set them up.",
"value": {
"has_data": false,
"has_required_role": true,
"has_setup": false,
"pre_8_9_1_data": false,
"profiling_enabled": true
}
},
"profilingDisabled": {
"summary": "Disabled in Elasticsearch",
"description": "The Universal Profiling plugin is disabled in the Elasticsearch cluster, so setup cannot complete until it is enabled.",
"value": {
"has_data": false,
"has_required_role": true,
"has_setup": false,
"pre_8_9_1_data": false,
"profiling_enabled": false
}
},
"setUpWithData": {
"summary": "Set up and receiving data",
"description": "Universal Profiling is set up and profiling data has been ingested.",
"value": {
"has_data": true,
"has_required_role": true,
"has_setup": true,
"pre_8_9_1_data": false,
"profiling_enabled": true
}
}
}
}
}
},
"403": {
"description": "The user does not have the privileges required to read the Universal Profiling setup status."
},
"500": {
"description": "An unexpected error occurred while checking the Universal Profiling setup status."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Universal Profiling"
],
"summary": "Initialize Universal Profiling setup",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSet up Universal Profiling resources and configuration
[Required authorization] Route required privileges: profiling.",
"operationId": "post-profiling-setup-es-resources",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"responses": {
"202": {
"description": "Setup was accepted. Enabling resource management in Elasticsearch is asynchronous and may not have completed by the time this response is sent."
},
"403": {
"description": "The user does not have the privileges required to set up Universal Profiling."
},
"500": {
"description": "An unexpected error occurred. Setup failed."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/risk_score/engine/dangerously_delete_data": {
"delete": {
"tags": [
"Security Entity Analytics API"
],
"summary": "Cleanup the Risk Engine",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve sets of saved objects that you want to import into Kibana. You must include `type` or `objects` in the request body. The output of exporting saved objects must be treated as opaque. Tampering with exported data risks introducing unspecified errors and data loss.\n\nExported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n\nNOTE: The exported saved objects include `coreMigrationVersion` and `typeMigrationVersion` metadata. If you store exported saved objects outside of Kibana (for example in NDJSON files) or generate them yourself, you must preserve or include these fields to retain forward compatibility across Kibana versions.\n\nNOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be exported.",
"operationId": "post-saved-objects-export",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"excludeExportDetails": {
"type": "boolean",
"description": "Do not add export details entry at the end of the stream.",
"default": false
},
"hasReference": {
"anyOf": [
{
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
},
{
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
}
}
]
},
"includeReferencesDeep": {
"type": "boolean",
"description": "Includes all of the referenced objects in the exported objects.",
"default": false
},
"objects": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
},
"description": "A list of objects to export. NOTE: this optional parameter cannot be combined with the `types` option"
},
"search": {
"maxLength": 10000,
"type": "string",
"description": "Search for documents to export using the Elasticsearch Simple Query String syntax."
},
"type": {
"anyOf": [
{
"maxLength": 256,
"type": "string"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
}
],
"description": "The saved object types to include in the export. Use `*` to export all the types. Valid options depend on enabled plugins, but may include `visualization`, `dashboard`, `search`, `index-pattern`, `tag`, `config`, `config-global`, `lens`, `map`, `event-annotation-group`, `query`, `url`, `action`, `alert`, `alerting_rule_template`, `apm-indices`, `cases-user-actions`, `cases`, `cases-comments`, `infrastructure-monitoring-log-view`, `ml-trained-model`, `osquery-saved-query`, `osquery-pack`, `osquery-pack-asset`."
}
},
"additionalProperties": false
},
"examples": {
"exportSavedObjectsRequest": {
"summary": "Export a specific saved object",
"value": {
"excludeExportDetails": true,
"includeReferencesDeep": false,
"objects": [
{
"id": "example-dashboard-1",
"type": "dashboard"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successfull call.",
"content": {
"application/x-ndjson": {
"schema": { },
"examples": {
"exportSavedObjectsResponse": {
"summary": "The export response contains an NDJSON record for each exported object",
"value": "{\"id\":\"example-dashboard-1\",\"type\":\"dashboard\",\"attributes\":{\"title\":\"Example dashboard 1\"},\"references\":[],\"managed\":false}\n{\"exportedCount\":1,\"missingRefCount\":0,\"missingReferences\":[]}\n"
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"schema": {
"required": [
"error",
"message",
"statusCode"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"enum": [
400
],
"type": "integer"
}
},
"additionalProperties": false,
"description": "Indicates an unsuccessful response."
},
"examples": {
"badRequestResponse": {
"summary": "A bad request error",
"value": {
"error": "Bad Request",
"message": "Either `type` or `objects` are required.: Bad Request",
"statusCode": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/saved_objects/_export\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"objects\":[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"}],\"includeReferencesDeep\":false,\"excludeExportDetails\":true}'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/saved_objects/_export\n{\"objects\":[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"}],\"includeReferencesDeep\":false,\"excludeExportDetails\":true}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/saved_objects/_find": {
"get": {
"tags": [
"saved objects"
],
"summary": "Search for saved objects",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/saved_objects/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nSearches for Kibana saved objects.\n\nFor transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`).",
"operationId": "get-saved-objects-find",
"parameters": [
{
"name": "per_page",
"in": "query",
"description": "The number of items per page.",
"schema": {
"minimum": 0,
"type": "number",
"default": 20
}
},
{
"name": "page",
"in": "query",
"description": "The page index to return.",
"schema": {
"minimum": 0,
"type": "number",
"default": 1
}
},
{
"name": "type",
"in": "query",
"description": "The saved object type or types to search for. Use multiple `type` values to search across types.",
"required": true,
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
}
},
{
"name": "search",
"in": "query",
"description": "A text search string.",
"schema": {
"maxLength": 10000,
"type": "string"
}
},
{
"name": "default_search_operator",
"in": "query",
"description": "The boolean operator to use when combining multiple values.",
"schema": {
"enum": [
"OR",
"AND"
],
"type": "string",
"default": "OR"
}
},
{
"name": "search_fields",
"in": "query",
"description": "The fields to search on.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"type": "string"
}
}
},
{
"name": "sort_field",
"in": "query",
"description": "The field to sort on.",
"schema": {
"maxLength": 1024,
"type": "string"
}
},
{
"name": "has_reference",
"in": "query",
"description": "Return only saved objects that have a reference to the specified saved object(s).",
"schema": {
"anyOf": [
{
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
},
{
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
}
}
]
}
},
{
"name": "has_reference_operator",
"in": "query",
"description": "The boolean operator to use when combining multiple values.",
"schema": {
"enum": [
"OR",
"AND"
],
"type": "string",
"default": "OR"
}
},
{
"name": "has_no_reference",
"in": "query",
"description": "Return only saved objects that do not have a reference to the specified saved object(s).",
"schema": {
"anyOf": [
{
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
},
{
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 512,
"type": "string"
},
"type": {
"maxLength": 256,
"type": "string"
}
},
"additionalProperties": false
}
}
]
}
},
{
"name": "has_no_reference_operator",
"in": "query",
"description": "The boolean operator to use when combining multiple values.",
"schema": {
"enum": [
"OR",
"AND"
],
"type": "string",
"default": "OR"
}
},
{
"name": "fields",
"in": "query",
"description": "The fields to return for each saved object.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"type": "string"
}
}
},
{
"name": "filter",
"in": "query",
"description": "A KQL filter to apply to the search.",
"schema": {
"maxLength": 10000,
"type": "string"
}
},
{
"name": "aggs",
"in": "query",
"description": "Aggregations as a JSON string.",
"schema": {
"maxLength": 100000,
"type": "string"
}
},
{
"name": "namespaces",
"in": "query",
"description": "The namespaces (spaces) to search in.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 512,
"type": "string"
}
}
}
],
"responses": {
"200": {
"description": "A search response.",
"content": {
"application/json": {
"examples": {
"findSavedObjectsResponse": {
"summary": "A page of saved objects",
"value": {
"page": 1,
"per_page": 20,
"saved_objects": [
{
"attributes": {
"title": "Example dashboard 1"
},
"id": "example-dashboard-1",
"managed": false,
"namespaces": [
"default"
],
"references": [ ],
"type": "dashboard",
"updated_at": "2026-04-17T12:00:00.000Z",
"version": "WzEsMV0="
}
],
"total": 1
}
}
}
}
}
},
"400": {
"description": "A bad request.",
"content": {
"application/json": {
"examples": {
"badRequestResponse": {
"summary": "A bad request error",
"value": {
"error": "Bad Request",
"message": "This type dashboard is not allowed: Bad Request",
"statusCode": 400
}
}
}
}
}
}
},
"deprecated": true,
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/saved_objects/_find?type=dashboard&fields=title&per_page=20&page=1\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/saved_objects/_find?type=dashboard&fields=title&per_page=20&page=1\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/saved_objects/_import": {
"post": {
"tags": [
"saved objects"
],
"summary": "Import saved objects",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/saved_objects/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate sets of Kibana saved objects from a file created by the export API. Saved objects can only be imported into the same version, a newer minor on the same major, or the next major. Tampering with exported data risks introducing unspecified errors and data loss.\n\nExported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n\nNOTE: The exported saved objects include `coreMigrationVersion` and `typeMigrationVersion` metadata. If you store exported saved objects outside of Kibana (for example in NDJSON files) or generate them yourself, you must preserve or include these fields to retain forwards compatibility across Kibana versions.",
"operationId": "post-saved-objects-import",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "overwrite",
"in": "query",
"description": "Overwrites saved objects when they already exist. When used, potential conflict errors are automatically resolved by overwriting the destination object. NOTE: This option cannot be used with the `createNewCopies` option.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "createNewCopies",
"in": "query",
"description": "Creates copies of saved objects, regenerates each object ID, and resets the origin. When used, potential conflict errors are avoided. NOTE: This option cannot be used with the `overwrite` and `compatibilityMode` options.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "compatibilityMode",
"in": "query",
"description": "Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with imported saved objects. NOTE: This option cannot be used with the `createNewCopies` option.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"multipart/form-data": {
"schema": {
"required": [
"file"
],
"type": "object",
"properties": {
"file": {
"type": "object",
"description": "A file exported using the export API. Changing the contents of the exported file in any way before importing it can cause errors, crashes or data loss. NOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be included in this file. Similarly, the `savedObjects.maxImportPayloadBytes` setting limits the overall size of the file that can be imported."
}
},
"additionalProperties": false
},
"examples": {
"importObjectsRequest": {
"summary": "Import saved objects from an NDJSON file",
"value": {
"file": "file.ndjson"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"success",
"successCount",
"errors",
"successResults"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"type": "object"
},
"description": "Indicates the import was unsuccessful and specifies the objects that failed to import.\n\nNOTE: One object may result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and conflict error."
},
"success": {
"type": "boolean",
"description": "Indicates when the import was successfully completed. When set to false, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties."
},
"successCount": {
"type": "number",
"description": "Indicates the number of successfully imported records."
},
"successResults": {
"type": "array",
"items": {
"type": "object"
},
"description": "Indicates the objects that are successfully imported, with any metadata if applicable.\n\nNOTE: Objects are created only when all resolvable errors are addressed, including conflicts and missing references. If objects are created as new copies, each entry in the `successResults` array includes a `destinationId` attribute."
}
},
"additionalProperties": false
},
"examples": {
"importObjectsResponse": {
"summary": "A successful import response",
"value": {
"errors": [ ],
"success": true,
"successCount": 1,
"successResults": [
{
"destinationId": "example-dashboard-1-copy",
"id": "example-dashboard-1",
"managed": false,
"type": "dashboard"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"schema": {
"required": [
"error",
"message",
"statusCode"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"enum": [
400
],
"type": "integer"
}
},
"additionalProperties": false,
"description": "Indicates an unsuccessful response."
},
"examples": {
"badRequestResponse": {
"summary": "A bad request error",
"value": {
"error": "Bad Request",
"message": "Invalid file extension .txt",
"statusCode": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/saved_objects/_import?createNewCopies=true\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n --form file=@file.ndjson\n"
},
{
"lang": "Console",
"source": "POST kbn://api/saved_objects/_import?createNewCopies=true\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/saved_objects/_resolve_import_errors": {
"post": {
"tags": [
"saved objects"
],
"summary": "Resolve import errors",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nRetrieve a single Kibana saved object by ID, using any legacy URL alias if it exists.\n\nUnder certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved with the resolve API using either its new ID or its old ID.",
"operationId": "get-saved-objects-resolve-type-id",
"parameters": [
{
"name": "type",
"in": "path",
"description": "The saved object type.",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
},
{
"name": "id",
"in": "path",
"description": "The saved object identifier.",
"required": true,
"schema": {
"maxLength": 512,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A resolve response.",
"content": {
"application/json": {
"examples": {
"resolveSavedObjectResponse": {
"summary": "A resolved saved object (alias match)",
"value": {
"alias_target_id": "example-dashboard-2",
"outcome": "aliasMatch",
"saved_object": {
"attributes": {
"title": "Example dashboard 2"
},
"id": "example-dashboard-2",
"managed": false,
"namespaces": [
"default"
],
"references": [ ],
"type": "dashboard",
"updated_at": "2026-04-17T12:00:00.000Z",
"version": "WzEsMl0="
}
}
}
}
}
}
},
"400": {
"description": "A bad request.",
"content": {
"application/json": {
"examples": {
"badRequestResponse": {
"summary": "A bad request error",
"value": {
"error": "Bad Request",
"message": "Unsupported saved object type(s): unknownType",
"statusCode": 400
}
}
}
}
}
}
},
"deprecated": true,
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/saved_objects/resolve/dashboard/legacy-id\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/saved_objects/resolve/dashboard/legacy-id\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security_ai_assistant/anonymization_fields/_bulk_action": {
"post": {
"tags": [
"Security AI Assistant API"
],
"summary": "Apply a bulk action to anonymization fields",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a knowledge base. Use this endpoint when no specific resource identifier is needed.",
"operationId": "PostKnowledgeBase",
"parameters": [
{
"name": "modelId",
"in": "query",
"description": "ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.",
"schema": {
"type": "string"
},
"example": "elser-model-001"
},
{
"name": "ignoreSecurityLabs",
"in": "query",
"description": "Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.",
"schema": {
"type": "boolean",
"default": false
},
"example": true
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse"
},
"examples": {
"KnowledgeBaseResponse200Example2": {
"summary": "A response that indicates that the request was successful.",
"value": {
"success": true
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400"
},
"examples": {
"KnowledgeBaseResponse400Example2": {
"summary": "A response for a request that failed due to an invalid query parameter value.",
"value": "statusCode: 400 error: Bad Request message: \"[request query]: ignoreSecurityLabs: Invalid enum value. Expected 'true' | 'false', received 'yes', ignoreSecurityLabs: Expected boolean, received string\"\n"
}
}
}
}
}
},
"x-codeSamples": [
{
"label": "Example request",
"lang": "curl",
"source": "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base?ignoreSecurityLabs=false' \\\n --header \"Authorization: $API_KEY\"\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security_ai_assistant/knowledge_base/{resource}": {
"get": {
"tags": [
"Security AI Assistant API"
],
"summary": "Read a KnowledgeBase for a resource",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRun one or more Security Solution initialization flows for the current space.\nEach flow provisions a specific set of assets, for example list indices,\nsecurity data views, prebuilt detection rules, endpoint protection, AI prompts,\nor detection rule monitoring assets. Only the requested flows are run, and the\nresponse reports a result for each one.\n",
"operationId": "InitializeSecuritySolution",
"requestBody": {
"description": "The initialization flows to run.",
"content": {
"application/json": {
"schema": {
"required": [
"flows"
],
"type": "object",
"properties": {
"flows": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowId"
}
}
}
},
"examples": {
"default": {
"value": {
"flows": [
"init-prebuilt-rules",
"init-endpoint-protection",
"init-ai-prompts"
]
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call. Returns a result for each requested flow.",
"content": {
"application/json": {
"schema": {
"required": [
"flows"
],
"type": "object",
"properties": {
"flows": {
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowsResult"
}
}
},
"examples": {
"default": {
"value": {
"flows": {
"init-ai-prompts": {
"payload": {
"install_status": "installed",
"name": "security_ai_prompts",
"version": "8.17.1"
},
"status": "ready"
},
"init-endpoint-protection": {
"payload": {
"install_status": "already_installed",
"name": "endpoint",
"version": "8.17.1"
},
"status": "ready"
},
"init-prebuilt-rules": {
"payload": {
"install_status": "installed",
"name": "security_detection_engine",
"version": "8.17.1"
},
"status": "ready"
}
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Update the Entity Store",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/security/entity_store
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the Entity Store configuration without reinstalling. Send `logExtraction` to change log extraction settings. Omitting a log extraction field leaves it unchanged. Sending `null` for a log extraction field clears that override and reverts to the default. Send `historySnapshot.frequency` to change the snapshot interval (at least 1 hour) and `historySnapshot.retentionDays` to change how long snapshots are kept. Omitting either history snapshot field leaves it unchanged. At least one of `logExtraction` or `historySnapshot` is required.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "put-security-entity-store",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"excludedUserNames": {
"maxItems": 200,
"type": "array",
"items": {
"type": "string"
}
},
"historySnapshot": {
"type": "object",
"properties": {
"frequency": {
"maxLength": 32,
"pattern": "[smdh]$",
"type": "string"
},
"retentionDays": {
"maximum": 3650,
"minimum": 1,
"type": "integer"
}
},
"additionalProperties": false
},
"logExtraction": {
"type": "object",
"properties": {
"additionalIndexPatterns": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"maxLength": 2048,
"type": "string"
}
},
"delay": {
"maxLength": 32,
"pattern": "[smdh]$",
"type": [
"null",
"string"
]
},
"docsLimit": {
"maximum": 9007199254740991,
"minimum": 1,
"type": [
"null",
"integer"
]
},
"excludedIndexPatterns": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"maxLength": 2048,
"type": "string"
}
},
"fieldHistoryLength": {
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"type": [
"null",
"integer"
]
},
"frequency": {
"maxLength": 32,
"pattern": "[smdh]$",
"type": [
"null",
"string"
]
},
"lookbackPeriod": {
"maxLength": 32,
"pattern": "[smdh]$",
"type": [
"null",
"string"
]
},
"maxLogsPerPage": {
"maximum": 9007199254740991,
"minimum": 1,
"type": [
"null",
"integer"
]
},
"maxLogsPerWindow": {
"maximum": 9007199254740991,
"minimum": 0,
"type": [
"null",
"integer"
]
},
"maxLogsPerWindowCapBehavior": {
"enum": [
"defer",
"drop"
],
"type": [
"null",
"string"
]
},
"maxTimeWindowSize": {
"maxLength": 32,
"pattern": "[smdh]$",
"type": [
"null",
"string"
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"examples": {
"clearLogExtractionOverrideExample": {
"summary": "Clear log extraction overrides",
"description": "Send null for any field to clear that override and revert it to the default value.",
"value": {
"logExtraction": {
"delay": "null",
"frequency": "null"
}
}
},
"updateHistorySnapshotExample": {
"summary": "Update history snapshot settings",
"description": "Update the history snapshot interval and retention. Omit a field to leave it unchanged.",
"value": {
"historySnapshot": {
"frequency": "12h",
"retentionDays": 90
}
}
},
"updateLogExtractionExample": {
"summary": "Update log extraction settings",
"description": "Update the log extraction configuration with a new lookback period and frequency.",
"value": {
"logExtraction": {
"fieldHistoryLength": 15,
"frequency": "10m",
"lookbackPeriod": "6h"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"updateSuccessExample": {
"summary": "Entity Store updated",
"description": "The Entity Store configuration was successfully updated.",
"value": {
"ok": true
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"invalidDurationExample": {
"summary": "Invalid duration parameter",
"description": "A log extraction parameter has an invalid duration format.",
"value": {
"error": "Bad Request",
"message": "[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)",
"statusCode": 400
}
},
"invalidHistorySnapshotFrequencyExample": {
"summary": "Invalid history snapshot interval",
"description": "The history snapshot interval must be at least 1 hour.",
"value": {
"error": "Bad Request",
"message": "[request body]: historySnapshot.frequency: must be a valid duration of at least 1 hour (e.g. 1h, 24h)",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Entity Store not found.",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"summary": "Entity Store not installed",
"description": "The Entity Store has not been installed yet.",
"value": {
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"logExtraction\":{\"lookbackPeriod\":\"6h\",\"frequency\":\"10m\",\"fieldHistoryLength\":15}}' \\\n \"${KIBANA_URL}/api/security/entity_store\"\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/security/entity_store\n{\n \"logExtraction\": {\n \"lookbackPeriod\": \"6h\",\n \"frequency\": \"10m\",\n \"fieldHistoryLength\": 15\n }\n}\n"
},
{
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"historySnapshot\":{\"frequency\":\"12h\",\"retentionDays\":90}}' \\\n \"${KIBANA_URL}/api/security/entity_store\"\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/security/entity_store\n{\n \"historySnapshot\": {\n \"frequency\": \"12h\",\n \"retentionDays\": 90\n }\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/entities": {
"get": {
"tags": [
"Security entity store"
],
"summary": "List entities",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "get-security-entity-store-entities",
"parameters": [
{
"name": "filter",
"in": "query",
"description": "A Kibana Query Language (KQL) filter for the search-after mode.",
"schema": {
"type": "string"
}
},
{
"name": "size",
"in": "query",
"description": "Number of entities to return in search-after mode.",
"schema": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
}
},
{
"name": "searchAfter",
"in": "query",
"description": "JSON-encoded search_after value for cursor-based pagination.",
"schema": {
"type": "string"
}
},
{
"name": "source",
"in": "query",
"description": "Fields to include in the response source.",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "fields",
"in": "query",
"description": "Fields to include in the response.",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "sort_field",
"in": "query",
"description": "Field to sort results by in page mode.",
"schema": {
"type": "string"
}
},
{
"name": "sort_order",
"in": "query",
"description": "Sort order in page mode.",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string"
}
},
{
"name": "page",
"in": "query",
"description": "Page number to return (1-indexed) in page mode.",
"schema": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
}
},
{
"name": "per_page",
"in": "query",
"description": "Number of entities per page in page mode.",
"schema": {
"maximum": 10000,
"minimum": 1,
"type": "integer"
}
},
{
"name": "filterQuery",
"in": "query",
"description": "An Elasticsearch query string to filter entities in page mode.",
"schema": {
"type": "string"
}
},
{
"name": "entity_types",
"in": "query",
"description": "Entity types to include in the results.",
"schema": {
"type": "array",
"items": {
"enum": [
"user",
"host",
"service",
"generic"
],
"type": "string"
}
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"emptyResultExample": {
"summary": "Empty result",
"description": "No entities matched the query.",
"value": {
"page": 1,
"per_page": 10,
"records": [ ],
"total": 0
}
},
"pageModeExample": {
"summary": "Page mode response with host entities",
"description": "A paginated list of host entities sorted by timestamp in descending order, including query inspection data.\n",
"value": {
"inspect": {
"dsl": [
"{\"index\":[\"entities-latest-default\"],\"body\":{\"terms\":{\"entity.EngineMetadata.Type\":[\"host\"]}}}"
],
"response": [
"{\"took\":1,\"timed_out\":false,\"hits\":{\"total\":{\"value\":1,\"relation\":\"eq\"}}}"
]
},
"page": 1,
"per_page": 10,
"records": [
{
"@timestamp": "2026-04-10T08:30:00.000Z",
"asset": {
"criticality": "high_impact",
"environment": "production"
},
"entity": {
"attributes": {
"asset": true,
"managed": true
},
"id": "host:web-server-prod-01",
"lifecycle": {
"first_seen": "2026-01-15T10:00:00.000Z",
"last_activity": "2026-04-10T08:30:00.000Z"
},
"name": "web-server-prod-01",
"risk": {
"calculated_level": "Moderate",
"calculated_score": 47.5,
"calculated_score_norm": 47.5
},
"source": [
"logs"
],
"type": "host"
},
"host": {
"hostname": [
"web-server-prod-01.example.com"
],
"ip": [
"10.0.1.42"
],
"name": "web-server-prod-01",
"os": {
"name": "Ubuntu",
"type": "linux"
}
}
}
],
"total": 1
}
},
"searchAfterModeExample": {
"summary": "Search-after mode response",
"description": "A cursor-based response with entities and a search_after token for the next page.\n",
"value": {
"entities": [
{
"@timestamp": "2026-04-10T08:30:00.000Z",
"entity": {
"id": "user:jane.doe@example.com",
"name": "jane.doe",
"type": "user"
},
"user": {
"email": [
"jane.doe@example.com"
],
"name": "jane.doe"
}
}
],
"nextSearchAfter": [
1712736600000,
1
]
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"invalidFilterExample": {
"summary": "Invalid filter",
"description": "The provided Kibana Query Language filter could not be parsed.",
"value": {
"error": "Bad Request",
"message": "Invalid filter: Expected \"(\", \"{\", value, whitespace but \":\" found.\ninvalid :: query\n---------^",
"statusCode": 400
}
},
"mixedModesExample": {
"summary": "Mixed pagination modes",
"description": "Cannot combine page-based pagination with cursor-based pagination in the same request.",
"value": {
"error": "Bad Request",
"message": "[request query]: Cannot combine page/per_page with searchAfter",
"statusCode": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/entities/": {
"delete": {
"tags": [
"Security entity store"
],
"summary": "Delete an entity",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a single entity record from the Entity Store. The entity is immediately removed from the latest index.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "delete-security-entity-store-entities",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"entityId"
],
"type": "object",
"properties": {
"entityId": {
"type": "string",
"description": "The identifier of the entity to delete."
}
},
"additionalProperties": false
},
"examples": {
"deleteEntityExample": {
"summary": "Delete an entity by identifier",
"description": "Delete a single entity from the Entity Store using its entity identifier.",
"value": {
"entityId": "host:web-server-prod-01"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates the entity was successfully deleted.",
"content": {
"application/json": {
"examples": {
"deleteSuccessExample": {
"summary": "Entity deleted",
"description": "The entity was found and successfully removed from the latest index.",
"value": {
"deleted": true
}
}
}
}
}
},
"404": {
"description": "Entity not found.",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"summary": "Entity not found",
"description": "No entity with the specified identifier exists in the Entity Store.",
"value": {
"error": "Not Found",
"message": "Entity ID 'host:web-server-prod-01' not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X DELETE -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityId\":\"host:web-server-prod-01\"}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/\"\n"
},
{
"lang": "Console",
"source": "DELETE kbn://api/security/entity_store/entities/\n{\n \"entityId\": \"host:web-server-prod-01\"\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/entities/{entityType}": {
"post": {
"tags": [
"Security entity store"
],
"summary": "Create an entity",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new entity record in the Entity Store for the specified entity type.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "post-security-entity-store-entities-entitytype",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "entityType",
"in": "path",
"description": "The entity type to create.",
"required": true,
"schema": {
"enum": [
"user",
"host",
"service",
"generic"
],
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
},
"user": {
"type": "object",
"properties": {
"domain": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user domains."
},
"email": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed email addresses."
},
"full_name": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed full names of the user."
},
"hash": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user hashes."
},
"id": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user identifiers."
},
"name": {
"type": "string",
"description": "Primary user name."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed roles assigned to the user."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) user fields collected on the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"host": {
"type": "object",
"properties": {
"architecture": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed CPU architectures."
},
"domain": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host domains."
},
"hostname": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed hostnames."
},
"id": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host identifiers."
},
"ip": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed IP addresses."
},
"mac": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed MAC addresses."
},
"name": {
"type": "string",
"description": "Primary host name."
},
"os": {
"type": "object",
"properties": {
"family": {
"type": "string"
},
"full": {
"type": "string"
},
"kernel": {
"type": "string"
},
"name": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"platform": {
"type": "string"
},
"type": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"version": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2)."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"type": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host types."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) host fields collected on the entity."
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"service": {
"type": "object",
"properties": {
"address": {
"type": "string",
"description": "Service address."
},
"environment": {
"type": "string",
"description": "Service environment (for example, production, staging)."
},
"ephemeral_id": {
"type": "string",
"description": "Ephemeral identifier of the service."
},
"id": {
"type": "string",
"description": "Unique identifier of the service."
},
"name": {
"type": "string",
"description": "Primary service name."
},
"node": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Node name."
},
"role": {
"type": "string",
"description": "Node role."
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Node roles."
}
},
"additionalProperties": false,
"description": "Node information for the service."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"state": {
"type": "string",
"description": "Current state of the service."
},
"type": {
"type": "string",
"description": "Service type."
},
"version": {
"type": "string",
"description": "Service version."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) service fields collected on the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"cloud": {
"type": "object",
"properties": {
"account": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"availability_zone": {
"type": "string"
},
"instance": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"machine": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"project": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"provider": {
"type": "string"
},
"region": {
"type": "string"
},
"service": {
"type": "object",
"properties": {
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) cloud fields for cloud-hosted entities."
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { }
},
"orchestrator": {
"type": "object",
"properties": {
"api_version": {
"type": "string"
},
"cluster": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"url": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"namespace": {
"type": "string"
},
"organization": {
"type": "string"
},
"resource": {
"type": "object",
"properties": {
"annotation": {
"type": "string"
},
"id": {
"type": "string"
},
"ip": {
"type": "string"
},
"label": {
"type": "string"
},
"name": {
"type": "string"
},
"parent": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities."
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
]
},
"examples": {
"createHostEntityExample": {
"summary": "Create a host entity",
"description": "Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type.",
"value": {
"asset": {
"business_unit": "Engineering",
"criticality": "high_impact",
"environment": "production"
},
"entity": {
"attributes": {
"asset": true,
"managed": true
},
"id": "host:web-server-prod-01",
"name": "web-server-prod-01",
"source": [
"manual"
],
"type": "host"
},
"host": {
"hostname": [
"web-server-prod-01.example.com"
],
"ip": [
"10.0.1.42"
],
"name": "web-server-prod-01"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates the entity was successfully created.",
"content": {
"application/json": {
"examples": {
"createSuccessExample": {
"summary": "Entity created",
"description": "The entity record was successfully created in the Entity Store.",
"value": {
"ok": true
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"euidMismatchExample": {
"summary": "Entity identifier mismatch",
"description": "The supplied entity identifier does not match the auto-generated identifier derived from the entity fields.",
"value": {
"error": "Bad Request",
"message": "Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01",
"statusCode": 400
}
}
}
}
}
},
"409": {
"description": "Conflict.",
"content": {
"application/json": {
"examples": {
"conflictExample": {
"summary": "Entity already exists",
"description": "An entity with the specified identifier already exists.",
"value": {
"error": "Conflict",
"message": "Entity ID 'host:web-server-prod-01' already exists",
"statusCode": 409
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"source\":[\"manual\"],\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\",\"ip\":[\"10.0.1.42\"]}}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/host\"\n"
},
{
"lang": "Console",
"source": "POST kbn://api/security/entity_store/entities/host\n{\n \"entity\": {\n \"id\": \"host:web-server-prod-01\",\n \"name\": \"web-server-prod-01\",\n \"type\": \"host\",\n \"source\": [\"manual\"],\n \"attributes\": { \"asset\": true }\n },\n \"host\": {\n \"name\": \"web-server-prod-01\",\n \"ip\": [\"10.0.1.42\"]\n }\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"Security entity store"
],
"summary": "Update an entity",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "put-security-entity-store-entities-entitytype",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "entityType",
"in": "path",
"description": "The entity type to update.",
"required": true,
"schema": {
"enum": [
"user",
"host",
"service",
"generic"
],
"type": "string"
}
},
{
"name": "force",
"in": "query",
"description": "When true, allows updating protected fields.",
"schema": {
"anyOf": [
{
"enum": [
"true",
"false"
],
"type": "string"
},
{
"type": "boolean"
}
],
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
},
"user": {
"type": "object",
"properties": {
"domain": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user domains."
},
"email": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed email addresses."
},
"full_name": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed full names of the user."
},
"hash": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user hashes."
},
"id": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user identifiers."
},
"name": {
"type": "string",
"description": "Primary user name."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed roles assigned to the user."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) user fields collected on the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"host": {
"type": "object",
"properties": {
"architecture": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed CPU architectures."
},
"domain": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host domains."
},
"hostname": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed hostnames."
},
"id": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host identifiers."
},
"ip": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed IP addresses."
},
"mac": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed MAC addresses."
},
"name": {
"type": "string",
"description": "Primary host name."
},
"os": {
"type": "object",
"properties": {
"family": {
"type": "string"
},
"full": {
"type": "string"
},
"kernel": {
"type": "string"
},
"name": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"platform": {
"type": "string"
},
"type": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"version": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2)."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"type": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host types."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) host fields collected on the entity."
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"service": {
"type": "object",
"properties": {
"address": {
"type": "string",
"description": "Service address."
},
"environment": {
"type": "string",
"description": "Service environment (for example, production, staging)."
},
"ephemeral_id": {
"type": "string",
"description": "Ephemeral identifier of the service."
},
"id": {
"type": "string",
"description": "Unique identifier of the service."
},
"name": {
"type": "string",
"description": "Primary service name."
},
"node": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Node name."
},
"role": {
"type": "string",
"description": "Node role."
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Node roles."
}
},
"additionalProperties": false,
"description": "Node information for the service."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"state": {
"type": "string",
"description": "Current state of the service."
},
"type": {
"type": "string",
"description": "Service type."
},
"version": {
"type": "string",
"description": "Service version."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) service fields collected on the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"cloud": {
"type": "object",
"properties": {
"account": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"availability_zone": {
"type": "string"
},
"instance": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"machine": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"project": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"provider": {
"type": "string"
},
"region": {
"type": "string"
},
"service": {
"type": "object",
"properties": {
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) cloud fields for cloud-hosted entities."
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { }
},
"orchestrator": {
"type": "object",
"properties": {
"api_version": {
"type": "string"
},
"cluster": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"url": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"namespace": {
"type": "string"
},
"organization": {
"type": "string"
},
"resource": {
"type": "object",
"properties": {
"annotation": {
"type": "string"
},
"id": {
"type": "string"
},
"ip": {
"type": "string"
},
"label": {
"type": "string"
},
"name": {
"type": "string"
},
"parent": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities."
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
]
},
"examples": {
"updateEntityAttributesExample": {
"summary": "Update entity attributes",
"description": "Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter.",
"value": {
"entity": {
"attributes": {
"managed": true,
"mfa_enabled": true
},
"id": "user:jane.doe@example.com",
"lifecycle": {
"last_activity": "2026-04-10T14:30:00.000Z"
},
"name": "jane.doe",
"type": "user"
},
"user": {
"email": [
"jane.doe@example.com"
],
"name": "jane.doe",
"roles": [
"admin",
"analyst"
]
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates the entity was successfully updated.",
"content": {
"application/json": {
"examples": {
"updateSuccessExample": {
"summary": "Entity updated",
"description": "The entity record was successfully updated.",
"value": {
"ok": true
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"protectedFieldsExample": {
"summary": "Protected fields without force",
"description": "The request attempts to update protected fields without the force query parameter.",
"value": {
"error": "Bad Request",
"message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Entity not found.",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"summary": "Entity not found",
"description": "No entity with the specified identifier exists.",
"value": {
"error": "Not Found",
"message": "Entity ID 'user:jane.doe@example.com' not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity\":{\"id\":\"user:jane.doe@example.com\",\"name\":\"jane.doe\",\"type\":\"user\",\"attributes\":{\"managed\":true,\"mfa_enabled\":true}},\"user\":{\"name\":\"jane.doe\"}}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/user?force=true\"\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/security/entity_store/entities/user?force=true\n{\n \"entity\": {\n \"id\": \"user:jane.doe@example.com\",\n \"name\": \"jane.doe\",\n \"type\": \"user\",\n \"attributes\": { \"managed\": true, \"mfa_enabled\": true }\n },\n \"user\": { \"name\": \"jane.doe\" }\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/entities/bulk": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Bulk update entities",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate multiple entity records in the Entity Store in a single request.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "put-security-entity-store-entities-bulk",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "force",
"in": "query",
"description": "When true, allows updating protected fields.",
"schema": {
"anyOf": [
{
"enum": [
"true",
"false"
],
"type": "string"
},
{
"type": "boolean"
}
],
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"entities"
],
"type": "object",
"properties": {
"entities": {
"type": "array",
"items": {
"required": [
"type"
],
"type": "object",
"properties": {
"doc": {
"anyOf": [
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
},
"user": {
"type": "object",
"properties": {
"domain": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user domains."
},
"email": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed email addresses."
},
"full_name": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed full names of the user."
},
"hash": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user hashes."
},
"id": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed user identifiers."
},
"name": {
"type": "string",
"description": "Primary user name."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed roles assigned to the user."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) user fields collected on the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"host": {
"type": "object",
"properties": {
"architecture": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed CPU architectures."
},
"domain": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host domains."
},
"hostname": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed hostnames."
},
"id": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host identifiers."
},
"ip": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed IP addresses."
},
"mac": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed MAC addresses."
},
"name": {
"type": "string",
"description": "Primary host name."
},
"os": {
"type": "object",
"properties": {
"family": {
"type": "string"
},
"full": {
"type": "string"
},
"kernel": {
"type": "string"
},
"name": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"platform": {
"type": "string"
},
"type": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"version": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2)."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"type": {
"type": "array",
"items": {
"type": "string"
},
"description": "Observed host types."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) host fields collected on the entity."
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the event was ingested into Elasticsearch.",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { },
"description": "Custom key-value labels attached to the entity."
},
"service": {
"type": "object",
"properties": {
"address": {
"type": "string",
"description": "Service address."
},
"environment": {
"type": "string",
"description": "Service environment (for example, production, staging)."
},
"ephemeral_id": {
"type": "string",
"description": "Ephemeral identifier of the service."
},
"id": {
"type": "string",
"description": "Unique identifier of the service."
},
"name": {
"type": "string",
"description": "Primary service name."
},
"node": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Node name."
},
"role": {
"type": "string",
"description": "Node role."
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Node roles."
}
},
"additionalProperties": false,
"description": "Node information for the service."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score."
}
},
"additionalProperties": false
},
"state": {
"type": "string",
"description": "Current state of the service."
},
"type": {
"type": "string",
"description": "Service type."
},
"version": {
"type": "string",
"description": "Service version."
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) service fields collected on the entity."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags attached to the entity."
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"@timestamp": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The time the entity record was last updated.",
"format": "date-time"
},
"asset": {
"type": "object",
"properties": {
"business_unit": {
"type": "string",
"description": "Business unit the asset belongs to."
},
"criticality": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": [
"null",
"string"
],
"description": "The criticality level assigned to this asset."
},
"environment": {
"type": "string",
"description": "Deployment environment (for example, production, staging)."
},
"id": {
"type": "string",
"description": "Unique identifier for the asset."
},
"model": {
"type": "string",
"description": "Model name or number."
},
"name": {
"type": "string",
"description": "Human-readable asset name."
},
"owner": {
"type": "string",
"description": "The owner of the asset."
},
"serial_number": {
"type": "string",
"description": "Serial number of the asset."
},
"vendor": {
"type": "string",
"description": "Vendor or manufacturer."
}
},
"additionalProperties": false
},
"cloud": {
"type": "object",
"properties": {
"account": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"availability_zone": {
"type": "string"
},
"instance": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"machine": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"project": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"provider": {
"type": "string"
},
"region": {
"type": "string"
},
"service": {
"type": "object",
"properties": {
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) cloud fields for cloud-hosted entities."
},
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"asset": {
"type": "boolean",
"description": "Whether the entity is classified as an asset."
},
"known_redirects": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known redirect URIs or URLs (e.g. OAuth application callbacks)."
},
"managed": {
"type": "boolean",
"description": "Whether the entity is managed (for example, via a directory service)."
},
"mfa_enabled": {
"type": "boolean",
"description": "Whether multi-factor authentication is enabled for the entity."
},
"oauth_consent_restriction": {
"type": "string",
"description": "OAuth consent restriction (e.g. admin_only, verified_only, unrestricted)."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Action-level permissions granted to this entity (not roles or groups)."
},
"storage_class": {
"type": "string",
"description": "Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive)."
},
"watchlists": {
"type": "array",
"items": {
"type": "string"
},
"description": "Watchlist identifiers the entity belongs to (v2)."
}
},
"additionalProperties": false,
"description": "Boolean flags describing characteristics of the entity."
},
"behaviors": {
"type": "object",
"properties": {
"anomaly_job_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Machine learning anomaly job identifiers (v2)."
},
"rule_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "Detection rule names that flagged this entity (v2)."
}
},
"additionalProperties": false,
"description": "Behavioral signals observed for the entity."
},
"created_by": {
"type": "string",
"description": "Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer)."
},
"EngineMetadata": {
"type": "object",
"properties": {
"Type": {
"type": "string",
"description": "The engine type that produced this entity record."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "Unique identifier for this entity."
},
"lifecycle": {
"type": "object",
"properties": {
"first_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was first observed.",
"format": "date-time"
},
"last_activity": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity last generated activity.",
"format": "date-time"
},
"last_seen": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "When the entity was last observed.",
"format": "date-time"
}
},
"additionalProperties": false,
"description": "Timestamps tracking the entity lifecycle."
},
"name": {
"type": "string",
"description": "Human-readable name of the entity."
},
"relationships": {
"type": "object",
"properties": {
"accesses_frequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses frequently."
},
"accesses_infrequently": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity accesses infrequently."
},
"administers": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity administers (for example, a user who is an admin of a service)."
},
"communicates_with": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity communicates with."
},
"depends_on": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities this entity depends on."
},
"owns": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities owned by this entity."
},
"owns_inferred": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities inferred to be owned by this entity."
},
"resolution": {
"type": "object",
"properties": {
"resolved_to": {
"type": "string",
"description": "entity.id of the entity this one resolves to"
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the resolution group's aggregated risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the resolution group's aggregated risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the resolution group's aggregated risk score."
}
},
"additionalProperties": false,
"description": "Aggregated risk score for the resolution group."
}
},
"additionalProperties": false,
"description": "Resolution metadata linking this entity to another."
},
"supervises": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters."
},
"raw_identifiers": {
"type": "object",
"properties": {
"entity.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.id": {
"type": "array",
"items": {
"type": "string"
}
},
"host.name": {
"type": "array",
"items": {
"type": "string"
}
},
"service.name": {
"type": "array",
"items": {
"type": "string"
}
},
"user.email": {
"type": "array",
"items": {
"type": "string"
}
},
"user.id": {
"type": "array",
"items": {
"type": "string"
}
},
"user.name": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Entities supervised by this entity."
}
},
"additionalProperties": false,
"description": "Connections between this entity and other entities."
},
"risk": {
"type": "object",
"properties": {
"calculated_level": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string",
"description": "Lexical description of the entity's risk."
},
"calculated_score": {
"type": "number",
"description": "The raw numeric value of the given entity's risk score."
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities."
}
},
"additionalProperties": false,
"description": "Risk scoring information for the entity."
},
"schema_version": {
"type": "string",
"description": "Schema version of the entity record."
},
"source": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sources that produced this entity record."
},
"sub_type": {
"type": "string",
"description": "Optional sub-type classification for the entity."
},
"type": {
"type": "string",
"description": "The entity type."
},
"url": {
"type": "string",
"description": "URL associated with the entity."
}
},
"additionalProperties": false
},
"event": {
"type": "object",
"properties": {
"ingested": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
}
},
"additionalProperties": false
},
"labels": {
"type": "object",
"additionalProperties": { }
},
"orchestrator": {
"type": "object",
"properties": {
"api_version": {
"type": "string"
},
"cluster": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"url": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"namespace": {
"type": "string"
},
"organization": {
"type": "string"
},
"resource": {
"type": "object",
"properties": {
"annotation": {
"type": "string"
},
"id": {
"type": "string"
},
"ip": {
"type": "string"
},
"label": {
"type": "string"
},
"name": {
"type": "string"
},
"parent": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities."
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
]
},
"type": {
"enum": [
"user",
"host",
"service",
"generic"
],
"type": "string",
"description": "The entity type of this record."
}
}
},
"description": "The entities to update."
}
},
"additionalProperties": false
},
"examples": {
"bulkUpdateExample": {
"summary": "Bulk update multiple entities",
"description": "Update a host entity and a user entity in a single request.",
"value": {
"entities": [
{
"doc": {
"entity": {
"attributes": {
"asset": true
},
"id": "host:web-server-prod-01",
"name": "web-server-prod-01",
"type": "host"
},
"host": {
"name": "web-server-prod-01"
}
},
"type": "host"
},
{
"doc": {
"entity": {
"attributes": {
"managed": true
},
"id": "user:jane.doe@example.com",
"name": "jane.doe",
"type": "user"
},
"user": {
"name": "jane.doe"
}
},
"type": "user"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"bulkUpdatePartialExample": {
"summary": "Partial success with errors",
"description": "Some entities were updated but others encountered Elasticsearch-level errors.",
"value": {
"errors": [
{
"_id": "5de9f93a68a72532e736bf5a6184b06300b9cabf",
"reason": "[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing",
"status": 404,
"type": "document_missing_exception"
}
],
"ok": true
}
},
"bulkUpdateSuccessExample": {
"summary": "All entities updated",
"description": "All entities were successfully updated with no errors.",
"value": {
"errors": [ ],
"ok": true
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"protectedFieldsExample": {
"summary": "Protected fields without force",
"description": "The request attempts to update protected fields without the force query parameter.",
"value": {
"error": "Bad Request",
"message": "Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type",
"statusCode": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entities\":[{\"type\":\"host\",\"doc\":{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\"}}}]}' \\\n \"${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true\"\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/security/entity_store/entities/bulk?force=true\n{\n \"entities\": [\n {\n \"type\": \"host\",\n \"doc\": {\n \"entity\": {\n \"id\": \"host:web-server-prod-01\",\n \"name\": \"web-server-prod-01\",\n \"type\": \"host\",\n \"attributes\": { \"asset\": true }\n },\n \"host\": { \"name\": \"web-server-prod-01\" }\n }\n }\n ]\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/history_snapshot/disable": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Disable the history snapshot task",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDisable the Entity Store history snapshot task for this space so it no longer creates snapshot indices. Existing snapshot indices remain unless you set `clearHistorySnapshots` to `true`. Returns 404 if the Entity Store is not installed in the current space.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "put-security-entity-store-history-snapshot-disable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"clearHistorySnapshots": {
"type": "boolean",
"description": "When `true`, deletes existing history snapshot indices for this space in the background after the task is disabled. The response returns immediately and does not wait for deletion to finish. Deletion failures are logged and are not returned to the caller. If the task is already disabled, the request succeeds and does not delete indices. Defaults to `false`.",
"default": false
}
},
"additionalProperties": false
},
"examples": {
"disableAndClear": {
"summary": "Disable and clear snapshot indices",
"value": {
"clearHistorySnapshots": true
}
},
"disableOnly": {
"summary": "Disable without clearing",
"value": { }
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"disableSuccessExample": {
"summary": "History snapshot task disabled",
"description": "The Entity Store history snapshot task was disabled.",
"value": {
"ok": true
}
}
}
}
}
},
"404": {
"description": "Entity store is not installed.",
"content": {
"application/json": {
"examples": {
"notInstalledExample": {
"summary": "Entity store not installed",
"description": "The Entity Store history snapshot task cannot be disabled because the entity store is not installed.",
"value": {
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Content-Type: application/json\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -d '{}' \\\n \"${KIBANA_URL}/api/security/entity_store/history_snapshot/disable\"\n"
},
{
"label": "Disable and clear indices",
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Content-Type: application/json\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -d '{\"clearHistorySnapshots\":true}' \\\n \"${KIBANA_URL}/api/security/entity_store/history_snapshot/disable\"\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/security/entity_store/history_snapshot/disable\n{}\n"
},
{
"label": "Disable and clear indices",
"lang": "Console",
"source": "PUT kbn://api/security/entity_store/history_snapshot/disable\n{\n \"clearHistorySnapshots\": true\n}\n"
}
],
"x-state": "Generally available; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/history_snapshot/enable": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Enable the history snapshot task",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nEnable the Entity Store history snapshot task for this space. After a successful enable, Kibana schedules an immediate snapshot run. If that immediate run fails, the response is still 200 and the task remains enabled for the next scheduled interval. If the task is already enabled, the request succeeds and does not start an extra run. Returns 404 if the Entity Store is not installed in the current space.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "put-security-entity-store-history-snapshot-enable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"enableSuccessExample": {
"summary": "History snapshot task enabled",
"description": "The Entity Store history snapshot task was enabled.",
"value": {
"ok": true
}
}
}
}
}
},
"404": {
"description": "Entity store is not installed.",
"content": {
"application/json": {
"examples": {
"notInstalledExample": {
"summary": "Entity store not installed",
"description": "The Entity Store history snapshot task cannot be enabled because the entity store is not installed.",
"value": {
"error": "Not Found",
"message": "Entity store is not installed",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/history_snapshot/enable\"\n"
},
{
"lang": "Console",
"source": "PUT kbn://api/security/entity_store/history_snapshot/enable\n"
}
],
"x-state": "Generally available; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/install": {
"post": {
"tags": [
"Security entity store"
],
"summary": "Install the Entity Store",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending `null` for a field clears that override and reverts to the default value. To change settings after install, use the update endpoint.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the resolution group for a given entity, returning all linked entities.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.",
"operationId": "get-security-entity-store-resolution-group",
"parameters": [
{
"name": "entity_id",
"in": "query",
"description": "The entity identifier to look up the resolution group for.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"resolutionGroupExample": {
"summary": "Resolution group with linked entities",
"description": "Returns the resolution group for an entity, including the target entity, all aliases, and the group size.",
"value": {
"aliases": [
{
"@timestamp": "2026-04-10T08:25:00.000Z",
"entity": {
"id": "user:jdoe@example.com",
"name": "jdoe",
"relationships": {
"resolution": {
"resolved_to": "user:jane.doe@example.com"
}
},
"type": "user"
},
"user": {
"name": "jdoe"
}
}
],
"entity_type": "user",
"group_size": 2,
"target": {
"@timestamp": "2026-04-10T08:30:00.000Z",
"entity": {
"id": "user:jane.doe@example.com",
"name": "jane.doe",
"type": "user"
},
"user": {
"email": [
"jane.doe@example.com"
],
"name": "jane.doe"
}
}
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"truncatedSearchExample": {
"summary": "Search results truncated",
"description": "The resolution search returned too many results and was truncated.",
"value": {
"error": "Bad Request",
"message": "Resolution search truncated",
"statusCode": 400
}
}
}
}
}
},
"404": {
"description": "Entity not found.",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"summary": "Entity not found",
"description": "The specified entity does not exist or has no resolution group.",
"value": {
"error": "Not Found",
"message": "Entities not found: [user:nonexistent@example.com]",
"statusCode": 404
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/group?entity_id=user%3Ajane.doe%40example.com\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/security/entity_store/resolution/group?entity_id=user:jane.doe@example.com\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/resolution/link": {
"post": {
"tags": [
"Security entity store"
],
"summary": "Link entities",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nLink one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.",
"operationId": "post-security-entity-store-resolution-link",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"target_id",
"entity_ids"
],
"type": "object",
"properties": {
"entity_ids": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Entity identifiers to link to the target entity. Minimum 1, maximum 1000."
},
"target_id": {
"type": "string",
"description": "The entity identifier to resolve the linked entities to."
}
},
"additionalProperties": false
},
"examples": {
"linkEntitiesExample": {
"summary": "Link entities to a target",
"description": "Link two user entities to a target entity, creating a resolution group.",
"value": {
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"target_id": "user:jane.doe@example.com"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"linkSuccessExample": {
"summary": "Entities linked",
"description": "The entities were successfully linked to the target entity.",
"value": {
"entity_type": "user",
"linked": [
"user:jdoe@example.com",
"user:j.doe@example.com"
],
"skipped": [ ],
"target_id": "user:jane.doe@example.com"
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"mixedTypesExample": {
"summary": "Mixed entity types",
"description": "All entities in a resolution group must be of the same type.",
"value": {
"error": "Bad Request",
"message": "Cannot link entities of different types",
"statusCode": 400
}
},
"notFoundExample": {
"summary": "Entities not found",
"description": "One or more of the specified entity identifiers were not found.",
"value": {
"error": "Bad Request",
"message": "Entities not found: [user:nonexistent@example.com, user:also-nonexistent@example.com]",
"statusCode": 400
}
},
"selfLinkExample": {
"summary": "Self-link error",
"description": "Cannot link an entity to itself.",
"value": {
"error": "Bad Request",
"message": "Cannot link entity 'user:jane.doe@example.com' to itself.",
"statusCode": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"target_id\":\"user:jane.doe@example.com\",\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/link\"\n"
},
{
"lang": "Console",
"source": "POST kbn://api/security/entity_store/resolution/link\n{\n \"target_id\": \"user:jane.doe@example.com\",\n \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/resolution/rules": {
"get": {
"tags": [
"Security entity store"
],
"summary": "List entity resolution rules",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList managed entity resolution rules and their effective enabled state for this space. Each rule description states what it bridges, which data sources it needs, and when to disable it.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.",
"operationId": "get-security-entity-store-resolution-rules",
"responses": {
"200": {
"description": "Entity resolution rules.",
"content": {
"application/json": {
"examples": {
"rulesListExample": {
"summary": "Managed resolution rules",
"description": "Lists the managed resolution rules and their enabled state in the current space.",
"value": {
"rules": [
{
"description": "Links user entities that share the same email address, compared case-insensitively, across identity providers. Several `local` users with that email (one per user name per host) are linked too. Unlinked users in the same identity provider that share an address are left unlinked. Disable if shared mailboxes or role accounts produce false links.",
"enabled": true,
"id": "email_exact_match",
"kind": "same_field",
"managed": true
},
{
"description": "Links user entities that share the same SID (`user.id`), including several `local` Windows or CrowdStrike endpoint users on different hosts. Windows domain accounts seen on several hosts are linked even before the Active Directory user is ingested; Active Directory entity analytics is needed only to link or retarget to that AD user once it arrives. A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. Needs Windows or CrowdStrike endpoint events (which create `local` user entities). Disable if well-known SID exclusions are not enough for your environment.",
"enabled": true,
"id": "windows_sid_bridge",
"kind": "same_field",
"managed": true
},
{
"description": "Links Microsoft Defender (`m365_defender`) identities to Entra ID by GUID-shaped `user.id`. Needs Defender identity events and Entra entity analytics. Disable if Defender SID IAM events leak through the GUID gate.",
"enabled": true,
"id": "entra_guid_bridge",
"kind": "same_field",
"managed": true
},
{
"description": "Links leftover CrowdStrike-namespace user entities to Active Directory by SID (`user.id`). A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. CrowdStrike FDR events now create `local` entities, which the Windows SID bridge covers. Disabled by default because the crowdstrike namespace no longer receives entities; enable if leftover CrowdStrike-namespace users should still link.",
"enabled": false,
"id": "crowdstrike_sid_bridge",
"kind": "same_field",
"managed": true
},
{
"description": "Links Microsoft 365 audit actors (`user.id` UPN) to Entra users (`user.name` UPN), compared case-insensitively. Needs o365 audit events that create user entities (`event.kind: asset`) and Entra entity analytics. Disabled by default because those events currently do not create entities; enable if your environment emits them as asset events.",
"enabled": false,
"id": "upn_cross_field_bridge",
"kind": "cross_field",
"managed": true
},
{
"description": "Related user alias resolution across identity providers",
"enabled": false,
"id": "related_user_alias_resolution",
"kind": "related_user_alias_resolution",
"managed": true
}
]
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/resolution/rules/{id}/disable": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Disable an entity resolution rule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDisable a managed entity resolution rule in this space.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.",
"operationId": "put-security-entity-store-resolution-rules-id-disable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The stable identifier of the entity resolution rule.",
"required": true,
"schema": {
"maxLength": 100,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Updated entity resolution rule.",
"content": {
"application/json": {
"examples": {
"ruleDisabledExample": {
"summary": "Rule disabled",
"description": "The related user alias resolution rule was disabled in the current space.",
"value": {
"description": "Related user alias resolution across identity providers",
"enabled": false,
"id": "related_user_alias_resolution",
"kind": "related_user_alias_resolution",
"managed": true
}
}
}
}
}
},
"404": {
"description": "Unknown entity resolution rule.",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"summary": "Unknown rule",
"description": "The requested entity resolution rule does not exist.",
"value": {
"error": "Not Found",
"message": "Saved object [entity-resolution-rule/unknown] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/resolution/rules/{id}/enable": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Enable an entity resolution rule",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nEnable a managed entity resolution rule in this space.
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.",
"operationId": "put-security-entity-store-resolution-rules-id-enable",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The stable identifier of the entity resolution rule.",
"required": true,
"schema": {
"maxLength": 100,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Updated entity resolution rule.",
"content": {
"application/json": {
"examples": {
"ruleEnabledExample": {
"summary": "Rule enabled",
"description": "The related user alias resolution rule was enabled in the current space.",
"value": {
"description": "Related user alias resolution across identity providers",
"enabled": true,
"id": "related_user_alias_resolution",
"kind": "related_user_alias_resolution",
"managed": true
}
}
}
}
}
},
"404": {
"description": "Unknown entity resolution rule.",
"content": {
"application/json": {
"examples": {
"notFoundExample": {
"summary": "Unknown rule",
"description": "The requested entity resolution rule does not exist.",
"value": {
"error": "Not Found",
"message": "Saved object [entity-resolution-rule/unknown] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/resolution/unlink": {
"post": {
"tags": [
"Security entity store"
],
"summary": "Unlink entities",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRemove one or more entities from their resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).
[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.",
"operationId": "post-security-entity-store-resolution-unlink",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"entity_ids"
],
"type": "object",
"properties": {
"entity_ids": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000."
}
},
"additionalProperties": false
},
"examples": {
"unlinkEntitiesExample": {
"summary": "Unlink entities from their resolution group",
"description": "Remove entities from their resolution group, restoring them as standalone entities.",
"value": {
"entity_ids": [
"user:jdoe@example.com",
"user:j.doe@example.com"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"unlinkSuccessExample": {
"summary": "Entities unlinked",
"description": "The entities were successfully removed from their resolution group.",
"value": {
"entity_type": "user",
"skipped": [ ],
"unlinked": [
"user:jdoe@example.com",
"user:j.doe@example.com"
]
}
}
}
}
}
},
"400": {
"description": "Bad request.",
"content": {
"application/json": {
"examples": {
"mixedTypesExample": {
"summary": "Mixed entity types",
"description": "All entities in a resolution group must be of the same type.",
"value": {
"error": "Bad Request",
"message": "All entities must be of the same type. Found types: [user, host]",
"statusCode": 400
}
},
"notFoundExample": {
"summary": "Entities not found",
"description": "One or more of the specified entity identifiers were not found.",
"value": {
"error": "Bad Request",
"message": "Entities not found: [user:nonexistent@example.com]",
"statusCode": 400
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/resolution/unlink\"\n"
},
{
"lang": "Console",
"source": "POST kbn://api/security/entity_store/resolution/unlink\n{\n \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/start": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Start Entity Store engines",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/security/entity_store/start
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nStart previously stopped entity engines, resuming data processing for the specified entity types.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the overall Entity Store status and per-engine statuses, optionally including component-level health details.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "get-security-entity-store-status",
"parameters": [
{
"name": "include_components",
"in": "query",
"description": "If true, returns a detailed status of each engine including all its components.",
"schema": {
"anyOf": [
{
"enum": [
"true",
"false"
],
"type": "string"
},
{
"type": "boolean"
}
],
"default": false
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"notInstalledExample": {
"summary": "Entity Store not installed",
"description": "The Entity Store has not been installed.",
"value": {
"engines": [ ],
"status": "not_installed"
}
},
"runningStatusExample": {
"summary": "Entity Store running",
"description": "The Entity Store is running with two started engines using default settings.",
"value": {
"engines": [
{
"delay": "1m",
"docsPerSecond": -1,
"enrichPolicyExecutionInterval": "null",
"fieldHistoryLength": 10,
"filter": "",
"frequency": "30s",
"indexPattern": "",
"lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
"lookbackPeriod": "3h",
"maxLogsPerPage": 40000,
"maxLogsPerWindow": 500000,
"maxLogsPerWindowCapBehavior": "defer",
"maxPageSearchSize": 10000,
"maxTimeWindowSize": "15m",
"status": "started",
"timeout": "25s",
"timestampField": "@timestamp",
"type": "host"
},
{
"delay": "1m",
"docsPerSecond": -1,
"enrichPolicyExecutionInterval": "null",
"fieldHistoryLength": 10,
"filter": "",
"frequency": "30s",
"indexPattern": "",
"lastExecutionTimestamp": "2026-04-10T08:30:00.000Z",
"lookbackPeriod": "3h",
"maxLogsPerPage": 40000,
"maxLogsPerWindow": 500000,
"maxLogsPerWindowCapBehavior": "defer",
"maxPageSearchSize": 10000,
"maxTimeWindowSize": "15m",
"nonPriority": {
"error": "null",
"lastExecutionTimestamp": "2026-04-10T08:26:00.000Z",
"samplingRate": "null",
"status": "started"
},
"status": "started",
"timeout": "25s",
"timestampField": "@timestamp",
"type": "user"
}
],
"status": "running"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n \"${KIBANA_URL}/api/security/entity_store/status?include_components=false\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/security/entity_store/status?include_components=false\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/entity_store/stop": {
"put": {
"tags": [
"Security entity store"
],
"summary": "Stop Entity Store engines",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/security/entity_store/stop
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nStop running entity engines, pausing data processing for the specified entity types.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUninstall the Entity Store, removing engines and associated resources for the specified entity types.
[Required authorization] Route required privileges: securitySolution.",
"operationId": "post-security-entity-store-uninstall",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"entityTypes": {
"type": "array",
"items": {
"enum": [
"user",
"host",
"service",
"generic"
],
"type": "string"
},
"description": "Entity types to uninstall. Defaults to all installed types.",
"default": [
"user",
"host",
"service",
"generic"
]
}
},
"additionalProperties": false
},
"examples": {
"uninstallAllExample": {
"summary": "Uninstall all entity types",
"description": "Uninstall all entity engines from the Entity Store.",
"value": {
"entityTypes": [
"user",
"host",
"service",
"generic"
]
}
},
"uninstallSingleExample": {
"summary": "Uninstall a single entity type",
"description": "Uninstall only the host engine from the Entity Store.",
"value": {
"entityTypes": [
"host"
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response.",
"content": {
"application/json": {
"examples": {
"uninstallSuccessExample": {
"summary": "Entity Store uninstalled",
"description": "The specified entity engines were successfully uninstalled.",
"value": {
"ok": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n \"${KIBANA_URL}/api/security/entity_store/uninstall\"\n"
},
{
"lang": "Console",
"source": "POST kbn://api/security/entity_store/uninstall\n{\n \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
}
],
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/role": {
"get": {
"tags": [
"roles"
],
"summary": "Get all roles",
"description": "Retrieve all Kibana roles.",
"operationId": "get-security-role",
"parameters": [
{
"name": "includeReservedRoles",
"in": "query",
"description": "If true, include built-in roles on serverless. By default, serverless returns only custom roles. Other deployments always include built-in roles.",
"schema": {
"type": "boolean"
}
},
{
"name": "replaceDeprecatedPrivileges",
"in": "query",
"description": "If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_response"
}
},
"examples": {
"getAllRolesResponse": {
"value": [
{
"_unrecognized_applications": [ ],
"description": "My custom Kibana role.",
"elasticsearch": {
"cluster": [
"monitor"
],
"indices": [
{
"names": [
"logs-*"
],
"privileges": [
"read"
]
}
],
"run_as": [ ]
},
"kibana": [
{
"base": [
"read"
],
"feature": { },
"spaces": [
"default"
]
}
],
"metadata": { },
"name": "my_kibana_role",
"transient_metadata": {
"enabled": true
}
}
]
},
"getRolesResponse1": {
"$ref": "#/components/examples/get_roles_response1"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/role/_query": {
"post": {
"summary": "Query roles",
"description": "Query Kibana roles with optional filters, paging, and sorting.",
"operationId": "post-security-role-query",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_query_roles_body"
},
"examples": {
"queryRolesRequest": {
"value": {
"from": 0,
"query": "kibana",
"size": 25,
"sort": {
"direction": "asc",
"field": "name"
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_query_roles_response"
},
"examples": {
"queryRolesResponse": {
"value": {
"count": 1,
"roles": [
{
"_unrecognized_applications": [ ],
"description": "My custom Kibana role.",
"elasticsearch": {
"cluster": [
"monitor"
],
"indices": [
{
"names": [
"logs-*"
],
"privileges": [
"read"
]
}
],
"run_as": [ ]
},
"kibana": [
{
"base": [
"read"
],
"feature": { },
"spaces": [
"default"
]
}
],
"metadata": { },
"name": "my_kibana_role",
"transient_metadata": {
"enabled": true
}
}
],
"total": 1
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/role/{name}": {
"delete": {
"tags": [
"roles"
],
"summary": "Delete a role",
"description": "Delete a Kibana role by its name.",
"operationId": "delete-security-role-name",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "name",
"in": "path",
"description": "The role name.",
"required": true,
"schema": {
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"roles"
],
"summary": "Get a role",
"description": "Retrieve a Kibana role by its name.",
"operationId": "get-security-role-name",
"parameters": [
{
"name": "name",
"in": "path",
"description": "The role name.",
"required": true,
"schema": {
"minLength": 1,
"type": "string"
}
},
{
"name": "replaceDeprecatedPrivileges",
"in": "query",
"description": "If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_response"
},
"examples": {
"getRoleResponse": {
"value": {
"_unrecognized_applications": [ ],
"description": "My custom Kibana role.",
"elasticsearch": {
"cluster": [
"monitor"
],
"indices": [
{
"names": [
"logs-*"
],
"privileges": [
"read"
]
}
],
"run_as": [ ]
},
"kibana": [
{
"base": [
"read"
],
"feature": { },
"spaces": [
"default"
]
}
],
"metadata": { },
"name": "my_kibana_role",
"transient_metadata": {
"enabled": true
}
}
},
"getRoleResponse1": {
"$ref": "#/components/examples/get_role_response1"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"roles"
],
"summary": "Create or update a role",
"description": "Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.",
"operationId": "put-security-role-name",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "name",
"in": "path",
"description": "The role name.",
"required": true,
"schema": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
}
},
{
"name": "createOnly",
"in": "query",
"description": "When true, a role is not overwritten if it already exists.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_put_payload"
},
"examples": {
"createOrUpdateRoleRequest": {
"value": {
"description": "My custom Kibana role.",
"elasticsearch": {
"cluster": [
"monitor"
],
"indices": [
{
"names": [
"logs-*"
],
"privileges": [
"read"
]
}
]
},
"kibana": [
{
"base": [
"read"
],
"feature": { },
"spaces": [
"default"
]
}
]
}
},
"createRoleRequest1": {
"$ref": "#/components/examples/create_role_request1"
},
"createRoleRequest2": {
"$ref": "#/components/examples/create_role_request2"
},
"createRoleRequest3": {
"$ref": "#/components/examples/create_role_request3"
},
"createRoleRequest4": {
"$ref": "#/components/examples/create_role_request4"
}
}
}
}
},
"responses": {
"204": {
"description": "Indicates a successful call."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/roles": {
"post": {
"tags": [
"roles"
],
"summary": "Create or update roles",
"description": "Create or update multiple Kibana roles in a single request.",
"operationId": "post-security-roles",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_roles_bulk_create_or_update_payload"
},
"examples": {
"bulkCreateOrUpdateRoles": {
"value": {
"roles": {
"my_kibana_role": {
"elasticsearch": {
"cluster": [
"monitor"
],
"indices": [
{
"names": [
"logs-*"
],
"privileges": [
"read"
]
}
]
},
"kibana": [
{
"base": [
"read"
],
"feature": { },
"spaces": [
"default"
]
}
]
}
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_bulk_create_or_update_roles_response"
},
"examples": {
"bulkCreateOrUpdateRolesResponse": {
"value": {
"created": [
"my_kibana_role"
],
"noop": [ ],
"updated": [ ]
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/security/session/_invalidate": {
"post": {
"tags": [
"user session"
],
"summary": "Invalidate user sessions",
"description": "Invalidate user sessions that match a query. To use this API, you must be a superuser.\n",
"operationId": "post-security-session-invalidate",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"match"
],
"type": "object",
"properties": {
"match": {
"enum": [
"all",
"query"
],
"type": "string",
"description": "The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.\n"
},
"query": {
"required": [
"provider"
],
"type": "object",
"properties": {
"provider": {
"required": [
"type"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The authentication provider name."
},
"type": {
"type": "string",
"description": "The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.\n"
}
},
"description": "The authentication providers that will have their user sessions invalidated."
},
"username": {
"type": "string",
"description": "The username that will have its sessions invalidated."
}
},
"description": "The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.\n"
}
}
},
"examples": {
"invalidateRequestExample1": {
"summary": "Invalidate all sessions",
"description": "Run `POST api/security/session/_invalidate` to invalidate all existing sessions.",
"value": "{\n \"match\" : \"all\"\n}"
},
"invalidateRequestExample2": {
"summary": "Invalidate all SAML sessions",
"description": "Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any SAML authentication provider.",
"value": "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"saml\" }\n }\n}"
},
"invalidateRequestExample3": {
"summary": "Invalidate sessions for a provider",
"description": "Run `POST api/security/session/_invalidate` to invalidate sessions that were created by the SAML authentication provider named `saml1`.",
"value": "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"saml\", \"name\": \"saml1\" }\n }\n}"
},
"invalidateRequestExample4": {
"summary": "Invalidate sessions for a user",
"description": "Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any OpenID Connect authentication provider for the user with the username `user@my-oidc-sso.com`.",
"value": "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"oidc\" },\n \"username\": \"user@my-oidc-sso.com\"\n }\n}"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"total": {
"type": "integer",
"description": "The number of sessions that were successfully invalidated."
}
}
}
}
}
},
"403": {
"description": "Indicates that the user may not be authorized to invalidate sessions for other users."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/short_url": {
"post": {
"tags": [
"short url"
],
"summary": "Create a short URL",
"description": "Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share.\nShort URLs are created by specifying the locator ID and locator parameters. When a short URL is resolved, the locator ID and locator parameters are used to redirect user to the right Kibana page.\n",
"operationId": "post-url",
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"locatorId",
"params"
],
"type": "object",
"properties": {
"humanReadableSlug": {
"type": "boolean",
"description": "When the `slug` parameter is omitted, the API will generate a random human-readable slug if `humanReadableSlug` is set to true.\n"
},
"locatorId": {
"type": "string",
"description": "The identifier for the locator."
},
"params": {
"type": "object",
"description": "An object which contains all necessary parameters for the given locator to resolve to a Kibana location.\n> warn\n> When you create a short URL, locator params are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.\n"
},
"slug": {
"type": "string",
"description": "A custom short URL slug. The slug is the part of the short URL that identifies it. You can provide a custom slug which consists of latin alphabet letters, numbers, and `-._` characters. The slug must be at least 3 characters long, but no longer than 255 characters.\n"
}
}
},
"examples": {
"createShortUrlRequest": {
"summary": "Create a short URL for a dashboard locator",
"description": "Request a short URL that resolves to a dashboard with a preset time range.",
"value": {
"locatorId": "DASHBOARD_APP_LOCATOR",
"params": {
"dashboardId": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b",
"timeRange": {
"from": "now-7d",
"to": "now"
}
},
"slug": "my-dashboard"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Short_URL_APIs_urlResponse"
},
"examples": {
"createShortUrlResponse": {
"summary": "Short URL created",
"description": "The created short URL record.",
"value": {
"accessCount": 0,
"accessDate": 1767225600000,
"createDate": 1767225600000,
"id": "c54b04f5d4b3aa3c",
"locator": {
"id": "DASHBOARD_APP_LOCATOR",
"state": {
"dashboardId": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b",
"timeRange": {
"from": "now-7d",
"to": "now"
}
},
"version": "9.4.0"
},
"slug": "my-dashboard"
}
}
}
}
}
}
},
"x-state": "Technical Preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/short_url/_slug/{slug}": {
"get": {
"tags": [
"short url"
],
"summary": "Resolve a short URL",
"description": "Resolve a Kibana short URL by its slug.\n",
"operationId": "resolve-url",
"parameters": [
{
"name": "slug",
"in": "path",
"description": "The slug of the short URL.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Short_URL_APIs_urlResponse"
},
"examples": {
"resolveShortUrlResponse": {
"summary": "Short URL resolved by slug",
"description": "The short URL record matching the given slug.",
"value": {
"accessCount": 12,
"accessDate": 1767744000000,
"createDate": 1767225600000,
"id": "c54b04f5d4b3aa3c",
"locator": {
"id": "DASHBOARD_APP_LOCATOR",
"state": {
"dashboardId": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b",
"timeRange": {
"from": "now-7d",
"to": "now"
}
},
"version": "9.4.0"
},
"slug": "my-dashboard"
}
}
}
}
}
}
},
"x-state": "Technical Preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/short_url/{id}": {
"delete": {
"tags": [
"short url"
],
"summary": "Delete a short URL",
"description": "Delete a Kibana short URL.\n",
"operationId": "delete-url",
"parameters": [
{
"$ref": "#/components/parameters/Short_URL_APIs_idParam"
}
],
"responses": {
"200": {
"description": "Indicates a successful call."
}
},
"x-state": "Technical Preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"short url"
],
"summary": "Get a short URL",
"description": "Get a single Kibana short URL.\n",
"operationId": "get-url",
"parameters": [
{
"$ref": "#/components/parameters/Short_URL_APIs_idParam"
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Short_URL_APIs_urlResponse"
},
"examples": {
"getShortUrlResponse": {
"summary": "Short URL retrieved by ID",
"description": "The short URL record matching the given identifier.",
"value": {
"accessCount": 12,
"accessDate": 1767744000000,
"createDate": 1767225600000,
"id": "c54b04f5d4b3aa3c",
"locator": {
"id": "DASHBOARD_APP_LOCATOR",
"state": {
"dashboardId": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b",
"timeRange": {
"from": "now-7d",
"to": "now"
}
},
"version": "9.4.0"
},
"slug": "my-dashboard"
}
}
}
}
}
}
},
"x-state": "Technical Preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/_copy_saved_objects": {
"post": {
"tags": [
"spaces"
],
"summary": "Copy saved objects between spaces",
"description": "It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required. You can request to overwrite any objects that already exist in the target space if they share an identifier or you can use the resolve copy saved objects conflicts API to do this on a per-object basis.
[Required authorization] Route required privileges: copySavedObjectsToSpaces.",
"operationId": "post-spaces-copy-saved-objects",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"spaces",
"objects"
],
"type": "object",
"properties": {
"compatibilityMode": {
"type": "boolean",
"description": "Apply various adjustments to the saved objects that are being copied to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with copied saved objects. This option cannot be used with the `createNewCopies` option.",
"default": false
},
"createNewCopies": {
"type": "boolean",
"description": "Create new copies of saved objects, regenerate each object identifier, and reset the origin. When used, potential conflict errors are avoided. This option cannot be used with the `overwrite` and `compatibilityMode` options.",
"default": true
},
"includeReferences": {
"type": "boolean",
"description": "When set to true, all saved objects related to the specified saved objects will also be copied into the target spaces.",
"default": false
},
"objects": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The identifier of the saved object to copy."
},
"type": {
"type": "string",
"description": "The type of the saved object to copy."
}
},
"additionalProperties": false
}
},
"overwrite": {
"type": "boolean",
"description": "When set to true, all conflicts are automatically overridden. When a saved object with a matching type and identifier exists in the target space, that version is replaced with the version from the source space. This option cannot be used with the `createNewCopies` option.",
"default": false
},
"spaces": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The identifiers of the spaces where you want to copy the specified objects."
}
}
},
"additionalProperties": false
},
"examples": {
"copySavedObjectsRequestExample1": {
"$ref": "#/components/examples/copy_saved_objects_request1"
},
"copySavedObjectsRequestExample2": {
"$ref": "#/components/examples/copy_saved_objects_request2"
}
}
}
}
},
"responses": {
"200": {
"description": "OK: A successful request.",
"content": {
"application/json": {
"examples": {
"copySavedObjectsResponseExample1": {
"$ref": "#/components/examples/copy_saved_objects_response1"
},
"copySavedObjectsResponseExample2": {
"$ref": "#/components/examples/copy_saved_objects_response2"
},
"copySavedObjectsResponseExample3": {
"$ref": "#/components/examples/copy_saved_objects_response3"
},
"copySavedObjectsResponseExample4": {
"$ref": "#/components/examples/copy_saved_objects_response4"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/_disable_legacy_url_aliases": {
"post": {
"tags": [
"spaces"
],
"summary": "Disable legacy URL aliases",
"description": "Disable one or more legacy URL aliases so that they no longer resolve to their target saved objects.",
"operationId": "post-spaces-disable-legacy-url-aliases",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"aliases"
],
"type": "object",
"properties": {
"aliases": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"targetSpace",
"targetType",
"sourceId"
],
"type": "object",
"properties": {
"sourceId": {
"type": "string",
"description": "The alias source object identifier. This is the legacy object identifier."
},
"targetSpace": {
"type": "string",
"description": "The space where the alias target object exists."
},
"targetType": {
"type": "string",
"description": "The type of alias target object. "
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"examples": {
"disableLegacyURLRequestExample1": {
"$ref": "#/components/examples/disable_legacy_url_request1"
}
}
}
}
},
"responses": {
"204": {
"description": "Indicates a successful call."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/_get_shareable_references": {
"post": {
"tags": [
"spaces"
],
"summary": "Get shareable references",
"description": "Collect references and space contexts for saved objects.",
"operationId": "post-spaces-get-shareable-references",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"objects"
],
"type": "object",
"properties": {
"objects": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"examples": {
"getShareableReferencesRequestExample1": {
"$ref": "#/components/examples/get_shareable_references_request1"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"examples": {
"getShareableReferencesResponseExample1": {
"$ref": "#/components/examples/get_shareable_references_response1"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/_resolve_copy_saved_objects_errors": {
"post": {
"summary": "Resolve conflicts copying saved objects",
"description": "Overwrite saved objects that are returned as errors from the copy saved objects to space API.
[Required authorization] Route required privileges: copySavedObjectsToSpaces.",
"operationId": "post-spaces-resolve-copy-saved-objects-errors",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"retries",
"objects"
],
"type": "object",
"properties": {
"compatibilityMode": {
"type": "boolean",
"default": false
},
"createNewCopies": {
"type": "boolean",
"default": true
},
"includeReferences": {
"type": "boolean",
"default": false
},
"objects": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
}
},
"additionalProperties": false
}
},
"retries": {
"type": "object",
"additionalProperties": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"createNewCopy": {
"type": "boolean",
"description": "Creates new copies of the saved objects, regenerates each object ID, and resets the origin."
},
"destinationId": {
"type": "string",
"description": "Specifies the destination identifier that the copied object should have, if different from the current identifier."
},
"id": {
"type": "string",
"description": "The saved object identifier."
},
"ignoreMissingReferences": {
"type": "boolean",
"description": "When set to true, any missing references errors are ignored."
},
"overwrite": {
"type": "boolean",
"description": "When set to true, the saved object from the source space overwrites the conflicting object in the destination space.",
"default": false
},
"type": {
"type": "string",
"description": "The saved object type."
}
},
"additionalProperties": false
}
}
}
},
"additionalProperties": false
},
"examples": {
"resolveCopySavedObjectsRequestExample1": {
"$ref": "#/components/examples/resolve_copy_saved_objects_request1"
},
"resolveCopySavedObjectsRequestExample2": {
"$ref": "#/components/examples/resolve_copy_saved_objects_request2"
}
}
}
}
},
"responses": {
"200": {
"description": "OK: A successful request.",
"content": {
"application/json": {
"examples": {
"resolveCopySavedObjectsResponseExample1": {
"$ref": "#/components/examples/copy_saved_objects_response1"
},
"resolveCopySavedObjectsResponseExample2": {
"$ref": "#/components/examples/copy_saved_objects_response2"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/_update_objects_spaces": {
"post": {
"tags": [
"spaces"
],
"summary": "Update saved objects in spaces",
"description": "Update one or more saved objects to add or remove them from some spaces.",
"operationId": "post-spaces-update-objects-spaces",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"objects",
"spacesToAdd",
"spacesToRemove"
],
"type": "object",
"properties": {
"objects": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The identifier of the saved object to update."
},
"type": {
"type": "string",
"description": "The type of the saved object to update."
}
},
"additionalProperties": false
}
},
"spacesToAdd": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "The identifiers of the spaces the saved objects should be added to or removed from."
}
},
"spacesToRemove": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "The identifiers of the spaces the saved objects should be added to or removed from."
}
}
},
"additionalProperties": false
},
"examples": {
"updateObjectSpacesRequestExample1": {
"$ref": "#/components/examples/update_saved_objects_spaces_request1"
}
}
}
}
},
"responses": {
"200": {
"description": "OK: A successful request.",
"content": {
"application/json": {
"examples": {
"updateObjectSpacesResponseExample1": {
"$ref": "#/components/examples/update_saved_objects_spaces_response1"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/space": {
"get": {
"tags": [
"spaces"
],
"summary": "Get all spaces",
"description": "Retrieve all available Kibana spaces. The list includes only the spaces that the user is authorized to access.",
"operationId": "get-spaces-space",
"parameters": [
{
"name": "purpose",
"in": "query",
"description": "Specifies which authorization checks are applied to the API call. The default value is `any`.",
"schema": {
"enum": [
"any",
"copySavedObjectsIntoSpace",
"shareSavedObjectsIntoSpace"
],
"type": "string"
}
},
{
"name": "include_authorized_purposes",
"in": "query",
"description": "When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"examples": {
"getSpacesResponseExample1": {
"$ref": "#/components/examples/get_spaces_response1"
},
"getSpacesResponseExample2": {
"$ref": "#/components/examples/get_spaces_response2"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"spaces"
],
"summary": "Create a space",
"description": "Create a new Kibana space.",
"operationId": "post-spaces-space",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"_reserved": {
"type": "boolean"
},
"color": {
"type": "string",
"description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name."
},
"description": {
"type": "string",
"description": "A description for the space."
},
"disabledFeatures": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The list of features that are turned off in the space."
},
"default": [ ]
},
"id": {
"type": "string",
"description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation."
},
"imageUrl": {
"type": "string",
"description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images."
},
"initials": {
"maxLength": 2,
"type": "string",
"description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name."
},
"name": {
"minLength": 1,
"type": "string",
"description": "The display name for the space. "
},
"projectRouting": {
"type": "string",
"description": "Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments."
},
"solution": {
"enum": [
"security",
"oblt",
"es",
"classic"
],
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"createSpaceRequest": {
"$ref": "#/components/examples/create_space_request"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"_reserved": {
"type": "boolean"
},
"color": {
"type": "string",
"description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name."
},
"description": {
"type": "string",
"description": "A description for the space."
},
"disabledFeatures": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The list of features that are turned off in the space."
},
"default": [ ]
},
"id": {
"type": "string",
"description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation."
},
"imageUrl": {
"type": "string",
"description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images."
},
"initials": {
"maxLength": 2,
"type": "string",
"description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name."
},
"name": {
"minLength": 1,
"type": "string",
"description": "The display name for the space. "
},
"projectRouting": {
"type": "string",
"description": "Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments."
},
"solution": {
"enum": [
"security",
"oblt",
"es",
"classic"
],
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"createSpaceResponseExample": {
"$ref": "#/components/examples/get_space_response"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/spaces/space/{id}": {
"delete": {
"tags": [
"spaces"
],
"summary": "Delete a space",
"description": "When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone.",
"operationId": "delete-spaces-space-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The space identifier.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"204": {
"description": "Indicates a successful call."
},
"404": {
"description": "Indicates that the request failed."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"spaces"
],
"summary": "Get a space",
"description": "Retrieve a single Kibana space by its identifier.",
"operationId": "get-spaces-space-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The space identifier.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"_reserved": {
"type": "boolean"
},
"color": {
"type": "string",
"description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name."
},
"description": {
"type": "string",
"description": "A description for the space."
},
"disabledFeatures": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The list of features that are turned off in the space."
},
"default": [ ]
},
"id": {
"type": "string",
"description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation."
},
"imageUrl": {
"type": "string",
"description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images."
},
"initials": {
"maxLength": 2,
"type": "string",
"description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name."
},
"name": {
"minLength": 1,
"type": "string",
"description": "The display name for the space. "
},
"projectRouting": {
"type": "string",
"description": "Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments."
},
"solution": {
"enum": [
"security",
"oblt",
"es",
"classic"
],
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"getSpaceResponse": {
"summary": "Get details about a marketing space",
"description": "A response that contains the full configuration for a single Kibana space.",
"value": {
"color": "#aabbcc",
"description": "This is the Marketing Space",
"disabledFeatures": [ ],
"id": "marketing",
"imageUrl": "",
"initials": "MK",
"name": "Marketing",
"solution": "es"
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"spaces"
],
"summary": "Update a space",
"description": "Update an existing Kibana space.",
"operationId": "put-spaces-space-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The space identifier. You are unable to change the ID with the update operation.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"_reserved": {
"type": "boolean"
},
"color": {
"type": "string",
"description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name."
},
"description": {
"type": "string",
"description": "A description for the space."
},
"disabledFeatures": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The list of features that are turned off in the space."
},
"default": [ ]
},
"id": {
"type": "string",
"description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation."
},
"imageUrl": {
"type": "string",
"description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images."
},
"initials": {
"maxLength": 2,
"type": "string",
"description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name."
},
"name": {
"minLength": 1,
"type": "string",
"description": "The display name for the space. "
},
"projectRouting": {
"type": "string",
"description": "Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments."
},
"solution": {
"enum": [
"security",
"oblt",
"es",
"classic"
],
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"updateSpaceRequest": {
"$ref": "#/components/examples/update_space_request"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"_reserved": {
"type": "boolean"
},
"color": {
"type": "string",
"description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name."
},
"description": {
"type": "string",
"description": "A description for the space."
},
"disabledFeatures": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The list of features that are turned off in the space."
},
"default": [ ]
},
"id": {
"type": "string",
"description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation."
},
"imageUrl": {
"type": "string",
"description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images."
},
"initials": {
"maxLength": 2,
"type": "string",
"description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name."
},
"name": {
"minLength": 1,
"type": "string",
"description": "The display name for the space. "
},
"projectRouting": {
"type": "string",
"description": "Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments."
},
"solution": {
"enum": [
"security",
"oblt",
"es",
"classic"
],
"type": "string"
}
},
"additionalProperties": false
},
"examples": {
"updateSpaceResponse": {
"summary": "Update the marketing space",
"description": "A response that contains the updated configuration of the Kibana space.",
"value": {
"color": "#aabbcc",
"description": "An updated description for the Marketing Space",
"disabledFeatures": [ ],
"id": "marketing",
"imageUrl": "",
"initials": "MK",
"name": "Marketing",
"solution": "es"
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/status": {
"get": {
"tags": [
"system"
],
"summary": "Get Kibana's current status",
"description": "Returns Kibana's overall operational status and a per-service breakdown for Elasticsearch, Saved Objects, and registered plugins. The endpoint is intended for liveness and readiness checks (for example, by Kubernetes probes) and for operators monitoring a Kibana deployment. Unauthenticated callers receive a redacted response that exposes only the overall status level.",
"operationId": "get-status",
"parameters": [
{
"name": "v7format",
"in": "query",
"description": "Set to \"true\" to get the response in v7 format.",
"schema": {
"type": "boolean"
}
},
{
"name": "v8format",
"in": "query",
"description": "Set to \"true\" to get the response in v8 format.",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Overall status is OK and Kibana should be functioning normally.",
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_response"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse"
}
],
"description": "Kibana's operational status. A minimal response is sent for unauthorized users."
},
"examples": {
"statusAvailableResponse": {
"summary": "Kibana is available",
"description": "A successful response when Kibana and its core services are operating normally.",
"value": {
"metrics": {
"collection_interval_in_millis": 5000,
"elasticsearch_client": {
"totalActiveSockets": 4,
"totalIdleSockets": 2,
"totalQueuedRequests": 0
},
"last_updated": "2026-04-30T12:00:05.000Z"
},
"name": "kibana",
"status": {
"core": {
"elasticsearch": {
"level": "available",
"summary": "Elasticsearch is available"
},
"savedObjects": {
"level": "available",
"summary": "SavedObjects service has completed migrations and is available"
}
},
"overall": {
"level": "available",
"summary": "All services are available"
},
"plugins": { }
},
"uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
"version": {
"build_date": "2026-04-30T12:00:00.000Z",
"build_flavor": "traditional",
"build_hash": "ad8f0fa4d5022f56bbe2c4d51e9d0fcfa1ee67fc",
"build_number": 100200,
"build_snapshot": false,
"number": "9.3.0"
}
}
},
"statusRedactedResponse": {
"summary": "Kibana is available (redacted)",
"description": "A redacted response returned when the caller is unauthenticated or lacks the `monitor` cluster privilege.",
"value": {
"status": {
"overall": {
"level": "available"
}
}
}
}
}
}
}
},
"503": {
"description": "Kibana or some of its essential services are unavailable. Kibana may be degraded or unavailable.",
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_response"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse"
}
],
"description": "Kibana's operational status. A minimal response is sent for unauthorized users."
},
"examples": {
"statusUnavailableResponse": {
"summary": "Kibana is unavailable",
"description": "A response when one or more core services are unavailable.",
"value": {
"metrics": {
"collection_interval_in_millis": 5000,
"elasticsearch_client": {
"totalActiveSockets": 0,
"totalIdleSockets": 0,
"totalQueuedRequests": 0
},
"last_updated": "2026-04-30T12:00:05.000Z"
},
"name": "kibana",
"status": {
"core": {
"elasticsearch": {
"level": "unavailable",
"summary": "Unable to connect to Elasticsearch"
},
"savedObjects": {
"level": "unavailable",
"summary": "SavedObjects service depends on Elasticsearch"
}
},
"overall": {
"level": "unavailable",
"summary": "Some services are unavailable"
},
"plugins": { }
},
"uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
"version": {
"build_date": "2026-04-30T12:00:00.000Z",
"build_flavor": "traditional",
"build_hash": "ad8f0fa4d5022f56bbe2c4d51e9d0fcfa1ee67fc",
"build_number": 100200,
"build_snapshot": false,
"number": "9.3.0"
}
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/streams": {
"get": {
"tags": [
"streams"
],
"summary": "Get stream list",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/streams
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFetches list of all streams
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDisables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nResyncs all streams, making sure that Elasticsearch assets are up to date
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes a stream definition and the underlying data stream
[Required authorization] Route required privileges: manage_stream.",
"operationId": "delete-streams-name",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "name",
"in": "path",
"description": "The name of the stream.",
"required": true,
"schema": {
"maxLength": 200,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"additionalProperties": false
},
{ }
]
}
}
}
},
"responses": {
"200": {
"description": "The stream was deleted successfully."
}
},
"x-state": "Experimental; added in 9.1.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"streams"
],
"summary": "Get a stream",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/streams/{name}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFetches a stream definition and associated dashboards
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates or updates a stream definition. Classic streams can not be created through this API, only updated
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nForks a wired stream and creates a child stream
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFetches the ingest settings of an ingest stream definition
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpserts the ingest settings of an ingest stream definition
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFetches the query settings of a query stream definition
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpserts the query settings of a query stream definition
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExports a content pack with the stream structure (routing, mappings, and processing). Significant-event queries are not included.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImports stream structure (routing, mappings, and processing) from a content pack into a stream.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFetches all attachments linked to a stream that are visible to the current user in the current space. Optionally filter by attachment types, search query, and tags.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nBulk update attachments linked to a stream. Can link new attachments and delete existing ones. Supports mixed attachment types in a single request.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUnlinks an attachment from a stream. Noop if the attachment is not linked to the stream.
[Required authorization] Route required privileges: manage_stream.",
"operationId": "delete-streams-streamname-attachments-attachmenttype-attachmentid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "streamName",
"in": "path",
"description": "The name of the stream",
"required": true,
"schema": {
"maxLength": 200,
"type": "string"
}
},
{
"name": "attachmentType",
"in": "path",
"description": "The type of the attachment",
"required": true,
"schema": {
"enum": [
"dashboard",
"rule",
"slo"
],
"type": "string"
}
},
{
"name": "attachmentId",
"in": "path",
"description": "The ID of the attachment",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"additionalProperties": false
},
{ }
]
},
"examples": {
"unlinkAttachmentExample": {
"value": { }
}
}
}
}
},
"responses": {
"200": {
"description": "Successfully unlinked attachment",
"content": {
"application/json": {
"examples": {
"unlinkAttachmentResponse": {
"value": {
"acknowledged": true
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.3.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"streams"
],
"summary": "Link an attachment to a stream",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nLinks an attachment to a stream. Noop if the attachment is already linked to the stream.
[Required authorization] Route required privileges: manage_stream.",
"operationId": "put-streams-streamname-attachments-attachmenttype-attachmentid",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "streamName",
"in": "path",
"description": "The name of the stream",
"required": true,
"schema": {
"maxLength": 200,
"type": "string"
}
},
{
"name": "attachmentType",
"in": "path",
"description": "The type of the attachment",
"required": true,
"schema": {
"enum": [
"dashboard",
"rule",
"slo"
],
"type": "string"
}
},
{
"name": "attachmentId",
"in": "path",
"description": "The ID of the attachment",
"required": true,
"schema": {
"maxLength": 256,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"anyOf": [
{
"type": "object",
"additionalProperties": false
},
{ }
]
},
"examples": {
"linkAttachmentExample": {
"value": { }
}
}
}
}
},
"responses": {
"200": {
"description": "Successfully linked attachment",
"content": {
"application/json": {
"examples": {
"linkAttachmentResponse": {
"value": {
"acknowledged": true
}
}
}
}
}
}
},
"x-state": "Experimental; added in 9.3.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/monitor/test/{monitorId}": {
"post": {
"tags": [
"synthetics"
],
"summary": "Trigger an on-demand test run for a monitor",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nTrigger an immediate test execution for the specified monitor. The response includes the generated `testRunId`. If the test encounters issues in one or more service locations, an `errors` array is also returned with details about the failures.\n",
"operationId": "post-synthetics-monitor-test",
"parameters": [
{
"name": "monitorId",
"in": "path",
"description": "The ID (config_id) of the monitor to test.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Test run triggered successfully.",
"content": {
"application/json": {
"schema": {
"required": [
"testRunId"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"required": [
"locationId",
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"status",
"reason",
"failed_monitors"
],
"type": "object",
"properties": {
"failed_monitors": {
"type": [
"null",
"array"
],
"items": {
"type": "object"
},
"description": "Optional list of monitors that failed at the location."
},
"reason": {
"type": "string",
"description": "Human-readable explanation of the failure."
},
"status": {
"type": "integer",
"description": "HTTP status code returned by the agent."
}
}
},
"locationId": {
"type": "string",
"description": "Identifier of the service location where the error occurred."
}
}
},
"description": "Array of errors encountered while triggering the test, one per service location."
},
"testRunId": {
"type": "string",
"description": "Unique identifier for the triggered test run."
}
}
},
"examples": {
"testNowMonitorResponseExample1": {
"value": "{\n \"testRunId\": \"2bd506e5-4f9a-4aa6-a019-7988500afba0\",\n \"errors\": [\n {\n \"locationId\": \"us_central_staging\",\n \"error\": {\n \"status\": 401,\n \"reason\": \"no auth credentials provided\",\n \"failed_monitors\": null\n }\n }\n ]\n}"
}
}
}
}
},
"404": {
"description": "Monitor not found."
}
},
"x-state": "Generally available; added in 9.2.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/monitors": {
"get": {
"tags": [
"synthetics"
],
"summary": "Get monitors",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/synthetics/monitors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of monitors.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "get-synthetic-monitors",
"parameters": [
{
"name": "filter",
"in": "query",
"description": "Additional filtering criteria.",
"schema": {
"type": "string"
}
},
{
"name": "locations",
"in": "query",
"description": "The locations to filter by.",
"schema": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
}
},
{
"name": "monitorTypes",
"in": "query",
"description": "The monitor types to filter.",
"schema": {
"oneOf": [
{
"enum": [
"browser",
"http",
"icmp",
"tcp"
],
"type": "string"
},
{
"type": "array",
"items": {
"enum": [
"browser",
"http",
"icmp",
"tcp"
],
"type": "string"
}
}
]
}
},
{
"name": "page",
"in": "query",
"description": "The page number for paginated results.",
"schema": {
"type": "integer"
}
},
{
"name": "per_page",
"in": "query",
"description": "The number of items to return per page.",
"schema": {
"type": "integer"
}
},
{
"name": "projects",
"in": "query",
"description": "The projects to filter by.",
"schema": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
}
},
{
"name": "query",
"in": "query",
"description": "A free-text query string.",
"schema": {
"type": "string"
}
},
{
"name": "schedules",
"in": "query",
"description": "The schedules to filter by.",
"schema": {
"oneOf": [
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "string"
}
]
}
},
{
"name": "sortField",
"in": "query",
"description": "The field to sort the results by.",
"schema": {
"enum": [
"name",
"createdAt",
"updatedAt",
"status"
],
"type": "string"
}
},
{
"name": "sortOrder",
"in": "query",
"description": "The sort order.",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string"
}
},
{
"name": "status",
"in": "query",
"description": "The status to filter by.",
"schema": {
"oneOf": [
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "string"
}
]
}
},
{
"name": "tags",
"in": "query",
"description": "Tags to filter monitors.",
"schema": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
}
},
{
"name": "useLogicalAndFor",
"in": "query",
"description": "Specifies whether to apply logical AND filtering for specific fields. Accepts either a string with values \"tags\" or \"locations\" or an array containing both.\n",
"schema": {
"oneOf": [
{
"enum": [
"tags",
"locations"
],
"type": "string"
},
{
"type": "array",
"items": {
"enum": [
"tags",
"locations"
],
"type": "string"
}
}
]
}
}
],
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"getSyntheticMonitorsResponseExample1": {
"description": "A successful response from `GET /api/synthetics/monitors?tags=prod&monitorTypes=http&locations=us-east-1&projects=project1&status=up`.",
"value": "{\n \"page\": 1,\n \"total\": 24,\n \"monitors\": [\n {\n \"type\": \"icmp\",\n \"enabled\": false,\n \"alert\": {\n \"status\": {\n \"enabled\": true\n },\n \"tls\": {\n \"enabled\": true\n }\n },\n \"schedule\": {\n \"number\": \"3\",\n \"unit\": \"m\"\n },\n \"config_id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n \"timeout\": \"16\",\n \"name\": \"8.8.8.8:80\",\n \"locations\": [\n {\n \"id\": \"us_central\",\n \"label\": \"North America - US Central\",\n \"geo\": {\n \"lat\": 41.25,\n \"lon\": -95.86\n },\n \"isServiceManaged\": true\n }\n ],\n \"namespace\": \"default\",\n \"origin\": \"ui\",\n \"id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n \"max_attempts\": 2,\n \"wait\": \"7\",\n \"revision\": 3,\n \"mode\": \"all\",\n \"ipv4\": true,\n \"ipv6\": true,\n \"created_at\": \"2023-11-07T09:57:04.152Z\",\n \"updated_at\": \"2023-12-04T19:19:34.039Z\",\n \"host\": \"8.8.8.8:80\"\n }\n ],\n \"absoluteTotal\": 24,\n \"perPage\": 10,\n}"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"synthetics"
],
"summary": "Create a monitor",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/synthetics/monitors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new monitor with the specified attributes. A monitor can be one of the following types: HTTP, TCP, ICMP, or Browser. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "post-synthetic-monitors",
"requestBody": {
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Synthetics_browserMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_httpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_icmpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_tcpMonitorFields"
}
],
"description": "The request body should contain the attributes of the monitor you want to create. The required and default fields differ depending on the monitor type.\n",
"discriminator": {
"propertyName": "type"
}
},
"examples": {
"postSyntheticMonitorsRequestExample1": {
"summary": "HTTP monitor",
"description": "Create an HTTP monitor to check a website's availability.",
"value": "{\n \"type\": \"http\",\n \"name\": \"Website Availability\",\n \"url\": \"https://example.com\",\n \"tags\": [\"website\", \"availability\"],\n \"locations\": [\"united_kingdom\"]\n}"
},
"postSyntheticMonitorsRequestExample2": {
"summary": "TCP monitor",
"description": "Create a TCP monitor to monitor a server's availability.",
"value": "{\n \"type\": \"tcp\",\n \"name\": \"Server Availability\",\n \"host\": \"example.com\",\n \"private_locations\": [\"my_private_location\"]\n}"
},
"postSyntheticMonitorsRequestExample3": {
"summary": "ICMP monitor",
"description": "Create an ICMP monitor to perform ping checks.",
"value": "{\n \"type\": \"icmp\",\n \"name\": \"Ping Test\",\n \"host\": \"example.com\",\n \"locations\": [\"united_kingdom\"]\n}"
},
"postSyntheticMonitorsRequestExample4": {
"summary": "Browser monitor",
"description": "Create a browser monitor to check a website.",
"value": "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n \"locations\": [\"united_kingdom\"]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response. The response may include a `warnings` array when the monitor configuration has non-critical issues. For example, if a browser monitor specifies a timeout but has no private locations configured, a warning is returned indicating the timeout will have no effect.\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"warnings": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Synthetics_monitorWarning"
},
"description": "An optional array of warnings about the monitor configuration.\n"
}
}
},
"examples": {
"postSyntheticMonitorsResponseWithWarning": {
"summary": "Response with warning",
"description": "A response when a browser monitor specifies a timeout but has no private locations.",
"value": "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"enabled\": true,\n \"warnings\": [\n {\n \"id\": \"monitor-id\",\n \"message\": \"For browser monitors, timeout is only supported on private locations. Browser monitor \\\"Example journey\\\" specifies a timeout and is running on public locations: \\\"public-1, public-2\\\". The timeout will have no effect on these locations.\",\n \"publicLocationIds\": [\"public-1\", \"public-2\"]\n }\n ]\n}"
}
}
}
}
},
"400": {
"description": "Bad request. For browser monitors, a 400 error is returned if the timeout is less than 30 seconds.\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"details": {
"type": "string",
"example": "Invalid timeout 20 seconds supplied. Minimum timeout for browser monitors is 30 seconds."
}
}
},
"error": {
"type": "string",
"example": "Bad Request"
},
"message": {
"type": "string",
"example": "Browser Monitor timeout is invalid"
},
"statusCode": {
"type": "integer",
"example": 400
}
}
},
"examples": {
"invalidBrowserTimeout": {
"summary": "Invalid browser timeout",
"description": "A 400 error when a browser monitor timeout is below 30 seconds.",
"value": "{\n \"statusCode\": 400,\n \"error\": \"Bad Request\",\n \"message\": \"Browser Monitor timeout is invalid\",\n \"attributes\": {\n \"details\": \"Invalid timeout 20 seconds supplied. Minimum timeout for browser monitors is 30 seconds.\"\n }\n}"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/monitors/_bulk_create": {
"post": {
"tags": [
"synthetics"
],
"summary": "Bulk create monitors",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate up to 1000 monitors in one request. Every monitor is validated before any monitor is persisted. The API creates the Saved Objects and synchronizes Fleet once for the batch.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. If a monitor is shared to additional spaces, you must also have create privileges in each of those spaces.\nThis is a versioned public API (`elastic-api-version: 2023-10-31`).\n",
"operationId": "post-synthetic-monitors-bulk-create",
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"monitors"
],
"type": "object",
"properties": {
"monitors": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Synthetics_browserMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_httpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_icmpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_tcpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_apiMonitorFields"
}
],
"discriminator": {
"propertyName": "type"
}
},
"description": "A non-empty list of monitor configurations, up to 1000 monitors."
}
},
"additionalProperties": false
},
"examples": {
"bulkCreateRequestExample1": {
"summary": "Two HTTP monitors",
"value": "{\n \"monitors\": [\n {\n \"type\": \"http\",\n \"name\": \"Storefront\",\n \"url\": \"https://example.com\",\n \"locations\": [\"united_kingdom\"]\n },\n {\n \"type\": \"http\",\n \"name\": \"Documentation\",\n \"url\": \"https://docs.example.com\",\n \"locations\": [\"united_kingdom\"]\n }\n ]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response. `created: false` indicates an individual Saved Object creation or Fleet synchronization failure; see `error`. Batch-level Fleet synchronization errors are returned in `errors`.\n",
"content": {
"application/json": {
"schema": {
"required": [
"result"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"description": "A service-level error from the bulk sync."
},
"description": "Optional service-level errors from the bulk sync."
},
"result": {
"type": "array",
"items": {
"required": [
"id",
"created"
],
"type": "object",
"properties": {
"created": {
"type": "boolean",
"description": "Whether the monitor Saved Object was created."
},
"error": {
"type": "string",
"description": "Present when `created` is `false`."
},
"id": {
"type": "string",
"description": "The config ID of the created monitor."
}
}
}
}
}
},
"examples": {
"bulkCreateResponseExample1": {
"value": "{\n \"result\": [\n {\n \"id\": \"monitor1-id\",\n \"created\": true\n },\n {\n \"id\": \"monitor2-id\",\n \"created\": true\n }\n ]\n}"
}
}
}
}
},
"400": {
"description": "Bad request. Returned when the batch is empty or too large, a monitor configuration is invalid, or two monitors use the same name.\n"
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/monitors/_bulk_delete": {
"post": {
"tags": [
"synthetics"
],
"summary": "Delete monitors",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPartially update multiple monitors in a single request.\nEach `updates` entry has its own `id` and `attributes` patch, so one request can apply a different change per monitor. Unspecified fields are left unchanged. Patches use the same merge, validate, and encrypt path as `PUT /api/synthetics/monitors/{id}`.\nFor private-location monitors, Fleet is synced once for the batch instead of once per monitor.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\nThis is a versioned public API (`elastic-api-version: 2023-10-31`).\n",
"operationId": "put-synthetic-monitors-bulk-update",
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"updates"
],
"type": "object",
"properties": {
"updates": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"required": [
"id",
"attributes"
],
"type": "object",
"properties": {
"attributes": {
"minProperties": 1,
"type": "object",
"description": "Attributes to update for the monitor. You can specify the same fields as in `PUT /api/synthetics/monitors/{id}`. An empty object is rejected.\n"
},
"id": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "The monitor config ID to update."
}
},
"additionalProperties": false
},
"description": "Monitors to update. Minimum 1 entry, maximum 1000. Each `id` may appear at most once. `attributes` must contain at least one field.\n"
}
},
"additionalProperties": false
},
"examples": {
"bulkUpdateRequestExample1": {
"summary": "Mixed patches",
"description": "Run `PUT /api/synthetics/monitors/_bulk_update` to apply a different partial update to each monitor.\n",
"value": "{\n \"updates\": [\n {\n \"id\": \"monitor1-id\",\n \"attributes\": {\n \"enabled\": false\n }\n },\n {\n \"id\": \"monitor2-id\",\n \"attributes\": {\n \"tags\": [\"bulk-patched\"]\n }\n },\n {\n \"id\": \"monitor3-id\",\n \"attributes\": {\n \"schedule\": {\n \"number\": \"15\",\n \"unit\": \"m\"\n }\n }\n }\n ]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response. The `result` array is in request order. Per-id failures (not found, validation, Fleet sync) set `updated: false` and `error` without failing the whole batch. `errors` is present only when there are service-level sync errors.\n",
"content": {
"application/json": {
"schema": {
"required": [
"result"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"description": "A service-level error from the bulk sync."
},
"description": "Optional service-level errors from the bulk sync."
},
"result": {
"type": "array",
"items": {
"required": [
"id",
"updated"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Present when `updated` is `false`."
},
"id": {
"type": "string",
"description": "The monitor config ID from the request."
},
"updated": {
"type": "boolean",
"description": "If `true`, the monitor was updated. If `false`, see `error`.\n"
}
}
}
}
}
},
"examples": {
"bulkUpdateResponseExample1": {
"description": "A response from a bulk update with one failure.",
"value": "{\n \"result\": [\n {\n \"id\": \"monitor1-id\",\n \"updated\": true\n },\n {\n \"id\": \"missing-id\",\n \"updated\": false,\n \"error\": \"Monitor id missing-id not found!\"\n },\n {\n \"id\": \"monitor3-id\",\n \"updated\": true\n }\n ]\n}"
}
}
}
}
},
"400": {
"description": "Bad request. Returned when `updates` is missing or empty, an `attributes` object is empty, or the same `id` appears more than once.\n"
}
},
"x-state": "added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/monitors/{id}": {
"delete": {
"tags": [
"synthetics"
],
"summary": "Delete a monitor",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a monitor from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "delete-synthetic-monitor",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The identifier for the monitor that you want to delete.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "OK"
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"synthetics"
],
"summary": "Get a monitor",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.",
"operationId": "get-synthetic-monitor",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The ID of the monitor.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"getSyntheticMonitorResponseExample1": {
"description": "A successful response from `GET /api/synthetics/monitors/`.",
"value": "{\n \"type\": \"http\",\n \"enabled\": true,\n \"alert\": {\n \"status\": {\n \"enabled\": true\n },\n \"tls\": {\n \"enabled\": true\n }\n },\n \"schedule\": {\n \"number\": \"3\",\n \"unit\": \"m\"\n },\n \"config_id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n \"timeout\": \"16\",\n \"name\": \"am i something\",\n \"locations\": [\n {\n \"id\": \"us_central\",\n \"label\": \"North America - US Central\",\n \"geo\": {\n \"lat\": 41.25,\n \"lon\": -95.86\n },\n \"isServiceManaged\": true\n }\n ],\n \"namespace\": \"default\",\n \"origin\": \"ui\",\n \"id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n \"max_attempts\": 2,\n \"__ui\": {\n \"is_tls_enabled\": false\n },\n \"max_redirects\": \"0\",\n \"response.include_body\": \"on_error\",\n \"response.include_headers\": true,\n \"check.request.method\": \"GET\",\n \"mode\": \"any\",\n \"response.include_body_max_bytes\": \"1024\",\n \"ipv4\": true,\n \"ipv6\": true,\n \"ssl.verification_mode\": \"full\",\n \"ssl.supported_protocols\": [\n \"TLSv1.1\",\n \"TLSv1.2\",\n \"TLSv1.3\"\n ],\n \"revision\": 13,\n \"created_at\": \"2023-11-08T08:45:29.334Z\",\n \"updated_at\": \"2023-12-18T20:31:44.770Z\",\n \"url\": \"https://fast.com\"\n}"
}
}
}
}
},
"404": {
"description": "If the monitor is not found, the API returns a 404 error."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"synthetics"
],
"summary": "Update a monitor",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a monitor with the specified attributes. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\nYou can also partially update a monitor. This will only update the fields that are specified in the request body. All other fields are left unchanged. The specified fields should conform to the monitor type. For example, you can't update the `inline_scipt` field of a HTTP monitor.\n",
"operationId": "put-synthetic-monitor",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The identifier for the monitor that you want to update.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"oneOf": [
{
"$ref": "#/components/schemas/Synthetics_browserMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_httpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_icmpMonitorFields"
},
{
"$ref": "#/components/schemas/Synthetics_tcpMonitorFields"
}
],
"description": "The request body should contain the attributes of the monitor you want to update. The required and default fields differ depending on the monitor type.\n",
"discriminator": {
"propertyName": "type"
}
},
"examples": {
"putSyntheticMonitorsRequestExample1": {
"summary": "HTTP monitor",
"description": "Update an HTTP monitor that checks a website's availability.",
"value": "{\n \"type\": \"http\",\n \"name\": \"Website Availability\",\n \"url\": \"https://example.com\",\n \"tags\": [\"website\", \"availability\"],\n \"locations\": [\"united_kingdom\"]\n}"
},
"putSyntheticMonitorsRequestExample2": {
"summary": "TCP monitor",
"description": "Update a TCP monitor that monitors a server's availability.",
"value": "{\n \"type\": \"tcp\",\n \"name\": \"Server Availability\",\n \"host\": \"example.com\",\n \"private_locations\": [\"my_private_location\"]\n}"
},
"putSyntheticMonitorsRequestExample3": {
"summary": "ICMP monitor",
"description": "Update an ICMP monitor that performs ping checks.",
"value": "{\n \"type\": \"icmp\",\n \"name\": \"Ping Test\",\n \"host\": \"example.com\",\n \"locations\": [\"united_kingdom\"]\n}"
},
"putSyntheticMonitorsRequestExample4": {
"summary": "Browser monitor",
"description": "Update a browser monitor that checks a website.",
"value": "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n \"locations\": [\"united_kingdom\"]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response. The response may include a `warnings` array when the monitor configuration has non-critical issues.\n",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"warnings": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Synthetics_monitorWarning"
},
"description": "An optional array of warnings about the monitor configuration.\n"
}
}
},
"examples": {
"putSyntheticMonitorResponseWithWarning": {
"summary": "Response with warning",
"description": "A response when a browser monitor specifies a timeout but has no private locations.",
"value": "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"enabled\": true,\n \"warnings\": [\n {\n \"id\": \"monitor-id\",\n \"message\": \"For browser monitors, timeout is only supported on private locations. Browser monitor \\\"Example journey\\\" specifies a timeout and is running on public locations: \\\"public-1, public-2\\\". The timeout will have no effect on these locations.\",\n \"publicLocationIds\": [\"public-1\", \"public-2\"]\n }\n ]\n}"
}
}
}
}
},
"400": {
"description": "Bad request. For browser monitors, a 400 error is returned if the timeout is less than 30 seconds.\n"
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/params": {
"get": {
"tags": [
"synthetics"
],
"summary": "Get parameters",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/synthetics/params
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all parameters. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "get-parameters",
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Synthetics_getParameterResponse"
}
},
"examples": {
"getParametersResponseExample1": {
"summary": "Read access",
"description": "A successful response for a user with read-only permissions to get a list of parameters.",
"value": "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"description\": \"Description for param1\",\n \"tags\": [\"tag1\", \"tag2\"],\n \"namespaces\": [\"namespace1\"]\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"description\": \"Description for param2\",\n \"tags\": [\"tag3\"],\n \"namespaces\": [\"namespace2\"]\n }\n]"
},
"getParametersResponseExample2": {
"summary": "Write access",
"description": "A successful response for a user with write permissions to get a list of parameters.",
"value": "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"description\": \"Description for param1\",\n \"tags\": [\"tag1\", \"tag2\"],\n \"namespaces\": [\"namespace1\"],\n \"value\": \"value1\"\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"description\": \"Description for param2\",\n \"tags\": [\"tag3\"],\n \"namespaces\": [\"namespace2\"],\n \"value\": \"value2\"\n }\n]"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"synthetics"
],
"summary": "Add parameters",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/synthetics/params
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd one or more parameters to the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "post-parameters",
"requestBody": {
"description": "The request body can contain either a single parameter object or an array of parameter objects.",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"type": "array",
"items": {
"$ref": "#/components/schemas/Synthetics_parameterRequest"
}
},
{
"$ref": "#/components/schemas/Synthetics_parameterRequest"
}
]
},
"examples": {
"postParametersRequestExample1": {
"summary": "Single parameter",
"description": "Add a single parameter.",
"value": "{\n \"key\": \"your-key-name\",\n \"value\": \"your-parameter-value\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"share_across_spaces\": true\n}"
},
"postParametersRequestExample2": {
"summary": "Multiple parameters",
"description": "Add multiple parameters.",
"value": "[\n {\n \"key\": \"param1\",\n \"value\": \"value1\"\n },\n {\n \"key\": \"param2\",\n \"value\": \"value2\"\n }\n]"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"oneOf": [
{
"type": "array",
"items": {
"$ref": "#/components/schemas/Synthetics_postParameterResponse"
}
},
{
"$ref": "#/components/schemas/Synthetics_postParameterResponse"
}
]
},
"examples": {
"postParametersResponseExample1": {
"summary": "Single parameter",
"description": "A successful response for a single added parameter.",
"value": "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-key-name\",\n \"value\": \"your-param-value\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"share_across_spaces\": true\n}"
},
"postParametersResponseExample2": {
"summary": "Multiple parameters",
"description": "A successful response for multiple added parameters.",
"value": "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"value\": \"value1\"\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"value\": \"value2\"\n }\n]"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/params/_bulk_delete": {
"post": {
"tags": [
"synthetics"
],
"summary": "Delete parameters",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete parameters from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "delete-parameters",
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of parameter IDs to delete."
}
}
},
"examples": {
"deleteParametersRequestExample1": {
"description": "Run `POST /api/synthetics/params/_bulk_delete` to delete multiple parameters.",
"value": "{\n \"ids\": [\"param1-id\", \"param2-id\"]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "object",
"properties": {
"deleted": {
"type": "boolean",
"description": "Indicates whether the parameter was successfully deleted. It is `true` if it was deleted. It is `false` if it was not deleted.\n"
},
"id": {
"type": "string",
"description": "The unique identifier for the deleted parameter."
}
}
}
},
"examples": {
"deleteParametersResponseExample1": {
"value": "[\n {\n \"id\": \"param1-id\",\n \"deleted\": true\n }\n]"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/params/{id}": {
"delete": {
"tags": [
"synthetics"
],
"summary": "Delete a parameter",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a parameter from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "delete-parameter",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The ID for the parameter to delete.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "OK"
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"synthetics"
],
"summary": "Get a parameter",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a parameter from the Synthetics app.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "get-parameter",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier for the parameter.",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Synthetics_getParameterResponse"
},
"examples": {
"getParameterResponseExample1": {
"summary": "Read access",
"description": "A successful response for a user with read-only permissions to get a single parameter.",
"value": "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-api-key\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"namespaces\": [\"namespace1\", \"namespace2\"]\n}"
},
"getParameterResponseExample2": {
"summary": "Write access",
"description": "A successful response for a user with write permissions to get a single parameter.",
"value": "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-param-key\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"namespaces\": [\"namespace1\", \"namespace2\"],\n \"value\": \"your-param-value\"\n}"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"synthetics"
],
"summary": "Update a parameter",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a parameter in the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "put-parameter",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier for the parameter.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"description": "The request body cannot be empty; at least one attribute is required.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "The updated description of the parameter."
},
"key": {
"type": "string",
"description": "The key of the parameter."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of updated tags to categorize the parameter."
},
"value": {
"type": "string",
"description": "The updated value associated with the parameter."
}
}
},
"examples": {
"putParameterRequestExample1": {
"value": "{\n \"key\": \"updated_param_key\",\n \"value\": \"updated-param-value\",\n \"description\": \"Updated Param to be used in browser monitor\",\n \"tags\": [\"authentication\", \"security\", \"updated\"]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"putParameterResponseExample1": {
"value": "{\n \"id\": \"param_id1\",\n \"key\": \"updated_param_key\",\n \"value\": \"updated-param-value\",\n \"description\": \"Updated Param to be used in browser monitor\",\n \"tags\": [\"authentication\", \"security\", \"updated\"]\n}"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/private_locations": {
"get": {
"tags": [
"synthetics"
],
"summary": "Get private locations",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/synthetics/private_locations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of private locations.\nYou must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "get-private-locations",
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Synthetics_getPrivateLocation"
}
},
"examples": {
"getPrivateLocationsResponseExample1": {
"value": "[\n {\n \"label\": \"Test private location\",\n \"id\": \"fleet-server-policy\",\n \"agentPolicyId\": \"fleet-server-policy\",\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"default\"\n },\n {\n \"label\": \"Test private location 2\",\n \"id\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n \"agentPolicyId\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"test\"\n }\n]"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"synthetics"
],
"summary": "Create a private location",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.",
"operationId": "post-private-location",
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"agentPolicyId",
"label"
],
"type": "object",
"properties": {
"agentPolicyId": {
"type": "string",
"description": "The ID of the agent policy associated with the private location."
},
"geo": {
"required": [
"lat",
"lon"
],
"type": "object",
"properties": {
"lat": {
"type": "number",
"description": "The latitude of the location."
},
"lon": {
"type": "number",
"description": "The longitude of the location."
}
},
"description": "Geographic coordinates (WGS84) for the location."
},
"label": {
"type": "string",
"description": "A label for the private location."
},
"spaces": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of space IDs where the private location is available. If it is not provided, the private location is available in all spaces.\n"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of tags to categorize the private location."
}
}
},
"examples": {
"postPrivateLocationRequestExample1": {
"description": "Run `POST /api/private_locations` to create a private location.",
"value": "{\n \"label\": \"Private Location 1\",\n \"agentPolicyId\": \"abcd1234\",\n \"tags\": [\"private\", \"testing\"],\n \"geo\": {\n \"lat\": 40.7128,\n \"lon\": -74.0060\n }\n \"spaces\": [\"default\"]\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"postPrivateLocationResponseExample1": {
"value": "{\n \"id\": \"abcd1234\",\n \"label\": \"Private Location 1\",\n \"agentPolicyId\": \"abcd1234\",\n \"tags\": [\"private\", \"testing\"],\n \"geo\": {\n \"lat\": 40.7128,\n \"lon\": -74.0060\n }\n}"
}
}
}
}
},
"400": {
"description": "If the `agentPolicyId` is already used by an existing private location or if the `label` already exists, the API will return a 400 Bad Request response with a corresponding error message."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/synthetics/private_locations/{id}": {
"delete": {
"tags": [
"synthetics"
],
"summary": "Delete a private location",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nThe API does not return a response body for deletion, but it will return an appropriate status code upon successful deletion.\nA location cannot be deleted if it has associated monitors in use. You must delete all monitors associated with the location before deleting the location.\n",
"operationId": "delete-private-location",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier of the private location to be deleted.",
"required": true,
"schema": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "OK"
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"synthetics"
],
"summary": "Get a private location",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing private location's label or agent policy.\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nWhen a private location's label is updated, all monitors using this location will also be updated to maintain data consistency.\nWhen a private location's agent policy is changed, the package policies of all monitors using this location are deleted and recreated on the new agent policy. Monitors stop running on the previous agents until agents on the new policy pick them up. The new agent policy must be available in all spaces of the private location and must not be used by another private location.\n",
"operationId": "put-private-location",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The unique identifier of the private location to be updated.",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"agentPolicyId": {
"minLength": 1,
"type": "string",
"description": "The ID of the Fleet agent policy to move the private location to."
},
"label": {
"minLength": 1,
"type": "string",
"description": "A new label for the private location. Must be at least 1 character long."
}
}
},
"examples": {
"putPrivateLocationRequestExample1": {
"description": "Update a private location's label.",
"value": "{\n \"label\": \"Updated Private Location Name\"\n}"
},
"putPrivateLocationRequestExample2": {
"description": "Move a private location to another agent policy.",
"value": "{\n \"agentPolicyId\": \"new-agent-policy-id\"\n}"
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "A successful response.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Synthetics_getPrivateLocation"
},
"examples": {
"putPrivateLocationResponseExample1": {
"value": "{\n \"label\": \"Updated Private Location Name\",\n \"id\": \"test-private-location-id\",\n \"agentPolicyId\": \"test-private-location-id\",\n \"isServiceManaged\": false,\n \"isInvalid\": false,\n \"tags\": [\"private\", \"testing\", \"updated\"],\n \"geo\": {\n \"lat\": 37.7749,\n \"lon\": -122.4194\n },\n \"spaces\": [\"*\"]\n}"
}
}
}
}
},
"400": {
"description": "If the `label` is shorter than 1 character, or the `agentPolicyId` is not available in the current space, does not cover all spaces of the private location, or is already used by another private location, the API will return a 400 Bad Request response with a corresponding error message.\n"
},
"404": {
"description": "If the private location with the specified ID does not exist, the API will return a 404 Not Found response."
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/tags": {
"get": {
"tags": [
"Tags"
],
"summary": "Search tags",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a paginated list of tags matching the optional `query` text.",
"operationId": "get-tags",
"parameters": [
{
"name": "query",
"in": "query",
"description": "Filters results by `name` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/simple-query-string-query) syntax. Multi-word terms require all words to match.",
"schema": {
"maxLength": 2048,
"type": "string"
}
},
{
"name": "page",
"in": "query",
"description": "The page of results to return.",
"schema": {
"minimum": 1,
"type": "number",
"default": 1
}
},
{
"name": "per_page",
"in": "query",
"description": "The number of results to return per page.",
"schema": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"default": 20
}
}
],
"responses": {
"200": {
"description": "success",
"content": {
"application/json": {
"schema": {
"required": [
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"maxItems": 1000,
"minItems": 0,
"type": "array",
"items": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes"
},
"id": {
"type": "string",
"description": "The tag ID."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"description": "List of tags matching the query."
},
"meta": {
"required": [
"total"
],
"type": "object",
"properties": {
"page": {
"minimum": 1,
"type": "number",
"description": "The returned page of results.",
"default": 1
},
"per_page": {
"maximum": 1000,
"minimum": 1,
"type": "number",
"description": "The number of results returned per page.",
"default": 20
},
"total": {
"type": "number",
"description": "The total number of results matching the query."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"examples": {
"searchTagsResponse": {
"summary": "Tags matching a search query",
"value": {
"data": [
{
"data": {
"color": "#1BA9F5",
"description": "Dashboards owned by engineering teams.",
"name": "Engineering"
},
"id": "tag-engineering",
"meta": {
"created_at": "2026-06-01T12:00:00.000Z",
"managed": false,
"updated_at": "2026-06-01T12:00:00.000Z",
"version": "WzEsMV0="
}
},
{
"data": {
"color": "#54B399",
"description": "Content used by operations teams.",
"name": "Operations"
},
"id": "tag-operations",
"meta": {
"created_at": "2026-06-02T09:30:00.000Z",
"managed": false,
"updated_at": "2026-06-02T09:30:00.000Z",
"version": "WzIsMV0="
}
}
],
"meta": {
"page": 1,
"per_page": 20,
"total": 2
}
}
}
}
}
}
},
"403": {
"description": "forbidden"
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Tags"
],
"summary": "Create a tag",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreates a new tag and returns it.",
"operationId": "post-tags",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-request-attributes"
},
"examples": {
"createTagRequest": {
"summary": "Create a tag",
"value": {
"color": "#F04E98",
"description": "Content related to security investigations.",
"name": "Security"
}
}
}
}
}
},
"responses": {
"201": {
"description": "created",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes"
},
"id": {
"type": "string",
"description": "The tag ID."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"createTagResponse": {
"summary": "The created tag",
"value": {
"data": {
"color": "#F04E98",
"description": "Content related to security investigations.",
"name": "Security"
},
"id": "tag-security",
"meta": {
"created_at": "2026-06-03T14:15:00.000Z",
"managed": false,
"updated_at": "2026-06-03T14:15:00.000Z",
"version": "WzMsMV0="
}
}
}
}
}
}
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
},
"409": {
"description": "conflict"
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/tags/{id}": {
"delete": {
"tags": [
"Tags"
],
"summary": "Delete a tag",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/tags/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPermanently deletes a tag by ID.",
"operationId": "delete-tags-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The tag ID, as returned by the create or search endpoints.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"204": {
"description": "deleted"
},
"403": {
"description": "forbidden"
},
"404": {
"description": "not found"
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Tags"
],
"summary": "Get a tag",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/tags/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns a tag by ID.",
"operationId": "get-tags-id",
"parameters": [
{
"name": "id",
"in": "path",
"description": "The tag ID, as returned by the create or search endpoints.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"responses": {
"200": {
"description": "success",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes"
},
"id": {
"type": "string",
"description": "The tag ID."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"readTagResponse": {
"summary": "The requested tag",
"value": {
"data": {
"color": "#1BA9F5",
"description": "Dashboards owned by engineering teams.",
"name": "Engineering"
},
"id": "tag-engineering",
"meta": {
"created_at": "2026-06-01T12:00:00.000Z",
"managed": false,
"updated_at": "2026-06-01T12:00:00.000Z",
"version": "WzEsMV0="
}
}
}
}
}
}
},
"403": {
"description": "forbidden"
},
"404": {
"description": "not found"
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"Tags"
],
"summary": "Upsert a tag",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/tags/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdates a tag if it exists, or creates it at the provided ID.",
"operationId": "put-tags-id",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "id",
"in": "path",
"description": "The tag ID, as returned by the create or search endpoints.",
"required": true,
"schema": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-request-attributes"
},
"examples": {
"upsertTagRequest": {
"summary": "Update or create a tag",
"value": {
"color": "#006BB4",
"description": "Dashboards and visualizations owned by engineering teams.",
"name": "Engineering"
}
}
}
}
}
},
"responses": {
"200": {
"description": "updated",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes"
},
"id": {
"type": "string",
"description": "The tag ID."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"updateTagResponse": {
"summary": "The updated tag",
"value": {
"data": {
"color": "#006BB4",
"description": "Dashboards and visualizations owned by engineering teams.",
"name": "Engineering"
},
"id": "tag-engineering",
"meta": {
"created_at": "2026-06-01T12:00:00.000Z",
"managed": false,
"updated_at": "2026-06-05T16:45:00.000Z",
"version": "WzEsMl0="
}
}
}
}
}
}
},
"201": {
"description": "created",
"content": {
"application/json": {
"schema": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes"
},
"id": {
"type": "string",
"description": "The tag ID."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"examples": {
"upsertTagCreatedResponse": {
"summary": "The created tag",
"value": {
"data": {
"color": "#9170B8",
"description": "Content used for compliance reporting.",
"name": "Compliance"
},
"id": "tag-compliance",
"meta": {
"created_at": "2026-06-06T10:20:00.000Z",
"managed": false,
"updated_at": "2026-06-06T10:20:00.000Z",
"version": "WzQsMV0="
}
}
}
}
}
}
},
"400": {
"description": "invalid request"
},
"403": {
"description": "forbidden"
},
"409": {
"description": "conflict"
}
},
"x-state": "Experimental; added in 9.5.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/task_manager/_health": {
"get": {
"tags": [
"task manager"
],
"summary": "Get the task manager health",
"description": "Get the health status of the Kibana task manager.\n",
"operationId": "task-manager-health",
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Task_manager_health_APIs_health_response"
},
"examples": {
"taskManagerHealthResponse1": {
"$ref": "#/components/examples/Task_manager_health_APIs_health_200response"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timeline": {
"delete": {
"tags": [
"Security Timeline API"
],
"summary": "Delete Timelines or Timeline templates",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete one or more Timelines or Timeline templates.",
"operationId": "DeleteTimelines",
"requestBody": {
"description": "The IDs of the Timelines or Timeline templates to delete.",
"content": {
"application/json": {
"schema": {
"required": [
"savedObjectIds"
],
"type": "object",
"properties": {
"savedObjectIds": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"description": "The list of IDs of the Timelines or Timeline templates to delete"
},
"searchIds": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"description": "Saved search IDs that should be deleted alongside the timelines"
}
}
},
"examples": {
"deleteByIds": {
"summary": "Delete timelines by saved object id",
"value": {
"savedObjectIds": [
"15c1929b-0af7-42bd-85a8-56e234cc7c4e"
]
}
},
"deleteWithSearches": {
"summary": "Delete Timelines and their linked saved searches",
"value": {
"savedObjectIds": [
"15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"6ce1b592-84e3-4b4a-9552-f189d4b82075"
],
"searchIds": [
"2c1b8f02-9ad6-4e33-8f6a-2c6b7d0a1f11"
]
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"success": {
"summary": "Success",
"value": { }
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"Security Timeline API"
],
"summary": "Get Timeline or Timeline template details",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an existing saved Timeline or Timeline template.",
"operationId": "GetTimeline",
"parameters": [
{
"name": "template_timeline_id",
"in": "query",
"description": "The `savedObjectId` of the Timeline template to retrieve.",
"schema": {
"type": "string"
}
},
{
"name": "id",
"in": "query",
"description": "The `savedObjectId` of the Timeline to retrieve.",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"examples": {
"timelineDetail": {
"summary": "Timeline detail",
"value": {
"description": "User-reported suspicious email",
"noteIds": [ ],
"pinnedEventIds": [ ],
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"status": "active",
"timelineType": "default",
"title": "Phishing investigation",
"version": "WzE0LDFd"
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"patch": {
"tags": [
"Security Timeline API"
],
"summary": "Update a Timeline",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing Timeline. You can update the title, description, date range, pinned events, pinned queries, and/or pinned saved queries of an existing Timeline.",
"operationId": "PatchTimeline",
"requestBody": {
"description": "The Timeline updates, along with the Timeline ID and version.",
"content": {
"application/json": {
"schema": {
"required": [
"timelineId",
"version",
"timeline"
],
"type": "object",
"properties": {
"timeline": {
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
"timelineId": {
"type": [
"null",
"string"
],
"description": "The `savedObjectId` of the Timeline or Timeline template that you’re updating.",
"example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
},
"version": {
"type": [
"null",
"string"
],
"description": "The version of the Timeline or Timeline template that you’re updating.",
"example": "WzE0LDFd"
}
}
},
"examples": {
"patchTitle": {
"summary": "Update title",
"value": {
"timeline": {
"title": "Escalated case review"
},
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"version": "WzE0LDFd"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"examples": {
"patched": {
"summary": "Updated timeline",
"value": {
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"status": "active",
"timelineType": "default",
"title": "Escalated case review",
"version": "WzE1LDFd"
}
}
}
}
}
},
"405": {
"description": "Indicates that the user does not have the required access to create a Timeline.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"body": {
"type": "string",
"description": "The error message.",
"example": "update timeline error"
},
"statusCode": {
"type": "number",
"example": 405
}
}
},
"examples": {
"error": {
"summary": "Error body",
"value": {
"body": "update timeline error",
"statusCode": 405
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Timeline API"
],
"summary": "Create a Timeline or Timeline template",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new Timeline or Timeline template.",
"operationId": "CreateTimelines",
"requestBody": {
"description": "The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.",
"content": {
"application/json": {
"schema": {
"required": [
"timeline"
],
"type": "object",
"properties": {
"status": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineStatus"
},
"templateTimelineId": {
"type": [
"null",
"string"
],
"description": "A unique identifier for the Timeline template.",
"example": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
},
"templateTimelineVersion": {
"type": [
"null",
"number"
],
"description": "Timeline template version number.",
"example": 12
},
"timeline": {
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
"timelineId": {
"type": [
"null",
"string"
],
"description": "A unique identifier for the Timeline.",
"example": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
},
"timelineType": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
},
"version": {
"type": [
"null",
"string"
]
}
}
},
"examples": {
"createDefault": {
"summary": "Create a default timeline",
"value": {
"timeline": {
"status": "active",
"timelineType": "default",
"title": "Malware containment"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"examples": {
"created": {
"summary": "Created timeline",
"value": {
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"status": "active",
"timelineType": "default",
"title": "Malware containment",
"version": "WzE0LDFd"
}
}
}
}
}
},
"405": {
"description": "Indicates that there was an error in the Timeline creation.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"body": {
"type": "string",
"description": "The error message",
"example": "update timeline error"
},
"statusCode": {
"type": "number",
"example": 405
}
}
},
"examples": {
"error": {
"summary": "Error body",
"value": {
"body": "update timeline error",
"statusCode": 405
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timeline/_copy": {
"post": {
"tags": [
"Security Timeline API"
],
"summary": "Copies timeline or timeline template",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/timeline/_copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCopies and returns a timeline or timeline template.\n",
"operationId": "CopyTimeline",
"requestBody": {
"description": "Source timeline id to copy plus timeline fields for the new saved object.",
"content": {
"application/json": {
"schema": {
"required": [
"timeline",
"timelineIdToCopy"
],
"type": "object",
"properties": {
"timeline": {
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
"timelineIdToCopy": {
"type": "string",
"description": "The `savedObjectId` of the timeline or template to duplicate."
}
}
},
"examples": {
"copyWithTitle": {
"summary": "Copy with a new title",
"value": {
"timeline": {
"timelineType": "default",
"title": "Copy of investigation"
},
"timelineIdToCopy": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"examples": {
"copied": {
"summary": "Newly saved timeline",
"value": {
"savedObjectId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"status": "active",
"timelineType": "default",
"title": "Copy of investigation",
"version": "WzE1LDFd"
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timeline/_draft": {
"get": {
"tags": [
"Security Timeline API"
],
"summary": "Get draft Timeline or Timeline template details",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/timeline/_draft
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned.",
"operationId": "GetDraftTimelines",
"parameters": [
{
"name": "timelineType",
"in": "query",
"description": "Which draft to load (`default` investigation timeline or `template` timeline template).",
"required": true,
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"examples": {
"draftPayload": {
"summary": "Draft timeline payload",
"value": {
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"status": "draft",
"timelineType": "default",
"title": "",
"version": "WzE0LDFd"
}
}
}
}
}
},
"403": {
"description": "If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "number"
}
}
},
"examples": {
"forbidden": {
"summary": "Permission denied",
"value": {
"message": "Forbidden",
"status_code": 403
}
}
}
}
}
},
"409": {
"description": "This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given `timelineId`.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "number"
}
}
},
"examples": {
"conflict": {
"summary": "Draft conflict",
"value": {
"message": "Conflict",
"status_code": 409
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"Security Timeline API"
],
"summary": "Create a clean draft Timeline or Timeline template",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/timeline/_draft
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a clean draft Timeline or Timeline template for the current user.\n> info\n> If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.\n",
"operationId": "CleanDraftTimelines",
"requestBody": {
"description": "The type of Timeline to create. Valid values are `default` and `template`.",
"content": {
"application/json": {
"schema": {
"required": [
"timelineType"
],
"type": "object",
"properties": {
"timelineType": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
}
}
},
"examples": {
"defaultDraft": {
"summary": "Create a default draft timeline",
"value": {
"timelineType": "default"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"examples": {
"draftResponse": {
"summary": "Draft after reset or creation",
"value": {
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"status": "draft",
"templateTimelineId": "null",
"templateTimelineVersion": "null",
"timelineType": "default",
"title": "",
"version": "WzE0LDFd"
}
}
}
}
}
},
"403": {
"description": "Indicates that the user does not have the required permissions to create a draft Timeline.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "number"
}
}
},
"examples": {
"forbidden": {
"summary": "Permission denied",
"value": {
"message": "Forbidden",
"status_code": 403
}
}
}
}
}
},
"409": {
"description": "Indicates that there is already a draft Timeline with the given `timelineId`.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "number"
}
}
},
"examples": {
"conflict": {
"summary": "Draft conflict",
"value": {
"message": "Conflict",
"status_code": 409
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timeline/_export": {
"post": {
"tags": [
"Security Timeline API"
],
"summary": "Export Timelines",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/timeline/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport Timelines as an NDJSON file.",
"operationId": "ExportTimelines",
"parameters": [
{
"name": "file_name",
"in": "query",
"description": "The name of the file to export",
"required": true,
"schema": {
"type": "string"
}
}
],
"requestBody": {
"description": "The IDs of the Timelines to export.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"ids": {
"maxItems": 1000,
"minItems": 1,
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
}
}
},
"examples": {
"exportIds": {
"summary": "Export by timeline ids",
"value": {
"ids": [
"15c1929b-0af7-42bd-85a8-56e234cc7c4e"
]
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/ndjson": {
"schema": {
"type": "string",
"description": "NDJSON of the exported Timelines"
},
"examples": {
"ndjsonLine": {
"summary": "Single NDJSON line",
"value": "{\"savedObjectId\":\"15c1929b-0af7-42bd-85a8-56e234cc7c4e\",\"version\":\"WzE0LDFd\",\"title\":\"Investigation\",\"timelineType\":\"default\"}"
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/ndjson": {
"schema": {
"type": "object",
"properties": {
"body": {
"type": "string"
},
"statusCode": {
"type": "number"
}
}
},
"examples": {
"badRequest": {
"summary": "Export error",
"value": {
"body": "Export limit exceeded",
"statusCode": 400
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timeline/_favorite": {
"patch": {
"tags": [
"Security Timeline API"
],
"summary": "Favorite a Timeline or Timeline template",
"description": "**Spaces method and path for this operation:**\n\n
patch/s/{space_id}/api/timeline/_favorite
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFavorite a Timeline or Timeline template for the current user.",
"operationId": "PersistFavoriteRoute",
"requestBody": {
"description": "The required fields used to favorite a (template) Timeline.",
"content": {
"application/json": {
"schema": {
"required": [
"timelineId",
"templateTimelineId",
"templateTimelineVersion",
"timelineType"
],
"type": "object",
"properties": {
"templateTimelineId": {
"type": [
"null",
"string"
]
},
"templateTimelineVersion": {
"type": [
"null",
"number"
]
},
"timelineId": {
"type": [
"null",
"string"
]
},
"timelineType": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
}
}
},
"examples": {
"favoriteDefault": {
"summary": "Favorite a default timeline",
"value": {
"templateTimelineId": "null",
"templateTimelineVersion": "null",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"timelineType": "default"
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_FavoriteTimelineResponse"
},
"examples": {
"favoriteResponse": {
"summary": "Favorite metadata updated",
"value": {
"favorite": [
{
"favoriteDate": 1741337636741,
"userName": "elastic"
}
],
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"timelineType": "default",
"version": "WzE2LDFd"
}
}
}
}
}
},
"403": {
"description": "Indicates the user does not have the required permissions to persist the favorite status.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"body": {
"type": "string"
},
"statusCode": {
"type": "number"
}
}
},
"examples": {
"forbidden": {
"summary": "Forbidden",
"value": {
"body": "Forbidden",
"statusCode": 403
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timeline/_import": {
"post": {
"tags": [
"Security Timeline API"
],
"summary": "Import Timelines",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nResolve a Timeline or Timeline template, surfacing outcomes such as `exactMatch`, `aliasMatch`, or `conflict` when object IDs have been remapped during upgrades or imports. Provide **either** `id` for default Timelines or `template_timeline_id` for templates.",
"operationId": "ResolveTimeline",
"parameters": [
{
"name": "template_timeline_id",
"in": "query",
"description": "The ID of the template timeline to resolve",
"schema": {
"type": "string"
}
},
{
"name": "id",
"in": "query",
"description": "The ID of the timeline to resolve",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_ResolvedTimeline"
},
"examples": {
"exactMatch": {
"summary": "Exact match outcome",
"description": "Timeline resolved without alias or conflict",
"value": {
"outcome": "exactMatch",
"timeline": {
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"timelineType": "default",
"title": "Investigation"
}
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"badRequest": {
"summary": "Bad request",
"value": { }
}
}
}
}
},
"404": {
"description": "The (template) Timeline was not found",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"notFound": {
"summary": "Not found",
"value": { }
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/timelines": {
"get": {
"tags": [
"Security Timeline API"
],
"summary": "Get Timelines or Timeline templates",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/timelines
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all saved Timelines or Timeline templates.",
"operationId": "GetTimelines",
"parameters": [
{
"name": "only_user_favorite",
"in": "query",
"description": "If `true`, only Timelines that the current user has marked as favorite are returned.",
"schema": {
"enum": [
"true",
"false"
],
"type": [
"null",
"string"
]
}
},
{
"name": "timeline_type",
"in": "query",
"description": "Restrict results to `default` investigation timelines or `template` timeline templates.",
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
}
},
{
"name": "sort_field",
"in": "query",
"description": "Field used to sort the list (`title`, `description`, `updated`, or `created`).",
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_SortFieldTimeline"
}
},
{
"name": "sort_order",
"in": "query",
"description": "Whether to sort the results `ascending` or `descending`",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string"
}
},
{
"name": "page_size",
"in": "query",
"description": "How many results should returned at once",
"schema": {
"type": [
"null",
"string"
]
}
},
{
"name": "page_index",
"in": "query",
"description": "How many pages should be skipped",
"schema": {
"type": [
"null",
"string"
]
}
},
{
"name": "search",
"in": "query",
"description": "Allows to search for timelines by their title",
"schema": {
"type": [
"null",
"string"
]
}
},
{
"name": "status",
"in": "query",
"description": "Filter by timeline lifecycle state (`active`, `draft`, or `immutable`).",
"schema": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineStatus"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"schema": {
"required": [
"timeline",
"totalCount"
],
"type": "object",
"properties": {
"customTemplateTimelineCount": {
"type": "number",
"description": "The amount of custom Timeline templates in the results",
"example": 2
},
"defaultTimelineCount": {
"type": "number",
"description": "The amount of `default` type Timelines in the results",
"example": 90
},
"elasticTemplateTimelineCount": {
"type": "number",
"description": "The amount of Elastic's Timeline templates in the results",
"example": 8
},
"favoriteCount": {
"type": "number",
"description": "The amount of favorited Timelines",
"example": 5
},
"templateTimelineCount": {
"type": "number",
"description": "The amount of Timeline templates in the results",
"example": 10
},
"timeline": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
}
},
"totalCount": {
"type": "number",
"description": "The total amount of results",
"example": 100
}
}
},
"examples": {
"timelineList": {
"summary": "Example list response",
"value": {
"customTemplateTimelineCount": 0,
"defaultTimelineCount": 1,
"elasticTemplateTimelineCount": 0,
"favoriteCount": 0,
"templateTimelineCount": 0,
"timeline": [
{
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"status": "active",
"timelineType": "default",
"title": "Phishing investigation",
"updated": 1741344876825,
"version": "WzE0LDFd"
}
],
"totalCount": 1
}
}
}
}
}
},
"400": {
"description": "Bad Request response.",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"body": {
"type": "string",
"description": "The error message.",
"example": "get timeline error"
},
"statusCode": {
"type": "number",
"example": 400
}
}
},
"examples": {
"badRequest": {
"summary": "Error response body",
"value": {
"body": "get timeline error",
"statusCode": 400
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/upgrade_assistant/status": {
"get": {
"tags": [
"upgrade"
],
"summary": "Get the upgrade readiness status",
"description": "Check the status of your cluster.",
"operationId": "get-upgrade-status",
"responses": {
"200": {
"description": "Indicates a successful call.",
"content": {
"application/json": {
"examples": {
"getUpgradeStatusResponseExample1": {
"value": "{\n \"readyForUpgrade\": false,\n \"cluster\": [\n {\n \"message\": \"Cluster deprecated issue\",\n \"details\":\"You have 2 system indices that must be migrated and 5 Elasticsearch deprecation issues and 0 Kibana deprecation issues that must be resolved before upgrading.\"\n }\n ]\n}"
}
}
}
}
}
},
"x-state": "Technical Preview",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/uptime/settings": {
"get": {
"tags": [
"uptime"
],
"summary": "Get uptime settings",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/uptime/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the uptime feature in the Observability section of the Kibana feature privileges.\n",
"operationId": "get-uptime-settings",
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"getUptimeSettingsResponseExample1": {
"value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"uptime"
],
"summary": "Update uptime settings",
"description": "**Spaces method and path for this operation:**\n\n
put/s/{space_id}/api/uptime/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate uptime setting attributes like `heartbeatIndices`, `certExpirationThreshold`, `certAgeThreshold`, `defaultConnectors`, or `defaultEmail`. You must have `all` privileges for the uptime feature in the Observability section of the Kibana feature privileges. A partial update is supported, provided settings keys will be merged with existing settings.\n",
"operationId": "put-uptime-settings",
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"certAgeThreshold": {
"type": "number",
"description": "The number of days after a certificate is created to trigger an alert.",
"default": 730
},
"certExpirationThreshold": {
"type": "number",
"description": "The number of days before a certificate expires to trigger an alert.",
"default": 30
},
"defaultConnectors": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of connector IDs to be used as default connectors for new alerts.",
"default": [ ]
},
"defaultEmail": {
"type": "object",
"properties": {
"bcc": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
},
"cc": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
},
"to": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
}
},
"description": "The default email configuration for new alerts.\n"
},
"heartbeatIndices": {
"type": "string",
"description": "An index pattern string to be used within the Uptime app and alerts to query Heartbeat data. \n",
"default": "heartbeat-*"
}
}
},
"examples": {
"putUptimeSettingsRequestExample1": {
"summary": "Update multiple settings",
"description": "Run `PUT api/uptime/settings` to update multiple Uptime settings.",
"value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}"
},
"putUptimeSettingsRequestExample2": {
"summary": "Update a setting",
"description": "Run `PUT api/uptime/settings` to update a single Uptime setting.",
"value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n}"
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful call",
"content": {
"application/json": {
"schema": {
"type": "object"
},
"examples": {
"putUptimeSettingsResponseExample1": {
"description": "A successful response from `PUT api/uptime/settings`.",
"value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}"
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/visualizations": {
"get": {
"tags": [
"Visualizations"
],
"summary": "Search visualizations",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**\n",
"operationId": "search-visualizations",
"responses": {
"200": {
"description": "See the full Visualizations API reference for detailed response schemas."
}
}
},
"post": {
"tags": [
"Visualizations"
],
"summary": "Create visualization",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**\n",
"operationId": "create-visualization",
"responses": {
"200": {
"description": "See the full Visualizations API reference for detailed response schemas."
}
}
}
},
"/api/visualizations/{id}": {
"get": {
"tags": [
"Visualizations"
],
"summary": "Get visualization",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**\n",
"operationId": "get-visualization",
"responses": {
"200": {
"description": "See the full Visualizations API reference for detailed response schemas."
}
}
},
"put": {
"tags": [
"Visualizations"
],
"summary": "Upsert visualization",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**\n",
"operationId": "upsert-visualization",
"responses": {
"200": {
"description": "See the full Visualizations API reference for detailed response schemas."
}
}
},
"delete": {
"tags": [
"Visualizations"
],
"summary": "Delete visualization",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**\n",
"operationId": "delete-visualization",
"responses": {
"200": {
"description": "See the full Visualizations API reference for detailed response schemas."
}
}
}
},
"/api/workflows": {
"delete": {
"tags": [
"workflows"
],
"summary": "Bulk delete workflows",
"description": "**Spaces method and path for this operation:**\n\n
delete/s/{space_id}/api/workflows
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete multiple workflows by their IDs.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of workflows with optional filtering.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate multiple workflows in a single request. Optionally overwrite existing workflows.
[Required authorization] Route required privileges: workflowsManagement:create AND workflowsManagement:update.",
"operationId": "post-workflows",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "overwrite",
"in": "query",
"description": "Whether to overwrite existing workflows.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "dryRun",
"in": "query",
"description": "When true, performs a preflight conflict check only. Returns the subset of the supplied workflow IDs that already exist (including soft-deleted tombstones and cross-space documents) without writing anything. The response body is `{ existingIds: string[] }` instead of the normal `{ created, failed }` shape.",
"schema": {
"type": "boolean",
"default": false
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"workflows"
],
"type": "object",
"properties": {
"workflows": {
"maxItems": 500,
"type": "array",
"items": {
"required": [
"yaml"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"minLength": 3,
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
"type": "string"
},
"yaml": {
"maxLength": 1048576,
"type": "string"
}
}
}
}
},
"additionalProperties": false
},
"examples": {
"bulkCreateWorkflowsRequestExample": {
"description": "Example request for creating multiple workflows at once",
"value": {
"workflows": [
{
"yaml": "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n - type: manual\ninputs:\n - name: message\n type: string\n default: \"hello world\"\nsteps:\n - name: hello_world_step\n type: console\n with:\n message: \"{{ inputs.message }}\"\n"
},
{
"id": "workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901",
"yaml": "name: Second workflow\nenabled: false\ndescription: Another workflow\ntriggers:\n - type: manual\nsteps:\n - name: log_step\n type: console\n with:\n message: \"Hello from second workflow\"\n"
}
]
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"bulkCreateWorkflowsResponseExample": {
"description": "Example response after creating multiple workflows",
"value": {
"created": [
{
"id": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "Example definition"
},
{
"id": "workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901",
"name": "Second workflow"
}
],
"failures": [ ],
"total": 2
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/workflows?overwrite=false\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"workflows\": [\n { \"yaml\": \"name: Example definition\\nenabled: true\\ndescription: This is a workflow example\\ntriggers:\\n - type: manual\\ninputs:\\n - name: message\\n type: string\\n default: \\\"hello world\\\"\\nsteps:\\n - name: hello_world_step\\n type: console\\n with:\\n message: \\\"{{ inputs.message }}\\\"\\n\" },\n { \"id\": \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\", \"yaml\": \"name: Second workflow\\nenabled: false\\ndescription: Another workflow\\ntriggers:\\n - type: manual\\nsteps:\\n - name: log_step\\n type: console\\n with:\\n message: \\\"Hello from second workflow\\\"\\n\" }\n ]\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/workflows?overwrite=false\n{\n \"workflows\": [\n { \"yaml\": \"name: Example definition\\nenabled: true\\ndescription: This is a workflow example\\ntriggers:\\n - type: manual\\ninputs:\\n - name: message\\n type: string\\n default: \\\"hello world\\\"\\nsteps:\\n - name: hello_world_step\\n type: console\\n with:\\n message: \\\"{{ inputs.message }}\\\"\\n\" },\n { \"id\": \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\", \"yaml\": \"name: Second workflow\\nenabled: false\\ndescription: Another workflow\\ntriggers:\\n - type: manual\\nsteps:\\n - name: log_step\\n type: console\\n with:\\n message: \\\"Hello from second workflow\\\"\\n\" }\n ]\n}\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/workflows/aggs": {
"get": {
"tags": [
"workflows"
],
"summary": "Get workflow aggregations",
"description": "**Spaces method and path for this operation:**\n\n
get/s/{space_id}/api/workflows/aggs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve distinct values and their counts for the specified workflow fields. Useful for building filters such as lists of tags or creators.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve the Kibana action connectors that can be used in workflow steps, grouped by connector type. Each type includes its configured instances and availability status.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve details of a single workflow execution by its ID.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve child workflow executions spawned by sub-workflow steps within a parent execution.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve paginated logs for a workflow execution. Optionally filter by a specific step execution.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nResume a paused workflow execution with the provided input.
[Required authorization] Route required privileges: workflowsManagement:execute.",
"operationId": "post-workflows-executions-executionid-resume",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
{
"name": "executionId",
"in": "path",
"description": "Workflow execution ID",
"required": true,
"schema": {
"maxLength": 255,
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"input"
],
"type": "object",
"properties": {
"input": {
"type": "object",
"additionalProperties": { },
"description": "Input data to resume the execution with."
},
"stepExecutionId": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Step execution ID of the HITL wait to claim. When omitted, the server looks up the waiting step."
}
},
"additionalProperties": false
},
"examples": {
"resumeExecutionRequestExample": {
"description": "Example request to resume a paused workflow execution",
"value": {
"input": {
"approved": true,
"comment": "Approved by analyst"
},
"stepExecutionId": "step-exec-a1b2c3d4"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"resumeExecutionResponseExample": {
"description": "Example response confirming the resume was scheduled",
"value": {
"executionId": "exec-a1b2c3d4-e5f6-7890",
"message": "Workflow resume scheduled",
"success": true
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/workflows/executions/{executionId}/resume\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"input\": {\n \"approved\": true,\n \"comment\": \"Approved by analyst\"\n },\n \"stepExecutionId\": \"step-exec-a1b2c3d4\"\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/workflows/executions/{executionId}/resume\n{\n \"input\": {\n \"approved\": true,\n \"comment\": \"Approved by analyst\"\n },\n \"stepExecutionId\": \"step-exec-a1b2c3d4\"\n}\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/workflows/executions/{executionId}/step/{stepExecutionId}": {
"get": {
"tags": [
"workflows"
],
"summary": "Get a step execution",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve details of a single step execution within a workflow execution.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of step executions for a specific workflow execution. Does not include step input or output; fetch those with GET /api/workflows/executions/{executionId}/step/{stepExecutionId}. If a page exceeds Kibana's response buffer, the handler returns 413.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport one or more workflows as JSON with YAML content and metadata.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPartially update an existing managed workflow. This elevated route can update fields beyond the enabled state.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve multiple workflows by their IDs in a single request. Optionally use the `source` parameter to return only specific fields from each workflow document.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve the JSON schema used to validate workflow YAML definitions. The schema includes available step types based on the configured connectors in the current space.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve summary statistics about workflows, including total, enabled, and disabled counts; execution history metrics for the last 30 days are included only when the caller has execution read privilege.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExecute a single step from a workflow definition in test mode.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExecute a workflow in test mode without requiring it to be saved or enabled. Provide either a workflow ID to test a saved workflow, a YAML definition to test an unsaved draft, or both to test a modified version of an existing workflow.
[Required authorization] Route required privileges: workflowsManagement:execute.",
"operationId": "post-workflows-test",
"parameters": [
{
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"required": [
"inputs"
],
"type": "object",
"properties": {
"inputs": {
"type": "object",
"additionalProperties": { },
"description": "Key-value inputs for the test execution."
},
"workflowId": {
"type": "string",
"description": "ID of an existing workflow to test."
},
"workflowYaml": {
"type": "string",
"description": "YAML definition to test."
}
},
"additionalProperties": false
},
"examples": {
"testWorkflowByIdRequestExample": {
"description": "Example request to test a saved workflow by its ID",
"value": {
"inputs": {
"message": "test message"
},
"workflowId": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
},
"testWorkflowByYamlRequestExample": {
"description": "Example request to test an unsaved workflow YAML draft",
"value": {
"inputs": {
"message": "test message"
},
"workflowYaml": "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n - type: manual\ninputs:\n - name: message\n type: string\n default: \"hello world\"\nsteps:\n - name: hello_world_step\n type: console\n with:\n message: \"{{ inputs.message }}\"\n"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"testWorkflowResponseExample": {
"description": "Example response returning the test execution ID",
"value": {
"workflowExecutionId": "test-exec-a1b2c3d4-e5f6"
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X POST \"${KIBANA_URL}/api/workflows/test\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"workflowId\": \"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n \"inputs\": { \"message\": \"test message\" }\n }'\n"
},
{
"lang": "Console",
"source": "POST kbn://api/workflows/test\n{\n \"workflowId\": \"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n \"inputs\": { \"message\": \"test message\" }\n}\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/workflows/workflow": {
"post": {
"tags": [
"workflows"
],
"summary": "Create a workflow",
"description": "**Spaces method and path for this operation:**\n\n
post/s/{space_id}/api/workflows/workflow
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new workflow from a YAML definition. The YAML is validated and parsed before the workflow is saved. An optional custom ID can be provided.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPartially update an existing workflow. You can update individual fields such as name, description, enabled state, tags, or the YAML definition without providing all fields.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExecute a workflow by its ID with the provided inputs. The workflow must be enabled and have a valid definition. Returns an execution ID that can be used to monitor progress.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of executions for a specific workflow.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRequest cancellation for all non-terminal executions of the given workflow in the current space.
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of step-level execution records for a specific workflow. Optionally filter by step ID and include input or output data.
[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.",
"operationId": "get-workflows-workflow-workflowid-executions-steps",
"parameters": [
{
"name": "workflowId",
"in": "path",
"description": "Workflow ID",
"required": true,
"schema": {
"maxLength": 255,
"type": "string"
}
},
{
"name": "stepId",
"in": "query",
"description": "Filter by step ID.",
"schema": {
"type": "string"
}
},
{
"name": "includeInput",
"in": "query",
"description": "Include step input data.",
"schema": {
"type": "boolean"
}
},
{
"name": "includeOutput",
"in": "query",
"description": "Include step output data.",
"schema": {
"type": "boolean"
}
},
{
"name": "page",
"in": "query",
"description": "Page number for pagination.",
"schema": {
"minimum": 1,
"type": "number"
}
},
{
"name": "size",
"in": "query",
"description": "Number of results per page.",
"schema": {
"maximum": 100,
"minimum": 1,
"type": "number"
}
},
{
"name": "startedAfter",
"in": "query",
"description": "Datemath lower bound for filtering step executions by startedAt (inclusive when parsed).",
"schema": {
"type": "string"
}
},
{
"name": "startedBefore",
"in": "query",
"description": "Datemath upper bound for filtering step executions by startedAt (inclusive when parsed with roundUp).",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"getWorkflowStepExecutionsResponseExample": {
"description": "Example response returning step execution records for a workflow. The second entry shows a Human-In-The-Loop `wait_for_input` step that has been responded to: the `hitl` envelope is populated synchronously by the inbox respond path so every reader (Kibana Inbox UI, Slack, Agent Builder, raw API/MCP) sees a single canonical responder for the step.",
"value": {
"results": [
{
"executionTimeMs": 1000,
"finishedAt": "2025-11-20T12:00:02.000Z",
"globalExecutionIndex": 0,
"id": "step-exec-001",
"input": {
"message": "hello world"
},
"isTestRun": false,
"scopeStack": [ ],
"spaceId": "default",
"startedAt": "2025-11-20T12:00:01.000Z",
"status": "completed",
"stepExecutionIndex": 0,
"stepId": "hello_world_step",
"stepType": "console",
"topologicalIndex": 0,
"workflowId": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"workflowRunId": "exec-001"
},
{
"executionTimeMs": 329000,
"finishedAt": "2025-11-20T12:05:31.000Z",
"globalExecutionIndex": 1,
"hitl": {
"channel": "kibana-ui",
"respondedAt": "2025-11-20T12:05:29.000Z",
"respondedBy": "alice"
},
"id": "step-exec-002",
"input": {
"message": "Approve change to production?"
},
"isTestRun": false,
"output": {
"respondedBy": "alice",
"response": {
"approved": true
}
},
"scopeStack": [ ],
"spaceId": "default",
"startedAt": "2025-11-20T12:00:02.000Z",
"status": "completed",
"stepExecutionIndex": 0,
"stepId": "approve_change",
"stepType": "wait_for_input",
"topologicalIndex": 1,
"workflowId": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"workflowRunId": "exec-001"
}
],
"total": 2
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/workflows/workflow/{workflowId}/executions/steps?includeInput=true\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/workflows/workflow/{workflowId}/executions/steps?includeInput=true\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/api/workflows/workflow/executions": {
"get": {
"tags": [
"workflows"
],
"summary": "Search workflow executions",
"description": "**Spaces method and path for this operation:**\n\n
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSearch across all workflow executions.
[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.",
"operationId": "get-workflows-workflow-executions",
"parameters": [
{
"name": "kql",
"in": "query",
"description": "KQL query string to filter executions.",
"schema": {
"maxLength": 4096,
"type": "string"
}
},
{
"name": "statuses",
"in": "query",
"description": "Filter by execution status.",
"schema": {
"maxItems": 11,
"type": "array",
"items": {
"enum": [
"pending",
"waiting",
"waiting_for_input",
"waiting_for_child",
"running",
"queued",
"completed",
"failed",
"cancelled",
"timed_out",
"skipped"
],
"type": "string"
}
}
},
{
"name": "executionTypes",
"in": "query",
"description": "Filter by execution type.",
"schema": {
"maxItems": 2,
"type": "array",
"items": {
"enum": [
"test",
"production"
],
"type": "string"
}
}
},
{
"name": "executedBy",
"in": "query",
"description": "Filter by the user who triggered the execution.",
"schema": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "concurrencyGroupKey",
"in": "query",
"description": "Filter by evaluated concurrency group key.",
"schema": {
"type": "string"
}
},
{
"name": "startedAfter",
"in": "query",
"description": "Datemath lower bound for filtering executions by startedAt.",
"schema": {
"type": "string"
}
},
{
"name": "startedBefore",
"in": "query",
"description": "Datemath upper bound for filtering executions by startedAt.",
"schema": {
"type": "string"
}
},
{
"name": "finishedAfter",
"in": "query",
"description": "Datemath lower bound for filtering executions by finishedAt.",
"schema": {
"type": "string"
}
},
{
"name": "finishedBefore",
"in": "query",
"description": "Datemath upper bound for filtering executions by finishedAt.",
"schema": {
"type": "string"
}
},
{
"name": "collapse",
"in": "query",
"description": "Field to collapse execution results by.",
"schema": {
"enum": [
"concurrencyGroupKey",
"status",
"executedBy",
"triggeredBy"
],
"type": "string"
}
},
{
"name": "sortField",
"in": "query",
"description": "Field to sort by. One of: startedAt, duration, workflowId, triggeredBy.",
"schema": {
"enum": [
"startedAt",
"duration",
"workflowId",
"triggeredBy"
],
"type": "string"
}
},
{
"name": "sortOrder",
"in": "query",
"description": "Sort direction.",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string"
}
},
{
"name": "page",
"in": "query",
"description": "Page number.",
"schema": {
"minimum": 1,
"type": "number"
}
},
{
"name": "size",
"in": "query",
"description": "Number of results to return.",
"schema": {
"maximum": 100,
"minimum": 1,
"type": "number"
}
},
{
"name": "trackTotalHits",
"in": "query",
"description": "Whether to track total hit count.",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Indicates a successful response",
"content": {
"application/json": {
"examples": {
"searchExecutionsResponseExample": {
"description": "Example paginated list of workflow-level executions",
"value": {
"page": 1,
"results": [
{
"duration": 3000,
"error": "null",
"executedBy": "elastic",
"finishedAt": "2025-11-20T12:00:03.000Z",
"id": "exec-a1b2c3d4-e5f6-7890",
"isTestRun": false,
"managed": false,
"spaceId": "default",
"startedAt": "2025-11-20T12:00:00.000Z",
"status": "completed",
"tags": [
"reporting"
],
"triggeredBy": "manual",
"workflowId": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"workflowName": "Example Workflow"
}
],
"size": 25,
"total": 1
}
}
}
}
}
},
"400": {
"description": "Indicates a bad request, such as invalid KQL syntax",
"content": {
"application/json": {
"examples": {
"searchExecutionsBadRequestExample": {
"description": "Example response when the kql parameter contains invalid syntax",
"value": {
"message": "Invalid KQL: Expected AND, OR, or end of input but \"f\" found."
}
}
}
}
}
}
},
"x-codeSamples": [
{
"lang": "curl",
"source": "curl \\\n -X GET \"${KIBANA_URL}/api/workflows/workflow/executions?page=1&size=25&trackTotalHits=true&kql=startedAt%20%3E%3D%20%22now-15m%22&sortField=startedAt&sortOrder=desc\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
},
{
"lang": "Console",
"source": "GET kbn://api/workflows/workflow/executions?from=0&size=25&trackTotalHits=true&kql=startedAt >= \"now-15m\"&sortField=startedAt&sortOrder=desc\n"
}
],
"x-state": "Generally available; added in 9.4.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos": {
"get": {
"tags": [
"slo"
],
"summary": "Get a paginated list of SLOs",
"description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "findSlosOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"name": "kqlQuery",
"in": "query",
"description": "A valid kql query to filter the SLO with",
"schema": {
"type": "string"
},
"example": "slo.name:latency* and slo.tags : \"prod\""
},
{
"name": "size",
"in": "query",
"description": "The page size to use for cursor-based pagination, must be greater or equal than 1",
"schema": {
"type": "integer",
"default": 1
},
"example": 1
},
{
"name": "searchAfter",
"in": "query",
"description": "The cursor to use for fetching the results from, when using a cursor-base pagination.",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "page",
"in": "query",
"description": "The page to use for pagination, must be greater or equal than 1",
"schema": {
"type": "integer",
"default": 1
},
"example": 1
},
{
"name": "perPage",
"in": "query",
"description": "Number of SLOs returned by page",
"schema": {
"maximum": 5000,
"type": "integer",
"default": 25
},
"example": 25
},
{
"name": "sortBy",
"in": "query",
"description": "Sort by field",
"schema": {
"enum": [
"sli_value",
"status",
"error_budget_consumed",
"error_budget_remaining"
],
"type": "string",
"default": "status"
},
"example": "status"
},
{
"name": "sortDirection",
"in": "query",
"description": "Sort order",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "asc"
},
"example": "asc"
},
{
"name": "hideStale",
"in": "query",
"description": "Hide stale SLOs from the list as defined by stale SLO threshold in SLO settings",
"schema": {
"type": "boolean"
}
}
],
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_find_slo_response"
},
"examples": {
"findSloResponse": {
"summary": "A paginated list of SLOs",
"value": {
"page": 1,
"perPage": 25,
"results": [
{
"budgetingMethod": "occurrences",
"createdAt": "2025-01-12T10:03:19.000Z",
"description": "Availability of my web service",
"enabled": true,
"groupBy": "*",
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"indicator": {
"params": {
"filter": "field.environment : \"production\" and service.name : \"my-service\"",
"good": "request.status_code : \"2xx\"",
"index": "logs-*",
"timestampField": "@timestamp",
"total": "request.status_code : *"
},
"type": "sli.kql.custom"
},
"instanceId": "*",
"name": "My Service Availability",
"objective": {
"target": 0.99
},
"revision": 1,
"settings": {
"frequency": "5m",
"syncDelay": "5m"
},
"summary": {
"errorBudget": {
"consumed": 0.17,
"initial": 0.01,
"isEstimated": false,
"remaining": 0.83
},
"sliValue": 0.9983,
"status": "HEALTHY"
},
"tags": [
"production",
"web-service"
],
"timeWindow": {
"duration": "30d",
"type": "rolling"
},
"updatedAt": "2025-01-12T10:03:19.000Z",
"version": 2
}
],
"total": 42
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'invalid' supplied to: sortBy",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_read] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"post": {
"tags": [
"slo"
],
"summary": "Create an SLO",
"description": "You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "createSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_create_slo_request"
},
"examples": {
"createSloKqlExample": {
"summary": "Create an SLO with a KQL indicator",
"value": {
"budgetingMethod": "occurrences",
"description": "Availability of my web service measured by successful HTTP responses",
"indicator": {
"params": {
"filter": "field.environment : \"production\" and service.name : \"my-service\"",
"good": "request.status_code : \"2xx\"",
"index": "logs-*",
"timestampField": "@timestamp",
"total": "request.status_code : *"
},
"type": "sli.kql.custom"
},
"name": "My Service Availability",
"objective": {
"target": 0.99
},
"settings": {
"frequency": "5m",
"syncDelay": "5m"
},
"tags": [
"production",
"web-service"
],
"timeWindow": {
"duration": "30d",
"type": "rolling"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_create_slo_response"
},
"examples": {
"createSloResponse": {
"summary": "Create SLO response",
"value": {
"id": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: indicator/type",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"409": {
"description": "Conflict - The SLO id already exists",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_409_response"
},
"examples": {
"conflictExample": {
"summary": "Conflict",
"value": {
"error": "Conflict",
"message": "SLO [d077e940-1515-11ee-9c50-9d096392f520] already exists",
"statusCode": 409
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/_bulk_delete": {
"post": {
"tags": [
"slo"
],
"summary": "Bulk delete SLO definitions and their associated summary and rollup data.",
"description": "Bulk delete SLO definitions and their associated summary and rollup data. This endpoint initiates a bulk deletion operation for SLOs, which may take some time to complete. The status of the operation can be checked using the `GET /api/slo/_bulk_delete/{taskId}` endpoint.\n",
"operationId": "bulkDeleteOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_bulk_delete_request"
},
"examples": {
"bulkDeleteRequest": {
"summary": "Bulk delete two SLOs",
"value": {
"list": [
"8853df00-ae2e-11ed-90af-09bb6422b258",
"d077e940-1515-11ee-9c50-9d096392f520"
]
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_bulk_delete_response"
},
"examples": {
"bulkDeleteResponse": {
"summary": "Bulk delete response with task ID",
"value": {
"taskId": "d08506b7-f0e8-4f8b-a06a-a83940f4db91"
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: list",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/_bulk_delete/{taskId}": {
"get": {
"tags": [
"slo"
],
"summary": "Retrieve the status of the bulk deletion",
"description": "Retrieve the status of the bulk deletion operation for SLOs. This endpoint returns the status of the bulk deletion operation, including whether it is completed and the results of the operation.\n",
"operationId": "bulkDeleteStatusOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"name": "taskId",
"in": "path",
"description": "The task id of the bulk delete operation",
"required": true,
"schema": {
"type": "string",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_bulk_delete_status_response"
},
"examples": {
"bulkDeleteStatusComplete": {
"summary": "Completed bulk deletion",
"value": {
"isDone": true,
"results": [
{
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"success": true
},
{
"id": "d077e940-1515-11ee-9c50-9d096392f520",
"success": true
}
]
}
},
"bulkDeleteStatusPartialFailure": {
"summary": "Completed with partial failure",
"value": {
"isDone": true,
"results": [
{
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"success": true
},
{
"error": "SLO [d077e940-1515-11ee-9c50-9d096392f520] not found",
"id": "d077e940-1515-11ee-9c50-9d096392f520",
"success": false
}
]
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: taskId",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/_bulk_purge_rollup": {
"post": {
"tags": [
"slo"
],
"summary": "Batch delete rollup and summary data",
"description": "The deletion occurs for the specified list of `sloId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "deleteRollupDataOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_bulk_purge_rollup_request"
},
"examples": {
"purgeByAgeExample": {
"summary": "Purge rollup data older than 7 days",
"value": {
"list": [
"8853df00-ae2e-11ed-90af-09bb6422b258"
],
"purgePolicy": {
"age": "7d",
"purgeType": "fixed-age"
}
}
},
"purgeByTimestampExample": {
"summary": "Purge rollup data before a specific date",
"value": {
"list": [
"8853df00-ae2e-11ed-90af-09bb6422b258",
"d077e940-1515-11ee-9c50-9d096392f520"
],
"purgePolicy": {
"purgeType": "fixed-time",
"timestamp": "2024-12-31T00:00:00.000Z"
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_bulk_purge_rollup_response"
},
"examples": {
"bulkPurgeResponse": {
"summary": "Bulk purge response with task ID",
"value": {
"taskId": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: purgePolicy/purgeType",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/_bulk_snapshot": {
"post": {
"tags": [
"slo"
],
"summary": "Compute SLO instance summaries in bulk at a point in time",
"description": "Compute the summary of multiple SLO instances at a given point in time. The endpoint is synchronous and returns results directly. Each result contains either a summary (on success) or a per-instance error. The list of requests is limited to 100 entries. When `instanceId` is omitted or set to `'*'`, the API returns a result for each matching instance (up to 1000 per SLO). You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "bulkSnapshotOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_bulk_snapshot_request"
},
"examples": {
"bulkSnapshotRequest": {
"summary": "Compute snapshots for two SLO instances",
"value": {
"at": "2025-01-12T10:00:00.000Z",
"requests": [
{
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"instanceId": "*"
},
{
"id": "d077e940-1515-11ee-9c50-9d096392f520",
"instanceId": "host.name:web-01"
}
]
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_snapshot_response"
},
"examples": {
"bulkSnapshotResponse": {
"summary": "Bulk snapshot response with mixed success and per-instance error",
"value": {
"at": "2025-01-12T10:00:00.000Z",
"results": [
{
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"instanceId": "*",
"summary": {
"errorBudget": {
"consumed": 0.24,
"initial": 0.01,
"remaining": 0.76
},
"good": 9976,
"sliValue": 0.9976,
"status": "HEALTHY",
"total": 10000
}
},
{
"error": {
"message": "SLO [d077e940-1515-11ee-9c50-9d096392f520] not found",
"statusCode": 404
},
"id": "d077e940-1515-11ee-9c50-9d096392f520",
"instanceId": "host.name:web-01"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "`requests` is limited to 100 entries",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_read] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/_delete_instances": {
"post": {
"tags": [
"slo"
],
"summary": "Batch delete rollup and summary data",
"description": "The deletion occurs for the specified list of `sloId` and `instanceId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "deleteSloInstancesOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_delete_slo_instances_request"
},
"examples": {
"deleteInstancesExample": {
"summary": "Delete specific SLO instances",
"value": {
"list": [
{
"instanceId": "host-abc123",
"sloId": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
{
"instanceId": "host-def456",
"sloId": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
]
}
}
}
}
},
"required": true
},
"responses": {
"204": {
"description": "Successful request"
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: list/0/sloId",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/{sloId}": {
"delete": {
"tags": [
"slo"
],
"summary": "Delete an SLO",
"description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "deleteSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
}
],
"responses": {
"204": {
"description": "Successful request"
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: id",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"get": {
"tags": [
"slo"
],
"summary": "Get an SLO",
"description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "getSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
},
{
"name": "instanceId",
"in": "query",
"description": "the specific instanceId used by the summary calculation",
"schema": {
"type": "string"
},
"example": "host-abcde"
}
],
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_slo_with_summary_response"
},
"examples": {
"getSloResponse": {
"summary": "Get SLO response",
"value": {
"budgetingMethod": "occurrences",
"createdAt": "2025-01-12T10:03:19.000Z",
"description": "Availability of my web service",
"enabled": true,
"groupBy": "*",
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"indicator": {
"params": {
"filter": "field.environment : \"production\" and service.name : \"my-service\"",
"good": "request.status_code : \"2xx\"",
"index": "logs-*",
"timestampField": "@timestamp",
"total": "request.status_code : *"
},
"type": "sli.kql.custom"
},
"instanceId": "*",
"name": "My Service Availability",
"objective": {
"target": 0.99
},
"revision": 1,
"settings": {
"frequency": "5m",
"syncDelay": "5m"
},
"summary": {
"errorBudget": {
"consumed": 0.17,
"initial": 0.01,
"isEstimated": false,
"remaining": 0.83
},
"sliValue": 0.9983,
"status": "HEALTHY"
},
"tags": [
"production",
"web-service"
],
"timeWindow": {
"duration": "30d",
"type": "rolling"
},
"updatedAt": "2025-01-12T10:03:19.000Z",
"version": 2
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: id",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_read] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
},
"put": {
"tags": [
"slo"
],
"summary": "Update an SLO",
"description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "updateSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_update_slo_request"
},
"examples": {
"updateSloNameExample": {
"summary": "Update the SLO name and tags",
"value": {
"name": "Updated Service Availability",
"tags": [
"production",
"updated"
]
}
},
"updateSloObjectiveExample": {
"summary": "Update the SLO objective",
"value": {
"objective": {
"target": 0.995
}
}
}
}
}
},
"required": true
},
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_slo_definition_response"
},
"examples": {
"updateSloResponse": {
"summary": "Update SLO response",
"value": {
"budgetingMethod": "occurrences",
"createdAt": "2025-01-12T10:03:19.000Z",
"description": "Availability of my web service",
"enabled": true,
"groupBy": "*",
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"indicator": {
"params": {
"filter": "field.environment : \"production\" and service.name : \"my-service\"",
"good": "request.status_code : \"2xx\"",
"index": "logs-*",
"timestampField": "@timestamp",
"total": "request.status_code : *"
},
"type": "sli.kql.custom"
},
"name": "Updated Service Availability",
"objective": {
"target": 0.99
},
"revision": 2,
"settings": {
"frequency": "5m",
"syncDelay": "5m"
},
"tags": [
"production",
"updated"
],
"timeWindow": {
"duration": "30d",
"type": "rolling"
},
"updatedAt": "2025-03-26T14:30:00.000Z",
"version": 2
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: indicator/type",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/{sloId}/_reset": {
"post": {
"tags": [
"slo"
],
"summary": "Reset an SLO",
"description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "resetSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
}
],
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_slo_definition_response"
},
"examples": {
"resetSloResponse": {
"summary": "Reset SLO response",
"value": {
"budgetingMethod": "occurrences",
"createdAt": "2025-01-12T10:03:19.000Z",
"description": "Availability of my web service",
"enabled": true,
"groupBy": "*",
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"indicator": {
"params": {
"filter": "field.environment : \"production\" and service.name : \"my-service\"",
"good": "request.status_code : \"2xx\"",
"index": "logs-*",
"timestampField": "@timestamp",
"total": "request.status_code : *"
},
"type": "sli.kql.custom"
},
"name": "My Service Availability",
"objective": {
"target": 0.99
},
"revision": 2,
"settings": {
"frequency": "5m",
"syncDelay": "5m"
},
"tags": [
"production",
"web-service"
],
"timeWindow": {
"duration": "30d",
"type": "rolling"
},
"updatedAt": "2025-03-26T14:30:00.000Z",
"version": 2
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: id",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/{sloId}/_snapshot": {
"get": {
"tags": [
"slo"
],
"summary": "Compute an SLO instance summary at a point in time",
"description": "Compute the summary of an SLO at a given point in time. When `instanceId` is provided, returns that instance. When `instanceId` is omitted or set to `'*'`, returns all matching instances (up to 1000). The endpoint is synchronous and returns results directly. You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "getSnapshotOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
},
{
"name": "at",
"in": "query",
"description": "The point in time at which to compute the SLO instance summary (ISO 8601 date-time)",
"required": true,
"schema": {
"type": "string",
"format": "date-time",
"example": "2025-01-12T10:00:00.000Z"
}
},
{
"name": "instanceId",
"in": "query",
"description": "The SLO instance ID. Omit this parameter or set it to `'*'` to return all instances for the SLO (up to 1000). Set a specific value (for example `host.name:web-01`) to return that instance only.\n",
"schema": {
"type": "string",
"example": "*"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_snapshot_response"
},
"examples": {
"getSnapshotResponse": {
"summary": "Snapshot result for a healthy SLO instance",
"value": {
"at": "2025-01-12T10:00:00.000Z",
"results": [
{
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"instanceId": "*",
"summary": {
"errorBudget": {
"consumed": 0.24,
"initial": 0.01,
"remaining": 0.76
},
"good": 9976,
"sliValue": 0.9976,
"status": "HEALTHY",
"total": 10000
}
}
]
}
},
"getSnapshotResponseViolated": {
"summary": "Snapshot result for a violated SLO instance",
"value": {
"at": "2025-01-12T10:00:00.000Z",
"results": [
{
"id": "8853df00-ae2e-11ed-90af-09bb6422b258",
"instanceId": "host.name:web-01",
"summary": {
"errorBudget": {
"consumed": 5,
"initial": 0.01,
"remaining": -4
},
"good": 9500,
"sliValue": 0.95,
"status": "VIOLATED",
"total": 10000
}
}
]
}
}
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: at",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_read] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [8853df00-ae2e-11ed-90af-09bb6422b258] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-state": "Generally available; added in 9.6.0",
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/{sloId}/disable": {
"post": {
"tags": [
"slo"
],
"summary": "Disable an SLO",
"description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "disableSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
}
],
"responses": {
"204": {
"description": "Successful request"
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: id",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/api/observability/slos/{sloId}/enable": {
"post": {
"tags": [
"slo"
],
"summary": "Enable an SLO",
"description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "enableSloOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"$ref": "#/components/parameters/SLOs_slo_id"
}
],
"responses": {
"204": {
"description": "Successful request"
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
},
"examples": {
"badRequestExample": {
"summary": "Bad request",
"value": {
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: id",
"statusCode": 400
}
}
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
},
"examples": {
"unauthorizedExample": {
"summary": "Unauthorized",
"value": {
"error": "Unauthorized",
"message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
"statusCode": 401
}
}
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
},
"examples": {
"forbiddenExample": {
"summary": "Forbidden",
"value": {
"error": "Forbidden",
"message": "security_exception: action [slo_write] is unauthorized for user",
"statusCode": 403
}
}
}
}
}
},
"404": {
"description": "Not found response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_404_response"
},
"examples": {
"notFoundExample": {
"summary": "Not found",
"value": {
"error": "Not Found",
"message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
"statusCode": 404
}
}
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
},
"/s/{spaceId}/internal/observability/slos/_definitions": {
"get": {
"tags": [
"slo"
],
"summary": "Get the SLO definitions",
"description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
"operationId": "getDefinitionsOp",
"parameters": [
{
"$ref": "#/components/parameters/SLOs_kbn_xsrf"
},
{
"$ref": "#/components/parameters/SLOs_space_id"
},
{
"name": "includeOutdatedOnly",
"in": "query",
"description": "Indicates if the API returns only outdated SLO or all SLO definitions",
"schema": {
"type": "boolean"
}
},
{
"name": "includeHealth",
"in": "query",
"description": "Indicates if the API returns SLO health data with definitions",
"schema": {
"type": "boolean"
},
"example": true
},
{
"name": "tags",
"in": "query",
"description": "Filters the SLOs by tag",
"schema": {
"type": "string"
}
},
{
"name": "search",
"in": "query",
"description": "Filters the SLOs by name",
"schema": {
"type": "string"
},
"example": "my service availability"
},
{
"name": "page",
"in": "query",
"description": "The page to use for pagination, must be greater or equal than 1",
"schema": {
"type": "number"
},
"example": 1
},
{
"name": "perPage",
"in": "query",
"description": "Number of SLOs returned by page",
"schema": {
"maximum": 1000,
"type": "integer",
"default": 100
},
"example": 100
}
],
"responses": {
"200": {
"description": "Successful request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_find_slo_definitions_response"
}
}
}
},
"400": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_400_response"
}
}
}
},
"401": {
"description": "Unauthorized response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_401_response"
}
}
}
},
"403": {
"description": "Forbidden response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SLOs_403_response"
}
}
}
}
},
"x-metaTags": [
{
"content": "Kibana",
"name": "product_name"
}
]
}
}
},
"components": {
"schemas": {
"Alerting_401_response": {
"title": "Unsuccessful rule API response",
"type": "object",
"properties": {
"error": {
"enum": [
"Unauthorized"
],
"type": "string",
"example": "Unauthorized"
},
"message": {
"type": "string"
},
"statusCode": {
"enum": [
401
],
"type": "integer",
"example": 401
}
}
},
"Alerting_fieldmap_properties": {
"title": "Field map objects in the get rule types response",
"type": "object",
"properties": {
"array": {
"type": "boolean",
"description": "Indicates whether the field is an array."
},
"dynamic": {
"type": "boolean",
"description": "Indicates whether it is a dynamic field mapping."
},
"format": {
"type": "string",
"description": "Indicates the format of the field. For example, if the `type` is `date_range`, the `format` can be `epoch_millis||strict_date_optional_time`.\n"
},
"ignore_above": {
"type": "integer",
"description": "Specifies the maximum length of a string field. Longer strings are not indexed or stored."
},
"index": {
"type": "boolean",
"description": "Indicates whether field values are indexed."
},
"path": {
"type": "string",
"description": "TBD"
},
"properties": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "The data type for each object property."
}
}
},
"description": "Details about the object properties. This property is applicable when `type` is `object`.\n"
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required."
},
"scaling_factor": {
"type": "integer",
"description": "The scaling factor to use when encoding values. This property is applicable when `type` is `scaled_float`. Values will be multiplied by this factor at index time and rounded to the closest long value. \n"
},
"type": {
"type": "string",
"description": "Specifies the data type for the field.",
"example": "scaled_float"
}
}
},
"APM_UI_400_response": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Not Found"
},
"message": {
"type": "string",
"description": "Error message",
"example": "Not Found"
},
"statusCode": {
"type": "number",
"description": "Error status code",
"example": 400
}
}
},
"APM_UI_401_response": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Unauthorized"
},
"message": {
"type": "string",
"description": "Error message"
},
"statusCode": {
"type": "number",
"description": "Error status code",
"example": 401
}
}
},
"APM_UI_403_response": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "Error message"
},
"statusCode": {
"type": "number",
"description": "Error status code",
"example": 403
}
}
},
"APM_UI_404_response": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Not Found"
},
"message": {
"type": "string",
"description": "Error message",
"example": "Not Found"
},
"statusCode": {
"type": "number",
"description": "Error status code",
"example": 404
}
}
},
"APM_UI_500_response": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Internal Server Error"
},
"message": {
"type": "string",
"description": "Error message"
},
"statusCode": {
"type": "number",
"description": "Error status code",
"example": 500
}
}
},
"APM_UI_501_response": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Not Implemented"
},
"message": {
"type": "string",
"description": "Error message",
"example": "Not Implemented"
},
"statusCode": {
"type": "number",
"description": "Error status code",
"example": 501
}
}
},
"APM_UI_agent_configuration_intake_object": {
"required": [
"service",
"settings"
],
"type": "object",
"properties": {
"agent_name": {
"type": "string",
"description": "The agent name is used by the UI to determine which settings to display."
},
"service": {
"$ref": "#/components/schemas/APM_UI_service_object"
},
"settings": {
"$ref": "#/components/schemas/APM_UI_settings_object"
}
}
},
"APM_UI_agent_configuration_object": {
"required": [
"service",
"settings",
"@timestamp",
"etag"
],
"type": "object",
"properties": {
"@timestamp": {
"type": "number",
"description": "Timestamp",
"example": 1730194190636
},
"agent_name": {
"type": "string",
"description": "Agent name"
},
"applied_by_agent": {
"type": "boolean",
"description": "Applied by agent",
"example": true
},
"etag": {
"type": "string",
"description": "`etag` is sent by the APM agent to indicate the `etag` of the last successfully applied configuration. If the `etag` matches an existing configuration its `applied_by_agent` property will be set to `true`. Every time a configuration is edited `applied_by_agent` is reset to `false`.\n",
"example": "0bc3b5ebf18fba8163fe4c96f491e3767a358f85"
},
"service": {
"$ref": "#/components/schemas/APM_UI_service_object"
},
"settings": {
"$ref": "#/components/schemas/APM_UI_settings_object"
}
},
"description": "Agent configuration"
},
"APM_UI_agent_configurations_response": {
"type": "object",
"properties": {
"configurations": {
"type": "array",
"items": {
"$ref": "#/components/schemas/APM_UI_agent_configuration_object"
},
"description": "Agent configuration"
}
}
},
"APM_UI_agent_keys_object": {
"required": [
"name",
"privileges"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the APM agent key."
},
"privileges": {
"type": "array",
"items": {
"enum": [
"event:write",
"config_agent:read"
],
"type": "string"
},
"description": "The APM agent key privileges. It can take one or more of the following values:\n* `event:write`, which is required for ingesting APM agent events. * `config_agent:read`, which is required for APM agents to read agent configuration remotely.\n"
}
}
},
"APM_UI_agent_keys_response": {
"type": "object",
"properties": {
"agentKey": {
"required": [
"id",
"name",
"api_key",
"encoded"
],
"type": "object",
"properties": {
"api_key": {
"type": "string"
},
"encoded": {
"type": "string"
},
"expiration": {
"type": "integer",
"format": "int64"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"description": "Agent key"
}
}
},
"APM_UI_annotation_search_response": {
"type": "object",
"properties": {
"annotations": {
"type": "array",
"items": {
"type": "object",
"properties": {
"@timestamp": {
"type": "number"
},
"id": {
"type": "string"
},
"text": {
"type": "string"
},
"type": {
"enum": [
"version"
],
"type": "string"
}
}
},
"description": "Annotations"
}
}
},
"APM_UI_base_source_map_object": {
"type": "object",
"properties": {
"compressionAlgorithm": {
"type": "string",
"description": "Compression Algorithm"
},
"created": {
"type": "string",
"description": "Created date"
},
"decodedSha256": {
"type": "string",
"description": "Decoded SHA-256"
},
"decodedSize": {
"type": "number",
"description": "Decoded size"
},
"encodedSha256": {
"type": "string",
"description": "Encoded SHA-256"
},
"encodedSize": {
"type": "number",
"description": "Encoded size"
},
"encryptionAlgorithm": {
"type": "string",
"description": "Encryption Algorithm"
},
"id": {
"type": "string",
"description": "Identifier"
},
"identifier": {
"type": "string",
"description": "Identifier"
},
"packageName": {
"type": "string",
"description": "Package name"
},
"relative_url": {
"type": "string",
"description": "Relative URL"
},
"type": {
"type": "string",
"description": "Type"
}
}
},
"APM_UI_create_annotation_object": {
"required": [
"@timestamp",
"service"
],
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"description": "The date and time of the annotation. It must be in ISO 8601 format."
},
"message": {
"type": "string",
"description": "The message displayed in the annotation. It defaults to `service.version`."
},
"service": {
"required": [
"version"
],
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "The environment of the service."
},
"version": {
"type": "string",
"description": "The version of the service."
}
},
"description": "The service that identifies the configuration to create or update."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags are used by the Applications UI to distinguish APM annotations from other annotations. Tags may have additional functionality in future releases. It defaults to `[apm]`. While you can add additional tags, you cannot remove the `apm` tag.\n"
}
}
},
"APM_UI_create_annotation_response": {
"type": "object",
"properties": {
"_id": {
"type": "string",
"description": "Identifier"
},
"_index": {
"type": "string",
"description": "Index"
},
"_source": {
"type": "object",
"properties": {
"@timestamp": {
"type": "string"
},
"annotation": {
"type": "object",
"properties": {
"title": {
"type": "string"
},
"type": {
"type": "string"
}
}
},
"event": {
"type": "object",
"properties": {
"created": {
"type": "string"
}
}
},
"message": {
"type": "string"
},
"service": {
"type": "object",
"properties": {
"environment": {
"type": "string"
},
"name": {
"type": "string"
},
"version": {
"type": "string"
}
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"description": "Response"
}
}
},
"APM_UI_delete_agent_configurations_response": {
"type": "object",
"properties": {
"result": {
"type": "string",
"description": "Result"
}
}
},
"APM_UI_delete_service_object": {
"required": [
"service"
],
"type": "object",
"properties": {
"service": {
"$ref": "#/components/schemas/APM_UI_service_object"
}
},
"description": "Service"
},
"APM_UI_search_agent_configuration_object": {
"required": [
"service"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "If provided, the agent configuration will be marked as error and `applied_by_agent` will be set to `false`.\nThis is useful for cases where the agent configuration was not applied successfully.\n"
},
"etag": {
"type": "string",
"description": "If etags match then `applied_by_agent` field will be set to `true`",
"example": "0bc3b5ebf18fba8163fe4c96f491e3767a358f85"
},
"mark_as_applied_by_agent": {
"type": "boolean",
"description": "`markAsAppliedByAgent=true` means \"force setting it to true regardless of etag\".\nThis is needed for Jaeger agent that doesn't have etags\n"
},
"service": {
"$ref": "#/components/schemas/APM_UI_service_object"
}
}
},
"APM_UI_search_agent_configuration_response": {
"type": "object",
"properties": {
"_id": {
"type": "string",
"description": "Identifier"
},
"_index": {
"type": "string",
"description": "Index"
},
"_score": {
"type": "number",
"description": "Score"
},
"_source": {
"$ref": "#/components/schemas/APM_UI_agent_configuration_object"
}
}
},
"APM_UI_service_agent_name_response": {
"type": "object",
"properties": {
"agentName": {
"type": "string",
"description": "Agent name",
"example": "nodejs"
}
}
},
"APM_UI_service_environment_object": {
"type": "object",
"properties": {
"alreadyConfigured": {
"type": "boolean",
"description": "Already configured"
},
"name": {
"type": "string",
"description": "Service environment name",
"example": "ALL_OPTION_VALUE"
}
}
},
"APM_UI_service_environments_response": {
"type": "object",
"properties": {
"environments": {
"type": "array",
"items": {
"$ref": "#/components/schemas/APM_UI_service_environment_object"
},
"description": "Service environment list"
}
}
},
"APM_UI_service_object": {
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "The environment of the service.",
"example": "prod"
},
"name": {
"type": "string",
"description": "The name of the service.",
"example": "node"
}
},
"description": "Service"
},
"APM_UI_settings_object": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Agent configuration settings"
},
"APM_UI_single_agent_configuration_response": {
"allOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
}
},
{
"$ref": "#/components/schemas/APM_UI_agent_configuration_object"
}
]
},
"APM_UI_source_maps_response": {
"type": "object",
"properties": {
"artifacts": {
"type": "array",
"items": {
"allOf": [
{
"type": "object",
"properties": {
"body": {
"type": "object",
"properties": {
"bundleFilepath": {
"type": "string"
},
"serviceName": {
"type": "string"
},
"serviceVersion": {
"type": "string"
},
"sourceMap": {
"type": "object",
"properties": {
"file": {
"type": "string"
},
"mappings": {
"type": "string"
},
"sourceRoot": {
"type": "string"
},
"sources": {
"type": "array",
"items": {
"type": "string"
}
},
"sourcesContent": {
"type": "array",
"items": {
"type": "string"
}
},
"version": {
"type": "number"
}
}
}
}
}
}
},
{
"$ref": "#/components/schemas/APM_UI_base_source_map_object"
}
]
},
"description": "Artifacts"
}
}
},
"APM_UI_upload_source_map_object": {
"required": [
"service_name",
"service_version",
"bundle_filepath",
"sourcemap"
],
"type": "object",
"properties": {
"bundle_filepath": {
"type": "string",
"description": "The absolute path of the final bundle as used in the web application."
},
"service_name": {
"type": "string",
"description": "The name of the service that the service map should apply to."
},
"service_version": {
"type": "string",
"description": "The version of the service that the service map should apply to."
},
"sourcemap": {
"type": "string",
"description": "The source map. It can be a string or file upload. It must follow the\n[source map format specification](https://tc39.es/ecma426/).\n",
"format": "binary"
}
}
},
"APM_UI_upload_source_maps_response": {
"allOf": [
{
"type": "object",
"properties": {
"body": {
"type": "string"
}
}
},
{
"$ref": "#/components/schemas/APM_UI_base_source_map_object"
}
]
},
"Cases_actions": {
"enum": [
"add",
"create",
"delete",
"push_to_service",
"update"
],
"type": "string",
"example": "create"
},
"Cases_add_alert_comment_request_properties": {
"title": "Add case comment request properties for alerts",
"required": [
"alertId",
"index",
"owner",
"rule",
"type"
],
"type": "object",
"properties": {
"alertId": {
"$ref": "#/components/schemas/Cases_alert_identifiers"
},
"index": {
"$ref": "#/components/schemas/Cases_alert_indices"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"rule": {
"$ref": "#/components/schemas/Cases_rule"
},
"type": {
"enum": [
"alert"
],
"type": "string",
"description": "The type of comment.",
"example": "alert"
}
},
"description": "Defines properties for case comment requests when type is alert."
},
"Cases_add_case_comment_request": {
"title": "Add case comment request",
"oneOf": [
{
"$ref": "#/components/schemas/Cases_add_alert_comment_request_properties"
},
{
"$ref": "#/components/schemas/Cases_add_user_comment_request_properties"
}
],
"description": "The add comment to case API request body varies depending on whether you are adding an alert or a comment.",
"discriminator": {
"propertyName": "type",
"mapping": {
"alert": "#/components/schemas/Cases_add_alert_comment_request_properties",
"user": "#/components/schemas/Cases_add_user_comment_request_properties"
}
}
},
"Cases_add_case_file_request": {
"title": "Add case file request properties",
"required": [
"file"
],
"type": "object",
"properties": {
"file": {
"type": "string",
"description": "The file being attached to the case.",
"format": "binary"
},
"filename": {
"type": "string",
"description": "The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**"
}
},
"description": "Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined."
},
"Cases_add_user_comment_request_properties": {
"title": "Add case comment request properties for user comments",
"required": [
"comment",
"owner",
"type"
],
"type": "object",
"properties": {
"comment": {
"maxLength": 30000,
"type": "string",
"description": "The new comment. It is required only when `type` is `user`.",
"example": "A new comment."
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"type": {
"enum": [
"user"
],
"type": "string",
"description": "The type of comment.",
"example": "user"
}
},
"description": "Defines properties for case comment requests when type is user."
},
"Cases_alert_comment_response_properties": {
"title": "Add case comment response properties for alerts",
"required": [
"type"
],
"type": "object",
"properties": {
"alertId": {
"type": "array",
"items": {
"type": "string",
"example": "a6e12ac4-7bce-457b-84f6-d7ce8deb8446"
}
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2023-11-06T19:29:38.424Z"
},
"created_by": {
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"id": {
"type": "string",
"example": "73362370-ab1a-11ec-985f-97e55adae8b9"
},
"index": {
"type": "array",
"items": {
"type": "string",
"example": ".internal.alerts-security.alerts-default-000001"
}
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"pushed_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "null"
},
"pushed_by": {
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"rule": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
],
"description": "The rule identifier.",
"example": "94d80550-aaf4-11ec-985f-97e55adae8b9"
},
"name": {
"type": [
"null",
"string"
],
"description": "The rule name.",
"example": "security_rule"
}
}
},
"type": {
"enum": [
"alert"
],
"type": "string",
"example": "alert"
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"updated_by": {
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"version": {
"type": "string",
"example": "WzMwNDgsMV0="
}
}
},
"Cases_alert_identifiers": {
"title": "Alert identifiers",
"oneOf": [
{
"type": "string"
},
{
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n",
"example": "6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42",
"x-state": "Technical preview"
},
"Cases_alert_indices": {
"title": "Alert indices",
"oneOf": [
{
"type": "string"
},
{
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n",
"x-state": "Technical preview"
},
"Cases_alert_response_properties": {
"type": "object",
"properties": {
"attached_at": {
"type": "string",
"format": "date-time"
},
"id": {
"type": "string",
"description": "The alert identifier."
},
"index": {
"type": "string",
"description": "The alert index."
}
}
},
"Cases_applicable_fields_response": {
"required": [
"fields"
],
"type": "object",
"properties": {
"fields": {
"type": "array",
"items": {
"required": [
"key",
"name",
"label",
"type",
"control",
"required",
"requiredOnClose",
"displayOnly",
"source",
"isGlobal"
],
"type": "object",
"properties": {
"control": {
"type": "string",
"description": "The UI control for the field, such as `INPUT_TEXT`, `INPUT_NUMBER`, `SELECT_BASIC`, `TOGGLE`, or `MARKDOWN`.\n",
"example": "SELECT_BASIC"
},
"defaultValue": {
"type": "string",
"description": "The default value, as a string, when the field definition declares one."
},
"displayOnly": {
"type": "boolean",
"description": "When `true` the field is display-only (for example a `MARKDOWN` block): it is returned so the full form shape is visible, but it holds no value and its `key` cannot be written to `extended_fields`.\n"
},
"isGlobal": {
"type": "boolean",
"description": "Whether the field is a global (library-wide) definition."
},
"key": {
"type": "string",
"description": "The storage key to write in the case `extended_fields` map. Follows the `_as_` convention (for example `priority_as_keyword`).\n",
"example": "priority_as_keyword"
},
"label": {
"type": "string",
"description": "The human-readable label. Falls back to `name` when no label is authored.",
"example": "Priority"
},
"name": {
"type": "string",
"description": "The field name as authored in the field definition.",
"example": "priority"
},
"options": {
"type": "array",
"items": {
"type": "string"
},
"description": "The allowed values for `SELECT_BASIC`, `RADIO_GROUP`, and `CHECKBOX_GROUP` fields."
},
"type": {
"type": "string",
"description": "The storage type: `keyword`, `integer`, `long`, `boolean`, or `date`.",
"example": "keyword"
},
"required": {
"type": "boolean",
"description": "Whether a value must be supplied at write time."
},
"requiredOnClose": {
"type": "boolean",
"description": "Whether the field must be filled before the case can be closed."
},
"source": {
"enum": [
"global",
"template"
],
"type": "string",
"description": "Where the field comes from: `global` for a library-wide (`isGlobal`) definition writable on any case, or `template` for a field contributed by the applied template.\n"
}
}
}
}
},
"description": "The fields a caller may apply to a case's `extended_fields`. When no template is in scope, this is the owner's global (library-wide) fields; when a template is applied, it also includes that template's fields. Migrated legacy custom fields appear here as `global` fields, so existing automations can look up the exact key to write.\n"
},
"Cases_assignees": {
"maxItems": 10,
"type": [
"null",
"array"
],
"items": {
"required": [
"uid"
],
"type": "object",
"properties": {
"uid": {
"type": "string",
"description": "A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.",
"example": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
}
}
},
"description": "An array containing users that are assigned to the case."
},
"Cases_attachment_totals": {
"title": "Attachment totals",
"required": [
"alerts",
"events",
"userComments"
],
"type": "object",
"properties": {
"alerts": {
"type": "integer",
"description": "Number of alert attachments on the case."
},
"events": {
"type": "integer",
"description": "Number of event attachments on the case."
},
"userComments": {
"type": "integer",
"description": "Number of user comment attachments on the case."
}
},
"description": "Counts of alerts, events, and user comments attached to a case."
},
"Cases_case_categories": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_case_category"
}
},
"Cases_case_category": {
"maxLength": 50,
"type": "string",
"description": "A word or phrase that categorizes the case."
},
"Cases_case_close_sync_reason": {
"oneOf": [
{
"enum": [
"false_positive",
"duplicate",
"true_positive",
"benign_positive",
"automated_closure",
"other"
],
"type": "string"
},
{
"type": "string"
}
],
"description": "The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user.\n"
},
"Cases_case_description": {
"maxLength": 30000,
"type": "string",
"description": "The description for the case."
},
"Cases_case_extended_fields": {
"title": "Case extended fields",
"maxProperties": 500,
"type": "object",
"additionalProperties": {
"maxLength": 30000,
"type": "string"
},
"description": "Case field values keyed by storage key. Keys follow the `_as_` convention (for example `priority_as_keyword`) and map to the owner's global (library-wide) fields plus, when a template is applied to the case, that template's fields. On update, the keys provided are merged into the stored map; unlisted keys are left untouched. To discover the writable keys, use the get case fields API (`GET /api/cases/fields`).\n",
"x-state": "Technical preview; added in 9.5.0"
},
"Cases_case_observable": {
"title": "Case observable",
"required": [
"id",
"typeKey",
"value",
"description",
"createdAt",
"updatedAt"
],
"type": "object",
"properties": {
"createdAt": {
"type": "string",
"description": "When the observable was created.",
"format": "date-time",
"example": "2024-11-14T10:00:00.000Z"
},
"description": {
"type": [
"null",
"string"
],
"description": "An optional description for the observable.",
"example": "Source IP"
},
"id": {
"type": "string",
"description": "The observable identifier.",
"example": "df927ab8-54ed-47d6-be07-9948c255c097"
},
"typeKey": {
"type": "string",
"description": "The observable type key.",
"example": "observable-type-ipv4"
},
"updatedAt": {
"type": [
"null",
"string"
],
"description": "When the observable was last updated.",
"format": "date-time",
"example": "2024-11-14T10:00:00.000Z"
},
"value": {
"type": "string",
"description": "The observable value.",
"example": "10.0.0.8"
}
},
"description": "A single observable attached to a case."
},
"Cases_case_response_closed_by_properties": {
"title": "Case response properties for closed_by",
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"Cases_case_response_created_by_properties": {
"title": "Case response properties for created_by",
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"Cases_case_response_get_case": {
"title": "Get case response",
"required": [
"closed_at",
"closed_by",
"connector",
"created_at",
"created_by",
"description",
"duration",
"external_service",
"id",
"observables",
"owner",
"settings",
"severity",
"status",
"tags",
"title",
"totalAlerts",
"totalComment",
"total_observables",
"updated_at",
"updated_by",
"version"
],
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
},
"category": {
"type": [
"null",
"string"
],
"description": "The case category."
},
"closed_at": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"closed_by": {
"$ref": "#/components/schemas/Cases_case_response_closed_by_properties"
},
"connector": {
"title": "Case response properties for connectors",
"oneOf": [
{
"$ref": "#/components/schemas/Cases_connector_properties_none"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_cases_webhook"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_jira"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_resilient"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_swimlane"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
".cases-webhook": "#/components/schemas/Cases_connector_properties_cases_webhook",
".jira": "#/components/schemas/Cases_connector_properties_jira",
".none": "#/components/schemas/Cases_connector_properties_none",
".resilient": "#/components/schemas/Cases_connector_properties_resilient",
".servicenow": "#/components/schemas/Cases_connector_properties_servicenow",
".servicenow-sir": "#/components/schemas/Cases_connector_properties_servicenow_sir",
".swimlane": "#/components/schemas/Cases_connector_properties_swimlane"
}
}
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-05-13T09:16:17.416Z"
},
"created_by": {
"$ref": "#/components/schemas/Cases_case_response_created_by_properties"
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The custom field type. It must match the type specified in the case configuration settings.\n"
},
"value": {
"oneOf": [
{
"maxLength": 160,
"minLength": 1,
"type": [
"null",
"string"
]
},
{
"type": "boolean"
}
],
"description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
}
}
},
"description": "Custom field values for the case."
},
"description": {
"type": "string",
"example": "A case description."
},
"duration": {
"type": [
"null",
"integer"
],
"description": "The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.\n",
"example": 120
},
"external_service": {
"$ref": "#/components/schemas/Cases_external_service"
},
"id": {
"type": "string",
"example": "66b9aa00-94fa-11ea-9f74-e7e108796192"
},
"incremental_id": {
"type": [
"null",
"integer"
],
"description": "A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.\n",
"example": 1
},
"observables": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_case_observable"
},
"description": "Observables attached to the case."
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"settings": {
"$ref": "#/components/schemas/Cases_settings"
},
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
},
"status": {
"$ref": "#/components/schemas/Cases_case_status"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"example": [
"tag-1"
]
},
"title": {
"type": "string",
"example": "Case title 1"
},
"total_observables": {
"type": [
"null",
"integer"
],
"description": "The number of observables attached to the case.",
"example": 0
},
"totalAlerts": {
"type": "integer",
"example": 0
},
"totalComment": {
"type": "integer",
"description": "The number of user comments on the case. Use the find case comments API to retrieve comment content.",
"example": 1
},
"totalEvents": {
"type": "integer",
"description": "The number of events attached to the case.",
"example": 0
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"updated_by": {
"$ref": "#/components/schemas/Cases_case_response_updated_by_properties"
},
"version": {
"type": "string",
"example": "WzUzMiwxXQ=="
}
},
"description": "Case details returned by the get case API. The comments property is not included in the response. Use the find case comments API to retrieve comments. totalComment reflects the actual number of user comments.\n"
},
"Cases_case_response_properties": {
"title": "Case response properties",
"required": [
"closed_at",
"closed_by",
"comments",
"connector",
"created_at",
"created_by",
"description",
"duration",
"external_service",
"id",
"observables",
"owner",
"settings",
"severity",
"status",
"tags",
"title",
"totalAlerts",
"totalComment",
"total_observables",
"updated_at",
"updated_by",
"version"
],
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
},
"category": {
"type": [
"null",
"string"
],
"description": "The case category."
},
"closed_at": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"closed_by": {
"$ref": "#/components/schemas/Cases_case_response_closed_by_properties"
},
"comments": {
"title": "Case response properties for comments",
"maxItems": 10000,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_alert_comment_response_properties"
},
{
"$ref": "#/components/schemas/Cases_event_comment_response_properties"
},
{
"$ref": "#/components/schemas/Cases_user_comment_response_properties"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"alert": "#/components/schemas/Cases_alert_comment_response_properties",
"event": "#/components/schemas/Cases_event_comment_response_properties",
"user": "#/components/schemas/Cases_user_comment_response_properties"
}
}
},
"description": "An array of comment objects for the case."
},
"connector": {
"title": "Case response properties for connectors",
"oneOf": [
{
"$ref": "#/components/schemas/Cases_connector_properties_none"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_cases_webhook"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_jira"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_resilient"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_swimlane"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
".cases-webhook": "#/components/schemas/Cases_connector_properties_cases_webhook",
".jira": "#/components/schemas/Cases_connector_properties_jira",
".none": "#/components/schemas/Cases_connector_properties_none",
".resilient": "#/components/schemas/Cases_connector_properties_resilient",
".servicenow": "#/components/schemas/Cases_connector_properties_servicenow",
".servicenow-sir": "#/components/schemas/Cases_connector_properties_servicenow_sir",
".swimlane": "#/components/schemas/Cases_connector_properties_swimlane"
}
}
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-05-13T09:16:17.416Z"
},
"created_by": {
"$ref": "#/components/schemas/Cases_case_response_created_by_properties"
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The custom field type. It must match the type specified in the case configuration settings.\n"
},
"value": {
"oneOf": [
{
"maxLength": 160,
"minLength": 1,
"type": [
"null",
"string"
]
},
{
"type": "boolean"
}
],
"description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
}
}
},
"description": "Custom field values for the case."
},
"description": {
"type": "string",
"example": "A case description."
},
"duration": {
"type": [
"null",
"integer"
],
"description": "The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.\n",
"example": 120
},
"extended_fields": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "The case's stored field values, keyed by storage key (for example `priority_as_keyword`).\n",
"x-state": "Technical preview; added in 9.5.0"
},
"external_service": {
"$ref": "#/components/schemas/Cases_external_service"
},
"id": {
"type": "string",
"example": "66b9aa00-94fa-11ea-9f74-e7e108796192"
},
"incremental_id": {
"type": [
"null",
"integer"
],
"description": "A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.\n",
"example": 1
},
"observables": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_case_observable"
},
"description": "Observables attached to the case."
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"settings": {
"$ref": "#/components/schemas/Cases_settings"
},
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
},
"status": {
"$ref": "#/components/schemas/Cases_case_status"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"example": [
"tag-1"
]
},
"title": {
"type": "string",
"example": "Case title 1"
},
"total_observables": {
"type": [
"null",
"integer"
],
"description": "The number of observables attached to the case.",
"example": 0
},
"totalAlerts": {
"type": "integer",
"example": 0
},
"totalComment": {
"type": "integer",
"example": 0
},
"totalEvents": {
"type": "integer",
"description": "The number of events attached to the case.",
"example": 0
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"updated_by": {
"$ref": "#/components/schemas/Cases_case_response_updated_by_properties"
},
"version": {
"type": "string",
"example": "WzUzMiwxXQ=="
}
}
},
"Cases_case_response_pushed_by_properties": {
"title": "Case response properties for pushed_by",
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"Cases_case_response_updated_by_properties": {
"title": "Case response properties for updated_by",
"required": [
"email",
"full_name",
"username"
],
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"Cases_case_severity": {
"enum": [
"critical",
"high",
"low",
"medium"
],
"type": "string",
"description": "The severity of the case."
},
"Cases_case_status": {
"enum": [
"closed",
"in-progress",
"open"
],
"type": "string",
"description": "The status of the case."
},
"Cases_case_tags": {
"maxItems": 200,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "The words and phrases that help categorize cases. It can be an empty array.\n"
},
"Cases_case_title": {
"maxLength": 160,
"type": "string",
"description": "A title for the case."
},
"Cases_closure_types": {
"enum": [
"close-by-pushing",
"close-by-user"
],
"type": "string",
"description": "Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).",
"example": "close-by-user"
},
"Cases_connector_properties_cases_webhook": {
"title": "Create or upate case request properties for Cases Webhook connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"string"
],
"example": "null"
},
"id": {
"type": "string",
"description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector."
},
"type": {
"enum": [
".cases-webhook"
],
"type": "string",
"description": "The type of connector.",
"example": ".cases-webhook"
}
},
"description": "Defines properties for connectors when type is `.cases-webhook`."
},
"Cases_connector_properties_jira": {
"title": "Create or update case request properties for a Jira connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"required": [
"issueType",
"parent",
"priority"
],
"type": "object",
"properties": {
"issueType": {
"type": [
"null",
"string"
],
"description": "The type of issue."
},
"parent": {
"type": [
"null",
"string"
],
"description": "The key of the parent issue, when the issue type is sub-task."
},
"priority": {
"type": [
"null",
"string"
],
"description": "The priority of the issue."
}
},
"description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value."
},
"id": {
"type": "string",
"description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector."
},
"type": {
"enum": [
".jira"
],
"type": "string",
"description": "The type of connector.",
"example": ".jira"
}
},
"description": "Defines properties for connectors when type is `.jira`."
},
"Cases_connector_properties_none": {
"title": "Create or update case request properties for no connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"string"
],
"description": "An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.",
"example": "null"
},
"id": {
"type": "string",
"description": "The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.",
"example": "none"
},
"type": {
"enum": [
".none"
],
"type": "string",
"description": "The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.",
"example": ".none"
}
},
"description": "Defines properties for connectors when type is `.none`."
},
"Cases_connector_properties_resilient": {
"title": "Create case request properties for a IBM Resilient connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"required": [
"issueTypes",
"severityCode"
],
"type": [
"null",
"object"
],
"properties": {
"issueTypes": {
"type": "array",
"items": {
"type": "string"
},
"description": "The type of incident."
},
"severityCode": {
"type": "string",
"description": "The severity code of the incident."
}
},
"description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value."
},
"id": {
"type": "string",
"description": "The identifier for the connector."
},
"name": {
"type": "string",
"description": "The name of the connector."
},
"type": {
"enum": [
".resilient"
],
"type": "string",
"description": "The type of connector.",
"example": ".resilient"
}
},
"description": "Defines properties for connectors when type is `.resilient`."
},
"Cases_connector_properties_servicenow": {
"title": "Create case request properties for a ServiceNow ITSM connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"required": [
"category",
"impact",
"severity",
"subcategory",
"urgency"
],
"type": "object",
"properties": {
"category": {
"type": [
"null",
"string"
],
"description": "The category of the incident."
},
"impact": {
"type": [
"null",
"string"
],
"description": "The effect an incident had on business."
},
"severity": {
"type": [
"null",
"string"
],
"description": "The severity of the incident."
},
"subcategory": {
"type": [
"null",
"string"
],
"description": "The subcategory of the incident."
},
"urgency": {
"type": [
"null",
"string"
],
"description": "The extent to which the incident resolution can be delayed."
}
},
"description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value."
},
"id": {
"type": "string",
"description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector."
},
"type": {
"enum": [
".servicenow"
],
"type": "string",
"description": "The type of connector.",
"example": ".servicenow"
}
},
"description": "Defines properties for connectors when type is `.servicenow`."
},
"Cases_connector_properties_servicenow_sir": {
"title": "Create case request properties for a ServiceNow SecOps connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"required": [
"category",
"destIp",
"malwareHash",
"malwareUrl",
"priority",
"sourceIp",
"subcategory"
],
"type": "object",
"properties": {
"category": {
"type": [
"null",
"string"
],
"description": "The category of the incident."
},
"destIp": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of destination IPs."
},
"malwareHash": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of malware hashes."
},
"malwareUrl": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of malware URLs."
},
"priority": {
"type": [
"null",
"string"
],
"description": "The priority of the issue."
},
"sourceIp": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of source IPs."
},
"subcategory": {
"type": [
"null",
"string"
],
"description": "The subcategory of the incident."
}
},
"description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value."
},
"id": {
"type": "string",
"description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector."
},
"type": {
"enum": [
".servicenow-sir"
],
"type": "string",
"description": "The type of connector.",
"example": ".servicenow-sir"
}
},
"description": "Defines properties for connectors when type is `.servicenow-sir`."
},
"Cases_connector_properties_swimlane": {
"title": "Create case request properties for a Swimlane connector",
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"required": [
"caseId"
],
"type": "object",
"properties": {
"caseId": {
"type": [
"null",
"string"
],
"description": "The case identifier for Swimlane connectors."
}
},
"description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value."
},
"id": {
"type": "string",
"description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector."
},
"type": {
"enum": [
".swimlane"
],
"type": "string",
"description": "The type of connector.",
"example": ".swimlane"
}
},
"description": "Defines properties for connectors when type is `.swimlane`."
},
"Cases_connector_types": {
"enum": [
".cases-webhook",
".jira",
".none",
".resilient",
".servicenow",
".servicenow-sir",
".swimlane"
],
"type": "string",
"description": "The type of connector.",
"example": ".none"
},
"Cases_create_case_request": {
"title": "Create case request",
"required": [
"connector",
"description",
"owner",
"settings",
"tags",
"title"
],
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
},
"category": {
"$ref": "#/components/schemas/Cases_case_category"
},
"connector": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_connector_properties_none"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_cases_webhook"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_jira"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_resilient"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_swimlane"
}
]
},
"customFields": {
"maxItems": 10,
"minItems": 0,
"type": "array",
"items": {
"required": [
"key",
"type",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The custom field type. It must match the type specified in the case configuration settings.\n"
},
"value": {
"oneOf": [
{
"maxLength": 160,
"minLength": 1,
"type": [
"null",
"string"
]
},
{
"type": "boolean"
}
],
"description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
}
}
},
"description": "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n"
},
"description": {
"$ref": "#/components/schemas/Cases_case_description"
},
"extended_fields": {
"$ref": "#/components/schemas/Cases_case_extended_fields"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"settings": {
"$ref": "#/components/schemas/Cases_settings"
},
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
},
"tags": {
"$ref": "#/components/schemas/Cases_case_tags"
},
"template": {
"required": [
"id"
],
"type": [
"null",
"object"
],
"properties": {
"id": {
"type": "string",
"description": "The template identifier. Retrieve template ids with `GET /api/cases/templates`."
},
"version": {
"minimum": 1,
"type": "integer",
"description": "The template version to apply. Omit to use (and pin) the latest version.\n"
}
},
"description": "A case template to create the case from. Requires the `xpack.cases.templates.enabled` setting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into `extended_fields`; any value explicitly provided in the request wins over the template default. When `version` is omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (`GET /api/cases/fields`).\n",
"x-state": "Technical preview"
},
"title": {
"$ref": "#/components/schemas/Cases_case_title"
}
},
"description": "The create case API request body varies depending on the type of connector."
},
"Cases_event_comment_response_properties": {
"title": "Case response properties for event comments",
"required": [
"type"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-05-13T09:16:17.416Z"
},
"created_by": {
"$ref": "#/components/schemas/Cases_case_response_created_by_properties"
},
"eventId": {
"type": "array",
"items": {
"type": "string",
"example": "7605e6a6f9f4f990ad9f8f6901e5f082f1f1f1665cbaf2f0f2c6f8f6b0d8a39f"
}
},
"id": {
"type": "string",
"example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6"
},
"index": {
"type": "array",
"items": {
"type": "string",
"example": ".internal.alerts-security.alerts-default-000001"
}
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"pushed_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "null"
},
"pushed_by": {
"$ref": "#/components/schemas/Cases_case_response_pushed_by_properties"
},
"type": {
"enum": [
"event"
],
"type": "string",
"example": "event"
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "null"
},
"updated_by": {
"$ref": "#/components/schemas/Cases_case_response_updated_by_properties"
},
"version": {
"type": "string",
"example": "WzIwNDMxLDFd"
}
}
},
"Cases_external_service": {
"type": [
"null",
"object"
],
"properties": {
"connector_id": {
"type": "string"
},
"connector_name": {
"type": "string"
},
"external_id": {
"type": "string"
},
"external_title": {
"type": "string"
},
"external_url": {
"type": "string"
},
"pushed_at": {
"type": "string",
"format": "date-time"
},
"pushed_by": {
"type": [
"null",
"object"
],
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
}
}
},
"Cases_field_definition_put_request": {
"title": "Field definition PUT request",
"required": [
"owner",
"definition"
],
"type": "object",
"properties": {
"definition": {
"maxLength": 1000000,
"type": "string",
"description": "The field definition as a YAML string describing a single field (type, label, control, metadata).",
"example": "name: priority\nlabel: Priority\ntype: keyword\ncontrol: SELECT_BASIC\nmetadata:\n options: [low, medium, high]\n default: medium\n"
},
"description": {
"maxLength": 1000,
"type": "string",
"description": "Optional human-readable description of the field's purpose."
},
"isGlobal": {
"type": "boolean",
"description": "When true, this field is rendered in every case for this owner, regardless of the template used. Global fields cannot be demoted (set to false) while they are linked to an active custom field in the Cases configuration.\n"
},
"name": {
"maxLength": 1000,
"minLength": 1,
"type": "string",
"description": "The field name, unique per owner (case-insensitive). Must match the `name` key inside the YAML definition. When omitted, the name is extracted from the definition YAML automatically. Immutable after creation. Unlike POST, the 50-character limit is not enforced on PUT so that definitions with legacy names that exceed the limit remain modifiable.\n"
},
"owner": {
"maxLength": 30,
"minLength": 1,
"type": "string",
"description": "The application that owns this field definition."
}
},
"additionalProperties": false,
"description": "The body for updating a field definition.\n\nIdentity constraints: the `name` property must match the `name` key in the YAML `definition`. When `name` is omitted, the server extracts it from the `definition` YAML automatically. A field's `name` and YAML `type` are immutable — an attempt to change either returns `409` with `attributes.code = \"field_identity_immutable\"` and `attributes.changed` listing which identity attributes were modified.\n\nUnlike the POST endpoint, PUT allows an unchanged `definition` to be submitted even if it exceeds 30 000 characters, so that field definitions created through internal tooling remain modifiable. When the submitted `definition` differs from the stored value, the 30 000-character limit is enforced. A hard upper bound of 1 000 000 characters always applies regardless of whether the definition is changed.\n"
},
"Cases_field_definition_response": {
"title": "Field definition response",
"required": [
"fieldDefinitionId",
"name",
"definition",
"owner"
],
"type": "object",
"properties": {
"definition": {
"type": "string",
"description": "The field definition as a YAML string. New definitions are limited to 30 000 characters, but existing definitions created via internal tooling may be longer.\n"
},
"description": {
"type": "string",
"description": "Optional human-readable description of the field's purpose."
},
"displayOrder": {
"minimum": 0,
"type": "integer",
"description": "Position of a global field in the case details view. Assigned by the server and changed via the Field Library reorder controls.\n"
},
"fieldDefinitionId": {
"maxLength": 36,
"type": "string",
"description": "Unique server-assigned identifier for the field definition (UUID). May be UUIDv4 for definitions created through the public API, or UUIDv5 for definitions created by internal migration processes.\n"
},
"isGlobal": {
"type": "boolean",
"description": "When true, this field is rendered in every case regardless of which template the case uses.\n"
},
"name": {
"type": "string",
"description": "The field name. Must match the `name` property in the YAML definition and is unique per owner (case-insensitive). Immutable after creation.\n"
},
"owner": {
"maxLength": 50,
"type": "string",
"description": "The application that owns this field definition."
}
},
"description": "A field definition from the field library. The `legacyKey` attribute, which is a server-managed link to a migrated custom field, is not included in the public API response.\n"
},
"Cases_field_definition_write_request": {
"title": "Field definition write request",
"required": [
"owner",
"definition"
],
"type": "object",
"properties": {
"definition": {
"maxLength": 30000,
"type": "string",
"description": "The field definition as a YAML string describing a single field (type, label, control, metadata).",
"example": "name: priority\nlabel: Priority\ntype: keyword\ncontrol: SELECT_BASIC\nmetadata:\n options: [low, medium, high]\n default: medium\n"
},
"description": {
"maxLength": 1000,
"type": "string",
"description": "Optional human-readable description of the field's purpose."
},
"isGlobal": {
"type": "boolean",
"description": "When true, this field is rendered in every case for this owner, regardless of the template used. Global fields cannot be demoted (set to false) while they are linked to an active custom field in the Cases configuration.\n"
},
"name": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The field name, unique per owner (case-insensitive). Must match the `name` key inside the YAML definition. When omitted, the name is extracted from the definition YAML automatically. Immutable after creation.\n"
},
"owner": {
"maxLength": 30,
"minLength": 1,
"type": "string",
"description": "The application that owns this field definition."
}
},
"additionalProperties": false,
"description": "The body for creating or updating a field definition.\n\nResource limits (enforced on write; a violation returns `400`): an owner may have at most 200 field definitions per space. The `definition` string may not exceed 30000 characters.\n\nIdentity constraints: the `name` property must match the `name` key in the YAML `definition`. When `name` is omitted, the server extracts it from the `definition` YAML automatically. Once created, a field's `name` and YAML `type` are immutable — they determine the key under which case values are stored. An attempt to change either returns `409` with `attributes.code = \"field_identity_immutable\"` and `attributes.changed` listing which identity attributes were modified.\n"
},
"Cases_find_comments_response": {
"title": "Find case comments response",
"required": [
"comments",
"page",
"per_page",
"total"
],
"type": "object",
"properties": {
"comments": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_user_comment_response_properties"
},
"description": "Paginated list of user comments for the case."
},
"page": {
"type": "integer",
"description": "The current page index."
},
"per_page": {
"type": "integer",
"description": "The number of items per page."
},
"total": {
"type": "integer",
"description": "The total number of comments."
}
}
},
"Cases_get_case_field_definitions_response": {
"title": "Get case field definitions response",
"required": [
"fieldDefinitions",
"page",
"perPage",
"total"
],
"type": "object",
"properties": {
"fieldDefinitions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_field_definition_response"
}
},
"page": {
"minimum": 1,
"type": "integer",
"description": "The current page number."
},
"perPage": {
"maximum": 100,
"minimum": 1,
"type": "integer",
"description": "The number of items per page."
},
"total": {
"minimum": 0,
"type": "integer",
"description": "The total number of field definitions matching the query (before pagination)."
}
},
"description": "A paginated list of reusable field definitions."
},
"Cases_get_case_templates_response": {
"required": [
"templates",
"page",
"perPage",
"total"
],
"type": "object",
"properties": {
"page": {
"type": "integer",
"description": "The page number of the returned results."
},
"perPage": {
"type": "integer",
"description": "The number of results per page."
},
"templates": {
"type": "array",
"items": {
"allOf": [
{
"$ref": "#/components/schemas/Cases_template_v2_response"
},
{
"required": [
"fieldSearchMatches"
],
"type": "object",
"properties": {
"fieldSearchMatches": {
"type": "boolean",
"description": "Whether the search query matched a field name in this template."
}
}
}
]
}
},
"total": {
"type": "integer",
"description": "The total number of templates matching the query."
}
},
"description": "Response returned by the get all case templates API."
},
"Cases_owner": {
"enum": [
"cases",
"observability",
"securitySolution"
],
"type": "string",
"description": "The application that owns the cases: Stack Management, Observability, or Elastic Security.\n",
"example": "cases"
},
"Cases_owners": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_owner"
}
},
"Cases_payload_alert_comment": {
"type": "object",
"properties": {
"comment": {
"type": "object",
"properties": {
"alertId": {
"oneOf": [
{
"type": "string",
"example": "1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"index": {
"oneOf": [
{
"type": "string",
"example": ".alerts-observability.logs.alerts-default"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"rule": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
],
"description": "The rule identifier.",
"example": "94d80550-aaf4-11ec-985f-97e55adae8b9"
},
"name": {
"type": [
"null",
"string"
],
"description": "The rule name.",
"example": "security_rule"
}
}
},
"type": {
"enum": [
"alert"
],
"type": "string"
}
}
}
}
},
"Cases_payload_assignees": {
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
}
}
},
"Cases_payload_connector": {
"type": "object",
"properties": {
"connector": {
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"properties": {
"caseId": {
"type": "string",
"description": "The case identifier for Swimlane connectors."
},
"category": {
"type": "string",
"description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors."
},
"destIp": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors."
},
"impact": {
"type": "string",
"description": "The effect an incident had on business for ServiceNow ITSM connectors."
},
"issueType": {
"type": "string",
"description": "The type of issue for Jira connectors."
},
"issueTypes": {
"type": "array",
"items": {
"type": "string"
},
"description": "The type of incident for IBM Resilient connectors."
},
"malwareHash": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors."
},
"malwareUrl": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors."
},
"parent": {
"type": "string",
"description": "The key of the parent issue, when the issue type is sub-task for Jira connectors."
},
"priority": {
"type": "string",
"description": "The priority of the issue for Jira and ServiceNow SecOps connectors."
},
"severity": {
"type": "string",
"description": "The severity of the incident for ServiceNow ITSM connectors."
},
"severityCode": {
"type": "string",
"description": "The severity code of the incident for IBM Resilient connectors."
},
"sourceIp": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors."
},
"subcategory": {
"type": "string",
"description": "The subcategory of the incident for ServiceNow ITSM connectors."
},
"urgency": {
"type": "string",
"description": "The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors."
}
},
"description": "An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.",
"example": "null"
},
"id": {
"type": "string",
"description": "The identifier for the connector. To create a case without a connector, use `none`.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. To create a case without a connector, use `none`.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
}
}
}
},
"Cases_payload_create_case": {
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
},
"connector": {
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"properties": {
"caseId": {
"type": "string",
"description": "The case identifier for Swimlane connectors."
},
"category": {
"type": "string",
"description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors."
},
"destIp": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors."
},
"impact": {
"type": "string",
"description": "The effect an incident had on business for ServiceNow ITSM connectors."
},
"issueType": {
"type": "string",
"description": "The type of issue for Jira connectors."
},
"issueTypes": {
"type": "array",
"items": {
"type": "string"
},
"description": "The type of incident for IBM Resilient connectors."
},
"malwareHash": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors."
},
"malwareUrl": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors."
},
"parent": {
"type": "string",
"description": "The key of the parent issue, when the issue type is sub-task for Jira connectors."
},
"priority": {
"type": "string",
"description": "The priority of the issue for Jira and ServiceNow SecOps connectors."
},
"severity": {
"type": "string",
"description": "The severity of the incident for ServiceNow ITSM connectors."
},
"severityCode": {
"type": "string",
"description": "The severity code of the incident for IBM Resilient connectors."
},
"sourceIp": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors."
},
"subcategory": {
"type": "string",
"description": "The subcategory of the incident for ServiceNow ITSM connectors."
},
"urgency": {
"type": "string",
"description": "The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors."
}
},
"description": "An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.",
"example": "null"
},
"id": {
"type": "string",
"description": "The identifier for the connector. To create a case without a connector, use `none`.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. To create a case without a connector, use `none`.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
}
},
"description": {
"type": "string"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"settings": {
"$ref": "#/components/schemas/Cases_settings"
},
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
},
"status": {
"$ref": "#/components/schemas/Cases_case_status"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"example": [
"tag-1"
]
},
"title": {
"type": "string"
}
}
},
"Cases_payload_delete": {
"type": [
"null",
"object"
],
"description": "If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable."
},
"Cases_payload_description": {
"type": "object",
"properties": {
"description": {
"type": "string"
}
}
},
"Cases_payload_pushed": {
"type": "object",
"properties": {
"externalService": {
"$ref": "#/components/schemas/Cases_external_service"
}
}
},
"Cases_payload_settings": {
"type": "object",
"properties": {
"settings": {
"$ref": "#/components/schemas/Cases_settings"
}
}
},
"Cases_payload_severity": {
"type": "object",
"properties": {
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
}
}
},
"Cases_payload_status": {
"type": "object",
"properties": {
"status": {
"$ref": "#/components/schemas/Cases_case_status"
}
}
},
"Cases_payload_tags": {
"type": "object",
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
},
"example": [
"tag-1"
]
}
}
},
"Cases_payload_title": {
"type": "object",
"properties": {
"title": {
"type": "string"
}
}
},
"Cases_payload_user_comment": {
"type": "object",
"properties": {
"comment": {
"type": "object",
"properties": {
"comment": {
"type": "string"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"type": {
"enum": [
"user"
],
"type": "string"
}
}
}
}
},
"Cases_payload_workflow": {
"required": [
"workflow"
],
"type": "object",
"properties": {
"origin": {
"oneOf": [
{
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The case ID."
},
"type": {
"enum": [
"cases.case"
],
"type": "string"
}
}
},
{
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The observable ID."
},
"type": {
"enum": [
"cases.observable"
],
"type": "string"
},
"typeKey": {
"type": "string",
"description": "The observable type key."
},
"value": {
"type": "string",
"description": "The observable value."
}
}
},
{
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"count": {
"type": "number",
"description": "The number of selected observables."
},
"id": {
"type": "string",
"description": "The case ID."
},
"type": {
"enum": [
"cases.observables"
],
"type": "string"
}
}
},
{
"required": [
"type",
"id",
"attachmentType"
],
"type": "object",
"properties": {
"attachmentType": {
"type": "string",
"description": "The normalized registered attachment type."
},
"id": {
"type": "string",
"description": "The attachment target ID."
},
"index": {
"type": "string",
"description": "The Elasticsearch index the target document lives in."
},
"type": {
"enum": [
"cases.attachment"
],
"type": "string"
}
}
},
{
"required": [
"type",
"id",
"attachmentType"
],
"type": "object",
"properties": {
"attachmentType": {
"type": "string",
"description": "The normalized registered attachment type."
},
"count": {
"type": "number",
"description": "The number of selected attachment targets."
},
"id": {
"type": "string",
"description": "The case ID."
},
"type": {
"enum": [
"cases.attachments"
],
"type": "string"
}
}
}
],
"description": "The context from which the workflow was triggered."
},
"workflow": {
"required": [
"id",
"name",
"executionId"
],
"type": "object",
"properties": {
"executionId": {
"type": "string",
"description": "The execution ID returned by the Workflows engine."
},
"id": {
"type": "string",
"description": "The workflow ID."
},
"name": {
"type": "string",
"description": "The workflow name at the time the run was triggered."
}
},
"description": "Identifies the workflow that was run."
}
},
"description": "The payload for a workflow user action, recorded when a user runs a workflow from a case."
},
"Cases_related_case": {
"title": "Related case",
"required": [
"id",
"title",
"description",
"status",
"createdAt",
"totals"
],
"type": "object",
"properties": {
"createdAt": {
"type": "string",
"description": "When the case was created.",
"format": "date-time"
},
"description": {
"type": "string",
"description": "The case description."
},
"id": {
"type": "string",
"description": "The case identifier."
},
"status": {
"$ref": "#/components/schemas/Cases_case_status"
},
"title": {
"type": "string",
"description": "The case title."
},
"totals": {
"$ref": "#/components/schemas/Cases_attachment_totals"
}
},
"description": "Summary of a case returned when listing cases that contain a given alert. This is a subset of the full case response.\n"
},
"Cases_response_4xx": {
"title": "Unsuccessful cases API response",
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Unauthorized"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer",
"example": 401
}
}
},
"Cases_rule": {
"title": "Alerting rule",
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The rule identifier.",
"example": "94d80550-aaf4-11ec-985f-97e55adae8b9"
},
"name": {
"type": "string",
"description": "The rule name.",
"example": "security_rule"
}
},
"description": "The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n",
"x-state": "Technical preview"
},
"Cases_searchFieldsType": {
"enum": [
"description",
"title"
],
"type": "string",
"description": "The fields to perform the `simple_query_string` parsed query against."
},
"Cases_searchFieldsTypeArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_searchFieldsType"
}
},
"Cases_set_case_configuration_request": {
"title": "Set case configuration request",
"required": [
"closure_type",
"connector",
"owner"
],
"type": "object",
"properties": {
"closure_type": {
"$ref": "#/components/schemas/Cases_closure_types"
},
"connector": {
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
},
"description": "An object that contains the connector configuration."
},
"customFields": {
"maxItems": 10,
"minItems": 0,
"type": "array",
"items": {
"required": [
"key",
"label",
"required",
"type"
],
"type": "object",
"properties": {
"defaultValue": {
"type": [
"boolean",
"string"
],
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
},
"key": {
"maxLength": 36,
"minLength": 1,
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
},
"label": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
}
}
},
"description": "Custom fields case configuration."
},
"extractObservables": {
"type": "boolean",
"description": "Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. When omitted, defaults to the owner's default: `true` for Security, `false` for Stack and Observability. For owners that do not support observable extraction (currently Observability), setting this to `true` has no effect on case creation; new cases for those owners always use `false`.\n"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"templates": {
"$ref": "#/components/schemas/Cases_templates"
},
"workflowTags": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
},
"description": "Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.\n"
}
},
"description": "External connection details, such as the closure type and default connector for cases."
},
"Cases_settings": {
"required": [
"syncAlerts"
],
"type": "object",
"properties": {
"extractObservables": {
"type": "boolean",
"description": "When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists: `true` for Security, `false` for Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves to `false` regardless of the space configuration.\n",
"example": true
},
"syncAlerts": {
"type": "boolean",
"description": "Turns alert syncing on or off.",
"example": true
}
},
"description": "An object that contains the case settings."
},
"Cases_string": {
"type": "string"
},
"Cases_string_array": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Cases_string"
}
},
"Cases_template_dry_run_response": {
"title": "Template write dry run response",
"required": [
"valid"
],
"type": "object",
"properties": {
"valid": {
"enum": [
true
],
"type": "boolean",
"description": "Always `true` — validation failures return a 4xx error instead."
}
},
"description": "Returned instead of the template when the request was sent with `dry_run=true`."
},
"Cases_template_tags": {
"maxItems": 200,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "The words and phrases that help categorize templates. It can be an empty array.\n"
},
"Cases_template_v2_response": {
"required": [
"templateId",
"name",
"owner",
"definition",
"definitionString",
"templateVersion",
"deletedAt",
"isLatest",
"latestVersion"
],
"type": "object",
"properties": {
"author": {
"maxLength": 1000,
"type": "string",
"description": "The username of the template author."
},
"definition": {
"description": "The parsed template definition."
},
"definitionString": {
"maxLength": 30000,
"type": "string",
"description": "The raw YAML definition string."
},
"deletedAt": {
"type": [
"null",
"string"
],
"description": "The date the template was soft-deleted, or null if active.",
"format": "date-time"
},
"description": {
"maxLength": 30000,
"type": "string",
"description": "A human-readable description of the template."
},
"fieldCount": {
"type": "integer",
"description": "The number of fields defined in the template."
},
"fieldDefinitions": {
"type": "array",
"items": {
"required": [
"name",
"label",
"type",
"control"
],
"type": "object",
"properties": {
"control": {
"maxLength": 50,
"type": "string"
},
"label": {
"maxLength": 256,
"type": "string"
},
"name": {
"maxLength": 256,
"type": "string"
},
"type": {
"maxLength": 50,
"type": "string"
}
}
},
"description": "Metadata about each field defined in the template."
},
"isDefault": {
"type": "boolean",
"description": "Whether this is the default template for its owner."
},
"isEnabled": {
"type": "boolean",
"description": "Whether the template is enabled."
},
"isLatest": {
"type": "boolean",
"description": "Whether this is the latest version of the template."
},
"lastUsedAt": {
"type": "string",
"description": "The date the template was last used to create a case.",
"format": "date-time"
},
"latestVersion": {
"type": "integer",
"description": "The latest version number of this template."
},
"name": {
"maxLength": 100,
"type": "string",
"description": "The display name of the template."
},
"owner": {
"maxLength": 50,
"type": "string",
"description": "The owning solution (e.g. cases, observability, securitySolution)."
},
"tags": {
"$ref": "#/components/schemas/Cases_template_tags"
},
"templateId": {
"maxLength": 36,
"type": "string",
"description": "The unique identifier of the template, shared across all versions."
},
"templateVersion": {
"type": "integer",
"description": "The version number of this template revision."
},
"usageCount": {
"type": "integer",
"description": "The number of times this template has been used to create a case."
}
},
"description": "A case template (v2)."
},
"Cases_template_write_request": {
"title": "Template write request",
"required": [
"owner",
"definition"
],
"type": "object",
"properties": {
"definition": {
"maxLength": 30000,
"type": "string",
"description": "The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a `fields` array of inline field definitions or `$ref` entries pointing into the owner's field library. Stored field values appear on cases under `extended_fields` keys shaped `_as_`.\n",
"example": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n - name: priority\n label: Priority\n type: keyword\n control: SELECT_BASIC\n metadata:\n options: [low, medium, high]\n default: medium\n - $ref: risk_score\n"
},
"description": {
"maxLength": 1000,
"type": "string",
"description": "A description of the template."
},
"isEnabled": {
"type": "boolean",
"description": "Disabled templates are hidden from the case creation flow.",
"default": true
},
"name": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (`name:`), which is then used as the identity name.\n"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"tags": {
"$ref": "#/components/schemas/Cases_template_tags"
}
},
"description": "The body for creating or fully replacing a case template. Server-managed attributes (author, usage statistics, field summaries, version flags) are computed and cannot be set.\n\nResource limits (enforced on write; a violation returns `400`): an owner may have at most 200 templates per space, and a definition may declare at most 200 fields. Version history is intentionally uncapped. A single stored extended-field value may not exceed 30000 UTF-8 bytes. The YAML `definition` string itself may not exceed 30000 characters (enforced on create, update, and `dry_run`).\n"
},
"Cases_templates": {
"type": "array",
"items": {
"type": "object",
"properties": {
"caseFields": {
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
},
"category": {
"$ref": "#/components/schemas/Cases_case_category"
},
"connector": {
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
}
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique key for the custom field."
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The type of the custom field."
},
"value": {
"type": [
"boolean",
"string"
],
"description": "The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
}
}
},
"description": "Custom field values in the template.",
"x-state": "Technical preview"
},
"description": {
"$ref": "#/components/schemas/Cases_case_description"
},
"settings": {
"$ref": "#/components/schemas/Cases_settings"
},
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
},
"tags": {
"$ref": "#/components/schemas/Cases_case_tags"
},
"title": {
"$ref": "#/components/schemas/Cases_case_title"
}
}
},
"description": {
"type": "string",
"description": "A description for the template."
},
"key": {
"type": "string",
"description": "A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.\n"
},
"name": {
"type": "string",
"description": "The name of the template."
},
"tags": {
"$ref": "#/components/schemas/Cases_template_tags"
}
}
},
"x-state": "Technical preview"
},
"Cases_update_alert_comment_request_properties": {
"title": "Update case comment request properties for alerts",
"required": [
"alertId",
"id",
"index",
"owner",
"rule",
"type",
"version"
],
"type": "object",
"properties": {
"alertId": {
"$ref": "#/components/schemas/Cases_alert_identifiers"
},
"id": {
"type": "string",
"description": "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n",
"example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6"
},
"index": {
"$ref": "#/components/schemas/Cases_alert_indices"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"rule": {
"$ref": "#/components/schemas/Cases_rule"
},
"type": {
"enum": [
"alert"
],
"type": "string",
"description": "The type of comment.",
"example": "alert"
},
"version": {
"type": "string",
"description": "The current comment version. To retrieve version values, use the get comments API.\n",
"example": "Wzk1LDFd"
}
},
"description": "Defines properties for case comment requests when type is alert."
},
"Cases_update_case_comment_request": {
"title": "Update case comment request",
"oneOf": [
{
"$ref": "#/components/schemas/Cases_update_alert_comment_request_properties"
},
{
"$ref": "#/components/schemas/Cases_update_user_comment_request_properties"
}
],
"description": "The update case comment API request body varies depending on whether you are updating an alert or a comment.",
"discriminator": {
"propertyName": "type",
"mapping": {
"alert": "#/components/schemas/Cases_update_alert_comment_request_properties",
"user": "#/components/schemas/Cases_update_user_comment_request_properties"
}
}
},
"Cases_update_case_configuration_request": {
"title": "Update case configuration request",
"required": [
"version"
],
"type": "object",
"properties": {
"closure_type": {
"$ref": "#/components/schemas/Cases_closure_types"
},
"connector": {
"required": [
"fields",
"id",
"name",
"type"
],
"type": "object",
"properties": {
"fields": {
"type": [
"null",
"object"
],
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.",
"example": "none"
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.",
"example": "none"
},
"type": {
"$ref": "#/components/schemas/Cases_connector_types"
}
},
"description": "An object that contains the connector configuration."
},
"customFields": {
"type": "array",
"items": {
"required": [
"key",
"label",
"required",
"type"
],
"type": "object",
"properties": {
"defaultValue": {
"type": [
"boolean",
"string"
],
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
},
"key": {
"maxLength": 36,
"minLength": 1,
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
},
"label": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
}
}
},
"description": "Custom fields case configuration."
},
"extractObservables": {
"type": "boolean",
"description": "Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.\n"
},
"templates": {
"$ref": "#/components/schemas/Cases_templates"
},
"version": {
"type": "string",
"description": "The version of the connector. To retrieve the version value, use the get configuration API.\n",
"example": "WzIwMiwxXQ=="
},
"workflowTags": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
},
"description": "Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.\n"
}
},
"description": "You can update settings such as the closure type, custom fields, templates, and the default connector for cases.\n"
},
"Cases_update_case_request": {
"title": "Update case request",
"required": [
"cases"
],
"type": "object",
"properties": {
"cases": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"id",
"version"
],
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Cases_assignees"
},
"category": {
"$ref": "#/components/schemas/Cases_case_category"
},
"closeReason": {
"$ref": "#/components/schemas/Cases_case_close_sync_reason"
},
"connector": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_connector_properties_none"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_cases_webhook"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_jira"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_resilient"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir"
},
{
"$ref": "#/components/schemas/Cases_connector_properties_swimlane"
}
]
},
"customFields": {
"maxItems": 10,
"minItems": 0,
"type": "array",
"items": {
"required": [
"key",
"type",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
},
"type": {
"enum": [
"text",
"toggle"
],
"type": "string",
"description": "The custom field type. It must match the type specified in the case configuration settings.\n"
},
"value": {
"oneOf": [
{
"maxLength": 160,
"minLength": 1,
"type": [
"null",
"string"
]
},
{
"type": "boolean"
}
],
"description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
}
}
},
"description": "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n"
},
"description": {
"$ref": "#/components/schemas/Cases_case_description"
},
"extended_fields": {
"$ref": "#/components/schemas/Cases_case_extended_fields"
},
"id": {
"maxLength": 30000,
"type": "string",
"description": "The identifier for the case."
},
"settings": {
"$ref": "#/components/schemas/Cases_settings"
},
"severity": {
"$ref": "#/components/schemas/Cases_case_severity"
},
"status": {
"$ref": "#/components/schemas/Cases_case_status"
},
"tags": {
"$ref": "#/components/schemas/Cases_case_tags"
},
"title": {
"$ref": "#/components/schemas/Cases_case_title"
},
"version": {
"type": "string",
"description": "The current version of the case. To determine this value, use the get case or search cases (`_find`) APIs.\n"
}
}
},
"description": "An array containing one or more case objects."
}
},
"description": "The update case API request body varies depending on the type of connector."
},
"Cases_update_user_comment_request_properties": {
"title": "Update case comment request properties for user comments",
"required": [
"comment",
"id",
"owner",
"type",
"version"
],
"type": "object",
"properties": {
"comment": {
"maxLength": 30000,
"type": "string",
"description": "The new comment. It is required only when `type` is `user`.",
"example": "A new comment."
},
"id": {
"type": "string",
"description": "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n",
"example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"type": {
"enum": [
"user"
],
"type": "string",
"description": "The type of comment.",
"example": "user"
},
"version": {
"type": "string",
"description": "The current comment version. To retrieve version values, use the get comments API.\n",
"example": "Wzk1LDFd"
}
},
"description": "Defines properties for case comment requests when type is user."
},
"Cases_user_actions_find_response_properties": {
"required": [
"action",
"comment_id",
"created_at",
"created_by",
"id",
"owner",
"payload",
"type",
"version"
],
"type": "object",
"properties": {
"action": {
"$ref": "#/components/schemas/Cases_actions"
},
"comment_id": {
"type": [
"null",
"string"
],
"example": "578608d0-03b1-11ed-920c-974bfa104448"
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-05-13T09:16:17.416Z"
},
"created_by": {
"required": [
"email",
"full_name",
"username"
],
"type": "object",
"properties": {
"email": {
"type": [
"null",
"string"
],
"example": "null"
},
"full_name": {
"type": [
"null",
"string"
],
"example": "null"
},
"profile_uid": {
"type": "string",
"example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
},
"username": {
"type": [
"null",
"string"
],
"example": "elastic"
}
}
},
"id": {
"type": "string",
"example": "22fd3e30-03b1-11ed-920c-974bfa104448"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"payload": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_payload_alert_comment"
},
{
"$ref": "#/components/schemas/Cases_payload_assignees"
},
{
"$ref": "#/components/schemas/Cases_payload_connector"
},
{
"$ref": "#/components/schemas/Cases_payload_create_case"
},
{
"$ref": "#/components/schemas/Cases_payload_delete"
},
{
"$ref": "#/components/schemas/Cases_payload_description"
},
{
"$ref": "#/components/schemas/Cases_payload_pushed"
},
{
"$ref": "#/components/schemas/Cases_payload_settings"
},
{
"$ref": "#/components/schemas/Cases_payload_severity"
},
{
"$ref": "#/components/schemas/Cases_payload_status"
},
{
"$ref": "#/components/schemas/Cases_payload_tags"
},
{
"$ref": "#/components/schemas/Cases_payload_title"
},
{
"$ref": "#/components/schemas/Cases_payload_user_comment"
},
{
"$ref": "#/components/schemas/Cases_payload_workflow"
}
]
},
"type": {
"enum": [
"assignees",
"category",
"comment",
"connector",
"create_case",
"customFields",
"delete_case",
"description",
"extended_fields",
"observables",
"pushed",
"settings",
"severity",
"status",
"tags",
"title",
"workflow"
],
"type": "string",
"description": "The type of action.",
"example": "create_case"
},
"version": {
"type": "string",
"example": "WzM1ODg4LDFd"
}
}
},
"Cases_user_comment_response_properties": {
"title": "Case response properties for user comments",
"required": [
"type"
],
"type": "object",
"properties": {
"comment": {
"type": "string",
"example": "A new comment."
},
"created_at": {
"type": "string",
"format": "date-time",
"example": "2022-05-13T09:16:17.416Z"
},
"created_by": {
"$ref": "#/components/schemas/Cases_case_response_created_by_properties"
},
"id": {
"type": "string",
"example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6"
},
"owner": {
"$ref": "#/components/schemas/Cases_owner"
},
"pushed_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "null"
},
"pushed_by": {
"$ref": "#/components/schemas/Cases_case_response_pushed_by_properties"
},
"type": {
"enum": [
"user"
],
"type": "string",
"example": "user"
},
"updated_at": {
"type": [
"null",
"string"
],
"format": "date-time",
"example": "null"
},
"updated_by": {
"$ref": "#/components/schemas/Cases_case_response_updated_by_properties"
},
"version": {
"type": "string",
"example": "WzIwNDMxLDFd"
}
}
},
"Data_views_400_response": {
"title": "Bad request",
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Bad Request"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "number",
"example": 400
}
}
},
"Data_views_404_response": {
"type": "object",
"properties": {
"error": {
"enum": [
"Not Found"
],
"type": "string",
"example": "Not Found"
},
"message": {
"type": "string",
"example": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found"
},
"statusCode": {
"enum": [
404
],
"type": "integer",
"example": 404
}
}
},
"Data_views_allownoindex": {
"type": "boolean",
"description": "Allows the data view saved object to exist before the data is available. Defaults to `false`."
},
"Data_views_create_data_view_request_object": {
"title": "Create data view request",
"required": [
"data_view"
],
"type": "object",
"properties": {
"data_view": {
"required": [
"title"
],
"type": "object",
"properties": {
"allowNoIndex": {
"$ref": "#/components/schemas/Data_views_allownoindex"
},
"fieldAttrs": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Data_views_fieldattrs"
}
},
"fieldFormats": {
"$ref": "#/components/schemas/Data_views_fieldformats"
},
"fields": {
"type": "object"
},
"id": {
"type": "string"
},
"name": {
"type": "string",
"description": "The data view name."
},
"namespaces": {
"$ref": "#/components/schemas/Data_views_namespaces"
},
"runtimeFieldMap": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Data_views_runtimefieldmap"
}
},
"sourceFilters": {
"$ref": "#/components/schemas/Data_views_sourcefilters"
},
"timeFieldName": {
"$ref": "#/components/schemas/Data_views_timefieldname"
},
"title": {
"$ref": "#/components/schemas/Data_views_title"
},
"type": {
"$ref": "#/components/schemas/Data_views_type"
},
"typeMeta": {
"$ref": "#/components/schemas/Data_views_typemeta"
},
"version": {
"type": "string"
}
},
"description": "The data view object."
},
"override": {
"type": "boolean",
"description": "Override an existing data view if a data view with the provided title already exists.",
"default": false
}
}
},
"Data_views_data_view_response_object": {
"title": "Data view response properties",
"type": "object",
"properties": {
"data_view": {
"type": "object",
"properties": {
"allowNoIndex": {
"$ref": "#/components/schemas/Data_views_allownoindex"
},
"fieldAttrs": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Data_views_fieldattrs"
}
},
"fieldFormats": {
"$ref": "#/components/schemas/Data_views_fieldformats"
},
"fields": {
"type": "object"
},
"id": {
"type": "string",
"example": "ff959d40-b880-11e8-a6d9-e546fe2bba5f"
},
"name": {
"type": "string",
"description": "The data view name."
},
"namespaces": {
"$ref": "#/components/schemas/Data_views_namespaces"
},
"runtimeFieldMap": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Data_views_runtimefieldmap"
}
},
"sourceFilters": {
"$ref": "#/components/schemas/Data_views_sourcefilters"
},
"timeFieldName": {
"$ref": "#/components/schemas/Data_views_timefieldname"
},
"title": {
"$ref": "#/components/schemas/Data_views_title"
},
"typeMeta": {
"$ref": "#/components/schemas/Data_views_typemeta_response"
},
"version": {
"type": "string",
"example": "WzQ2LDJd"
}
}
}
}
},
"Data_views_fieldattrs": {
"type": "object",
"properties": {
"count": {
"type": "integer",
"description": "Popularity count for the field."
},
"customDescription": {
"maxLength": 300,
"type": "string",
"description": "Custom description for the field."
},
"customLabel": {
"type": "string",
"description": "Custom label for the field."
}
},
"description": "A map of field attributes by field name."
},
"Data_views_fieldformats": {
"type": "object",
"description": "A map of field formats by field name."
},
"Data_views_namespaces": {
"type": "array",
"items": {
"type": "string",
"default": "default"
},
"description": "An array of space identifiers for sharing the data view between multiple spaces."
},
"Data_views_runtimefieldmap": {
"required": [
"script",
"type"
],
"type": "object",
"properties": {
"script": {
"type": "object",
"properties": {
"source": {
"type": "string",
"description": "Script for the runtime field."
}
}
},
"type": {
"type": "string",
"description": "Mapping type of the runtime field."
}
},
"description": "A map of runtime field definitions by field name."
},
"Data_views_sourcefilters": {
"type": "array",
"items": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"type": "string"
}
}
},
"description": "The array of field names you want to filter out in Discover."
},
"Data_views_swap_data_view_request_object": {
"title": "Data view reference swap request",
"required": [
"fromId",
"toId"
],
"type": "object",
"properties": {
"delete": {
"type": "boolean",
"description": "Deletes referenced saved object if all references are removed."
},
"forId": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Limit the affected saved objects to one or more by identifier."
},
"forType": {
"type": "string",
"description": "Limit the affected saved objects by type."
},
"fromId": {
"type": "string",
"description": "The saved object reference to change."
},
"fromType": {
"type": "string",
"description": "Specify the type of the saved object reference to alter. The default value is `index-pattern` for data views.\n"
},
"toId": {
"type": "string",
"description": "New saved object reference value to replace the old value."
}
}
},
"Data_views_timefieldname": {
"type": "string",
"description": "The timestamp field name, which you use for time-based data views."
},
"Data_views_title": {
"type": "string",
"description": "Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (`*`)."
},
"Data_views_type": {
"type": "string",
"description": "When set to `rollup`, identifies the rollup data views."
},
"Data_views_typemeta": {
"required": [
"aggs",
"params"
],
"type": "object",
"properties": {
"aggs": {
"type": "object",
"description": "A map of rollup restrictions by aggregation type and field name."
},
"params": {
"type": "object",
"description": "Properties for retrieving rollup fields."
}
},
"description": "When you use rollup indices, contains the field list for the rollup data view API endpoints."
},
"Data_views_typemeta_response": {
"type": [
"null",
"object"
],
"properties": {
"aggs": {
"type": "object",
"description": "A map of rollup restrictions by aggregation type and field name."
},
"params": {
"type": "object",
"description": "Properties for retrieving rollup fields."
}
},
"description": "When you use rollup indices, contains the field list for the rollup data view API endpoints."
},
"Data_views_update_data_view_request_object": {
"title": "Update data view request",
"required": [
"data_view"
],
"type": "object",
"properties": {
"data_view": {
"type": "object",
"properties": {
"allowNoIndex": {
"$ref": "#/components/schemas/Data_views_allownoindex"
},
"fieldFormats": {
"$ref": "#/components/schemas/Data_views_fieldformats"
},
"fields": {
"type": "object"
},
"name": {
"type": "string"
},
"runtimeFieldMap": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Data_views_runtimefieldmap"
}
},
"sourceFilters": {
"$ref": "#/components/schemas/Data_views_sourcefilters"
},
"timeFieldName": {
"$ref": "#/components/schemas/Data_views_timefieldname"
},
"title": {
"$ref": "#/components/schemas/Data_views_title"
},
"type": {
"$ref": "#/components/schemas/Data_views_type"
},
"typeMeta": {
"$ref": "#/components/schemas/Data_views_typemeta"
}
},
"description": "The data view properties you want to update. Only the specified properties are updated in the data view. Unspecified fields stay as they are persisted.\n"
},
"refresh_fields": {
"type": "boolean",
"description": "Reloads the data view fields after the data view is updated.",
"default": false
}
}
},
"Kibana_HTTP_APIs__zod_v4_54___schema0": {
"anyOf": [
{
"required": [
"objects"
],
"type": "object",
"properties": {
"objects": {
"required": [
"all"
],
"type": "object",
"properties": {
"all": {
"type": "object",
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"objects"
],
"type": "object",
"properties": {
"objects": {
"required": [
"mappings",
"routing"
],
"type": "object",
"properties": {
"mappings": {
"type": "boolean"
},
"routing": {
"maxItems": 200,
"type": "array",
"items": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs__zod_v4_54___schema0"
},
{
"required": [
"destination"
],
"type": "object",
"properties": {
"destination": {
"maxLength": 200,
"minLength": 1,
"type": "string"
}
}
}
]
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
]
},
"Kibana_HTTP_APIs_action_id_response": {
"title": "action_id_response",
"required": [
"actionId"
],
"type": "object",
"properties": {
"actionId": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_action_message_response": {
"title": "action_message_response",
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_agent_policy_response": {
"title": "agent_policy_response",
"required": [
"id",
"name",
"namespace",
"is_protected",
"status",
"updated_at",
"updated_by",
"revision"
],
"type": "object",
"properties": {
"advanced_settings": {
"type": "object",
"properties": {
"agent_download_target_directory": { },
"agent_download_timeout": { },
"agent_features_disable_policy_change_acks_enabled": { },
"agent_features_include_tags_in_events_enabled": { },
"agent_internal": { },
"agent_limits_go_max_procs": { },
"agent_logging_files_interval": { },
"agent_logging_files_keepfiles": { },
"agent_logging_files_rotateeverybytes": { },
"agent_logging_level": { },
"agent_logging_metrics_period": { },
"agent_logging_to_files": { },
"agent_monitoring_runtime_experimental": { }
},
"additionalProperties": false
},
"agent_features": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"agentless": {
"type": "object",
"properties": {
"cloud_connectors": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"target_csp": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string"
}
},
"additionalProperties": false
},
"cluster_id": {
"type": "string"
},
"resources": {
"type": "object",
"properties": {
"requests": {
"type": "object",
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"agents": {
"type": "number"
},
"agents_per_version": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"version",
"count"
],
"type": "object",
"properties": {
"count": {
"type": "number"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
}
},
"created_at": {
"type": "string"
},
"data_output_id": {
"type": [
"null",
"string"
]
},
"description": {
"type": "string"
},
"download_source_id": {
"type": [
"null",
"string"
],
"description": "Use `download_source_ids` instead",
"deprecated": true
},
"download_source_ids": {
"maxItems": 3,
"type": "array",
"items": {
"maxLength": 500,
"type": "string",
"description": "A download source ID, or the reserved value 'default' to dynamically reference whichever source is currently set as default."
}
},
"fips_agents": {
"type": "number"
},
"fleet_server_host_id": {
"type": [
"null",
"string"
]
},
"global_data_tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"value": {
"type": [
"number",
"string"
]
}
},
"additionalProperties": false
},
"description": "User defined data tags that are added to all of the inputs. The values can be strings or numbers."
},
"has_agent_version_conditions": {
"type": "boolean"
},
"has_fleet_server": {
"type": "boolean"
},
"id": {
"type": "string"
},
"inactivity_timeout": {
"minimum": 0,
"type": "number",
"default": 1209600
},
"is_default": {
"type": "boolean"
},
"is_default_fleet_server": {
"type": "boolean"
},
"is_managed": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"is_protected": {
"type": "boolean",
"description": "Indicates whether the agent policy has tamper protection enabled. Defaults to `false`."
},
"is_verifier": {
"type": "boolean"
},
"keep_monitoring_alive": {
"type": [
"null",
"boolean"
],
"description": "When set to true, monitoring will be enabled but logs/metrics collection will be disabled"
},
"min_agent_version": {
"type": [
"null",
"string"
]
},
"monitoring_diagnostics": {
"type": "object",
"properties": {
"limit": {
"type": "object",
"properties": {
"burst": {
"type": "number"
},
"interval": {
"type": "string"
}
},
"additionalProperties": false
},
"uploader": {
"type": "object",
"properties": {
"init_dur": {
"type": "string"
},
"max_dur": {
"type": "string"
},
"max_retries": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"monitoring_enabled": {
"maxItems": 3,
"type": "array",
"items": {
"enum": [
"logs",
"metrics",
"traces"
],
"type": "string"
}
},
"monitoring_http": {
"type": "object",
"properties": {
"buffer": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false
},
"enabled": {
"type": "boolean"
},
"host": {
"type": "string"
},
"port": {
"maximum": 65353,
"minimum": 0,
"type": "number"
}
},
"additionalProperties": false
},
"monitoring_output_id": {
"type": [
"null",
"string"
]
},
"monitoring_pprof_enabled": {
"type": "boolean"
},
"name": {
"minLength": 1,
"type": "string"
},
"namespace": {
"minLength": 1,
"type": "string"
},
"overrides": {
"type": [
"null",
"object"
],
"additionalProperties": { },
"description": "Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package_agent_version_conditions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"title",
"version_condition"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"title": {
"type": "string"
},
"version_condition": {
"type": "string"
}
},
"additionalProperties": false
}
},
"package_policies": {
"anyOf": [
{
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
}
},
{
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_response"
},
"description": "This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the `?full=true` parameter"
}
]
},
"required_versions": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"version",
"percentage"
],
"type": "object",
"properties": {
"percentage": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "Target percentage of agents to auto upgrade"
},
"version": {
"type": "string",
"description": "Target version for automatic agent upgrade"
}
},
"additionalProperties": false
}
},
"revision": {
"type": "number"
},
"schema_version": {
"type": "string"
},
"space_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"status": {
"enum": [
"active",
"inactive"
],
"type": "string"
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the agent policy supports agentless integrations."
},
"unenroll_timeout": {
"minimum": 0,
"type": "number"
},
"unprivileged_agents": {
"type": "number"
},
"updated_at": {
"type": "string"
},
"updated_by": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_aiops_change_point_chart": {
"required": [
"data_view_id",
"metric_field"
],
"type": "object",
"properties": {
"aggregation_function": {
"anyOf": [
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"sum"
],
"type": "string"
},
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
}
],
"description": "The aggregation function used to calculate the metric values.",
"default": "avg"
},
"data_view_id": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "The data view ID used to run change point detection."
},
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"max_series_to_plot": {
"maximum": 50,
"minimum": 1,
"type": "integer",
"description": "The maximum number of change points to visualize. Defaults to 6.",
"default": 6
},
"metric_field": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "The metric field used by the aggregation function."
},
"partitions": {
"maxItems": 10000,
"type": "array",
"items": {
"maxLength": 10000,
"minLength": 1,
"type": "string"
},
"description": "Optional split field values to include in the panel."
},
"split_field": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "The optional field used to split change point results."
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
},
"view_type": {
"anyOf": [
{
"enum": [
"charts"
],
"type": "string"
},
{
"enum": [
"table"
],
"type": "string"
}
],
"description": "The type of change point detection view to display.",
"default": "charts"
}
},
"additionalProperties": false,
"description": "Change point detection chart embeddable schema"
},
"Kibana_HTTP_APIs_aiops_log_rate_analysis": {
"required": [
"data_view_id"
],
"type": "object",
"properties": {
"data_view_id": {
"maxLength": 1000,
"minLength": 1,
"type": "string",
"description": "The data view ID used to run log rate analysis."
},
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Log rate analysis embeddable schema"
},
"Kibana_HTTP_APIs_aiops_pattern_analysis": {
"required": [
"data_view_id",
"field_name"
],
"type": "object",
"properties": {
"data_view_id": {
"maxLength": 1000,
"minLength": 1,
"type": "string",
"description": "The data view ID used for pattern analysis."
},
"description": {
"type": "string",
"description": "A short description of the panel."
},
"field_name": {
"maxLength": 1000,
"minLength": 1,
"type": "string",
"description": "The text field on which to run pattern analysis."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"minimum_time_range": {
"anyOf": [
{
"enum": [
"no_minimum"
],
"type": "string"
},
{
"enum": [
"1_week"
],
"type": "string"
},
{
"enum": [
"1_month"
],
"type": "string"
},
{
"enum": [
"3_months"
],
"type": "string"
},
{
"enum": [
"6_months"
],
"type": "string"
}
],
"description": "Minimum time range for pattern analysis.",
"default": "no_minimum"
},
"random_sampler_mode": {
"anyOf": [
{
"enum": [
"on_automatic"
],
"type": "string"
},
{
"enum": [
"on_manual"
],
"type": "string"
},
{
"enum": [
"off"
],
"type": "string"
}
],
"description": "The random sampler mode.",
"default": "on_automatic"
},
"random_sampler_probability": {
"maximum": 0.5,
"minimum": 1E-05,
"type": [
"null",
"number"
],
"description": "The probability to use for random sampling (between 0.00001 and 0.5).",
"default": "null"
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Log Pattern Analysis embeddable schema"
},
"Kibana_HTTP_APIs_alerting_action_policy_destination": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_workflow_action_policy_destination"
}
],
"description": "An action policy destination configuration.",
"discriminator": {
"propertyName": "type",
"mapping": {
"workflow": "#/components/schemas/Kibana_HTTP_APIs_alerting_workflow_action_policy_destination"
}
}
},
"Kibana_HTTP_APIs_alerting_action_policy_grouping": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_per_alert"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_all"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_per_field"
}
],
"discriminator": {
"propertyName": "mode",
"mapping": {
"all": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_all",
"per_alert": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_per_alert",
"per_field": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_per_field"
}
}
},
"Kibana_HTTP_APIs_alerting_action_policy_grouping_all": {
"required": [
"mode"
],
"type": "object",
"properties": {
"mode": {
"enum": [
"all"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "a single notification for all matching alerts."
},
"Kibana_HTTP_APIs_alerting_action_policy_grouping_per_alert": {
"required": [
"mode"
],
"type": "object",
"properties": {
"mode": {
"enum": [
"per_alert"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "one notification per alert lifecycle (default)."
},
"Kibana_HTTP_APIs_alerting_action_policy_grouping_per_field": {
"required": [
"mode",
"fields"
],
"type": "object",
"properties": {
"fields": {
"maxItems": 16,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The fields alerts are grouped by. At least one is required, and no other mode accepts them."
},
"mode": {
"enum": [
"per_field"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "group by the specified `fields`."
},
"Kibana_HTTP_APIs_alerting_action_policy_list_response": {
"required": [
"items",
"total",
"page",
"per_page"
],
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response"
},
"description": "The list of action policies."
},
"page": {
"type": "number",
"description": "The current page number."
},
"per_page": {
"type": "number",
"description": "The number of action policies per page."
},
"total": {
"type": "number",
"description": "The number of action policies matching the query. This count is an estimate: results above 10,000 may be reported as 10,000."
}
},
"additionalProperties": false,
"description": "Paginated list of action policies."
},
"Kibana_HTTP_APIs_alerting_action_policy_response": {
"required": [
"id",
"name",
"enabled",
"destinations",
"created_by",
"created_at",
"updated_by",
"updated_at"
],
"type": "object",
"properties": {
"created_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The ISO datetime when the action policy was created.",
"format": "date-time"
},
"created_by": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_actor"
}
],
"description": "The actor who created the action policy."
},
"description": {
"type": "string",
"description": "A description of the action policy. Omitted when the policy has none."
},
"destinations": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination"
},
"description": "The list of destinations."
},
"enabled": {
"type": "boolean",
"description": "Whether the action policy is enabled."
},
"grouping": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping"
},
"id": {
"type": "string",
"description": "The unique identifier for the action policy."
},
"matcher": {
"type": "object",
"properties": {
"expression": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "A KQL query that's evaluated against each alert. Supported fields are: `alert_id`, `alert_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule's query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won't work. Omit `matcher.expression` to match on `tags` alone."
},
"tags": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Routing tags this policy should match. The policy applies to alerts from any rule whose `metadata.routing_tags` include at least one of these tags. An empty array is not accepted. Omit `matcher.tags` to match on `matcher.expression` alone."
}
},
"additionalProperties": false,
"description": "Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those routing tags. Set `expression` to a KQL query, which will be evaluated against each alert.
If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. At least one of `tags` and `expression` must be set, so an empty `matcher` is rejected. Omit `matcher` entirely for a catch-all policy that applies to all alerts."
},
"name": {
"type": "string",
"description": "The name of the action policy."
},
"snoozed_until": {
"type": "string",
"description": "The ISO datetime until which the policy is snoozed. Omitted when the policy is not snoozed."
},
"throttle": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle"
},
"updated_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The ISO datetime when the action policy was last updated.",
"format": "date-time"
},
"updated_by": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_actor"
}
],
"description": "The actor who last updated the action policy."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_action_policy_throttle": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_on_status_change"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_per_status_interval"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_time_interval"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_every_time"
}
],
"discriminator": {
"propertyName": "strategy",
"mapping": {
"every_time": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_every_time",
"on_status_change": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_on_status_change",
"per_status_interval": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_per_status_interval",
"time_interval": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle_time_interval"
}
}
},
"Kibana_HTTP_APIs_alerting_action_policy_throttle_every_time": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"strategy": {
"enum": [
"every_time"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "notify on every evaluation cycle (high volume)."
},
"Kibana_HTTP_APIs_alerting_action_policy_throttle_on_status_change": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"strategy": {
"enum": [
"on_status_change"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "notify only on alert status transitions (default for `per_alert`)."
},
"Kibana_HTTP_APIs_alerting_action_policy_throttle_per_status_interval": {
"required": [
"strategy",
"interval"
],
"type": "object",
"properties": {
"interval": {
"maxLength": 32,
"type": "string",
"description": "The throttle interval duration (e.g. 5m, 1h) that sets the notification cadence."
},
"strategy": {
"enum": [
"per_status_interval"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "notify on transitions and at regular intervals."
},
"Kibana_HTTP_APIs_alerting_action_policy_throttle_time_interval": {
"required": [
"strategy",
"interval"
],
"type": "object",
"properties": {
"interval": {
"maxLength": 32,
"type": "string",
"description": "The throttle interval duration (e.g. 5m, 1h) that sets the notification cadence."
},
"strategy": {
"enum": [
"time_interval"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "notify at regular intervals regardless of status (default for `all`/`per_field`)."
},
"Kibana_HTTP_APIs_alerting_actor": {
"required": [
"profile_uid"
],
"type": "object",
"properties": {
"profile_uid": {
"type": [
"null",
"string"
],
"description": "User profile ID of the actor, or `null` when it cannot be resolved."
}
},
"additionalProperties": false,
"description": "Identity that performed the write."
},
"Kibana_HTTP_APIs_alerting_bulk_ack_alerts_item": {
"required": [
"alert_id"
],
"type": "object",
"properties": {
"alert_id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Identifier of the alert to apply the action to."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_ack_alerts_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_ack_alerts_item"
},
"description": "List of 1 to 100 ack actions to create, each for a different `alert_id`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_activate_alerts_item": {
"required": [
"reason",
"alert_id"
],
"type": "object",
"properties": {
"alert_id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Identifier of the alert to apply the action to."
},
"reason": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Reason for activating the alert."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_activate_alerts_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_activate_alerts_item"
},
"description": "List of 1 to 100 activate actions to create, each for a different `alert_id`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_assign_alerts_item": {
"required": [
"assignee_uid",
"alert_id"
],
"type": "object",
"properties": {
"alert_id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Identifier of the alert to apply the action to."
},
"assignee_uid": {
"maxLength": 150,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "User profile UID of the assignee, or null to remove the assignee from the alert."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_assign_alerts_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_assign_alerts_item"
},
"description": "List of 1 to 100 assign actions to create, each for a different `alert_id`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_by_ids_request": {
"required": [
"ids"
],
"type": "object",
"properties": {
"ids": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
},
"description": "Explicit list of IDs to operate on."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_by_query_request": {
"type": "object",
"properties": {
"filter": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use `match_all: true`."
},
"force": {
"type": "boolean",
"description": "When true, executes the operation. When false (default), returns a dry-run preview with `match_count` and a `sample` of matching resource IDs so the client can verify before committing.",
"default": false
},
"match_all": {
"enum": [
true
],
"type": "boolean",
"description": "When true, targets every resource. Requires an explicit opt-in. Omitted by default."
},
"search": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use `match_all: true`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_create_rule_item": {
"required": [
"kind",
"metadata",
"schedule",
"query"
],
"type": "object",
"properties": {
"artifacts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact"
},
"description": "Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present. An empty array is rejected: omit `artifacts` on create, or send `null` on PATCH to clear."
},
"enabled": {
"type": "boolean",
"description": "If `true` (default), the rule runs on its schedule after creation. If `false`, the rule is saved but does not run until you enable it.",
"default": true
},
"grouping": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping"
},
"id": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string",
"description": "Optional rule ID. If omitted, Kibana generates one. IDs in the request must be unique."
},
"kind": {
"anyOf": [
{
"enum": [
"alert"
],
"type": "string",
"description": "Creates an alert for each matching group and tracks it until it recovers. Use this when you want to detect a problem and notify or automate a response."
},
{
"enum": [
"signal"
],
"type": "string",
"description": "Stores each match as a rule event you can query. Alerts are not created and notifications are not sent."
}
],
"description": "Whether the rule creates alerts (`alert`) or only stores matching events (`signal`)."
},
"metadata": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata"
},
"no_data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query"
},
"recovery": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery"
},
"schedule": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule"
},
"state_transition": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition"
},
"time_field": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Document field Kibana uses with `schedule.lookback` to time-filter `query.base`.",
"default": "@timestamp"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_create_rules_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rule_item"
},
"description": "The rules to create. Must contain between 1 and 100 rules."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_create_rules_response": {
"required": [
"items",
"errors"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"required": [
"id",
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"code",
"message"
],
"type": "object",
"properties": {
"code": {
"type": "string",
"description": "Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`."
},
"details": {
"type": "object",
"additionalProperties": { },
"description": "Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists."
},
"message": {
"type": "string",
"description": "A readable explanation of the error. The wording can change without notice. Do not parse this field."
}
}
},
"id": {
"type": "string",
"description": "The identifier of the resource that failed."
}
}
},
"description": "Errors for rules that could not be created. Each entry includes the rule `id` and the error. Empty when every requested rule was created."
},
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"description": "Rules that were created. Rules listed in `errors` are not included."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_deactivate_alerts_item": {
"required": [
"reason",
"alert_id"
],
"type": "object",
"properties": {
"alert_id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Identifier of the alert to apply the action to."
},
"reason": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Reason for deactivating the alert."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_deactivate_alerts_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_deactivate_alerts_item"
},
"description": "List of 1 to 100 deactivate actions to create, each for a different `alert_id`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_dry_run_response": {
"required": [
"match_count",
"sample"
],
"type": "object",
"properties": {
"match_count": {
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer",
"description": "Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with `force: true` is rejected with `BULK_QUERY_MATCH_LIMIT_EXCEEDED`; narrow the query before executing."
},
"sample": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"description": "Sample of matching resource IDs (up to 100) for spot-checking before executing."
}
},
"additionalProperties": false,
"description": "Dry-run preview returned by a by-query bulk endpoint when `force` is false."
},
"Kibana_HTTP_APIs_alerting_bulk_get_rules_response": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"description": "The requested rules, in the same order as the requested ids."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_operation_response": {
"required": [
"affected_count",
"errors"
],
"type": "object",
"properties": {
"affected_count": {
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer",
"description": "Number of resources the operation successfully touched."
},
"errors": {
"type": "array",
"items": {
"required": [
"id",
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"code",
"message"
],
"type": "object",
"properties": {
"code": {
"type": "string",
"description": "Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`."
},
"details": {
"type": "object",
"additionalProperties": { },
"description": "Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists."
},
"message": {
"type": "string",
"description": "A readable explanation of the error. The wording can change without notice. Do not parse this field."
}
}
},
"id": {
"type": "string",
"description": "The identifier of the resource that failed."
}
}
},
"description": "Errors encountered during the operation."
}
},
"additionalProperties": false,
"description": "Result of an executed bulk operation."
},
"Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request": {
"required": [
"ids",
"snoozed_until"
],
"type": "object",
"properties": {
"ids": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 150,
"minLength": 1,
"pattern": "^[a-zA-Z0-9_-]+$",
"type": "string"
},
"description": "Explicit list of IDs to operate on."
},
"snoozed_until": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The ISO datetime until which the targeted action policies should be snoozed.",
"format": "date-time"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_tag_alerts_item": {
"required": [
"tags",
"alert_id"
],
"type": "object",
"properties": {
"alert_id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Identifier of the alert to apply the action to."
},
"tags": {
"maxItems": 20,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Replaces the alert's tags. Send `[]` to clear."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_tag_alerts_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_tag_alerts_item"
},
"description": "List of 1 to 100 tag actions to create, each for a different `alert_id`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_unack_alerts_item": {
"required": [
"alert_id"
],
"type": "object",
"properties": {
"alert_id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Identifier of the alert to apply the action to."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_bulk_unack_alerts_request": {
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unack_alerts_item"
},
"description": "List of 1 to 100 unack actions to create, each for a different `alert_id`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_error_response": {
"required": [
"code",
"error",
"message"
],
"type": "object",
"properties": {
"code": {
"type": "string",
"description": "Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`."
},
"details": {
"type": "object",
"additionalProperties": { },
"description": "Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists."
},
"error": {
"type": "string",
"description": "A short human-readable summary of the error category (e.g., \"Not Found\", \"Bad Request\"). Subject to change without notice. Do not parse or rely on its content."
},
"message": {
"type": "string",
"description": "A readable explanation of the error. The wording can change without notice. Do not parse this field."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_ack_alert_action": {
"type": "object",
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_action_policy": {
"required": [
"name",
"destinations"
],
"type": "object",
"properties": {
"description": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "A description of the action policy. Absent when the policy has none; send `null` on PATCH to clear it."
},
"destinations": {
"maxItems": 10,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination"
},
"description": "The list of destinations. At least one is required."
},
"grouping": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping"
},
"matcher": {
"type": "object",
"properties": {
"expression": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "A KQL query that's evaluated against each alert. Supported fields are: `alert_id`, `alert_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule's query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won't work. Omit `matcher.expression` to match on `tags` alone."
},
"tags": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Routing tags this policy should match. The policy applies to alerts from any rule whose `metadata.routing_tags` include at least one of these tags. An empty array is not accepted. Omit `matcher.tags` to match on `matcher.expression` alone."
}
},
"additionalProperties": false,
"description": "Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those routing tags. Set `expression` to a KQL query, which will be evaluated against each alert.
If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. At least one of `tags` and `expression` must be set, so an empty `matcher` is rejected. Omit `matcher` entirely for a catch-all policy that applies to all alerts."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The name of the action policy."
},
"throttle": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_activate_alert_action": {
"required": [
"reason"
],
"type": "object",
"properties": {
"reason": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Reason for activating the alert."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_assign_alert_action": {
"required": [
"assignee_uid"
],
"type": "object",
"properties": {
"assignee_uid": {
"maxLength": 150,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "User profile UID of the assignee, or null to remove the assignee from the alert."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_deactivate_alert_action": {
"required": [
"reason"
],
"type": "object",
"properties": {
"reason": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Reason for deactivating the alert."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_rule": {
"required": [
"kind",
"metadata",
"schedule",
"query"
],
"type": "object",
"properties": {
"artifacts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact"
},
"description": "Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present. An empty array is rejected: omit `artifacts` on create, or send `null` on PATCH to clear."
},
"grouping": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping"
},
"kind": {
"anyOf": [
{
"enum": [
"alert"
],
"type": "string",
"description": "Creates an alert for each matching group and tracks it until it recovers. Use this when you want to detect a problem and notify or automate a response."
},
{
"enum": [
"signal"
],
"type": "string",
"description": "Stores each match as a rule event you can query. Alerts are not created and notifications are not sent."
}
],
"description": "Whether the rule creates alerts (`alert`) or only stores matching events (`signal`)."
},
"metadata": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata"
},
"no_data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query"
},
"recovery": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery"
},
"schedule": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule"
},
"state_transition": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition"
},
"time_field": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Document field Kibana uses with `schedule.lookback` to time-filter `query.base`.",
"default": "@timestamp"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_tag_alert_action": {
"required": [
"tags"
],
"type": "object",
"properties": {
"tags": {
"maxItems": 20,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Replaces the alert's tags. Send `[]` to clear."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_new_unack_alert_action": {
"type": "object",
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_policy_execution_history_item": {
"required": [
"dispatched_at",
"policy",
"outcome",
"alert_count",
"alerts",
"action_group_count",
"rules",
"rule_count",
"workflows"
],
"type": "object",
"properties": {
"action_group_count": {
"type": "number"
},
"alert_count": {
"type": "number"
},
"alerts": {
"maxItems": 50,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
}
},
"description": "Alert IDs referenced by this event, bounded to 50. Empty when the event references no alerts. Use `alert_count` for the true total."
},
"dispatched_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
},
"error": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"stack_trace": {
"type": "string",
"description": "Omitted when the source recorded no trace."
}
},
"additionalProperties": false,
"description": "Failure details. Omitted when the dispatch did not fail."
},
"failure_reason": {
"enum": [
"missing_api_key",
"workflow_not_found",
"workflow_disabled",
"schedule_error",
"license_not_supported"
],
"type": "string"
},
"outcome": {
"enum": [
"success",
"throttled",
"failure"
],
"type": "string"
},
"policy": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string",
"description": "Omitted when the referenced resource could not be resolved."
}
},
"additionalProperties": false
},
"rule_count": {
"type": "number",
"description": "Number of rules referenced by this event after search or rule-filter narrowing. Unlike `total` on a list response, this is an exact count and it can exceed `rules.length` when the embedded array is truncated to the cap."
},
"rules": {
"maxItems": 20,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string",
"description": "Omitted when the referenced resource could not be resolved."
}
}
},
"description": "Rules referenced by this event, bounded to 20. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use `rule_count` for the full count."
},
"workflows": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string",
"description": "Omitted when the referenced resource could not be resolved."
}
}
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_policy_execution_history_response": {
"required": [
"items",
"page",
"per_page",
"total"
],
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_item"
}
},
"page": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"per_page": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"search_matches": {
"required": [
"policies",
"rules",
"is_truncated"
],
"type": "object",
"properties": {
"is_truncated": {
"type": "boolean",
"description": "True when the server filter cap was reached and results may be truncated."
},
"policies": {
"type": "number",
"description": "Policies matching the search. This count is an estimate: results above 10,000 may be reported as 10,000."
},
"rules": {
"type": "number",
"description": "Rules matching the search. This count is an estimate: results above 10,000 may be reported as 10,000."
}
},
"additionalProperties": false,
"description": "Per-type match counts for the active search. Omitted when no search was provided. When is_truncated is true the server ID filter was capped and the result may be truncated."
},
"total": {
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer",
"description": "The number of action policy events matching the query. This count is an estimate: results above 10,000 may be reported as 10,000."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_put_action_policy": {
"required": [
"name",
"destinations"
],
"type": "object",
"properties": {
"description": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "A description of the action policy. Absent when the policy has none; send `null` on PATCH to clear it."
},
"destinations": {
"maxItems": 10,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination"
},
"description": "The list of destinations. At least one is required."
},
"grouping": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping"
},
"matcher": {
"type": "object",
"properties": {
"expression": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "A KQL query that's evaluated against each alert. Supported fields are: `alert_id`, `alert_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule's query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won't work. Omit `matcher.expression` to match on `tags` alone."
},
"tags": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Routing tags this policy should match. The policy applies to alerts from any rule whose `metadata.routing_tags` include at least one of these tags. An empty array is not accepted. Omit `matcher.tags` to match on `matcher.expression` alone."
}
},
"additionalProperties": false,
"description": "Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those routing tags. Set `expression` to a KQL query, which will be evaluated against each alert.
If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. At least one of `tags` and `expression` must be set, so an empty `matcher` is rejected. Omit `matcher` entirely for a catch-all policy that applies to all alerts."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The name of the action policy."
},
"throttle": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_artifact": {
"required": [
"id",
"type",
"data"
],
"type": "object",
"properties": {
"data": {
"type": "object",
"additionalProperties": { },
"description": "Structured artifact data."
},
"id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "Artifact identifier."
},
"type": {
"maxLength": 128,
"minLength": 1,
"type": "string",
"description": "Artifact type."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_breach": {
"required": [
"segment"
],
"type": "object",
"properties": {
"segment": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "ES|QL clause appended to `query.base`, for example `WHERE avg_cpu > 0.85`. Don't include a `FROM` clause."
}
},
"additionalProperties": false,
"description": "Optional ES|QL clause appended to `query.base`. If omitted, every row from `query.base` is a match, and a `no_data` strategy other than `ignore` then requires `no_data.query`."
},
"Kibana_HTTP_APIs_alerting_rule_breach_patch": {
"type": "object",
"properties": {
"segment": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "ES|QL clause appended to `query.base`, for example `WHERE avg_cpu > 0.85`. Don't include a `FROM` clause."
}
},
"additionalProperties": false,
"description": "Optional ES|QL clause appended to `query.base`. If omitted, every row from `query.base` is a match, and a `no_data` strategy other than `ignore` then requires `no_data.query`."
},
"Kibana_HTTP_APIs_alerting_rule_execution": {
"required": [
"id",
"rule",
"space_id",
"started_at",
"ended_at",
"timings",
"outcome"
],
"type": "object",
"properties": {
"ended_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
},
"error": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"stack_trace": {
"type": "string",
"description": "Omitted when the source recorded no trace."
}
},
"additionalProperties": false,
"description": "Failure details. Omitted on a successful run, or when the failure was unclassified."
},
"id": {
"type": "string"
},
"outcome": {
"enum": [
"success",
"failure"
],
"type": "string"
},
"reason": {
"type": "string",
"description": "Why the run ended the way it did. Omitted when the source recorded no reason."
},
"rule": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"version": {
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"type": "integer",
"description": "The rule version this run executed. Omitted until the rule executor emits its own event; the `task-run` event does not carry one."
}
},
"additionalProperties": false
},
"space_id": {
"type": "string"
},
"started_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"format": "date-time"
},
"timings": {
"required": [
"duration_ms",
"scheduled_delay_ms"
],
"type": "object",
"properties": {
"duration_ms": {
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer",
"description": "Wall-clock duration of the run, in milliseconds."
},
"scheduled_delay_ms": {
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"type": "integer",
"description": "Delay between the scheduled run time and the actual start, in milliseconds. Negative when the run started ahead of its scheduled time."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_executions_response": {
"required": [
"items",
"total",
"page",
"per_page"
],
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_execution"
}
},
"page": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"per_page": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer"
},
"total": {
"maximum": 9007199254740991,
"minimum": 0,
"type": "integer",
"description": "The number of rule executions matching the query. This count is an estimate: results above 10,000 may be reported as 10,000."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_grouping": {
"required": [
"fields"
],
"type": "object",
"properties": {
"fields": {
"maxItems": 16,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "Fields to group alerts by, e.g. [\"host.name\", \"service.name\"]. Should match ES|QL GROUP BY fields."
}
},
"additionalProperties": false,
"description": "Grouping configuration."
},
"Kibana_HTTP_APIs_alerting_rule_grouping_patch": {
"type": "object",
"properties": {
"fields": {
"maxItems": 16,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "Fields to group alerts by, e.g. [\"host.name\", \"service.name\"]. Should match ES|QL GROUP BY fields."
}
},
"additionalProperties": false,
"description": "Grouping configuration."
},
"Kibana_HTTP_APIs_alerting_rule_list_response": {
"required": [
"items",
"total",
"page",
"per_page"
],
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response"
},
"description": "The list of rules."
},
"page": {
"type": "number",
"description": "The current page number."
},
"per_page": {
"type": "number",
"description": "The number of rules per page."
},
"total": {
"type": "number",
"description": "The number of rules matching the query. This count is an estimate: results above 10,000 may be reported as 10,000."
}
},
"additionalProperties": false,
"description": "Paginated list of rules."
},
"Kibana_HTTP_APIs_alerting_rule_metadata": {
"required": [
"name"
],
"type": "object",
"properties": {
"builder": {
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"maxLength": 64,
"minLength": 1,
"type": "string",
"description": "Rule builder type."
}
},
"additionalProperties": false,
"description": "Identifies the rule builder that authored this rule (e.g. \"threshold\"). Absent for rules authored directly in ES|QL; send `null` on PATCH to clear it."
},
"description": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "Human-readable description of the rule. Omit to leave it unset; send `null` on PATCH to clear it. An empty string is rejected."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Rule name (must be unique within the space)."
},
"routing_tags": {
"maxItems": 20,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Routing tags that link alerts from this rule to action policies. An action policy applies when its `matcher.tags` contains at least one of these tags. Only allowed when kind is \"alert\"."
},
"tags": {
"maxItems": 20,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Tags for categorization, e.g. [\"production\", \"infra\"]."
}
},
"additionalProperties": false,
"description": "Rule metadata."
},
"Kibana_HTTP_APIs_alerting_rule_metadata_patch": {
"type": "object",
"properties": {
"builder": {
"required": [
"type"
],
"type": [
"null",
"object"
],
"properties": {
"type": {
"maxLength": 64,
"minLength": 1,
"type": "string",
"description": "Rule builder type."
}
},
"additionalProperties": false,
"description": "Identifies the rule builder that authored this rule (e.g. \"threshold\"). Absent for rules authored directly in ES|QL; send `null` on PATCH to clear it."
},
"description": {
"maxLength": 1024,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "Human-readable description of the rule. Omit to leave it unset; send `null` on PATCH to clear it. An empty string is rejected."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Rule name (must be unique within the space)."
},
"routing_tags": {
"maxItems": 20,
"minItems": 1,
"type": [
"null",
"array"
],
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Routing tags that link alerts from this rule to action policies. An action policy applies when its `matcher.tags` contains at least one of these tags. Only allowed when kind is \"alert\"."
},
"tags": {
"maxItems": 20,
"minItems": 1,
"type": [
"null",
"array"
],
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Tags for categorization, e.g. [\"production\", \"infra\"]."
}
},
"additionalProperties": false,
"description": "Rule metadata."
},
"Kibana_HTTP_APIs_alerting_rule_no_data": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_ignore"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_keep_last"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_resolve"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_alert"
}
],
"description": "What the rule does when a group has no data. Required when `kind` is `alert`. Not allowed when `kind` is `signal`. Any strategy other than `ignore` requires either `query.breach` or `no_data.query`, so that a group with no data can be told apart from one that stopped breaching.",
"discriminator": {
"propertyName": "strategy",
"mapping": {
"alert": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_alert",
"ignore": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_ignore",
"keep_last": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_keep_last",
"resolve": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data_resolve"
}
}
},
"Kibana_HTTP_APIs_alerting_rule_no_data_alert": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"query": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "Optional ES|QL query that checks whether a group has data. If omitted, `query.base` is used, which then has to be a presence query in its own right — so `query.breach` is required."
},
"strategy": {
"enum": [
"alert"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Marks an existing alert `active` when the rule finds no data. It never opens an alert for a group that has not breached. Not accepted when creating or updating rules."
},
"Kibana_HTTP_APIs_alerting_rule_no_data_ignore": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"strategy": {
"enum": [
"ignore"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Does not check whether a group still has data. Missing groups do not produce `no_data` events."
},
"Kibana_HTTP_APIs_alerting_rule_no_data_keep_last": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"query": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "Optional ES|QL query that checks whether a group has data. If omitted, `query.base` is used, which then has to be a presence query in its own right — so `query.breach` is required."
},
"strategy": {
"enum": [
"keep_last"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Holds the alert's current status when the rule finds no data."
},
"Kibana_HTTP_APIs_alerting_rule_no_data_resolve": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"query": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "Optional ES|QL query that checks whether a group has data. If omitted, `query.base` is used, which then has to be a presence query in its own right — so `query.breach` is required."
},
"strategy": {
"enum": [
"resolve"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Closes the alert the first time the rule finds no data for a group."
},
"Kibana_HTTP_APIs_alerting_rule_query": {
"required": [
"base"
],
"type": "object",
"properties": {
"base": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "ES|QL query that specifies the data to evaluate. Must include a `FROM` clause. Kibana applies the time filter from `schedule.lookback` using `time_field`."
},
"breach": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_breach"
}
},
"additionalProperties": false,
"description": "ES|QL query the rule evaluates. `base` is required. `breach` is an optional clause appended to it."
},
"Kibana_HTTP_APIs_alerting_rule_query_patch": {
"type": "object",
"properties": {
"base": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "ES|QL query that specifies the data to evaluate. Must include a `FROM` clause. Kibana applies the time filter from `schedule.lookback` using `time_field`."
},
"breach": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_breach_patch"
}
],
"description": "Optional ES|QL clause appended to `query.base`. If omitted, every row from `query.base` is a match, and a `no_data` strategy other than `ignore` then requires `no_data.query`."
}
},
"additionalProperties": false,
"description": "ES|QL query the rule evaluates. `base` is required. `breach` is an optional clause appended to it."
},
"Kibana_HTTP_APIs_alerting_rule_recovery": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_no_breach"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_condition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_query"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_manual"
}
],
"description": "When an alert recovers. Required when `kind` is `alert`. Not allowed when `kind` is `signal`.",
"discriminator": {
"propertyName": "strategy",
"mapping": {
"condition": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_condition",
"manual": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_manual",
"no_breach": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_no_breach",
"query": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery_query"
}
}
},
"Kibana_HTTP_APIs_alerting_rule_recovery_condition": {
"required": [
"strategy",
"segment"
],
"type": "object",
"properties": {
"segment": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "ES|QL clause appended to `query.base`, for example `WHERE avg_cpu < 0.60`. Don't include a `FROM` clause."
},
"strategy": {
"enum": [
"condition"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Recovers the alert when `query.base` plus `segment` returns the group. Requires `query.breach`."
},
"Kibana_HTTP_APIs_alerting_rule_recovery_manual": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"strategy": {
"enum": [
"manual"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Does not recover automatically. Close the alert with a user action. `state_transition.recovering` has no effect."
},
"Kibana_HTTP_APIs_alerting_rule_recovery_no_breach": {
"required": [
"strategy"
],
"type": "object",
"properties": {
"strategy": {
"enum": [
"no_breach"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Recovers the alert when its group no longer appears in the breach results."
},
"Kibana_HTTP_APIs_alerting_rule_recovery_query": {
"required": [
"strategy",
"query"
],
"type": "object",
"properties": {
"query": {
"maxLength": 10000,
"minLength": 1,
"type": "string",
"description": "Independent ES|QL query, including its own `FROM` clause. A matching group recovers the alert."
},
"strategy": {
"enum": [
"query"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Recovers the alert when this separate query returns the group."
},
"Kibana_HTTP_APIs_alerting_rule_response": {
"required": [
"kind",
"metadata",
"schedule",
"query",
"id",
"version",
"enabled",
"created_by",
"created_at",
"updated_by",
"updated_at"
],
"type": "object",
"properties": {
"artifacts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact"
},
"description": "Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present. An empty array is rejected: omit `artifacts` on create, or send `null` on PATCH to clear."
},
"created_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "ISO timestamp when the rule was created.",
"format": "date-time"
},
"created_by": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_actor"
}
],
"description": "Actor who created the rule."
},
"enabled": {
"type": "boolean",
"description": "Whether the rule is enabled."
},
"grouping": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping"
},
"id": {
"type": "string",
"description": "Unique rule identifier."
},
"kind": {
"anyOf": [
{
"enum": [
"alert"
],
"type": "string",
"description": "Creates an alert for each matching group and tracks it until it recovers. Use this when you want to detect a problem and notify or automate a response."
},
{
"enum": [
"signal"
],
"type": "string",
"description": "Stores each match as a rule event you can query. Alerts are not created and notifications are not sent."
}
],
"description": "Whether the rule creates alerts (`alert`) or only stores matching events (`signal`)."
},
"metadata": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata"
},
"no_data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query"
},
"recovery": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery"
},
"schedule": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule"
},
"state_transition": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition"
},
"time_field": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Document field Kibana uses with `schedule.lookback` to time-filter `query.base`.",
"default": "@timestamp"
},
"updated_at": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "ISO timestamp when the rule was last updated.",
"format": "date-time"
},
"updated_by": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_actor"
}
],
"description": "Actor who last updated the rule."
},
"version": {
"maximum": 9007199254740991,
"minimum": 1,
"type": "integer",
"description": "Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as `rule.version`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_schedule": {
"required": [
"every"
],
"type": "object",
"properties": {
"every": {
"maxLength": 32,
"type": "string",
"description": "Execution interval, e.g. 1m, 5m, 1h."
},
"lookback": {
"maxLength": 32,
"type": "string",
"description": "Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL."
}
},
"additionalProperties": false,
"description": "Execution schedule configuration."
},
"Kibana_HTTP_APIs_alerting_rule_schedule_patch": {
"type": "object",
"properties": {
"every": {
"maxLength": 32,
"type": "string",
"description": "Execution interval, e.g. 1m, 5m, 1h."
},
"lookback": {
"maxLength": 32,
"type": [
"null",
"string"
],
"description": "Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL."
}
},
"additionalProperties": false,
"description": "Execution schedule configuration."
},
"Kibana_HTTP_APIs_alerting_rule_state_transition": {
"type": "object",
"properties": {
"pending": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition_pending"
},
"recovering": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition_recovering"
}
},
"additionalProperties": false,
"description": "Specifies how many consecutive matches, or how long a condition must hold, before an alert becomes `active` or `inactive`. Allowed only when `kind` is `alert`."
},
"Kibana_HTTP_APIs_alerting_rule_state_transition_patch": {
"type": "object",
"properties": {
"pending": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition_pending_patch"
}
],
"description": "Delay before a match opens an alert."
},
"recovering": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition_recovering_patch"
}
],
"description": "Delay before a recovered match closes the alert. Has no effect when `recovery.strategy` is `manual`."
}
},
"additionalProperties": false,
"description": "Specifies how many consecutive matches, or how long a condition must hold, before an alert becomes `active` or `inactive`. Allowed only when `kind` is `alert`."
},
"Kibana_HTTP_APIs_alerting_rule_state_transition_pending": {
"type": "object",
"properties": {
"count": {
"maximum": 1000,
"minimum": 0,
"type": "integer",
"description": "Consecutive matches the alert spends in `pending` before it becomes `active` on the next match. For example, `2` opens it on the third consecutive match. Set to `0` to open it on the first match."
},
"operator": {
"enum": [
"and",
"or"
],
"type": "string",
"description": "When both `count` and `timeframe` are set, `and` requires both and `or` requires either. Allowed only when both fields are present."
},
"timeframe": {
"maxLength": 32,
"type": "string",
"description": "Duration the condition must hold, for example `5m`. Combine with `count` using `operator`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_state_transition_pending_patch": {
"type": "object",
"properties": {
"count": {
"maximum": 1000,
"minimum": 0,
"type": [
"null",
"integer"
],
"description": "Consecutive matches the alert spends in `pending` before it becomes `active` on the next match. For example, `2` opens it on the third consecutive match. Set to `0` to open it on the first match."
},
"operator": {
"enum": [
"and",
"or"
],
"type": [
"null",
"string"
],
"description": "When both `count` and `timeframe` are set, `and` requires both and `or` requires either. Allowed only when both fields are present."
},
"timeframe": {
"maxLength": 32,
"type": [
"null",
"string"
],
"description": "Duration the condition must hold, for example `5m`. Combine with `count` using `operator`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_state_transition_recovering": {
"type": "object",
"properties": {
"count": {
"maximum": 1000,
"minimum": 0,
"type": "integer",
"description": "Consecutive recoveries the alert spends in `recovering` before it becomes `inactive` on the next recovery. For example, `2` closes it on the third consecutive recovery. Set to `0` to close it on the first recovery."
},
"operator": {
"enum": [
"and",
"or"
],
"type": "string",
"description": "When both `count` and `timeframe` are set, `and` requires both and `or` requires either. Allowed only when both fields are present."
},
"timeframe": {
"maxLength": 32,
"type": "string",
"description": "Duration the condition must hold, for example `5m`. Combine with `count` using `operator`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_rule_state_transition_recovering_patch": {
"type": "object",
"properties": {
"count": {
"maximum": 1000,
"minimum": 0,
"type": [
"null",
"integer"
],
"description": "Consecutive recoveries the alert spends in `recovering` before it becomes `inactive` on the next recovery. For example, `2` closes it on the third consecutive recovery. Set to `0` to close it on the first recovery."
},
"operator": {
"enum": [
"and",
"or"
],
"type": [
"null",
"string"
],
"description": "When both `count` and `timeframe` are set, `and` requires both and `or` requires either. Allowed only when both fields are present."
},
"timeframe": {
"maxLength": 32,
"type": [
"null",
"string"
],
"description": "Duration the condition must hold, for example `5m`. Combine with `count` using `operator`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_snooze_action_policy_request": {
"required": [
"snoozed_until"
],
"type": "object",
"properties": {
"snoozed_until": {
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"type": "string",
"description": "The ISO datetime until which the action policy should be snoozed.",
"format": "date-time"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_update_action_policy": {
"type": "object",
"properties": {
"description": {
"maxLength": 1024,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "A description of the action policy. Absent when the policy has none; send `null` on PATCH to clear it."
},
"destinations": {
"maxItems": 10,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination"
},
"description": "The list of destinations. At least one is required."
},
"grouping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping"
}
],
"description": "How matched alerts are batched into notifications. Absent falls back to `per_alert`; send `null` on PATCH to clear it. The mode decides the rest of the block, so a PATCH replaces it whole: send the complete mode variant rather than a single field."
},
"matcher": {
"type": [
"null",
"object"
],
"properties": {
"expression": {
"maxLength": 4096,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "A KQL query that's evaluated against each alert. Supported fields are: `alert_id`, `alert_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule's query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won't work. Omit `matcher.expression` to keep the stored expression, or set it to `null` to clear it and match on `tags` alone."
},
"tags": {
"maxItems": 50,
"minItems": 1,
"type": [
"null",
"array"
],
"items": {
"maxLength": 128,
"minLength": 1,
"type": "string"
},
"description": "Routing tags this policy should match. The policy applies to alerts from any rule whose `metadata.routing_tags` include at least one of these tags. An empty array is not accepted. Omit `matcher.tags` to keep the stored tags, or set it to `null` to clear them and match on `matcher.expression` alone."
}
},
"additionalProperties": false,
"description": "Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those routing tags. Set `expression` to a KQL query, which will be evaluated against each alert.
If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. Omit `matcher` to keep the stored matcher, or set it to `null` for a catch-all policy that applies to all alerts. An empty `matcher` names no leaf and so changes nothing; clearing the last of `tags` and `expression` clears the matcher itself, which is also a catch-all."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The name of the action policy."
},
"throttle": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle"
}
],
"description": "The throttle configuration for notifications. Absent when notifications are not throttled; send `null` on PATCH to clear it. The strategy decides the rest of the block, so a PATCH replaces it whole: send the complete strategy variant rather than a single field."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_update_rule": {
"type": "object",
"properties": {
"artifacts": {
"maxItems": 100,
"minItems": 1,
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact"
},
"description": "Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present. An empty array is rejected: omit `artifacts` on create, or send `null` on PATCH to clear."
},
"grouping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping_patch"
}
],
"description": "Grouping configuration."
},
"metadata": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata_patch"
},
"no_data": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_no_data"
}
],
"description": "What the rule does when a group has no data. Required when `kind` is `alert`. Not allowed when `kind` is `signal`. Any strategy other than `ignore` requires either `query.breach` or `no_data.query`, so that a group with no data can be told apart from one that stopped breaching."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query_patch"
},
"recovery": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_recovery"
}
],
"description": "When an alert recovers. Required when `kind` is `alert`. Not allowed when `kind` is `signal`."
},
"schedule": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule_patch"
},
"state_transition": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerting_rule_state_transition_patch"
}
],
"description": "Specifies how many consecutive matches, or how long a condition must hold, before an alert becomes `active` or `inactive`. Allowed only when `kind` is `alert`."
},
"time_field": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Document field Kibana uses with `schedule.lookback` to time-filter `query.base`."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerting_workflow_action_policy_destination": {
"required": [
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 150,
"minLength": 1,
"type": "string",
"description": "The workflow identifier."
},
"type": {
"enum": [
"workflow"
],
"type": "string",
"description": "The destination type."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_alerts_filter_query": {
"title": "alerts_filter_query",
"required": [
"kql",
"filters"
],
"type": "object",
"properties": {
"dsl": {
"type": "string",
"description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)."
},
"filters": {
"type": "array",
"items": {
"required": [
"meta"
],
"type": "object",
"properties": {
"$state": {
"required": [
"store"
],
"type": "object",
"properties": {
"store": {
"enum": [
"appState",
"globalState"
],
"type": "string",
"description": "A filter that can be applied to a specific application context or applied globally."
}
},
"additionalProperties": false
},
"meta": {
"type": "object",
"additionalProperties": {
"description": "An object with fields such as \"controlledBy\", \"disabled\", \"field\", \"group\", \"index\", \"isMultiIndex\", \"key\", \"negate\", \"params\", \"type\", \"value\""
}
},
"query": {
"type": "object",
"additionalProperties": {
"description": "A query for the filter."
}
}
},
"additionalProperties": false
},
"description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package."
},
"kql": {
"type": "string",
"description": "A filter written in Kibana Query Language (KQL)."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting": {
"title": "APM anomaly",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "APM Anomaly Rule Params",
"required": [
"windowSize",
"windowUnit",
"environment",
"anomalySeverityType"
],
"type": "object",
"properties": {
"anomalyDetectorTypes": {
"minItems": 1,
"type": "array",
"items": {
"enum": [
"txLatency",
"txThroughput",
"txFailureRate",
"txLowCount"
],
"type": "string"
},
"description": "The types of anomalies that are detected. For example, detect abnormal latency, throughput, failed transaction rates, or low transaction count."
},
"anomalySeverityType": {
"enum": [
"critical",
"major",
"minor",
"warning"
],
"type": "string",
"description": "The severity of anomalies that result in an alert: critical, major, minor, or warning."
},
"environment": {
"type": "string",
"description": "The environment from APM."
},
"serviceName": {
"type": "string",
"description": "The service name from APM."
},
"transactionType": {
"type": "string",
"description": "The transaction type from APM."
},
"windowSize": {
"type": "number",
"description": "The size of the time window (in `windowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"windowUnit": {
"type": "string",
"description": "The type of units for the time window: minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The parameters for the APM anomaly rule. These parameters are appropriate when `rule_type_id` is `apm.anomaly\"`."
},
"rule_type_id": {
"enum": [
"apm.anomaly"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting": {
"title": "Error rate",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Error Count Rule Params",
"required": [
"windowSize",
"windowUnit",
"threshold",
"environment"
],
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "Filter the errors coming from your application to apply the rule to a specific environment."
},
"errorGroupingKey": {
"type": "string",
"description": "Filter the errors coming from your application to apply the rule to a specific error grouping key, which is a hash of the stack trace and other properties."
},
"groupBy": {
"type": "array",
"items": {
"type": "string",
"description": "Perform a composite aggregation against the selected fields. When any of these groups match the selected rule conditions, an alert is triggered per group."
}
},
"searchConfiguration": {
"required": [
"query"
],
"type": "object",
"properties": {
"query": {
"required": [
"query",
"language"
],
"type": "object",
"properties": {
"language": {
"type": "string"
},
"query": {
"anyOf": [
{
"type": "string"
},
{
"type": "object",
"additionalProperties": { }
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"serviceName": {
"type": "string",
"description": "Filter the errors coming from your application to apply the rule to a specific service."
},
"threshold": {
"type": "number",
"description": "The number of errors, which is the threshold for alerts."
},
"useKqlFilter": {
"type": "boolean",
"description": "A filter in Kibana Query Language (KQL) that limits the scope of the rule."
},
"windowSize": {
"type": "number",
"description": "The time frame in which the errors must occur (in `windowUnit` units). Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"windowUnit": {
"type": "string",
"description": "The type of units for the time window: minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The parameters for the error count rule. These parameters are appropriate when `rule_type_id` is `apm.error_rate`."
},
"rule_type_id": {
"enum": [
"apm.error_rate"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_apm-service-map-embeddable": {
"type": "object",
"properties": {
"alert_status_filter": {
"maxItems": 4,
"type": "array",
"items": {
"enum": [
"active",
"recovered",
"untracked",
"delayed"
],
"type": "string"
}
},
"anomaly_severity_filter": {
"maxItems": 6,
"type": "array",
"items": {
"enum": [
"critical",
"major",
"minor",
"warning",
"low",
"unknown"
],
"type": "string"
}
},
"connection_filter": {
"maxItems": 2,
"type": "array",
"items": {
"enum": [
"orphaned",
"connected"
],
"type": "string"
}
},
"description": {
"type": "string",
"description": "A short description of the panel."
},
"environment": {
"maxLength": 1024,
"type": "string",
"default": "ENVIRONMENT_ALL"
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"highlighted_service_names": {
"maxItems": 50,
"type": "array",
"items": {
"maxLength": 1024,
"type": "string"
}
},
"kuery": {
"maxLength": 2048,
"type": "string"
},
"map_orientation": {
"enum": [
"horizontal",
"vertical"
],
"type": "string"
},
"service_group_id": {
"maxLength": 1024,
"type": "string"
},
"service_name": {
"maxLength": 1024,
"type": "string"
},
"slo_status_filter": {
"maxItems": 4,
"type": "array",
"items": {
"enum": [
"healthy",
"degrading",
"violated",
"noData"
],
"type": "string"
}
},
"sync_with_dashboard_filters": {
"type": "boolean"
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "APM service map embeddable schema"
},
"Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting": {
"title": "Transaction duration",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Transaction Duration Rule Params",
"required": [
"windowSize",
"windowUnit",
"threshold",
"aggregationType",
"environment"
],
"type": "object",
"properties": {
"aggregationType": {
"enum": [
"avg",
"95th",
"99th"
],
"type": "string",
"description": "The type of aggregation to perform."
},
"environment": {
"type": "string",
"description": "Filter the rule to apply to a specific environment."
},
"groupBy": {
"type": "array",
"items": {
"type": "string",
"description": "Perform a composite aggregation against the selected fields. When any of these groups match the selected rule conditions, an alert is triggered per group."
}
},
"searchConfiguration": {
"required": [
"query"
],
"type": "object",
"properties": {
"query": {
"required": [
"query",
"language"
],
"type": "object",
"properties": {
"language": {
"type": "string"
},
"query": {
"anyOf": [
{
"type": "string"
},
{
"type": "object",
"additionalProperties": { }
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"serviceName": {
"type": "string",
"description": "Filter the rule to apply to a specific service."
},
"threshold": {
"type": "number",
"description": "The latency threshold value."
},
"transactionName": {
"type": "string",
"description": "Filter the rule to apply to a specific transaction name."
},
"transactionType": {
"type": "string",
"description": "Filter the rule to apply to a specific transaction type."
},
"useKqlFilter": {
"type": "boolean",
"description": "A Kibana Query Language (KQL) expression thats limits the scope of alerts."
},
"windowSize": {
"type": "number",
"description": "The size of the time window (in `windowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"windowUnit": {
"type": "string",
"description": "The type of units for the time window. For example: minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The parameters for the transaction duration rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_duration`."
},
"rule_type_id": {
"enum": [
"apm.transaction_duration"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting": {
"title": "Transaction error rate",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Transaction Error Rate Rule Params",
"required": [
"windowSize",
"windowUnit",
"threshold",
"environment"
],
"type": "object",
"properties": {
"environment": {
"type": "string"
},
"groupBy": {
"type": "array",
"items": {
"type": "string"
}
},
"searchConfiguration": {
"required": [
"query"
],
"type": "object",
"properties": {
"query": {
"required": [
"query",
"language"
],
"type": "object",
"properties": {
"language": {
"type": "string"
},
"query": {
"anyOf": [
{
"type": "string"
},
{
"type": "object",
"additionalProperties": { }
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"serviceName": {
"type": "string"
},
"threshold": {
"type": "number"
},
"transactionName": {
"type": "string"
},
"transactionType": {
"type": "string"
},
"useKqlFilter": {
"type": "boolean"
},
"windowSize": {
"type": "number"
},
"windowUnit": {
"type": "string"
}
},
"additionalProperties": false,
"description": "The parameters for the transaction error rate rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_error_rate`."
},
"rule_type_id": {
"enum": [
"apm.transaction_error_rate"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_backfill_error_response": {
"title": "backfill_error_response",
"required": [
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"message",
"rule"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"rule": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"status": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_backfill_response": {
"title": "backfill_response",
"required": [
"id",
"created_at",
"duration",
"enabled",
"rule",
"space_id",
"initiator",
"start",
"status",
"schedule"
],
"type": "object",
"properties": {
"created_at": {
"type": "string"
},
"duration": {
"type": "string"
},
"enabled": {
"type": "boolean"
},
"end": {
"type": "string"
},
"id": {
"type": "string"
},
"initiator": {
"enum": [
"user",
"system"
],
"type": "string"
},
"initiator_id": {
"type": "string"
},
"rule": {
"required": [
"id",
"name",
"tags",
"rule_type_id",
"params",
"consumer",
"enabled",
"schedule",
"created_at",
"updated_at",
"revision"
],
"type": "object",
"properties": {
"api_key_created_by_user": {
"type": [
"null",
"boolean"
]
},
"api_key_owner": {
"type": [
"null",
"string"
],
"default": "null"
},
"consumer": {
"type": "string"
},
"created_at": {
"type": "string"
},
"created_by": {
"type": [
"null",
"string"
],
"default": "null"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the rule."
},
"revision": {
"type": "number"
},
"rule_type_id": {
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string"
}
},
"additionalProperties": false
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"updated_at": {
"type": "string"
},
"updated_by": {
"type": [
"null",
"string"
],
"default": "null"
}
},
"additionalProperties": false
},
"schedule": {
"type": "array",
"items": {
"required": [
"run_at",
"status",
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string"
},
"run_at": {
"type": "string"
},
"status": {
"enum": [
"complete",
"pending",
"running",
"error",
"timeout"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"space_id": {
"type": "string"
},
"start": {
"type": "string"
},
"status": {
"enum": [
"complete",
"pending",
"running",
"error",
"timeout"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_request": {
"title": "bulk_delete_enrollment_api_keys_request",
"type": "object",
"properties": {
"forceDelete": {
"type": "boolean",
"description": "When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.",
"default": false
},
"includeHidden": {
"type": "boolean",
"description": "When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.",
"default": false
},
"kuery": {
"type": "string",
"description": "KQL query to select enrollment tokens to delete."
},
"tokenIds": {
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
},
"description": "List of enrollment token IDs to delete."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_response": {
"title": "bulk_delete_enrollment_api_keys_response",
"required": [
"action",
"count",
"successCount",
"errorCount"
],
"type": "object",
"properties": {
"action": {
"type": "string"
},
"count": {
"type": "number"
},
"errorCount": {
"type": "number"
},
"successCount": {
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_get_agent_policies_response": {
"title": "bulk_get_agent_policies_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_agent_policy_response"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_get_package_policies_response": {
"title": "bulk_get_package_policies_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_response"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_install_packages_from_registry_request": {
"title": "bulk_install_packages_from_registry_request",
"required": [
"packages"
],
"type": "object",
"properties": {
"allow_outdated_version": {
"type": "boolean",
"description": "When true, allow installing a version older than the latest available. Bypasses only the out-of-date version check.",
"default": false
},
"force": {
"type": "boolean",
"default": false
},
"packages": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"type": "string"
},
{
"required": [
"name",
"version"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"prerelease": {
"type": "boolean"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
}
]
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_install_packages_from_registry_response": {
"title": "bulk_install_packages_from_registry_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_response_item_success"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_response_item_error"
}
]
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_install_packages_response_item_error": {
"title": "bulk_install_packages_response_item_error",
"required": [
"name",
"statusCode"
],
"type": "object",
"properties": {
"error": {
"anyOf": [
{
"type": "string"
},
{ }
]
},
"name": {
"type": "string"
},
"statusCode": {
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_install_packages_response_item_success": {
"title": "bulk_install_packages_response_item_success",
"required": [
"name",
"version",
"result"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"result": {
"required": [
"error",
"installType"
],
"type": "object",
"properties": {
"assets": {
"maxItems": 10000,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kibana_asset_reference"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_es_asset_reference"
}
]
}
},
"error": { },
"installSource": {
"type": "string"
},
"installType": {
"type": "string"
},
"status": {
"enum": [
"installed",
"already_installed"
],
"type": "string"
}
},
"additionalProperties": false
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_namespace_customization_request": {
"title": "bulk_namespace_customization_request",
"required": [
"packages"
],
"type": "object",
"properties": {
"disable": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"description": "Namespaces to disable namespace-level customization for on each package."
},
"enable": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"description": "Namespaces to enable namespace-level customization for on each package."
},
"packages": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Package names to apply the customization changes to."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_namespace_customization_response": {
"title": "bulk_namespace_customization_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"name",
"success"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"name": {
"type": "string"
},
"namespace_customization_enabled_for": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
},
"description": "The opt-in list on the package. Returned whenever the package is installed: the new list on success, or the unchanged list when the request is rejected (for example, because of a namespace-prefix restriction)."
},
"success": {
"type": "boolean"
},
"warnings": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"dataStreamName",
"namespace",
"baseTemplateName",
"nsTemplateName",
"conflictingTemplates"
],
"type": "object",
"properties": {
"baseTemplateName": {
"maxLength": 1000,
"type": "string"
},
"conflictingTemplates": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"priority",
"conflictType"
],
"type": "object",
"properties": {
"conflictType": {
"enum": [
"overrides_fleet",
"blocked_by_same_priority",
"overridden_by_fleet"
],
"type": "string"
},
"name": {
"maxLength": 1000,
"type": "string"
},
"priority": {
"type": "number"
}
},
"additionalProperties": false
}
},
"dataStreamName": {
"maxLength": 1000,
"type": "string"
},
"namespace": {
"maxLength": 255,
"type": "string"
},
"nsTemplateName": {
"maxLength": 1000,
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_rollback_packages_request": {
"title": "bulk_rollback_packages_request",
"required": [
"packages"
],
"type": "object",
"properties": {
"packages": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Package name to rollback"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_rollback_packages_response": {
"title": "bulk_rollback_packages_response",
"required": [
"taskId"
],
"type": "object",
"properties": {
"taskId": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_uninstall_packages_request": {
"title": "bulk_uninstall_packages_request",
"required": [
"packages"
],
"type": "object",
"properties": {
"force": {
"type": "boolean",
"default": false
},
"packages": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"required": [
"name",
"version"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result": {
"title": "bulk_upgrade_managed_integration_result",
"required": [
"id",
"success"
],
"type": "object",
"properties": {
"body": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"maxLength": 4096,
"type": "string",
"description": "Error message when the upgrade failed for this policy."
}
},
"additionalProperties": false
},
"id": {
"maxLength": 256,
"type": "string",
"description": "The ID of the managed integration."
},
"name": {
"maxLength": 256,
"type": "string",
"description": "The name of the managed integration."
},
"statusCode": {
"type": "number",
"description": "HTTP-like status code when the upgrade failed for this policy."
},
"success": {
"type": "boolean",
"description": "Whether the policy's saved object was upgraded successfully. The live workload is reconciled asynchronously in the background."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request": {
"title": "bulk_upgrade_managed_integrations_request",
"required": [
"policyIds"
],
"type": "object",
"properties": {
"policyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "IDs of the managed integrations to upgrade to their installed package version."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_upgrade_packages_request": {
"title": "bulk_upgrade_packages_request",
"required": [
"packages"
],
"type": "object",
"properties": {
"force": {
"type": "boolean",
"default": false
},
"packages": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
}
},
"prerelease": {
"type": "boolean"
},
"upgrade_package_policies": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_bulk_upgrade_packages_response": {
"title": "bulk_upgrade_packages_response",
"required": [
"taskId"
],
"type": "object",
"properties": {
"taskId": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_category_summary_item": {
"title": "category_summary_item",
"required": [
"id",
"title",
"count"
],
"type": "object",
"properties": {
"count": {
"type": "number"
},
"id": {
"type": "string"
},
"parent_id": {
"type": "string"
},
"parent_title": {
"type": "string"
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_ClassicFieldDefinition": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinitionConfig"
}
},
"Kibana_HTTP_APIs_ClassicFieldDefinitionConfig": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord"
},
{
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"format": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"type": {
"enum": [
"keyword",
"match_only_text",
"long",
"double",
"date",
"boolean",
"ip",
"geo_point",
"integer",
"short",
"byte",
"float",
"half_float",
"text",
"wildcard",
"version",
"unsigned_long",
"date_nanos"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"type": {
"enum": [
"system"
],
"type": "string"
}
},
"additionalProperties": false
}
]
}
]
},
"Kibana_HTTP_APIs_ClassicStreamUpsertRequest": {
"required": [
"dashboards",
"rules",
"stream"
],
"type": "object",
"properties": {
"dashboards": {
"type": "array",
"items": {
"type": "string"
}
},
"rules": {
"type": "array",
"items": {
"type": "string"
}
},
"stream": {
"required": [
"description",
"ingest",
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"ingest": {
"required": [
"lifecycle",
"processing",
"settings",
"failure_store",
"classic"
],
"type": "object",
"properties": {
"classic": {
"type": "object",
"properties": {
"field_overrides": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinition"
}
},
"additionalProperties": false
},
"failure_store": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_FailureStore"
},
"lifecycle": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle"
},
"processing": {
"anyOf": [
{
"required": [
"steps"
],
"type": "object",
"properties": {
"steps": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_StreamlangStep"
}
}
},
"additionalProperties": false
},
{
"required": [
"processors"
],
"type": "object",
"properties": {
"processors": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
}
},
"additionalProperties": false
}
]
},
"settings": {
"type": "object",
"properties": {
"index.number_of_replicas": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"index.number_of_shards": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"index.refresh_interval": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"anyOf": [
{
"type": "string"
},
{
"enum": [
-1
],
"type": "number"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"query_streams": {
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
},
"type": {
"enum": [
"classic"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_Condition": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_FilterCondition"
},
{
"required": [
"and"
],
"type": "object",
"properties": {
"and": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
},
"description": "An array of conditions. All sub-conditions must be true for this condition to be true."
}
},
"additionalProperties": false,
"description": "A logical AND that groups multiple conditions."
},
{
"required": [
"or"
],
"type": "object",
"properties": {
"or": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
},
"description": "An array of conditions. At least one sub-condition must be true for this condition to be true."
}
},
"additionalProperties": false,
"description": "A logical OR that groups multiple conditions."
},
{
"required": [
"not"
],
"type": "object",
"properties": {
"not": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "A logical NOT that negates a condition."
},
{
"required": [
"never"
],
"type": "object",
"properties": {
"never": {
"type": "object",
"additionalProperties": false,
"description": "An empty object. This condition never matches."
}
},
"additionalProperties": false,
"description": "A condition that always evaluates to false."
},
{
"required": [
"always"
],
"type": "object",
"properties": {
"always": {
"type": "object",
"additionalProperties": false,
"description": "An empty object. This condition always matches."
}
},
"additionalProperties": false,
"description": "A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered."
}
],
"description": "The root condition object. It can be a simple filter or a combination of other conditions."
},
"Kibana_HTTP_APIs_ConditionWithSteps": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
},
{
"required": [
"steps"
],
"type": "object",
"properties": {
"else": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_StreamlangStep"
}
},
"steps": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_StreamlangStep"
}
}
},
"additionalProperties": false
}
]
},
"Kibana_HTTP_APIs_connector_execute_request": {
"title": "connector_execute_request",
"required": [
"params"
],
"type": "object",
"properties": {
"params": {
"oneOf": [
{
"$ref": "#/components/schemas/run_acknowledge_resolve_pagerduty"
},
{
"$ref": "#/components/schemas/run_documents"
},
{
"$ref": "#/components/schemas/run_message_email"
},
{
"$ref": "#/components/schemas/run_message_serverlog"
},
{
"$ref": "#/components/schemas/run_message_slack"
},
{
"$ref": "#/components/schemas/run_trigger_pagerduty"
},
{
"$ref": "#/components/schemas/run_addevent"
},
{
"$ref": "#/components/schemas/run_closealert"
},
{
"$ref": "#/components/schemas/run_closeincident"
},
{
"$ref": "#/components/schemas/run_createalert"
},
{
"$ref": "#/components/schemas/run_fieldsbyissuetype"
},
{
"$ref": "#/components/schemas/run_getagentdetails"
},
{
"$ref": "#/components/schemas/run_getagents"
},
{
"$ref": "#/components/schemas/run_getchoices"
},
{
"$ref": "#/components/schemas/run_getfields"
},
{
"$ref": "#/components/schemas/run_getincident"
},
{
"$ref": "#/components/schemas/run_issue"
},
{
"$ref": "#/components/schemas/run_issues"
},
{
"$ref": "#/components/schemas/run_issuetypes"
},
{
"$ref": "#/components/schemas/run_postmessage"
},
{
"$ref": "#/components/schemas/run_pushtoservice"
},
{
"$ref": "#/components/schemas/run_validchannelid"
}
],
"additionalProperties": { }
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_connector_response": {
"title": "connector_response",
"required": [
"id",
"name",
"connector_type_id",
"is_preconfigured",
"is_deprecated",
"is_system_action",
"is_connector_type_deprecated"
],
"type": "object",
"properties": {
"auth_mode": {
"enum": [
"shared",
"per-user"
],
"type": "string",
"description": "The authentication mode used for the connector."
},
"config": {
"type": "object",
"additionalProperties": { }
},
"connector_type_id": {
"type": "string",
"description": "The connector type identifier."
},
"id": {
"type": "string",
"description": "The identifier for the connector."
},
"is_connector_type_deprecated": {
"type": "boolean",
"description": "Indicates whether the connector type is deprecated."
},
"is_deprecated": {
"type": "boolean",
"description": "Indicates whether the connector is deprecated."
},
"is_missing_secrets": {
"type": "boolean",
"description": "Indicates whether the connector is missing secrets."
},
"is_preconfigured": {
"type": "boolean",
"description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. "
},
"is_system_action": {
"type": "boolean",
"description": "Indicates whether the connector is used for system actions."
},
"name": {
"type": "string",
"description": " The name of the connector."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_connector_response_with_references_count": {
"title": "connector_response_with_references_count",
"required": [
"id",
"name",
"connector_type_id",
"is_preconfigured",
"is_deprecated",
"is_system_action",
"is_connector_type_deprecated",
"referenced_by_count"
],
"type": "object",
"properties": {
"auth_mode": {
"enum": [
"shared",
"per-user"
],
"type": "string",
"description": "The authentication mode used for the connector."
},
"config": {
"type": "object",
"additionalProperties": { }
},
"connector_type_id": {
"type": "string",
"description": "The connector type identifier."
},
"id": {
"type": "string",
"description": "The identifier for the connector."
},
"is_connector_type_deprecated": {
"type": "boolean",
"description": "Indicates whether the connector type is deprecated."
},
"is_deprecated": {
"type": "boolean",
"description": "Indicates whether the connector is deprecated."
},
"is_missing_secrets": {
"type": "boolean",
"description": "Indicates whether the connector is missing secrets."
},
"is_preconfigured": {
"type": "boolean",
"description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. "
},
"is_system_action": {
"type": "boolean",
"description": "Indicates whether the connector is used for system actions."
},
"name": {
"type": "string",
"description": " The name of the connector."
},
"referenced_by_count": {
"type": "number",
"description": "The number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_connector_type_response": {
"title": "connector_type_response",
"required": [
"id",
"name",
"enabled",
"enabled_in_config",
"enabled_in_license",
"minimum_license_required",
"supported_feature_ids",
"is_system_action_type",
"is_deprecated",
"source",
"is_testable"
],
"type": "object",
"properties": {
"allow_multiple_system_actions": {
"type": "boolean",
"description": "Indicates whether multiple instances of the same system action connector can be used in a single rule."
},
"description": {
"type": "string",
"description": "Description of the connector type."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether the connector is enabled."
},
"enabled_in_config": {
"type": "boolean",
"description": "Indicates whether the connector is enabled in the Kibana configuration."
},
"enabled_in_license": {
"type": "boolean",
"description": "Indicates whether the connector is enabled through the license."
},
"id": {
"type": "string",
"description": "The identifier for the connector."
},
"is_deprecated": {
"type": "boolean",
"description": "Indicates whether the connector type is deprecated."
},
"is_experimental": {
"type": "boolean",
"description": "Indicates whether the connector type is in technical preview."
},
"is_system_action_type": {
"type": "boolean",
"description": "Indicates whether the action is a system action."
},
"is_testable": {
"type": "boolean",
"description": "Indicates whether the connector type supports testing."
},
"minimum_license_required": {
"enum": [
"basic",
"standard",
"gold",
"platinum",
"enterprise",
"trial"
],
"type": "string",
"description": "The minimum license required to enable the connector."
},
"name": {
"type": "string",
"description": "The name of the connector type."
},
"source": {
"enum": [
"yml",
"spec",
"stack"
],
"type": "string",
"description": "The source of the connector type definition."
},
"sub_feature": {
"enum": [
"endpointSecurity"
],
"type": "string",
"description": "Indicates the sub-feature type the connector is grouped under."
},
"supported_feature_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of supported features"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_copy_agent_policy_request": {
"title": "copy_agent_policy_request",
"required": [
"name"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"name": {
"minLength": 1,
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_core_status_redactedResponse": {
"title": "core_status_redactedResponse",
"required": [
"status"
],
"type": "object",
"properties": {
"status": {
"required": [
"overall"
],
"type": "object",
"properties": {
"overall": {
"required": [
"level"
],
"type": "object",
"properties": {
"level": {
"enum": [
"available",
"degraded",
"unavailable",
"critical"
],
"type": "string",
"description": "Service status levels as human and machine readable values."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "A minimal representation of Kibana's operational status. Returned when the caller is unauthenticated or lacks the `monitor` cluster privilege."
},
"Kibana_HTTP_APIs_core_status_response": {
"title": "core_status_response",
"required": [
"name",
"uuid",
"version",
"status",
"metrics"
],
"type": "object",
"properties": {
"metrics": {
"required": [
"elasticsearch_client",
"last_updated",
"collection_interval_in_millis"
],
"type": "object",
"properties": {
"collection_interval_in_millis": {
"type": "number",
"description": "The interval at which metrics should be collected."
},
"elasticsearch_client": {
"required": [
"totalActiveSockets",
"totalIdleSockets",
"totalQueuedRequests"
],
"type": "object",
"properties": {
"totalActiveSockets": {
"type": "number",
"description": "Count of network sockets currently in use."
},
"totalIdleSockets": {
"type": "number",
"description": "Count of network sockets currently idle."
},
"totalQueuedRequests": {
"type": "number",
"description": "Count of requests not yet assigned to sockets."
}
},
"additionalProperties": false,
"description": "Current network metrics of Kibana's Elasticsearch client."
},
"last_updated": {
"type": "string",
"description": "The time metrics were collected."
}
},
"additionalProperties": false,
"description": "Metric groups collected by Kibana."
},
"name": {
"type": "string",
"description": "Kibana instance name."
},
"status": {
"required": [
"overall",
"core",
"plugins"
],
"type": "object",
"properties": {
"core": {
"required": [
"elasticsearch",
"savedObjects"
],
"type": "object",
"properties": {
"elasticsearch": {
"required": [
"level",
"summary",
"meta"
],
"type": "object",
"properties": {
"detail": {
"type": "string",
"description": "Human readable detail of the service status."
},
"documentationUrl": {
"type": "string",
"description": "A URL to further documentation regarding this service."
},
"level": {
"enum": [
"available",
"degraded",
"unavailable",
"critical"
],
"type": "string",
"description": "Service status levels as human and machine readable values."
},
"meta": {
"type": "object",
"additionalProperties": { },
"description": "An unstructured set of extra metadata about this service."
},
"summary": {
"type": "string",
"description": "A human readable summary of the service status."
}
},
"additionalProperties": false
},
"http": {
"required": [
"level",
"summary",
"meta"
],
"type": "object",
"properties": {
"detail": {
"type": "string",
"description": "Human readable detail of the service status."
},
"documentationUrl": {
"type": "string",
"description": "A URL to further documentation regarding this service."
},
"level": {
"enum": [
"available",
"degraded",
"unavailable",
"critical"
],
"type": "string",
"description": "Service status levels as human and machine readable values."
},
"meta": {
"type": "object",
"additionalProperties": { },
"description": "An unstructured set of extra metadata about this service."
},
"summary": {
"type": "string",
"description": "A human readable summary of the service status."
}
},
"additionalProperties": false
},
"savedObjects": {
"required": [
"level",
"summary",
"meta"
],
"type": "object",
"properties": {
"detail": {
"type": "string",
"description": "Human readable detail of the service status."
},
"documentationUrl": {
"type": "string",
"description": "A URL to further documentation regarding this service."
},
"level": {
"enum": [
"available",
"degraded",
"unavailable",
"critical"
],
"type": "string",
"description": "Service status levels as human and machine readable values."
},
"meta": {
"type": "object",
"additionalProperties": { },
"description": "An unstructured set of extra metadata about this service."
},
"summary": {
"type": "string",
"description": "A human readable summary of the service status."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Statuses of core Kibana services."
},
"overall": {
"required": [
"level",
"summary",
"meta"
],
"type": "object",
"properties": {
"detail": {
"type": "string",
"description": "Human readable detail of the service status."
},
"documentationUrl": {
"type": "string",
"description": "A URL to further documentation regarding this service."
},
"level": {
"enum": [
"available",
"degraded",
"unavailable",
"critical"
],
"type": "string",
"description": "Service status levels as human and machine readable values."
},
"meta": {
"type": "object",
"additionalProperties": { },
"description": "An unstructured set of extra metadata about this service."
},
"summary": {
"type": "string",
"description": "A human readable summary of the service status."
}
},
"additionalProperties": false
},
"plugins": {
"type": "object",
"additionalProperties": {
"required": [
"level",
"summary",
"meta"
],
"type": "object",
"properties": {
"detail": {
"type": "string",
"description": "Human readable detail of the service status."
},
"documentationUrl": {
"type": "string",
"description": "A URL to further documentation regarding this service."
},
"level": {
"enum": [
"available",
"degraded",
"unavailable",
"critical"
],
"type": "string",
"description": "Service status levels as human and machine readable values."
},
"meta": {
"type": "object",
"additionalProperties": { },
"description": "An unstructured set of extra metadata about this service."
},
"summary": {
"type": "string",
"description": "A human readable summary of the service status."
}
},
"additionalProperties": false
},
"description": "A dynamic mapping of plugin ID to plugin status."
}
},
"additionalProperties": false
},
"uuid": {
"type": "string",
"description": "Unique, generated Kibana instance UUID. This UUID should persist even if the Kibana process restarts."
},
"version": {
"required": [
"number",
"build_hash",
"build_number",
"build_snapshot",
"build_flavor",
"build_date"
],
"type": "object",
"properties": {
"build_date": {
"type": "string",
"description": "The date and time of this build."
},
"build_flavor": {
"enum": [
"serverless",
"traditional"
],
"type": "string",
"description": "The build flavour determines configuration and behavior of Kibana. On premise users will almost always run the \"traditional\" flavour, while other flavours are reserved for Elastic-specific use cases."
},
"build_hash": {
"type": "string",
"description": "A unique hash value representing the git commit of this Kibana build."
},
"build_number": {
"type": "number",
"description": "A monotonically increasing number, each subsequent build will have a higher number."
},
"build_snapshot": {
"type": "boolean",
"description": "Whether this build is a snapshot build."
},
"number": {
"type": "string",
"description": "A semantic version number."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Kibana's operational status as well as a detailed breakdown of plugin statuses indication of various loads (like event loop utilization and network traffic) at time of request."
},
"Kibana_HTTP_APIs_create_custom_integration_request": {
"title": "create_custom_integration_request",
"required": [
"integrationName",
"datasets"
],
"type": "object",
"properties": {
"datasets": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"name",
"type"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"type": {
"enum": [
"logs",
"metrics",
"traces",
"synthetics",
"profiles"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"force": {
"type": "boolean"
},
"integrationName": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_create_enrollment_api_key_response": {
"title": "create_enrollment_api_key_response",
"required": [
"item",
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"created"
],
"type": "string"
},
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_create_managed_integration_request": {
"title": "create_managed_integration_request",
"required": [
"name",
"package"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"cloud_connector": {
"type": [
"null",
"object"
],
"properties": {
"cloud_connector_id": {
"maxLength": 256,
"type": "string",
"description": "ID of an existing cloud connector to reuse. If not provided, a new connector is created. Requires `enabled: true` and cannot be combined with `name`."
},
"enabled": {
"type": "boolean",
"description": "Set to `true` to attach a cloud connector to this policy. Must be `true` to set any of `cloud_connector_id`, `name`, or `target_csp`.",
"default": false
},
"name": {
"maxLength": 255,
"minLength": 1,
"type": "string",
"description": "Name for a new cloud connector. If not provided, a name is generated automatically from the credentials. Requires `enabled: true` and only applies when creating a new connector (cannot be combined with `cloud_connector_id`)."
},
"target_csp": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string",
"description": "Target cloud service provider. If not provided, the provider is detected automatically from the inputs. Requires `enabled: true`."
}
},
"additionalProperties": false
},
"create_dataset_templates": {
"type": "boolean",
"description": "When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Policy description."
},
"force": {
"type": "boolean",
"description": "Force package policy creation even if the package is not verified, or if the agent policy is managed."
},
"global_data_tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"maxLength": 1024,
"type": "string",
"description": "Name of the custom field. The name cannot contain spaces."
},
"value": {
"anyOf": [
{
"maxLength": 1024,
"type": "string"
},
{
"type": "number"
}
],
"description": "Value of the custom field."
}
},
"additionalProperties": false
}
},
"id": {
"maxLength": 255,
"type": "string",
"description": "Policy unique identifier."
},
"inputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that input. Defaults to `true` (enabled)."
},
"streams": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that stream. Defaults to `true` (enabled)."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Input streams. Refer to the integration documentation to know which streams are available."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Package policy inputs. Refer to the integration documentation to know which inputs are available."
},
"name": {
"maxLength": 255,
"type": "string",
"description": "Unique name for the policy."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "Policy namespace. When not specified, it inherits the agent policy namespace."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"policy_template": {
"maxLength": 256,
"type": "string",
"description": "The policy template to use for the managed integration. If not provided, the default policy template is used."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_create_package_policy_request": {
"title": "create_package_policy_request",
"required": [
"name",
"inputs"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"cloud_connector_id": {
"type": [
"null",
"string"
],
"description": "ID of the cloud connector associated with this package policy."
},
"cloud_connector_name": {
"maxLength": 255,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "Transient field for cloud connector name during creation."
},
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this integration to its inputs."
},
"create_dataset_templates": {
"type": "boolean",
"description": "When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages."
},
"description": {
"type": "string",
"description": "Package policy description"
},
"enabled": {
"type": "boolean"
},
"force": {
"type": "boolean",
"description": "Force package policy creation even if the package is not verified, or if the agent policy is managed."
},
"global_data_tags": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the custom field. Cannot contain spaces."
},
"value": {
"type": [
"number",
"string"
],
"description": "The value of the custom field."
}
},
"additionalProperties": false
}
},
"id": {
"type": "string",
"description": "Package policy unique identifier"
},
"inputs": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"enabled"
],
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"name": {
"type": "string"
},
"policy_template": {
"type": "string"
},
"streams": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"enabled",
"data_stream",
"compiled_stream"
],
"type": "object",
"properties": {
"compiled_stream": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"elasticsearch": {
"type": "object",
"properties": {
"dynamic_dataset": {
"type": "boolean"
},
"dynamic_namespace": {
"type": "boolean"
},
"privileges": {
"type": "object",
"properties": {
"indices": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"type": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"is_managed": {
"type": "boolean"
},
"name": {
"type": "string",
"description": "Unique name for the package policy."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "The package policy namespace. Leave blank to inherit the agent policy's namespace."
},
"output_id": {
"type": [
"null",
"string"
]
},
"overrides": {
"type": [
"null",
"object"
],
"properties": {
"inputs": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"package_agent_version_condition": {
"type": "string"
},
"policy_id": {
"type": [
"null",
"string"
],
"description": "ID of the agent policy which the package policy will be added to.",
"deprecated": true
},
"policy_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "IDs of the agent policies that the package policy will be added to."
}
},
"spaceIds": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.",
"deprecated": true
},
"supports_cloud_connector": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy supports cloud connectors."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_create_package_policy_response": {
"title": "create_package_policy_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_response"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_data_visualizer_field_stats": {
"oneOf": [
{
"required": [
"view_type",
"data_view_id"
],
"type": "object",
"properties": {
"data_view_id": {
"maxLength": 1000,
"minLength": 1,
"type": "string",
"description": "Data view ID (stored as a panel reference)."
},
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"show_distributions": {
"type": "boolean",
"description": "Whether to show the distribution mini-charts in the table.",
"default": false
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
},
"view_type": {
"enum": [
"dataview"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"view_type",
"query"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"query": {
"required": [
"esql"
],
"type": "object",
"properties": {
"esql": {
"maxLength": 1000,
"type": "string",
"description": "The ES|QL query string."
}
},
"additionalProperties": false,
"description": "ES|QL query."
},
"show_distributions": {
"type": "boolean",
"description": "Whether to show the distribution mini-charts in the table.",
"default": false
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
},
"view_type": {
"enum": [
"esql"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "Field statistics table embeddable schema",
"discriminator": {
"propertyName": "view_type"
}
},
"Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting": {
"title": "Degraded docs",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Degraded Docs Rule Params",
"required": [
"timeUnit",
"timeSize",
"threshold",
"comparator",
"searchConfiguration"
],
"type": "object",
"properties": {
"comparator": {
"type": "string"
},
"groupBy": {
"type": "array",
"items": {
"type": "string"
}
},
"searchConfiguration": {
"required": [
"index"
],
"type": "object",
"properties": {
"index": {
"type": "string"
}
},
"additionalProperties": false
},
"threshold": {
"type": "array",
"items": {
"type": "number"
}
},
"timeSize": {
"type": "number"
},
"timeUnit": {
"type": "string"
}
},
"additionalProperties": false,
"description": "The parameters for the degraded docs rule. These parameters are appropriate when `rule_type_id` is `datasetQuality.degradedDocs`."
},
"rule_type_id": {
"enum": [
"datasetQuality.degradedDocs"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_datatableLibItemNoESQL": {
"title": "Datatable Chart (library)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metrics": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment of the columns.",
"default": "right"
},
"apply_color_to": {
"anyOf": [
{
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
{
"enum": [
"badge"
],
"type": "string"
}
],
"description": "Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay."
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.",
"default": {
"type": "auto"
}
},
"summary": {
"required": [
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Summary row label."
},
"type": {
"anyOf": [
{
"enum": [
"sum"
],
"type": "string"
},
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"count"
],
"type": "string"
},
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
}
],
"description": "Type of summary function to apply to the column."
}
},
"additionalProperties": false,
"description": "Summary row configuration"
},
"visible": {
"type": "boolean",
"description": "When `false`, hides the column from the datatable.",
"default": true
},
"width": {
"minimum": 0,
"type": "number",
"description": "Column width in pixels."
}
},
"additionalProperties": false
}
]
},
"description": "Array of metrics to display as columns in the datatable"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"rows": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment of the rows.",
"default": "left"
},
"apply_color_to": {
"anyOf": [
{
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
{
"enum": [
"badge"
],
"type": "string"
}
],
"description": "Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay."
},
"click_filter": {
"type": "boolean",
"description": "When `true`, enables one-click filtering on cell values.",
"default": false
},
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"visible": {
"type": "boolean",
"description": "When `false`, hides the column from the datatable.",
"default": true
},
"width": {
"minimum": 0,
"type": "number",
"description": "Column width in pixels."
}
},
"additionalProperties": false
}
]
},
"description": "Array of operations to split the datatable rows by"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"split_metrics_by": {
"maxItems": 20,
"minItems": 1,
"type": "array",
"items": {
"title": "Breakdown Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
],
"description": "Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters."
},
"description": "Array of operations to split the metric columns by"
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"data_table"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_agent_policy_request": {
"title": "delete_agent_policy_request",
"required": [
"agentPolicyId"
],
"type": "object",
"properties": {
"agentPolicyId": {
"type": "string",
"description": "The ID of the agent policy"
},
"force": {
"type": "boolean",
"description": "bypass validation checks that can prevent agent policy deletion"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_agent_policy_response": {
"title": "delete_agent_policy_response",
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_enrollment_api_key_response": {
"title": "delete_enrollment_api_key_response",
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"deleted"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_one_package_policy_response": {
"title": "delete_one_package_policy_response",
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_package_datastream_assets_response": {
"title": "delete_package_datastream_assets_response",
"required": [
"success"
],
"type": "object",
"properties": {
"success": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_package_policies_request": {
"title": "delete_package_policies_request",
"required": [
"packagePolicyIds"
],
"type": "object",
"properties": {
"force": {
"type": "boolean"
},
"packagePolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_package_policies_response_item": {
"title": "delete_package_policies_response_item",
"required": [
"id",
"success",
"policy_ids",
"package"
],
"type": "object",
"properties": {
"body": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"output_id": {
"type": [
"null",
"string"
]
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"policy_id": {
"type": [
"null",
"string"
],
"description": "Use `policy_ids` instead",
"deprecated": true
},
"policy_ids": {
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
}
},
"statusCode": {
"type": "number"
},
"success": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_delete_package_response": {
"title": "delete_package_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kibana_asset_reference"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_es_asset_reference"
}
]
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_dry_run_package_policies_request": {
"title": "dry_run_package_policies_request",
"required": [
"packagePolicyIds"
],
"type": "object",
"properties": {
"packagePolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"packageVersion": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_dry_run_package_policy": {
"title": "dry_run_package_policy",
"required": [
"name",
"enabled",
"inputs"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"cloud_connector_id": {
"type": [
"null",
"string"
],
"description": "ID of the cloud connector associated with this package policy."
},
"cloud_connector_name": {
"maxLength": 255,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "Transient field for cloud connector name during creation."
},
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this integration to its inputs."
},
"created_at": {
"type": "string"
},
"created_by": {
"type": "string"
},
"description": {
"type": "string",
"description": "Package policy description"
},
"elasticsearch": {
"type": "object",
"properties": {
"privileges": {
"type": "object",
"properties": {
"cluster": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
"enabled": {
"type": "boolean"
},
"errors": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"message"
],
"type": "object",
"properties": {
"key": {
"type": "string"
},
"message": {
"type": "string"
}
},
"additionalProperties": false
}
},
"force": {
"type": "boolean"
},
"global_data_tags": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the custom field. Cannot contain spaces."
},
"value": {
"type": [
"number",
"string"
],
"description": "The value of the custom field."
}
},
"additionalProperties": false
}
},
"id": {
"maxLength": 255,
"type": "string"
},
"inputs": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"enabled",
"streams",
"compiled_input"
],
"type": "object",
"properties": {
"compiled_input": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"name": {
"type": "string"
},
"policy_template": {
"type": "string"
},
"streams": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"enabled",
"data_stream",
"compiled_stream"
],
"type": "object",
"properties": {
"compiled_stream": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"elasticsearch": {
"type": "object",
"properties": {
"dynamic_dataset": {
"type": "boolean"
},
"dynamic_namespace": {
"type": "boolean"
},
"privileges": {
"type": "object",
"properties": {
"indices": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"type": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"is_managed": {
"type": "boolean"
},
"missingVars": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"name": {
"type": "string",
"description": "Unique name for the package policy."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "The package policy namespace. Leave blank to inherit the agent policy's namespace."
},
"output_id": {
"type": [
"null",
"string"
]
},
"overrides": {
"type": [
"null",
"object"
],
"properties": {
"inputs": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"package_agent_version_condition": {
"type": "string"
},
"policy_id": {
"type": [
"null",
"string"
],
"description": "ID of the agent policy which the package policy will be added to.",
"deprecated": true
},
"policy_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "IDs of the agent policies that the package policy will be added to."
}
},
"revision": {
"type": "number"
},
"secret_references": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy belongs to an agentless agent policy."
},
"supports_cloud_connector": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy supports cloud connectors."
},
"updated_at": {
"type": "string"
},
"updated_by": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"version": {
"type": "string",
"description": "Package policy ES version."
}
}
},
"Kibana_HTTP_APIs_dry_run_package_policy_response": {
"title": "dry_run_package_policy_response",
"required": [
"name",
"enabled",
"inputs",
"revision",
"updated_at",
"updated_by",
"created_at",
"created_by"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"agents": {
"type": "number"
},
"cloud_connector_id": {
"type": [
"null",
"string"
],
"description": "ID of the cloud connector associated with this package policy."
},
"cloud_connector_name": {
"maxLength": 255,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "Transient field for cloud connector name during creation."
},
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this integration to its inputs."
},
"created_at": {
"type": "string"
},
"created_by": {
"type": "string"
},
"description": {
"type": "string",
"description": "Package policy description"
},
"elasticsearch": {
"type": "object",
"properties": {
"privileges": {
"type": "object",
"properties": {
"cluster": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
"enabled": {
"type": "boolean"
},
"global_data_tags": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the custom field. Cannot contain spaces."
},
"value": {
"type": [
"number",
"string"
],
"description": "The value of the custom field."
}
},
"additionalProperties": false
}
},
"id": {
"maxLength": 255,
"type": "string"
},
"inputs": {
"anyOf": [
{
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"enabled",
"streams",
"compiled_input"
],
"type": "object",
"properties": {
"compiled_input": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"name": {
"type": "string"
},
"policy_template": {
"type": "string"
},
"streams": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"enabled",
"data_stream",
"compiled_stream"
],
"type": "object",
"properties": {
"compiled_stream": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"elasticsearch": {
"type": "object",
"properties": {
"dynamic_dataset": {
"type": "boolean"
},
"dynamic_namespace": {
"type": "boolean"
},
"privileges": {
"type": "object",
"properties": {
"indices": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"type": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
{
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that input. Defaults to `true` (enabled)."
},
"streams": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that stream. Defaults to `true` (enabled)."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Input streams. Refer to the integration documentation to know which streams are available."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Package policy inputs. Refer to the integration documentation to know which inputs are available."
}
],
"description": "Package policy inputs."
},
"is_managed": {
"type": "boolean"
},
"name": {
"type": "string",
"description": "Unique name for the package policy."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "The package policy namespace. Leave blank to inherit the agent policy's namespace."
},
"output_id": {
"type": [
"null",
"string"
]
},
"overrides": {
"type": [
"null",
"object"
],
"properties": {
"inputs": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"package_agent_version_condition": {
"type": "string"
},
"policy_id": {
"type": [
"null",
"string"
],
"description": "ID of the agent policy which the package policy will be added to.",
"deprecated": true
},
"policy_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "IDs of the agent policies that the package policy will be added to."
}
},
"revision": {
"type": "number",
"description": "Package policy revision."
},
"secret_references": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"spaceIds": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy belongs to an agentless agent policy."
},
"supports_cloud_connector": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy supports cloud connectors."
},
"updated_at": {
"type": "string"
},
"updated_by": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"anyOf": [
{
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
{
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
],
"description": "Package level variable."
},
"version": {
"type": "string",
"description": "Package policy ES version."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_enrollment_api_key": {
"title": "enrollment_api_key",
"required": [
"id",
"api_key_id",
"api_key",
"active",
"created_at"
],
"type": "object",
"properties": {
"active": {
"type": "boolean",
"description": "When false, the enrollment API key is revoked and cannot be used for enrolling Elastic Agents."
},
"api_key": {
"type": "string",
"description": "The enrollment API key (token) used for enrolling Elastic Agents."
},
"api_key_id": {
"type": "string",
"description": "The ID of the API key in the Security API."
},
"created_at": {
"type": "string"
},
"expire_at": {
"type": "string",
"description": "The expiration date of the enrollment token as an ISO 8601 date string. Absent when the token never expires."
},
"hidden": {
"type": "boolean"
},
"id": {
"type": "string"
},
"name": {
"type": "string",
"description": "The name of the enrollment API key."
},
"policy_id": {
"type": "string",
"description": "The ID of the agent policy the Elastic Agent will be enrolled in."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_enrollment_api_key_response": {
"title": "enrollment_api_key_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_es_asset_reference": {
"title": "es_asset_reference",
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"customDataStreamOriginDataset": {
"type": "string"
},
"customDataStreamOriginType": {
"type": "string"
},
"deferred": {
"type": "boolean"
},
"id": {
"type": "string"
},
"type": {
"enum": [
"index",
"index_template",
"component_template",
"ingest_pipeline",
"ilm_policy",
"data_stream_ilm_policy",
"transform",
"ml_model",
"knowledge_base",
"esql_view"
],
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_es-query-create-rule-body-alerting": {
"title": "ES query",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "ES Query Rule Params",
"required": [
"size",
"timeWindowSize",
"timeWindowUnit",
"threshold",
"thresholdComparator",
"timeField",
"searchConfiguration",
"esQuery",
"index",
"esqlQuery"
],
"type": "object",
"properties": {
"aggField": {
"minLength": 1,
"type": "string",
"description": "The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`."
},
"aggType": {
"type": "string",
"description": "The type of aggregation to perform.",
"default": "count"
},
"esqlQuery": {
"anyOf": [
{
"type": "array",
"items": { }
},
{
"type": "boolean"
},
{
"type": "number"
},
{
"type": "object"
},
{
"type": "string"
}
],
"oneOf": [
{
"required": [
"esql"
],
"type": "object",
"properties": {
"esql": {
"minLength": 1,
"type": "string"
}
},
"additionalProperties": false
},
{
"not": { }
}
],
"description": "The query definition in Elasticsearch Query Language."
},
"esQuery": {
"anyOf": [
{
"type": "array",
"items": { }
},
{
"type": "boolean"
},
{
"type": "number"
},
{
"type": "object"
},
{
"type": "string"
}
],
"oneOf": [
{
"minLength": 1,
"type": "string"
},
{
"not": { }
}
]
},
"excludeHitsFromPreviousRun": {
"type": "boolean",
"description": "Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.",
"default": true
},
"groupBy": {
"type": "string",
"description": "Indicates whether the aggregation is applied over all documents (`all`), grouped by row (`row`), or split into groups (`top`) using a grouping field (`termField`) where only the top groups (up to `termSize` number of groups) are checked. If grouping is used, an alert will be created for each group when it exceeds the threshold.",
"default": "all"
},
"index": {
"anyOf": [
{
"type": "array",
"items": { }
},
{
"type": "boolean"
},
{
"type": "number"
},
{
"type": "object"
},
{
"type": "string"
}
],
"oneOf": [
{
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string"
}
},
{
"not": { }
}
],
"description": "The indices to query."
},
"searchConfiguration": {
"anyOf": [
{
"type": "array",
"items": { }
},
{
"type": "boolean"
},
{
"type": "number"
},
{
"type": "object"
},
{
"type": "string"
}
],
"oneOf": [
{
"type": "object"
},
{
"not": { }
}
],
"description": "The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch."
},
"searchType": {
"enum": [
"searchSource",
"esQuery",
"esqlQuery"
],
"type": "string",
"description": "The type of query For example: `esQuery` for Elasticsearch Query DSL or `esqlQuery` for Elasticsearch Query Language (ES|QL).",
"default": "esQuery"
},
"size": {
"maximum": 10000,
"minimum": 0,
"type": "number",
"description": "The number of documents to pass to the configured actions when the threshold condition is met."
},
"sourceFields": {
"maxItems": 5,
"type": "array",
"items": {
"required": [
"label",
"searchPath"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"searchPath": {
"type": "string"
}
},
"additionalProperties": false
},
"description": "The sourceFields param is ignored."
},
"termField": {
"anyOf": [
{
"minLength": 1,
"type": "string"
},
{
"maxItems": 4,
"minItems": 2,
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`."
},
"termSize": {
"minimum": 1,
"type": "number",
"description": "This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields."
},
"threshold": {
"maxItems": 2,
"minItems": 1,
"type": "array",
"items": {
"type": "number",
"description": "The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values."
}
},
"thresholdComparator": {
"enum": [
">",
"<",
">=",
"<=",
"between",
"notBetween"
],
"type": "string",
"description": "The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between."
},
"timeField": {
"anyOf": [
{
"type": "array",
"items": { }
},
{
"type": "boolean"
},
{
"type": "number"
},
{
"type": "object"
},
{
"type": "string"
}
],
"oneOf": [
{
"minLength": 1,
"type": "string"
},
{
"minLength": 1,
"type": "string"
}
],
"description": "The field that is used to calculate the time window."
},
"timeWindowSize": {
"minimum": 1,
"type": "number",
"description": "The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"timeWindowUnit": {
"type": "string",
"description": "The type of units for the time window. For example: seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The parameters for the ES query rule. These parameters are appropriate when `rule_type_id` is `.es-query`."
},
"rule_type_id": {
"enum": [
".es-query"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_esqlDataSource": {
"title": "ES|QL Data Source",
"required": [
"type",
"query"
],
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: \"FROM logs-* | STATS count = COUNT(*) BY host.name\"."
},
"type": {
"enum": [
"esql"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields."
},
"Kibana_HTTP_APIs_FailureStore": {
"anyOf": [
{
"required": [
"inherit"
],
"type": "object",
"properties": {
"inherit": {
"type": "object",
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"disabled"
],
"type": "object",
"properties": {
"disabled": {
"type": "object",
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"lifecycle"
],
"type": "object",
"properties": {
"lifecycle": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "object",
"properties": {
"data_retention": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"lifecycle"
],
"type": "object",
"properties": {
"lifecycle": {
"required": [
"disabled"
],
"type": "object",
"properties": {
"disabled": {
"type": "object",
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
]
},
"Kibana_HTTP_APIs_FieldDefinition": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_FieldDefinitionConfig"
}
},
"Kibana_HTTP_APIs_FieldDefinitionConfig": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord"
},
{
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"format": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"type": {
"enum": [
"keyword",
"match_only_text",
"long",
"double",
"date",
"boolean",
"ip",
"geo_point",
"integer",
"short",
"byte",
"float",
"half_float",
"text",
"wildcard",
"version",
"unsigned_long",
"date_nanos"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"format": {
"not": { }
},
"type": {
"not": { }
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"type": {
"enum": [
"system"
],
"type": "string"
}
},
"additionalProperties": false
}
]
}
]
},
"Kibana_HTTP_APIs_FilterCondition": {
"anyOf": [
{
"required": [
"field"
],
"type": "object",
"properties": {
"contains": {
"type": [
"boolean",
"number",
"string"
],
"description": "Contains comparison value."
},
"endsWith": {
"type": [
"boolean",
"number",
"string"
],
"description": "Ends-with comparison value."
},
"eq": {
"type": [
"boolean",
"number",
"string"
],
"description": "Equality comparison value."
},
"field": {
"minLength": 1,
"type": "string",
"description": "The document field to filter on."
},
"gt": {
"type": [
"boolean",
"number",
"string"
],
"description": "Greater-than comparison value."
},
"gte": {
"type": [
"boolean",
"number",
"string"
],
"description": "Greater-than-or-equal comparison value."
},
"includes": {
"type": [
"boolean",
"number",
"string"
],
"description": "Checks if multivalue field includes the value."
},
"lt": {
"type": [
"boolean",
"number",
"string"
],
"description": "Less-than comparison value."
},
"lte": {
"type": [
"boolean",
"number",
"string"
],
"description": "Less-than-or-equal comparison value."
},
"neq": {
"type": [
"boolean",
"number",
"string"
],
"description": "Inequality comparison value."
},
"range": {
"type": "object",
"properties": {
"gt": {
"type": [
"boolean",
"number",
"string"
],
"description": "A value that can be a string, number, or boolean."
},
"gte": {
"type": [
"boolean",
"number",
"string"
],
"description": "A value that can be a string, number, or boolean."
},
"lt": {
"type": [
"boolean",
"number",
"string"
],
"description": "A value that can be a string, number, or boolean."
},
"lte": {
"type": [
"boolean",
"number",
"string"
],
"description": "A value that can be a string, number, or boolean."
}
},
"additionalProperties": false,
"description": "Range comparison values."
},
"startsWith": {
"type": [
"boolean",
"number",
"string"
],
"description": "Starts-with comparison value."
}
},
"additionalProperties": false,
"description": "A condition that compares a field to a value or range using an operator as the key."
},
{
"required": [
"field"
],
"type": "object",
"properties": {
"exists": {
"type": "boolean",
"description": "Indicates whether the field exists or not."
},
"field": {
"minLength": 1,
"type": "string",
"description": "The document field to check."
}
},
"additionalProperties": false,
"description": "A condition that checks for the existence or non-existence of a field."
}
],
"description": "A basic filter condition, either unary or binary."
},
"Kibana_HTTP_APIs_find_backfill_response": {
"title": "find_backfill_response",
"required": [
"page",
"per_page",
"total",
"data"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_backfill_response"
}
},
"page": {
"type": "number"
},
"per_page": {
"type": "number"
},
"total": {
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_find_maintenance_windows_response": {
"title": "find_maintenance_windows_response",
"required": [
"page",
"per_page",
"total",
"maintenanceWindows"
],
"type": "object",
"properties": {
"maintenanceWindows": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response"
},
"description": "The list of maintenance windows."
},
"page": {
"type": "number",
"description": "The current page number."
},
"per_page": {
"type": "number",
"description": "The number of maintenance windows returned per page."
},
"total": {
"type": "number",
"description": "The total number of maintenance windows that match the query."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_full_agent_policy": {
"title": "full_agent_policy",
"required": [
"id",
"outputs",
"inputs"
],
"type": "object",
"properties": {
"agent": {
"required": [
"monitoring",
"download",
"features",
"internal"
],
"type": "object",
"properties": {
"download": {
"required": [
"sourceURI"
],
"type": "object",
"properties": {
"auth": {
"type": "object",
"properties": {
"api_key": {
"type": "string"
},
"headers": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"key",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
},
"additionalProperties": false
}
},
"password": {
"type": "string"
},
"username": {
"type": "string"
}
},
"additionalProperties": false
},
"proxy_headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"type": [
"boolean",
"number",
"string"
]
}
},
"proxy_url": {
"type": "string"
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"required": [
"key"
],
"type": "object",
"properties": {
"key": {
"type": "object",
"properties": {
"id": {
"type": "string"
}
}
}
}
}
}
},
"sources": {
"maxItems": 3,
"type": "array",
"items": {
"type": "string"
}
},
"sourceURI": {
"type": "string"
},
"ssl": {
"type": "object",
"properties": {
"certificate": {
"type": "string"
},
"certificate_authorities": {
"maxItems": 10,
"type": "array",
"items": {
"type": "string"
}
},
"key": {
"type": "string"
},
"renegotiation": {
"type": "string"
},
"verification_mode": {
"type": "string"
}
},
"additionalProperties": false
},
"target_directory": {
"type": "string"
},
"timeout": {
"type": "string"
}
},
"additionalProperties": false
},
"features": {
"type": "object",
"additionalProperties": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
},
"additionalProperties": false
}
},
"internal": { },
"limits": {
"type": "object",
"properties": {
"go_max_procs": {
"type": "number"
}
},
"additionalProperties": false
},
"logging": {
"type": "object",
"properties": {
"files": {
"type": "object",
"properties": {
"interval": {
"type": "string"
},
"keepfiles": {
"type": "number"
},
"rotateeverybytes": {
"type": "number"
}
},
"additionalProperties": false
},
"level": {
"type": "string"
},
"metrics": {
"type": "object",
"properties": {
"period": {
"type": "string"
}
},
"additionalProperties": false
},
"to_files": {
"type": "boolean"
}
},
"additionalProperties": false
},
"monitoring": {
"required": [
"enabled",
"metrics",
"logs",
"traces",
"apm"
],
"type": "object",
"properties": {
"_runtime_experimental": {
"type": "string"
},
"apm": { },
"diagnostics": {
"type": "object",
"properties": {
"limit": {
"type": "object",
"properties": {
"burst": {
"type": "number"
},
"interval": {
"type": "string"
}
},
"additionalProperties": false
},
"uploader": {
"type": "object",
"properties": {
"init_dur": {
"type": "string"
},
"max_dur": {
"type": "string"
},
"max_retries": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"enabled": {
"type": "boolean"
},
"http": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"host": {
"type": "string"
},
"port": {
"type": "number"
}
},
"additionalProperties": false
},
"logs": {
"type": "boolean"
},
"metrics": {
"type": "boolean"
},
"namespace": {
"type": "string"
},
"pprof": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
},
"additionalProperties": false
},
"traces": {
"type": "boolean"
},
"use_output": {
"type": "string"
}
},
"additionalProperties": false
},
"protection": {
"required": [
"enabled",
"uninstall_token_hash",
"signing_key"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"signing_key": {
"type": "string"
},
"uninstall_token_hash": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"connectors": {
"type": "object",
"additionalProperties": { }
},
"exporters": {
"type": "object",
"additionalProperties": { }
},
"extensions": {
"type": "object",
"additionalProperties": { }
},
"fleet": {
"anyOf": [
{
"required": [
"hosts"
],
"type": "object",
"properties": {
"hosts": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"proxy_headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"type": [
"boolean",
"number",
"string"
]
}
},
"proxy_url": {
"type": "string"
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"required": [
"key"
],
"type": "object",
"properties": {
"key": {
"type": "object",
"properties": {
"id": {
"type": "string"
}
}
}
}
}
}
},
"ssl": {
"type": "object",
"properties": {
"certificate": {
"type": "string"
},
"certificate_authorities": {
"maxItems": 10,
"type": "array",
"items": {
"type": "string"
}
},
"key": {
"type": "string"
},
"renegotiation": {
"type": "string"
},
"verification_mode": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"kibana"
],
"type": "object",
"properties": {
"kibana": {
"required": [
"hosts",
"protocol"
],
"type": "object",
"properties": {
"hosts": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"path": {
"type": "string"
},
"protocol": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
]
},
"id": {
"type": "string"
},
"inputs": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"name",
"revision",
"type",
"data_stream",
"use_output",
"package_policy_id"
],
"type": "object",
"properties": {
"data_stream": {
"required": [
"namespace"
],
"type": "object",
"properties": {
"namespace": {
"type": "string"
}
}
},
"id": {
"type": "string"
},
"meta": {
"type": "object",
"properties": {
"package": {
"required": [
"name",
"version"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
}
}
}
}
},
"name": {
"type": "string"
},
"package_policy_id": {
"type": "string"
},
"processors": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"add_fields"
],
"type": "object",
"properties": {
"add_fields": {
"required": [
"target",
"fields"
],
"type": "object",
"properties": {
"fields": {
"type": "object",
"additionalProperties": {
"type": [
"number",
"string"
]
}
},
"target": {
"type": "string"
}
}
}
}
}
},
"revision": {
"type": "number"
},
"streams": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"data_stream"
],
"type": "object",
"properties": {
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"type": {
"type": "string"
}
}
},
"id": {
"type": "string"
}
}
}
},
"type": {
"type": "string"
},
"use_output": {
"type": "string"
}
}
}
},
"namespaces": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"output_permissions": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": { }
}
},
"outputs": {
"type": "object",
"additionalProperties": {
"required": [
"type"
],
"type": "object",
"properties": {
"ca_sha256": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"proxy_headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"type": [
"boolean",
"number",
"string"
]
}
},
"proxy_url": {
"type": "string"
},
"type": {
"type": "string"
}
}
}
},
"processors": {
"type": "object",
"additionalProperties": { }
},
"receivers": {
"type": "object",
"additionalProperties": { }
},
"revision": {
"type": "number"
},
"secret_references": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"service": {
"type": "object",
"properties": {
"extensions": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"pipelines": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"exporters": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"processors": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"receivers": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"signed": {
"required": [
"data",
"signature"
],
"type": "object",
"properties": {
"data": {
"type": "string"
},
"signature": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_gaugeLibItemNoESQL": {
"title": "Gauge Chart (library)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNoColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for the gauge fill.",
"default": {
"type": "auto"
}
},
"goal": {
"title": "Field Metric, Static Value, or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation, a static value, or a mathematical formula."
},
"max": {
"title": "Field Metric, Static Value, or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation, a static value, or a mathematical formula."
},
"min": {
"title": "Field Metric, Static Value, or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation, a static value, or a mathematical formula."
},
"subtitle": {
"type": "string",
"description": "Subtitle below the gauge value."
},
"ticks": {
"type": "object",
"properties": {
"mode": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"bands"
],
"type": "string"
}
],
"description": "Tick placement mode.",
"default": "bands"
},
"visible": {
"type": "boolean",
"description": "When `true`, displays tick marks on the gauge.",
"default": true
}
},
"additionalProperties": false,
"description": "Ticks configuration"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title.",
"default": true
}
},
"additionalProperties": false,
"description": "Title configuration"
}
},
"additionalProperties": false
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"gauge"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting": {
"title": "Geo containment",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Geo Containment Rule Params",
"required": [
"index",
"indexId",
"geoField",
"entity",
"dateField",
"boundaryType",
"boundaryIndexTitle",
"boundaryIndexId",
"boundaryGeoField",
"indexQuery",
"boundaryIndexQuery"
],
"type": "object",
"properties": {
"boundaryGeoField": {
"minLength": 1,
"type": "string"
},
"boundaryIndexId": {
"minLength": 1,
"type": "string"
},
"boundaryIndexQuery": { },
"boundaryIndexTitle": {
"minLength": 1,
"type": "string"
},
"boundaryNameField": {
"minLength": 1,
"type": "string"
},
"boundaryType": {
"minLength": 1,
"type": "string"
},
"dateField": {
"minLength": 1,
"type": "string"
},
"entity": {
"minLength": 1,
"type": "string"
},
"geoField": {
"minLength": 1,
"type": "string"
},
"index": {
"minLength": 1,
"type": "string"
},
"indexId": {
"minLength": 1,
"type": "string"
},
"indexQuery": { }
},
"additionalProperties": false,
"description": "The parameters for the geo containment rule. These parameters are appropriate when `rule_type_id` is `.geo-containment`."
},
"rule_type_id": {
"enum": [
".geo-containment"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_agent_policy_outputs_response": {
"title": "get_agent_policy_outputs_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"required": [
"monitoring",
"data"
],
"type": "object",
"properties": {
"agentPolicyId": {
"type": "string"
},
"data": {
"required": [
"output"
],
"type": "object",
"properties": {
"integrations": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"integrationPolicyName": {
"type": "string"
},
"name": {
"type": "string"
},
"pkgName": {
"type": "string"
}
},
"additionalProperties": false
}
},
"output": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"monitoring": {
"required": [
"output"
],
"type": "object",
"properties": {
"output": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_agent_policy_response": {
"title": "get_agent_policy_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_agent_policy_response"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_bulk_assets_request": {
"title": "get_bulk_assets_request",
"required": [
"assetIds"
],
"type": "object",
"properties": {
"assetIds": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_bulk_assets_response": {
"title": "get_bulk_assets_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"type",
"attributes"
],
"type": "object",
"properties": {
"appLink": {
"type": "string"
},
"attributes": {
"type": "object",
"properties": {
"description": {
"type": "string"
},
"engine": {
"enum": [
"v1",
"v2"
],
"type": "string"
},
"service": {
"type": "string"
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"id": {
"type": "string"
},
"type": {
"type": "string"
},
"updatedAt": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_categories_response": {
"title": "get_categories_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_category_summary_item"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_data_streams_response": {
"title": "get_data_streams_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_dependencies_response": {
"title": "get_dependencies_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"name",
"version",
"title"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"title": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_enrollment_api_keys_response": {
"title": "get_enrollment_api_keys_response",
"required": [
"items",
"total",
"page",
"perPage",
"list"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key"
}
},
"list": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key"
},
"deprecated": true
},
"page": {
"type": "number"
},
"perPage": {
"type": "number"
},
"total": {
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_full_agent_policy_response": {
"title": "get_full_agent_policy_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"anyOf": [
{
"type": "string"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_full_agent_policy"
}
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_info_response": {
"title": "get_info_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_get_package_info"
},
"metadata": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_metadata"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_inputs_response": {
"title": "get_inputs_response",
"required": [
"inputs"
],
"type": "object",
"properties": {
"connectors": {
"type": "object",
"additionalProperties": { }
},
"exporters": {
"type": "object",
"additionalProperties": { }
},
"extensions": {
"type": "object",
"additionalProperties": { }
},
"inputs": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"streams": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"data_stream"
],
"type": "object",
"properties": {
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"type": {
"type": "string"
}
}
},
"id": {
"type": "string"
}
}
}
},
"type": {
"type": "string"
}
},
"additionalProperties": false
}
},
"processors": {
"type": "object",
"additionalProperties": { }
},
"receivers": {
"type": "object",
"additionalProperties": { }
},
"service": {
"type": "object",
"properties": {
"extensions": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"pipelines": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"exporters": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"processors": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"receivers": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_installed_packages_response": {
"title": "get_installed_packages_response",
"required": [
"items",
"total"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_installed_package"
}
},
"searchAfter": {
"maxItems": 2,
"type": "array",
"items": {
"anyOf": [
{
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{ }
]
}
},
"total": {
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_k8s_manifest_response": {
"title": "get_k8s_manifest_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_limited_packages_response": {
"title": "get_limited_packages_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_list_agent_policy_outputs_request": {
"title": "get_list_agent_policy_outputs_request",
"required": [
"ids"
],
"type": "object",
"properties": {
"ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "list of package policy ids"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_list_agent_policy_outputs_response": {
"title": "get_list_agent_policy_outputs_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"monitoring",
"data"
],
"type": "object",
"properties": {
"agentPolicyId": {
"type": "string"
},
"data": {
"required": [
"output"
],
"type": "object",
"properties": {
"integrations": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"integrationPolicyName": {
"type": "string"
},
"name": {
"type": "string"
},
"pkgName": {
"type": "string"
}
},
"additionalProperties": false
}
},
"output": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"monitoring": {
"required": [
"output"
],
"type": "object",
"properties": {
"output": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_one_bulk_operation_packages_response": {
"title": "get_one_bulk_operation_packages_response",
"required": [
"status"
],
"type": "object",
"properties": {
"error": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"results": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"name",
"success"
],
"type": "object",
"properties": {
"error": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"name": {
"type": "string"
},
"success": {
"type": "boolean"
}
},
"additionalProperties": false
}
},
"status": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_package_info": {
"title": "get_package_info",
"required": [
"name",
"version",
"title",
"assets"
],
"type": "object",
"properties": {
"agent": {
"type": "object",
"properties": {
"privileges": {
"type": "object",
"properties": {
"root": {
"type": "boolean"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"asset_tags": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"text"
],
"type": "object",
"properties": {
"asset_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"asset_types": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"text": {
"type": "string"
}
},
"additionalProperties": false
}
},
"assets": {
"type": "object",
"additionalProperties": { }
},
"categories": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"conditions": {
"type": "object",
"properties": {
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_conditions_deprecation_info"
},
"elastic": {
"type": "object",
"properties": {
"capabilities": {
"maxItems": 10,
"type": "array",
"items": {
"type": "string"
}
},
"subscription": {
"type": "string"
}
}
},
"kibana": {
"type": "object",
"properties": {
"version": {
"type": "string"
}
}
}
}
},
"data_streams": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_deprecation_info"
},
"description": {
"type": "string"
},
"discovery": {
"type": "object",
"properties": {
"datasets": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
},
"fields": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
}
}
},
"download": {
"type": "string"
},
"elasticsearch": {
"type": "object",
"additionalProperties": { }
},
"format_version": {
"type": "string"
},
"icons": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_icon"
}
},
"installationInfo": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_installation_info"
},
"internal": {
"type": "boolean"
},
"keepPoliciesUpToDate": {
"type": "boolean"
},
"latestVersion": {
"type": "string"
},
"license": {
"type": "string"
},
"licensePath": {
"type": "string"
},
"name": {
"type": "string"
},
"notice": {
"type": "string"
},
"owner": {
"type": "object",
"properties": {
"github": {
"type": "string"
},
"type": {
"enum": [
"elastic",
"partner",
"community"
],
"type": "string"
}
}
},
"path": {
"type": "string"
},
"policy_templates": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
},
"readme": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"screenshots": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_icon"
}
},
"signature_path": {
"type": "string"
},
"source": {
"required": [
"license"
],
"type": "object",
"properties": {
"license": {
"type": "string"
}
}
},
"status": {
"type": "string"
},
"title": {
"type": "string"
},
"type": {
"anyOf": [
{
"enum": [
"integration"
],
"type": "string"
},
{
"enum": [
"input"
],
"type": "string"
},
{
"enum": [
"content"
],
"type": "string"
},
{
"type": "string"
}
]
},
"var_groups": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"title",
"selector_title",
"options"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"name": {
"type": "string"
},
"options": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"title",
"vars"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"hide_in_deployment_modes": {
"maxItems": 2,
"type": "array",
"items": {
"enum": [
"default",
"agentless"
],
"type": "string"
}
},
"name": {
"type": "string"
},
"title": {
"type": "string"
},
"vars": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"selector_title": {
"type": "string"
},
"title": {
"type": "string"
}
}
}
},
"vars": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
},
"version": {
"type": "string"
}
}
},
"Kibana_HTTP_APIs_get_packages_response": {
"title": "get_packages_response",
"required": [
"items"
],
"type": "object",
"properties": {
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_list_item"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_stats_response": {
"title": "get_stats_response",
"required": [
"response"
],
"type": "object",
"properties": {
"response": {
"required": [
"agent_policy_count",
"package_policy_count"
],
"type": "object",
"properties": {
"agent_policy_count": {
"type": "number"
},
"package_policy_count": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_get_verification_key_id_response": {
"title": "get_verification_key_id_response",
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_heatmapLibItemNoESQL": {
"title": "Heatmap Chart (library)",
"required": [
"type",
"x",
"data_source",
"metric"
],
"type": "object",
"properties": {
"axis": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapAxes"
},
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapLegend"
},
"metric": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color scale configuration for the heatmap cells.",
"default": {
"type": "auto"
}
}
},
"additionalProperties": false
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"heatmap"
],
"type": "string"
},
"x": {
"title": "Breakdown Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
],
"description": "Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters."
},
"y": {
"title": "Breakdown Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
],
"description": "Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting": {
"title": "Index threshold",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Index Threshold Rule Params",
"required": [
"index",
"timeField",
"timeWindowSize",
"timeWindowUnit",
"thresholdComparator",
"threshold"
],
"type": "object",
"properties": {
"aggField": {
"minLength": 1,
"type": "string",
"description": "The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`."
},
"aggType": {
"type": "string",
"description": "The type of aggregation to perform.",
"default": "count"
},
"filterKuery": {
"type": "string",
"description": "A Kibana Query Language (KQL) expression thats limits the scope of alerts."
},
"groupBy": {
"type": "string",
"description": "Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.",
"default": "all"
},
"index": {
"anyOf": [
{
"minLength": 1,
"type": "string"
},
{
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string"
}
}
],
"description": "The indices to query."
},
"termField": {
"minLength": 1,
"type": "string",
"description": "The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`."
},
"termSize": {
"minimum": 1,
"type": "number",
"description": "This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields."
},
"threshold": {
"maxItems": 2,
"minItems": 1,
"type": "array",
"items": {
"type": "number"
}
},
"thresholdComparator": {
"enum": [
">",
"<",
">=",
"<=",
"between",
"notBetween"
],
"type": "string",
"description": "The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between."
},
"timeField": {
"minLength": 1,
"type": "string",
"description": "The field that is used to calculate the time window."
},
"timeWindowSize": {
"minimum": 1,
"type": "number",
"description": "The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"timeWindowUnit": {
"type": "string",
"description": "The type of units for the time window. For example: seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The parameters for the index threshold rule. These parameters are appropriate when `rule_type_id` is `.index-threshold`."
},
"rule_type_id": {
"enum": [
".index-threshold"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_IngestStreamLifecycle": {
"anyOf": [
{
"required": [
"dsl"
],
"type": "object",
"properties": {
"dsl": {
"type": "object",
"properties": {
"data_retention": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"downsample": {
"type": "array",
"items": {
"required": [
"after",
"fixed_interval"
],
"type": "object",
"properties": {
"after": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"fixed_interval": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
}
}
}
},
"frozen_after": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"ilm"
],
"type": "object",
"properties": {
"ilm": {
"required": [
"policy"
],
"type": "object",
"properties": {
"policy": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"required": [
"inherit"
],
"type": "object",
"properties": {
"inherit": {
"type": "object",
"additionalProperties": false
}
},
"additionalProperties": false
}
]
},
"Kibana_HTTP_APIs_install_kibana_assets_request": {
"title": "install_kibana_assets_request",
"type": "object",
"properties": {
"force": {
"type": "boolean"
},
"space_ids": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "When provided, assets are installed in the specified spaces instead of the current space."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_install_kibana_assets_response": {
"title": "install_kibana_assets_response",
"required": [
"success"
],
"type": "object",
"properties": {
"success": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_install_package_from_registry_request": {
"title": "install_package_from_registry_request",
"type": "object",
"properties": {
"allow_outdated_version": {
"type": "boolean",
"description": "When true, allow installing a version older than the latest available. Bypasses only the out-of-date version check.",
"default": false
},
"force": {
"type": "boolean",
"default": false
},
"ignore_constraints": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_install_package_response": {
"title": "install_package_response",
"required": [
"items",
"_meta"
],
"type": "object",
"properties": {
"_meta": {
"required": [
"install_source",
"name"
],
"type": "object",
"properties": {
"install_source": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
"items": {
"maxItems": 10000,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kibana_asset_reference"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_es_asset_reference"
}
]
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_install_rule_assets_request": {
"title": "install_rule_assets_request",
"type": "object",
"properties": {
"force": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_installed_package": {
"title": "installed_package",
"required": [
"name",
"version",
"status",
"dataStreams"
],
"type": "object",
"properties": {
"dataStreams": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"name",
"title"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"title": {
"type": "string"
}
},
"additionalProperties": false
}
},
"description": {
"type": "string"
},
"icons": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_icon"
}
},
"name": {
"type": "string"
},
"rolledBack": {
"type": "boolean"
},
"status": {
"type": "string"
},
"title": {
"type": "string"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeConditionFilterSchema": {
"title": "condition",
"required": [
"type",
"condition"
],
"type": "object",
"properties": {
"condition": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_conditionSchema"
},
"controlled_by": {
"type": "string",
"description": "Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel."
},
"data_view_id": {
"type": "string",
"description": "Identifier of the data view used as context for this filter."
},
"disabled": {
"type": "boolean",
"description": "When `true`, the filter is inactive and does not affect query results. Defaults to `false`."
},
"is_multi_index": {
"type": "boolean",
"description": "When `true`, the filter can be applied across multiple indices. Defaults to `false`."
},
"label": {
"type": "string",
"description": "Human-readable label for the filter, used for display purposes."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"type": {
"enum": [
"condition"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "A filter that evaluates a single field condition such as equality, range, or existence."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeDSLFilterSchema": {
"title": "dsl",
"required": [
"type",
"dsl"
],
"type": "object",
"properties": {
"controlled_by": {
"type": "string",
"description": "Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel."
},
"data_view_id": {
"type": "string",
"description": "Identifier of the data view used as context for this filter."
},
"disabled": {
"type": "boolean",
"description": "When `true`, the filter is inactive and does not affect query results. Defaults to `false`."
},
"dsl": {
"type": "object",
"additionalProperties": { },
"description": "Elasticsearch Query DSL object passed directly to the query."
},
"field": {
"type": "string",
"description": "Field name for scripted filters where the field cannot be extracted from the DSL query."
},
"is_multi_index": {
"type": "boolean",
"description": "When `true`, the filter can be applied across multiple indices. Defaults to `false`."
},
"label": {
"type": "string",
"description": "Human-readable label for the filter, used for display purposes."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"params": {
"description": "Filter parameters metadata. May contain display values, formats, and parameters for scripted filters."
},
"type": {
"enum": [
"dsl"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "A filter expressed as a raw [Elasticsearch Query DSL](https://www.elastic.co/docs/reference/query-languages/querydsl) object, used for queries that cannot be represented by condition or group filters."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeConditionFilterSchema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeGroupFilterSchema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeDSLFilterSchema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeSpatialFilterSchema"
}
],
"description": "A filter applied to query results. Can be a field condition (`condition`), a logical group of conditions (`group`), a raw Elasticsearch DSL query (`dsl`), or a geo spatial query (`spatial`).",
"discriminator": {
"propertyName": "type",
"mapping": {
"condition": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeConditionFilterSchema",
"dsl": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeDSLFilterSchema",
"group": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeGroupFilterSchema",
"spatial": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeSpatialFilterSchema"
}
}
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeGroupFilterSchema": {
"title": "group",
"required": [
"type",
"group"
],
"type": "object",
"properties": {
"controlled_by": {
"type": "string",
"description": "Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel."
},
"data_view_id": {
"type": "string",
"description": "Identifier of the data view used as context for this filter."
},
"disabled": {
"type": "boolean",
"description": "When `true`, the filter is inactive and does not affect query results. Defaults to `false`."
},
"group": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_groupConditionSchema"
},
"is_multi_index": {
"type": "boolean",
"description": "When `true`, the filter can be applied across multiple indices. Defaults to `false`."
},
"label": {
"type": "string",
"description": "Human-readable label for the filter, used for display purposes."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"type": {
"enum": [
"group"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "A filter that combines multiple conditions or nested groups using a logical `and` or `or` operator."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeSpatialFilterSchema": {
"title": "spatial",
"required": [
"type",
"dsl"
],
"type": "object",
"properties": {
"controlled_by": {
"type": "string",
"description": "Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel."
},
"data_view_id": {
"type": "string",
"description": "Identifier of the data view used as context for this filter."
},
"disabled": {
"type": "boolean",
"description": "When `true`, the filter is inactive and does not affect query results. Defaults to `false`."
},
"dsl": {
"type": "object",
"additionalProperties": { },
"description": "Elasticsearch geo query DSL object."
},
"is_multi_index": {
"type": "boolean",
"description": "When `true`, the filter can be applied across multiple indices. Defaults to `false`."
},
"label": {
"type": "string",
"description": "Human-readable label for the filter, used for display purposes."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"type": {
"enum": [
"spatial"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "A filter that applies an Elasticsearch geo query, used for geographic boundary and shape matching."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_exists": {
"title": "exists",
"required": [
"field",
"operator"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Name of the document field the condition evaluates."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"operator": {
"enum": [
"exists"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Matches documents where `field` exists and contains a non-null value."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is": {
"title": "is",
"required": [
"field",
"operator",
"value"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Name of the document field the condition evaluates."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"operator": {
"enum": [
"is"
],
"type": "string"
},
"value": {
"anyOf": [
{
"title": "value",
"type": "string"
},
{
"title": "value",
"type": "number"
},
{
"title": "value",
"type": "boolean"
}
],
"description": "Single value to compare against the field."
}
},
"additionalProperties": false,
"description": "Matches documents where `field` equals a single specified value."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is_one_of": {
"title": "is_one_of",
"required": [
"field",
"operator",
"value"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Name of the document field the condition evaluates."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"operator": {
"enum": [
"is_one_of"
],
"type": "string"
},
"value": {
"anyOf": [
{
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
}
},
{
"maxItems": 10000,
"type": "array",
"items": {
"type": "number"
}
},
{
"maxItems": 10000,
"type": "array",
"items": {
"type": "boolean"
}
}
],
"description": "Homogeneous array of values to match against the field."
}
},
"additionalProperties": false,
"description": "Matches documents where `field` equals any value in a provided list."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_range": {
"title": "range",
"required": [
"field",
"operator",
"value"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Name of the document field the condition evaluates."
},
"negate": {
"type": "boolean",
"description": "When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`."
},
"operator": {
"enum": [
"range"
],
"type": "string"
},
"value": {
"type": "object",
"properties": {
"format": {
"type": "string",
"description": "Elasticsearch [date format](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format) string applied when parsing date boundary values. For example, `strict_date_optional_time` or `epoch_millis`."
},
"gt": {
"type": [
"number",
"string"
],
"description": "Greater than."
},
"gte": {
"type": [
"number",
"string"
],
"description": "Greater than or equal to."
},
"lt": {
"type": [
"number",
"string"
],
"description": "Less than."
},
"lte": {
"type": [
"number",
"string"
],
"description": "Less than or equal to."
}
},
"additionalProperties": false,
"description": "Boundary values for a range comparison."
}
},
"additionalProperties": false,
"description": "Matches documents where `field` falls within a specified numeric or date range."
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_conditionSchema": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is_one_of"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_range"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_exists"
}
],
"description": "A filter condition with strict operator/value type matching.",
"discriminator": {
"propertyName": "operator",
"mapping": {
"exists": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_exists",
"is": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is",
"is_one_of": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is_one_of",
"range": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_range"
}
}
},
"Kibana_HTTP_APIs_kbn-as-code-filters-schema_groupConditionSchema": {
"required": [
"operator",
"conditions"
],
"type": "object",
"properties": {
"conditions": {
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_conditionSchema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_groupConditionSchema"
}
]
},
"description": "Ordered list of conditions or nested groups combined by the group `operator`."
},
"operator": {
"anyOf": [
{
"enum": [
"and"
],
"type": "string"
},
{
"enum": [
"or"
],
"type": "string"
}
],
"description": "Logical operator applied across all entries in `conditions`. Use `and` to require all conditions, or `or` to require at least one."
}
},
"additionalProperties": false,
"description": "Logical group that combines one or more conditions or nested groups."
},
"Kibana_HTTP_APIs_kbn-as-code-meta": {
"type": "object",
"properties": {
"created_at": {
"type": "string",
"description": "Timestamp when the object was created (ISO 8601)."
},
"created_by": {
"type": "string",
"description": "User profile ID of the user who created the object."
},
"managed": {
"type": "boolean",
"description": "When `true`, the object is managed by Kibana and cannot be edited by users."
},
"owner": {
"type": "string",
"description": "Identifier of the plugin or team that owns this object."
},
"updated_at": {
"type": "string",
"description": "Timestamp when the object was last updated (ISO 8601)."
},
"updated_by": {
"type": "string",
"description": "User profile ID of the user who last updated the object."
},
"version": {
"type": "string",
"description": "Internal version identifier for optimistic concurrency control."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-as-code-query": {
"title": "Query",
"required": [
"expression",
"language"
],
"type": "object",
"properties": {
"expression": {
"type": "string",
"description": "A query expression in KQL or Lucene syntax."
},
"language": {
"enum": [
"kql",
"lucene"
],
"type": "string",
"description": "Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax."
}
},
"additionalProperties": false,
"description": "A search query consisting of an expression and its language. Supports KQL and Lucene syntax."
},
"Kibana_HTTP_APIs_kbn-composite-runtime-field-schema": {
"title": "Composite runtime field",
"required": [
"type",
"fields"
],
"type": "object",
"properties": {
"fields": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-base-schema"
}
},
"script": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-script"
},
"type": {
"enum": [
"composite"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema": {
"required": [
"name",
"type",
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-esql-control": {
"title": "esql_control",
"required": [
"type",
"config"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query"
}
],
"discriminator": {
"propertyName": "control_type",
"mapping": {
"STATIC_VALUES": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values",
"VALUES_FROM_QUERY": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query"
}
}
},
"grow": {
"type": "boolean",
"description": "When `true`, the control expands to fill any available horizontal space. Defaults to `false`.",
"default": false
},
"id": {
"type": "string",
"description": "The unique ID of the control"
},
"type": {
"enum": [
"esql_control"
],
"type": "string"
},
"width": {
"anyOf": [
{
"enum": [
"small"
],
"type": "string"
},
{
"enum": [
"medium"
],
"type": "string"
},
{
"enum": [
"large"
],
"type": "string"
}
],
"description": "Minimum width of the control panel.",
"default": "medium"
}
},
"additionalProperties": false,
"description": "An ES|QL variable control whose selected value is injected into ES|QL visualizations using the `?variable_name` syntax. Options can come from a fixed list or an ES|QL query. Define the options source in `config`."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-options-list-control": {
"title": "options_list_control",
"required": [
"type"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-field"
}
],
"discriminator": {
"propertyName": "values_source",
"mapping": {
"esql": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql"
}
}
},
"grow": {
"type": "boolean",
"description": "When `true`, the control expands to fill any available horizontal space. Defaults to `false`.",
"default": false
},
"id": {
"type": "string",
"description": "The unique ID of the control"
},
"type": {
"enum": [
"options_list_control"
],
"type": "string"
},
"width": {
"anyOf": [
{
"enum": [
"small"
],
"type": "string"
},
{
"enum": [
"medium"
],
"type": "string"
},
{
"enum": [
"large"
],
"type": "string"
}
],
"description": "Minimum width of the control panel.",
"default": "medium"
}
},
"additionalProperties": false,
"description": "A dropdown control that filters data by selecting field values from a data view. Define the data view, field, and selection settings in `config`."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-range-slider-control": {
"title": "range_slider_control",
"required": [
"type"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-field"
}
],
"discriminator": {
"propertyName": "values_source",
"mapping": {
"esql": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql"
}
}
},
"grow": {
"type": "boolean",
"description": "When `true`, the control expands to fill any available horizontal space. Defaults to `false`.",
"default": false
},
"id": {
"type": "string",
"description": "The unique ID of the control"
},
"type": {
"enum": [
"range_slider_control"
],
"type": "string"
},
"width": {
"anyOf": [
{
"enum": [
"small"
],
"type": "string"
},
{
"enum": [
"medium"
],
"type": "string"
},
{
"enum": [
"large"
],
"type": "string"
}
],
"description": "Minimum width of the control panel.",
"default": "medium"
}
},
"additionalProperties": false,
"description": "A slider control that filters data by selecting a numeric range for the configured field. Define the data view, field, and selection settings in `config`."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-time-slider-control": {
"title": "time_slider_control",
"required": [
"type",
"config"
],
"type": "object",
"properties": {
"config": {
"type": "object",
"properties": {
"end_percentage_of_time_range": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.",
"default": 1
},
"is_anchored": {
"type": "boolean",
"description": "When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`.",
"default": false
},
"start_percentage_of_time_range": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.",
"default": 0
}
},
"additionalProperties": false
},
"grow": {
"type": "boolean",
"description": "When `true`, the control expands to fill any available horizontal space. Defaults to `false`.",
"default": false
},
"id": {
"type": "string",
"description": "The unique ID of the control"
},
"type": {
"enum": [
"time_slider_control"
],
"type": "string"
},
"width": {
"anyOf": [
{
"enum": [
"small"
],
"type": "string"
},
{
"enum": [
"medium"
],
"type": "string"
},
{
"enum": [
"large"
],
"type": "string"
}
],
"description": "Minimum width of the control panel.",
"default": "medium"
}
},
"additionalProperties": false,
"description": "A control panel that filters a time field to a selected sub-range of the global time range. Define the start and end positions in `config` as fractions of the global range (0 to 1)."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql": {
"title": "EsqlOptionsListControl",
"required": [
"values_source",
"esql_query"
],
"type": "object",
"properties": {
"display_settings": {
"type": "object",
"properties": {
"hide_action_bar": {
"type": "boolean",
"description": "When `true`, the search bar, sorting options, and select all toggle are hidden from the control."
},
"hide_exclude": {
"type": "boolean",
"description": "When `true`, the exclude mode toggle is hidden from the control."
},
"hide_exists": {
"type": "boolean",
"description": "When `true`, the exists filter option is hidden from the control."
},
"hide_sort": {
"type": "boolean",
"description": "When `true`, the sort selector is hidden from the control."
},
"placeholder": {
"type": "string",
"description": "Placeholder text displayed in the control input when no option is selected."
}
},
"additionalProperties": false
},
"esql_query": {
"minLength": 1,
"type": "string",
"description": "The ES|QL query that provides field options for this control"
},
"exclude": {
"type": "boolean",
"description": "When `true`, the control filters to documents that do NOT match the selected options. Defaults to `false`.",
"default": false
},
"exists_selected": {
"type": "boolean",
"description": "When `true`, the control filters to documents where the field exists, regardless of the field's value. Defaults to `false`.",
"default": false
},
"ignore_validations": {
"type": "boolean",
"description": "When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.",
"default": false
},
"run_past_timeout": {
"type": "boolean",
"description": "When `true`, the options list query continues running even if it exceeds the configured timeout threshold. Defaults to `false`.",
"default": false
},
"search_technique": {
"anyOf": [
{
"enum": [
"prefix"
],
"type": "string"
},
{
"enum": [
"wildcard"
],
"type": "string"
},
{
"enum": [
"exact"
],
"type": "string"
}
],
"description": "The matching technique used when searching available options. `prefix` matches values starting with the search term, `wildcard` matches values containing the search term, and `exact` requires a complete match. Only applies to string and IP fields. Defaults to `wildcard`.",
"default": "wildcard"
},
"selected_options": {
"maxItems": 10000,
"type": "array",
"items": {
"type": [
"number",
"string"
],
"description": "A selected option value. Accepts a string or a number."
},
"description": "The list of currently selected option values.",
"default": [ ]
},
"single_select": {
"type": "boolean",
"description": "When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `false`.",
"default": false
},
"sort": {
"required": [
"by",
"direction"
],
"type": "object",
"properties": {
"by": {
"enum": [
"_count",
"_key"
],
"type": "string",
"description": "The field used to sort the available options list. `_count` sorts by document count and `_key` sorts alphabetically by option value."
},
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The sort direction. `asc` sorts ascending and `desc` sorts descending."
}
},
"additionalProperties": false,
"description": "Defines how the available options are sorted in the control popover. Defaults to `{ by: \"_count\", direction: \"desc\" }`.",
"default": {
"by": "_count",
"direction": "desc"
}
},
"title": {
"type": "string",
"description": "A human-readable title for the control."
},
"use_global_filters": {
"type": "boolean",
"description": "When `true`, the control's available options are narrowed by the page's active filters.",
"default": true
},
"values_source": {
"enum": [
"esql"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "An options list control whose available options come from an ES|QL query's results."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-field": {
"title": "FieldOptionsListControl",
"required": [
"data_view_id",
"field_name"
],
"type": "object",
"properties": {
"data_view_id": {
"minLength": 1,
"type": "string",
"description": "The ID of the data view that provides field options for this control."
},
"display_settings": {
"type": "object",
"properties": {
"hide_action_bar": {
"type": "boolean",
"description": "When `true`, the search bar, sorting options, and select all toggle are hidden from the control."
},
"hide_exclude": {
"type": "boolean",
"description": "When `true`, the exclude mode toggle is hidden from the control."
},
"hide_exists": {
"type": "boolean",
"description": "When `true`, the exists filter option is hidden from the control."
},
"hide_sort": {
"type": "boolean",
"description": "When `true`, the sort selector is hidden from the control."
},
"placeholder": {
"type": "string",
"description": "Placeholder text displayed in the control input when no option is selected."
}
},
"additionalProperties": false
},
"exclude": {
"type": "boolean",
"description": "When `true`, the control filters to documents that do NOT match the selected options. Defaults to `false`.",
"default": false
},
"exists_selected": {
"type": "boolean",
"description": "When `true`, the control filters to documents where the field exists, regardless of the field's value. Defaults to `false`.",
"default": false
},
"field_name": {
"minLength": 1,
"type": "string",
"description": "The name of the field in the data view that this control filters on."
},
"ignore_validations": {
"type": "boolean",
"description": "When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.",
"default": false
},
"run_past_timeout": {
"type": "boolean",
"description": "When `true`, the options list query continues running even if it exceeds the configured timeout threshold. Defaults to `false`.",
"default": false
},
"search_technique": {
"anyOf": [
{
"enum": [
"prefix"
],
"type": "string"
},
{
"enum": [
"wildcard"
],
"type": "string"
},
{
"enum": [
"exact"
],
"type": "string"
}
],
"description": "The matching technique used when searching available options. `prefix` matches values starting with the search term, `wildcard` matches values containing the search term, and `exact` requires a complete match. Only applies to string and IP fields. Defaults to `wildcard`.",
"default": "wildcard"
},
"selected_options": {
"maxItems": 10000,
"type": "array",
"items": {
"type": [
"number",
"string"
],
"description": "A selected option value. Accepts a string or a number."
},
"description": "The list of currently selected option values.",
"default": [ ]
},
"single_select": {
"type": "boolean",
"description": "When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `false`.",
"default": false
},
"sort": {
"required": [
"by",
"direction"
],
"type": "object",
"properties": {
"by": {
"enum": [
"_count",
"_key"
],
"type": "string",
"description": "The field used to sort the available options list. `_count` sorts by document count and `_key` sorts alphabetically by option value."
},
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The sort direction. `asc` sorts ascending and `desc` sorts descending."
}
},
"additionalProperties": false,
"description": "Defines how the available options are sorted in the control popover. Defaults to `{ by: \"_count\", direction: \"desc\" }`.",
"default": {
"by": "_count",
"direction": "desc"
}
},
"title": {
"type": "string",
"description": "A human-readable title for the control."
},
"use_global_filters": {
"type": "boolean",
"description": "When `true`, the control's available options are narrowed by the page's active filters.",
"default": true
},
"values_source": {
"anyOf": [
{
"enum": [
"field"
],
"type": "string"
}
],
"description": "The source of the field options for this control. Defaults to `field` for legacy controls.",
"default": "field"
}
},
"additionalProperties": false,
"description": "An options list control whose available options come from a data view field."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values": {
"title": "STATIC_VALUES",
"required": [
"selected_options",
"variable_name",
"variable_type",
"control_type",
"available_options"
],
"type": "object",
"properties": {
"available_options": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
},
"description": "A fixed list of option strings displayed in the control."
},
"control_type": {
"enum": [
"STATIC_VALUES"
],
"type": "string"
},
"display_settings": {
"type": "object",
"properties": {
"hide_action_bar": {
"type": "boolean",
"description": "When `true`, the search bar, sorting options, and select all toggle are hidden from the control."
},
"hide_exclude": {
"type": "boolean",
"description": "When `true`, the exclude mode toggle is hidden from the control."
},
"hide_exists": {
"type": "boolean",
"description": "When `true`, the exists filter option is hidden from the control."
},
"hide_sort": {
"type": "boolean",
"description": "When `true`, the sort selector is hidden from the control."
},
"placeholder": {
"type": "string",
"description": "Placeholder text displayed in the control input when no option is selected."
}
},
"additionalProperties": false
},
"selected_options": {
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
},
"description": "The list of currently selected option values."
},
"single_select": {
"type": "boolean",
"description": "When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `true`.",
"default": true
},
"title": {
"type": "string",
"description": "A human-readable title for the control."
},
"variable_name": {
"type": "string",
"description": "The name of the ES|QL variable that this control populates. The variable is referenced in ES|QL queries using the `?variable_name` syntax."
},
"variable_type": {
"anyOf": [
{
"enum": [
"fields"
],
"type": "string"
},
{
"enum": [
"values"
],
"type": "string"
},
{
"enum": [
"functions"
],
"type": "string"
},
{
"enum": [
"time_literal"
],
"type": "string"
},
{
"enum": [
"multi_values"
],
"type": "string"
}
],
"description": "The ES|QL variable type that determines how the selected value is substituted into the query. Accepts `fields`, `values`, `functions`, `time_literal`, or `multi_values`."
}
},
"additionalProperties": false,
"description": "An ES|QL variable control with a fixed list of selectable options defined directly in `available_options`."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query": {
"title": "VALUES_FROM_QUERY",
"required": [
"selected_options",
"variable_name",
"variable_type",
"control_type",
"esql_query"
],
"type": "object",
"properties": {
"control_type": {
"enum": [
"VALUES_FROM_QUERY"
],
"type": "string"
},
"display_settings": {
"type": "object",
"properties": {
"hide_action_bar": {
"type": "boolean",
"description": "When `true`, the search bar, sorting options, and select all toggle are hidden from the control."
},
"hide_exclude": {
"type": "boolean",
"description": "When `true`, the exclude mode toggle is hidden from the control."
},
"hide_exists": {
"type": "boolean",
"description": "When `true`, the exists filter option is hidden from the control."
},
"hide_sort": {
"type": "boolean",
"description": "When `true`, the sort selector is hidden from the control."
},
"placeholder": {
"type": "string",
"description": "Placeholder text displayed in the control input when no option is selected."
}
},
"additionalProperties": false
},
"esql_query": {
"type": "string",
"description": "An ES|QL query whose results populate the list of available options in the control popover."
},
"selected_options": {
"maxItems": 10000,
"type": "array",
"items": {
"type": "string"
},
"description": "The list of currently selected option values."
},
"single_select": {
"type": "boolean",
"description": "When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `true`.",
"default": true
},
"title": {
"type": "string",
"description": "A human-readable title for the control."
},
"variable_name": {
"type": "string",
"description": "The name of the ES|QL variable that this control populates. The variable is referenced in ES|QL queries using the `?variable_name` syntax."
},
"variable_type": {
"anyOf": [
{
"enum": [
"fields"
],
"type": "string"
},
{
"enum": [
"values"
],
"type": "string"
},
{
"enum": [
"functions"
],
"type": "string"
},
{
"enum": [
"time_literal"
],
"type": "string"
},
{
"enum": [
"multi_values"
],
"type": "string"
}
],
"description": "The ES|QL variable type that determines how the selected value is substituted into the query. Accepts `fields`, `values`, `functions`, `time_literal`, or `multi_values`."
}
},
"additionalProperties": false,
"description": "An ES|QL variable control whose selectable options are dynamically retrieved by running an ES|QL query."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql": {
"title": "EsqlRangeSliderControl",
"required": [
"values_source",
"esql_query"
],
"type": "object",
"properties": {
"esql_query": {
"minLength": 1,
"type": "string",
"description": "The ES|QL query that provides field options for this control"
},
"ignore_validations": {
"type": "boolean",
"description": "When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.",
"default": false
},
"step": {
"minimum": 0,
"type": "number",
"description": "The step size between selectable range values.",
"default": 1
},
"title": {
"type": "string",
"description": "A human-readable title for the control."
},
"use_global_filters": {
"type": "boolean",
"description": "When `true`, the control's available options are narrowed by the page's active filters.",
"default": true
},
"value": {
"maxItems": 2,
"minItems": 2,
"type": "array",
"items": {
"type": "string"
},
"description": "The selected range as a two-element array of strings representing the lower and upper bound values, for example `[\"10\", \"50\"]`."
},
"values_source": {
"enum": [
"esql"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "A range slider control whose values come from an ES|QL query's results."
},
"Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-field": {
"title": "FieldRangeSliderControl",
"required": [
"data_view_id",
"field_name"
],
"type": "object",
"properties": {
"data_view_id": {
"minLength": 1,
"type": "string",
"description": "The ID of the data view that provides field options for this control."
},
"field_name": {
"minLength": 1,
"type": "string",
"description": "The name of the field in the data view that this control filters on."
},
"ignore_validations": {
"type": "boolean",
"description": "When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.",
"default": false
},
"step": {
"minimum": 0,
"type": "number",
"description": "The step size between selectable range values.",
"default": 1
},
"title": {
"type": "string",
"description": "A human-readable title for the control."
},
"use_global_filters": {
"type": "boolean",
"description": "When `true`, the control's available options are narrowed by the page's active filters.",
"default": true
},
"value": {
"maxItems": 2,
"minItems": 2,
"type": "array",
"items": {
"type": "string"
},
"description": "The selected range as a two-element array of strings representing the lower and upper bound values, for example `[\"10\", \"50\"]`."
},
"values_source": {
"anyOf": [
{
"enum": [
"field"
],
"type": "string"
}
],
"description": "The source of the field options for this control. Defaults to `field` for legacy controls.",
"default": "field"
}
},
"additionalProperties": false,
"description": "A range slider control whose values come from a numeric data view field."
},
"Kibana_HTTP_APIs_kbn-dashboard-access-control": {
"title": "Access control",
"type": "object",
"properties": {
"access_mode": {
"anyOf": [
{
"enum": [
"write_restricted"
],
"type": "string"
},
{
"enum": [
"default"
],
"type": "string"
}
],
"description": "Controls edit access to the dashboard. Set to `write_restricted` to prevent edits by users without explicit write permission. Defaults to `default` (all viewers can edit)."
}
},
"additionalProperties": false,
"description": "Access control settings for the dashboard."
},
"Kibana_HTTP_APIs_kbn-dashboard-data": {
"required": [
"title"
],
"type": "object",
"properties": {
"access_control": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-access-control"
},
"description": {
"type": "string",
"description": "A short description of the dashboard."
},
"esql_approximation": {
"type": "boolean",
"description": "When `true`, ES|QL visualizations that use `STATS` run with [approximate execution](https://www.elastic.co/docs/reference/query-languages/esql/esql-query-approximation) for faster, estimated results."
},
"filters": {
"maxItems": 500,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema"
},
"description": "Filters applied across all panels, including pinned panels."
},
"options": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-options"
},
"panels": {
"maxItems": 1000,
"type": "array",
"items": {
"anyOf": [
{
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"aiops_change_point_chart": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart",
"aiops_log_rate_analysis": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis",
"aiops_pattern_analysis": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis",
"apm_service_map": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map",
"custom_content": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content",
"discover_session": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session",
"esql_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control",
"field_stats_table": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table",
"image": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image",
"links": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links",
"markdown": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown",
"ml_anomaly_charts": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts",
"ml_anomaly_swimlane": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane",
"ml_single_metric_viewer": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer",
"options_list_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control",
"range_slider_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control",
"slo_alerts": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts",
"slo_burn_rate": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate",
"slo_error_budget": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget",
"slo_overview": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview",
"synthetics_monitors": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors",
"synthetics_stats_overview": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview",
"time_slider_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control",
"vis": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis"
}
}
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-section"
}
]
},
"description": "Panels and sections in the dashboard. Each entry is either a panel (with a `type` and `config`) or a collapsible section (with a `title`, `collapsed` state, and nested `panels`)."
},
"pinned_panels": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-esql-control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-options-list-control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-range-slider-control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-time-slider-control"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"esql_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-esql-control",
"options_list_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-options-list-control",
"range_slider_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-range-slider-control",
"time_slider_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-time-slider-control"
}
}
},
"description": "An array of control panels and their state in the control group."
},
"project_routing": {
"type": "string",
"description": "Controls [cross-project search](https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-project-routing) behavior for this dashboard (Serverless only). Set to `_alias:_origin` to scope data to the current project, or `_alias:*` to search across all projects. When omitted, the space default applies."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-query"
},
"refresh_interval": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-service-server-refreshIntervalSchema"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this dashboard.",
"default": [ ]
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"minLength": 1,
"type": "string",
"description": "A human-readable title for the dashboard."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-dropped-panel-warning": {
"title": "Dropped panel",
"required": [
"type",
"message",
"panel_type",
"panel_config"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "Human-readable explanation of why the panel was dropped."
},
"panel_config": {
"type": "object",
"additionalProperties": { },
"description": "The original configuration of the dropped panel."
},
"panel_references": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema"
},
"description": "Saved object references used by the dropped panel."
},
"panel_type": {
"type": "string",
"description": "The type identifier of the dropped panel."
},
"type": {
"enum": [
"dropped_panel"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "A panel that was excluded from the response because its type is not supported by the API."
},
"Kibana_HTTP_APIs_kbn-dashboard-dropped-property-warning": {
"title": "Dropped property",
"required": [
"type",
"message",
"key"
],
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The name of the property that was dropped."
},
"message": {
"type": "string",
"description": "Human-readable explanation of why the property was dropped."
},
"type": {
"enum": [
"dropped_property"
],
"type": "string"
},
"value": {
"description": "The original value of the property that was dropped."
}
},
"additionalProperties": false,
"description": "A property that was excluded from the response because it failed validation."
},
"Kibana_HTTP_APIs_kbn-dashboard-options": {
"title": "Options",
"type": "object",
"properties": {
"auto_apply_filters": {
"type": "boolean",
"description": "When `true`, control filter changes are applied automatically. When `false`, control filter changes are applied manually through the dashboard's search update button. Defaults to `true`.",
"default": true
},
"hide_panel_borders": {
"type": "boolean",
"description": "When `true`, panel borders are hidden. Defaults to `false`.",
"default": false
},
"hide_panel_titles": {
"type": "boolean",
"description": "When `true`, panel titles are hidden. Defaults to `false`.",
"default": false
},
"sync_colors": {
"type": "boolean",
"description": "When `true`, colors are synchronized across panels that share a data source. Defaults to `false`.",
"default": false
},
"sync_cursor": {
"type": "boolean",
"description": "When `true`, the cursor position is synchronized across panels. Defaults to `true`.",
"default": true
},
"sync_tooltips": {
"type": "boolean",
"description": "When `true`, tooltips are synchronized across panels. Defaults to `false`.",
"default": false
},
"use_margins": {
"type": "boolean",
"description": "When `true`, panels are separated by a margin. Defaults to `true`.",
"default": true
}
},
"additionalProperties": false,
"description": "Display and behavior settings for the dashboard.",
"default": {
"auto_apply_filters": true,
"hide_panel_borders": false,
"hide_panel_titles": false,
"sync_colors": false,
"sync_cursor": true,
"sync_tooltips": false,
"use_margins": true
}
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-grid": {
"title": "Panel grid",
"required": [
"x",
"y"
],
"type": "object",
"properties": {
"h": {
"minimum": 1,
"type": "number",
"description": "The height of the panel in grid units. Minimum `1`. Defaults to `15`.",
"default": 15
},
"w": {
"maximum": 48,
"minimum": 1,
"type": "number",
"description": "The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`.",
"default": 24
},
"x": {
"type": "number",
"description": "The x coordinate of the panel in grid units."
},
"y": {
"type": "number",
"description": "The y coordinate of the panel in grid units."
}
},
"additionalProperties": false,
"description": "The position and size of the panel on the dashboard grid."
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart": {
"title": "Change point detection chart",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_aiops_change_point_chart"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"aiops_change_point_chart"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis": {
"title": "Log rate analysis",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_aiops_log_rate_analysis"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"aiops_log_rate_analysis"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis": {
"title": "Pattern analysis",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_aiops_pattern_analysis"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"aiops_pattern_analysis"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map": {
"title": "APM Service map",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_apm-service-map-embeddable"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"apm_service_map"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content": {
"title": "Custom panel",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"esql_query": {
"maxItems": 1,
"type": "array",
"items": {
"maxLength": 1000000,
"type": "string"
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"template": {
"maxLength": 510000,
"type": "string"
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"custom_content"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session": {
"title": "Discover session",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"anyOf": [
{
"title": "By value",
"required": [
"tabs"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"tabs": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"data_source"
],
"type": "object",
"properties": {
"column_order": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Field name of a column in display order."
},
"description": "Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting \"defaultColumns\" or the referenced saved object."
},
"column_settings": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"width": {
"minimum": 0,
"type": "number",
"description": "Optional width of the column in pixels."
}
},
"additionalProperties": false
},
"description": "Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in `column_order` when both are set."
},
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"default_rendered_nodes": {
"maximum": 200,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many nodes each JSON cell renders by default in JSON document view."
},
"density": {
"anyOf": [
{
"enum": [
"compact"
],
"type": "string"
},
{
"enum": [
"expanded"
],
"type": "string"
},
{
"enum": [
"normal"
],
"type": "string"
}
],
"description": "Discover display option: controls table row spacing. Choose \"compact\", \"expanded\", or \"normal\". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference."
},
"documents_display_mode": {
"anyOf": [
{
"enum": [
"table"
],
"type": "string"
},
{
"enum": [
"json"
],
"type": "string"
}
],
"description": "Discover display option: controls whether documents are shown as a formatted table (\"table\") or as a raw JSON tree (\"json\")."
},
"filters": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema"
},
"description": "List of filters to apply to the data in the tab.",
"default": [ ]
},
"header_row_height": {
"anyOf": [
{
"maximum": 5,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table header row height. Use a number (1–5) or \"auto\" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference."
},
"hide_nulls": {
"type": "boolean",
"description": "Discover display option: controls whether fields with null values are hidden in JSON document view."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-query"
},
"row_height": {
"anyOf": [
{
"maximum": 20,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table data row height. Use a number (1–20) or \"auto\" to size based on content. If omitted, defaults to the advanced setting \"discover:rowHeightOption\"."
},
"rows_per_page": {
"maximum": 10000,
"minimum": 1,
"type": "number",
"description": "The number of rows to display per page in the data table. If omitted, defaults to the advanced setting \"discover:sampleRowsPerPage\". Has no effect on ES|QL tabs since Kibana 8.16."
},
"sample_size": {
"maximum": 10000,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting \"discover:sampleSize\"."
},
"sort": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"direction"
],
"type": "object",
"properties": {
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The direction to sort the field by: Use \"asc\" for ascending or \"desc\" for descending."
},
"name": {
"type": "string",
"description": "The name of the field to sort by."
}
},
"additionalProperties": false
},
"description": "Sort configuration for the data table (field and direction).",
"default": [ ]
},
"type": {
"enum": [
"default"
],
"type": "string",
"description": "Identifies the type of profile settings saved with the tab. The `default` value indicates that no profile settings are included.",
"default": "default"
},
"view_mode": {
"anyOf": [
{
"enum": [
"documents"
],
"type": "string"
},
{
"enum": [
"patterns"
],
"type": "string"
},
{
"enum": [
"aggregated"
],
"type": "string"
}
],
"description": "Discover view mode. Choose \"documents\" (search hits), \"patterns\" (pattern analysis), or \"aggregated\" (field statistics).",
"default": "documents"
},
"wrap_lines": {
"type": "boolean",
"description": "Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line."
}
},
"additionalProperties": false
},
{
"required": [
"data_source"
],
"type": "object",
"properties": {
"column_order": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Field name of a column in display order."
},
"description": "Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting \"defaultColumns\" or the referenced saved object."
},
"column_settings": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"width": {
"minimum": 0,
"type": "number",
"description": "Optional width of the column in pixels."
}
},
"additionalProperties": false
},
"description": "Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in `column_order` when both are set."
},
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"default_rendered_nodes": {
"maximum": 200,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many nodes each JSON cell renders by default in JSON document view."
},
"density": {
"anyOf": [
{
"enum": [
"compact"
],
"type": "string"
},
{
"enum": [
"expanded"
],
"type": "string"
},
{
"enum": [
"normal"
],
"type": "string"
}
],
"description": "Discover display option: controls table row spacing. Choose \"compact\", \"expanded\", or \"normal\". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference."
},
"documents_display_mode": {
"anyOf": [
{
"enum": [
"table"
],
"type": "string"
},
{
"enum": [
"json"
],
"type": "string"
}
],
"description": "Discover display option: controls whether documents are shown as a formatted table (\"table\") or as a raw JSON tree (\"json\")."
},
"header_row_height": {
"anyOf": [
{
"maximum": 5,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table header row height. Use a number (1–5) or \"auto\" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference."
},
"hide_nulls": {
"type": "boolean",
"description": "Discover display option: controls whether fields with null values are hidden in JSON document view."
},
"row_height": {
"anyOf": [
{
"maximum": 20,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table data row height. Use a number (1–20) or \"auto\" to size based on content. If omitted, defaults to the advanced setting \"discover:rowHeightOption\"."
},
"rows_per_page": {
"maximum": 10000,
"minimum": 1,
"type": "number",
"description": "The number of rows to display per page in the data table. If omitted, defaults to the advanced setting \"discover:sampleRowsPerPage\". Has no effect on ES|QL tabs since Kibana 8.16."
},
"sample_size": {
"maximum": 10000,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting \"discover:sampleSize\"."
},
"sort": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"direction"
],
"type": "object",
"properties": {
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The direction to sort the field by: Use \"asc\" for ascending or \"desc\" for descending."
},
"name": {
"type": "string",
"description": "The name of the field to sort by."
}
},
"additionalProperties": false
},
"description": "Sort configuration for the data table (field and direction).",
"default": [ ]
},
"type": {
"enum": [
"default"
],
"type": "string",
"description": "Identifies the type of profile settings saved with the tab. The `default` value indicates that no profile settings are included.",
"default": "default"
},
"wrap_lines": {
"type": "boolean",
"description": "Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line."
}
},
"additionalProperties": false,
"description": "ES|QL (Elasticsearch Query Language) data source."
},
{
"title": "Metrics tab",
"required": [
"data_source",
"type",
"dimensions",
"search_term",
"counter_aggregation",
"gauge_aggregation",
"histogram_percentile"
],
"type": "object",
"properties": {
"column_order": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Field name of a column in display order."
},
"description": "Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting \"defaultColumns\" or the referenced saved object."
},
"column_settings": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"width": {
"minimum": 0,
"type": "number",
"description": "Optional width of the column in pixels."
}
},
"additionalProperties": false
},
"description": "Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in `column_order` when both are set."
},
"counter_aggregation": {
"enum": [
"avg",
"sum",
"min",
"max"
],
"type": "string",
"description": "Aggregation applied to counter metric fields."
},
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"default_rendered_nodes": {
"maximum": 200,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many nodes each JSON cell renders by default in JSON document view."
},
"density": {
"anyOf": [
{
"enum": [
"compact"
],
"type": "string"
},
{
"enum": [
"expanded"
],
"type": "string"
},
{
"enum": [
"normal"
],
"type": "string"
}
],
"description": "Discover display option: controls table row spacing. Choose \"compact\", \"expanded\", or \"normal\". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference."
},
"dimensions": {
"maxItems": 5,
"type": "array",
"items": {
"maxLength": 1000,
"type": "string"
},
"description": "Fields used to group metrics in the metrics grid."
},
"documents_display_mode": {
"anyOf": [
{
"enum": [
"table"
],
"type": "string"
},
{
"enum": [
"json"
],
"type": "string"
}
],
"description": "Discover display option: controls whether documents are shown as a formatted table (\"table\") or as a raw JSON tree (\"json\")."
},
"gauge_aggregation": {
"enum": [
"avg",
"sum",
"min",
"max"
],
"type": "string",
"description": "Aggregation applied to gauge metric fields."
},
"header_row_height": {
"anyOf": [
{
"maximum": 5,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table header row height. Use a number (1–5) or \"auto\" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference."
},
"hide_nulls": {
"type": "boolean",
"description": "Discover display option: controls whether fields with null values are hidden in JSON document view."
},
"histogram_percentile": {
"enum": [
"p50",
"p75",
"p90",
"p95",
"p99"
],
"type": "string",
"description": "Percentile displayed for histogram metric fields."
},
"row_height": {
"anyOf": [
{
"maximum": 20,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table data row height. Use a number (1–20) or \"auto\" to size based on content. If omitted, defaults to the advanced setting \"discover:rowHeightOption\"."
},
"rows_per_page": {
"maximum": 10000,
"minimum": 1,
"type": "number",
"description": "The number of rows to display per page in the data table. If omitted, defaults to the advanced setting \"discover:sampleRowsPerPage\". Has no effect on ES|QL tabs since Kibana 8.16."
},
"sample_size": {
"maximum": 10000,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting \"discover:sampleSize\"."
},
"search_term": {
"maxLength": 1000,
"type": "string",
"description": "Search term used to filter metrics in the metrics grid."
},
"sort": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"direction"
],
"type": "object",
"properties": {
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The direction to sort the field by: Use \"asc\" for ascending or \"desc\" for descending."
},
"name": {
"type": "string",
"description": "The name of the field to sort by."
}
},
"additionalProperties": false
},
"description": "Sort configuration for the data table (field and direction).",
"default": [ ]
},
"type": {
"enum": [
"metrics"
],
"type": "string",
"description": "A tab with saved metrics grid settings. Requires an ES|QL data source. These settings are used only when the query supports the metrics experience."
},
"wrap_lines": {
"type": "boolean",
"description": "Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line."
}
},
"additionalProperties": false,
"description": "An ES|QL tab with saved metrics grid settings. The dashboard panel stores these settings and restores them in Discover. The panel does not render the metrics grid."
}
]
},
"description": "Inline tab configuration. Used when no `ref_id` is set. Currently supports one tab."
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored inline"
},
{
"title": "By reference",
"required": [
"ref_id"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"overrides": {
"type": "object",
"properties": {
"column_order": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Field name of a column in display order."
},
"description": "When set, overrides column order for the data table relative to the referenced saved object (`ref_id`) or the inline tab in `tabs`. If omitted, the source configuration is used."
},
"column_settings": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"width": {
"minimum": 0,
"type": "number",
"description": "Optional width of the column in pixels."
}
},
"additionalProperties": false
},
"description": "Per-column presentation overrides (e.g. widths) keyed by field name. When set, merges with the source configuration for the referenced session or inline tab."
},
"default_rendered_nodes": {
"maximum": 200,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many nodes each JSON cell renders by default in JSON document view. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used."
},
"density": {
"anyOf": [
{
"enum": [
"compact"
],
"type": "string"
},
{
"enum": [
"expanded"
],
"type": "string"
},
{
"enum": [
"normal"
],
"type": "string"
}
],
"description": "Discover display option: controls table row spacing (`compact`, `expanded`, or `normal`). When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used."
},
"documents_display_mode": {
"anyOf": [
{
"enum": [
"table"
],
"type": "string"
},
{
"enum": [
"json"
],
"type": "string"
}
],
"description": "Discover display option: controls whether documents are shown as a formatted table (\"table\") or as a raw JSON tree (\"json\"). When set, overrides the referenced saved object or the inline tab config in `tabs`."
},
"header_row_height": {
"anyOf": [
{
"maximum": 5,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table header row height (number 1–5 or `auto`). When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used."
},
"hide_nulls": {
"type": "boolean",
"description": "Discover display option: controls whether fields with null values are hidden in JSON document view. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used."
},
"row_height": {
"anyOf": [
{
"maximum": 20,
"minimum": 1,
"type": "number"
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"description": "Discover display option: controls table data row height (number 1–20 or `auto`). When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the advanced setting \"discover:rowHeightOption\"."
},
"rows_per_page": {
"maximum": 10000,
"minimum": 1,
"type": "number",
"description": "Number of rows per page. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the advanced setting \"discover:sampleRowsPerPage\"."
},
"sample_size": {
"maximum": 10000,
"minimum": 10,
"type": "number",
"description": "Discover display option: controls how many documents to sample. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the advanced setting \"discover:sampleSize\"."
},
"sort": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"direction"
],
"type": "object",
"properties": {
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The direction to sort the field by: Use \"asc\" for ascending or \"desc\" for descending."
},
"name": {
"type": "string",
"description": "The name of the field to sort by."
}
},
"additionalProperties": false
},
"description": "Sort configuration (field and direction) for the data table. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used."
},
"wrap_lines": {
"type": "boolean",
"description": "Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used."
}
},
"additionalProperties": false
},
"ref_id": {
"type": "string"
},
"selected_tab_id": {
"type": "string",
"description": "Tab to select from the referenced saved object. If omitted, defaults to the first tab."
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored in a linked library item"
}
]
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"discover_session"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control": {
"title": "ES|QL variable control",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query"
}
],
"discriminator": {
"propertyName": "control_type",
"mapping": {
"STATIC_VALUES": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values",
"VALUES_FROM_QUERY": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query"
}
}
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"esql_control"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table": {
"title": "Field statistics table",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_data_visualizer_field_stats"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"field_stats_table"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-image": {
"title": "Image",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"required": [
"image_config"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "dashboard_drilldown",
"allOf": [
{
"type": "object",
"properties": {
"open_in_new_tab": {
"type": "boolean",
"description": "When enabled, the dashboard opens in a new browser tab.",
"default": false
},
"use_filters": {
"type": "boolean",
"description": "When enabled, filters are passed to the opening dashboard.",
"default": true
},
"use_time_range": {
"type": "boolean",
"description": "When enabled, time range is passed to the opening dashboard.",
"default": true
}
},
"additionalProperties": false,
"default": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
}
},
{
"required": [
"dashboard_id"
],
"type": "object",
"properties": {
"dashboard_id": {
"type": "string"
}
}
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_click_image"
],
"type": "string"
}
]
},
"type": {
"enum": [
"dashboard_drilldown"
],
"type": "string"
}
}
}
]
},
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_click_image"
],
"type": "string"
},
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"image_config": {
"required": [
"src"
],
"type": "object",
"properties": {
"alt_text": {
"type": "string"
},
"background_color": {
"type": "string"
},
"object_fit": {
"anyOf": [
{
"enum": [
"fill"
],
"type": "string"
},
{
"enum": [
"contain"
],
"type": "string"
},
{
"enum": [
"cover"
],
"type": "string"
},
{
"enum": [
"none"
],
"type": "string"
}
],
"description": "How the image should be sized within its container",
"default": "contain"
},
"src": {
"anyOf": [
{
"title": "file",
"required": [
"type",
"file_id"
],
"type": "object",
"properties": {
"file_id": {
"type": "string"
},
"type": {
"enum": [
"file"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"title": "url",
"required": [
"type",
"url"
],
"type": "object",
"properties": {
"type": {
"enum": [
"url"
],
"type": "string"
},
"url": {
"type": "string",
"description": "URL of the image"
}
},
"additionalProperties": false
}
],
"description": "Image source"
}
},
"additionalProperties": false
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Image embeddable schema"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"image"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-links": {
"title": "Links",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"anyOf": [
{
"title": "By value",
"required": [
"links"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"layout": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Whether to display the links in a horizontal or vertical layout."
},
"links": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"dashboardLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink",
"externalLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
}
},
"description": "The list of links to display."
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored inline"
},
{
"title": "By reference",
"required": [
"ref_id"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"ref_id": {
"title": "Reference ID",
"type": "string",
"description": "The unique identifier of the links library item."
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored in a linked library item"
}
],
"description": "Links embeddable schema"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"links"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown": {
"title": "Markdown",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"anyOf": [
{
"title": "By value",
"required": [
"content"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\\n` for line breaks within JSON strings."
},
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"settings": {
"type": "object",
"properties": {
"open_links_in_new_tab": {
"type": "boolean",
"description": "Open links in a new browser tab.",
"default": true
}
},
"additionalProperties": false,
"description": "Display settings for the markdown panel.",
"default": {
"open_links_in_new_tab": true
}
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored inline"
},
{
"title": "By reference",
"required": [
"ref_id"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"ref_id": {
"type": "string",
"description": "The unique identifier of the markdown library item."
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored in a linked library item"
}
],
"description": "Markdown panel config"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"markdown"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts": {
"title": "Anomaly charts",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ml_anomaly_charts"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"ml_anomaly_charts"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane": {
"title": "Anomaly swim lane",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ml_anomaly_swimlane"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"ml_anomaly_swimlane"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer": {
"title": "Single metric viewer",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ml_single_metric_viewer"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"ml_single_metric_viewer"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control": {
"title": "Options list control",
"required": [
"type",
"grid"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-field"
}
],
"discriminator": {
"propertyName": "values_source",
"mapping": {
"esql": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql"
}
}
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"options_list_control"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control": {
"title": "Range slider control",
"required": [
"type",
"grid"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-field"
}
],
"discriminator": {
"propertyName": "values_source",
"mapping": {
"esql": "#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql"
}
}
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"range_slider_control"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts": {
"title": "SLO alerts",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_slo-alerts-embeddable"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"slo_alerts"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate": {
"title": "SLO burn rate",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_slo-burn-rate-embeddable"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"slo_burn_rate"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget": {
"title": "SLO error budget",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_slo-error-budget-embeddable"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"slo_error_budget"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview": {
"title": "SLO overview",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_slo-single-overview-embeddable"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_slo-group-overview-embeddable"
}
],
"description": "SLO Overview embeddable schema",
"discriminator": {
"propertyName": "overview_mode",
"mapping": {
"groups": "#/components/schemas/Kibana_HTTP_APIs_slo-group-overview-embeddable",
"single": "#/components/schemas/Kibana_HTTP_APIs_slo-single-overview-embeddable"
}
}
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"slo_overview"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors": {
"title": "Synthetics monitors",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"filters": {
"type": "object",
"properties": {
"locations": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by monitor locations"
},
"monitor_ids": {
"maxItems": 5000,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by monitor IDs"
},
"monitor_types": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by monitor types"
},
"projects": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by project"
},
"tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by tags"
}
},
"additionalProperties": false
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"title": {
"type": "string",
"description": "The panel title."
},
"view": {
"anyOf": [
{
"enum": [
"cardView"
],
"type": "string"
},
{
"enum": [
"compactView"
],
"type": "string"
}
],
"description": "View mode for the monitors embeddable (defaults to cardView)"
}
},
"additionalProperties": false,
"description": "Synthetics monitors embeddable schema"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"synthetics_monitors"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview": {
"title": "Synthetics stats overview",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"filters": {
"type": "object",
"properties": {
"locations": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by monitor locations"
},
"monitor_ids": {
"maxItems": 5000,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by monitor IDs"
},
"monitor_types": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by monitor types"
},
"projects": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by project"
},
"tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Display label for the filter option"
},
"value": {
"type": "string",
"description": "Value for the filter option"
}
},
"additionalProperties": false
},
"description": "Filter by tags"
}
},
"additionalProperties": false
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Synthetics stats overview embeddable schema"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"synthetics_stats_overview"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control": {
"title": "Time slider control",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"type": "object",
"properties": {
"end_percentage_of_time_range": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.",
"default": 1
},
"is_anchored": {
"type": "boolean",
"description": "When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`.",
"default": false
},
"start_percentage_of_time_range": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.",
"default": 0
}
},
"additionalProperties": false
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"time_slider_control"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis": {
"title": "Visualization",
"required": [
"type",
"grid",
"config"
],
"type": "object",
"properties": {
"config": {
"anyOf": [
{
"title": "By value",
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiConfig"
},
{
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "dashboard_drilldown",
"allOf": [
{
"type": "object",
"properties": {
"open_in_new_tab": {
"type": "boolean",
"description": "When enabled, the dashboard opens in a new browser tab.",
"default": false
},
"use_filters": {
"type": "boolean",
"description": "When enabled, filters are passed to the opening dashboard.",
"default": true
},
"use_time_range": {
"type": "boolean",
"description": "When enabled, time range is passed to the opening dashboard.",
"default": true
}
},
"additionalProperties": false,
"default": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
}
},
{
"required": [
"dashboard_id"
],
"type": "object",
"properties": {
"dashboard_id": {
"type": "string"
}
}
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_apply_filter"
],
"type": "string"
}
]
},
"type": {
"enum": [
"dashboard_drilldown"
],
"type": "string"
}
}
}
]
},
{
"title": "discover_drilldown",
"allOf": [
{
"type": "object",
"properties": {
"open_in_new_tab": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_apply_filter"
],
"type": "string"
}
]
},
"type": {
"enum": [
"discover_drilldown"
],
"type": "string"
}
}
}
]
},
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_click_row"
],
"type": "string"
},
{
"enum": [
"on_click_value"
],
"type": "string"
},
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
},
{
"enum": [
"on_select_range"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"references": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema"
}
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false
}
],
"description": "Panel configuration stored inline"
},
{
"title": "By reference",
"required": [
"ref_id"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "dashboard_drilldown",
"allOf": [
{
"type": "object",
"properties": {
"open_in_new_tab": {
"type": "boolean",
"description": "When enabled, the dashboard opens in a new browser tab.",
"default": false
},
"use_filters": {
"type": "boolean",
"description": "When enabled, filters are passed to the opening dashboard.",
"default": true
},
"use_time_range": {
"type": "boolean",
"description": "When enabled, time range is passed to the opening dashboard.",
"default": true
}
},
"additionalProperties": false,
"default": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
}
},
{
"required": [
"dashboard_id"
],
"type": "object",
"properties": {
"dashboard_id": {
"type": "string"
}
}
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_apply_filter"
],
"type": "string"
}
]
},
"type": {
"enum": [
"dashboard_drilldown"
],
"type": "string"
}
}
}
]
},
{
"title": "discover_drilldown",
"allOf": [
{
"type": "object",
"properties": {
"open_in_new_tab": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_apply_filter"
],
"type": "string"
}
]
},
"type": {
"enum": [
"discover_drilldown"
],
"type": "string"
}
}
}
]
},
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_click_row"
],
"type": "string"
},
{
"enum": [
"on_click_value"
],
"type": "string"
},
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
},
{
"enum": [
"on_select_range"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"ref_id": {
"type": "string"
},
"references": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema"
}
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Panel configuration stored in a linked library item"
}
],
"description": "Lens embeddable schema"
},
"grid": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid"
},
"id": {
"type": "string",
"description": "The unique ID of the panel."
},
"type": {
"enum": [
"vis"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-dashboard-section": {
"title": "Section",
"required": [
"title",
"grid"
],
"type": "object",
"properties": {
"collapsed": {
"type": "boolean",
"description": "When `true`, the section is collapsed and its panels are not rendered until expanded. Useful for improving initial load time on large dashboards. Defaults to `false`.",
"default": false
},
"grid": {
"required": [
"y"
],
"type": "object",
"properties": {
"y": {
"type": "number",
"description": "The y coordinate of the section in grid units."
}
},
"additionalProperties": false
},
"id": {
"type": "string",
"description": "The unique ID of the section."
},
"panels": {
"maxItems": 1000,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"aiops_change_point_chart": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart",
"aiops_log_rate_analysis": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis",
"aiops_pattern_analysis": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis",
"apm_service_map": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map",
"custom_content": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content",
"discover_session": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session",
"esql_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control",
"field_stats_table": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table",
"image": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image",
"links": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links",
"markdown": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown",
"ml_anomaly_charts": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts",
"ml_anomaly_swimlane": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane",
"ml_single_metric_viewer": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer",
"options_list_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control",
"range_slider_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control",
"slo_alerts": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts",
"slo_burn_rate": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate",
"slo_error_budget": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget",
"slo_overview": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview",
"synthetics_monitors": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors",
"synthetics_stats_overview": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview",
"time_slider_control": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control",
"vis": "#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis"
}
}
},
"description": "The panels that belong to the section."
},
"title": {
"type": "string",
"description": "The title of the section."
}
},
"additionalProperties": false,
"description": "A collapsible group of panels."
},
"Kibana_HTTP_APIs_kbn-data-service-server-refreshIntervalSchema": {
"title": "Refresh interval",
"required": [
"pause",
"value"
],
"type": "object",
"properties": {
"pause": {
"type": "boolean",
"description": "When `true`, auto-refresh is paused."
},
"value": {
"type": "number",
"description": "The refresh interval in milliseconds."
}
},
"additionalProperties": false,
"description": "Specifies the auto-refresh interval for the object."
},
"Kibana_HTTP_APIs_kbn-data-view-field-setting": {
"title": "Field settings",
"type": "object",
"properties": {
"custom_description": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-description"
},
"custom_label": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-label"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format"
}
},
"additionalProperties": false,
"description": "Display overrides for a field. These settings can define a custom label, description, and format."
},
"Kibana_HTTP_APIs_kbn-data-view-reference-schema": {
"title": "Data view reference",
"required": [
"type",
"ref_id"
],
"type": "object",
"properties": {
"ref_id": {
"type": "string",
"description": "The id of the Kibana data view to use as the data source. Example: \"my-data-view\"."
},
"type": {
"enum": [
"data_view_reference"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-data-view-spec-schema": {
"title": "Data view inline spec",
"required": [
"type",
"index_pattern"
],
"type": "object",
"properties": {
"allow_hidden_indices": {
"title": "Allow hidden and system indices",
"type": "boolean",
"description": "When `true`, allows the data view to match hidden indices."
},
"field_filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-filters-schema"
},
"field_settings": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-settings-entry"
}
},
"index_pattern": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-index-pattern-schema"
},
"name": {
"title": "Data view name",
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The name of the data view. Example: \"Sample data view\"."
},
"time_field": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-time-field-schema"
},
"type": {
"enum": [
"data_view_spec"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema": {
"title": "Time range",
"required": [
"from",
"to"
],
"type": "object",
"properties": {
"from": {
"type": "string",
"description": "The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps."
},
"mode": {
"anyOf": [
{
"enum": [
"absolute"
],
"type": "string"
},
{
"enum": [
"relative"
],
"type": "string"
}
],
"description": "The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`)."
},
"to": {
"type": "string",
"description": "The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps."
}
},
"additionalProperties": false,
"description": "Specifies the time range for a query."
},
"Kibana_HTTP_APIs_kbn-field-custom-description": {
"title": "Custom description",
"minLength": 1,
"type": "string",
"description": "Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages."
},
"Kibana_HTTP_APIs_kbn-field-custom-label": {
"title": "Custom label",
"minLength": 1,
"type": "string",
"description": "Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name."
},
"Kibana_HTTP_APIs_kbn-field-filters-schema": {
"title": "Field filters",
"maxItems": 10000,
"type": "array",
"items": {
"maxLength": 1000,
"minLength": 1,
"type": "string"
},
"description": "Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as `user*` which filters fields starting with 'user'."
},
"Kibana_HTTP_APIs_kbn-field-format": {
"title": "Format",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-boolean"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-bytes"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-color"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-currency"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-date_nanos"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-date"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-duration"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-geo_point"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-histogram"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-ip"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-number"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-percent"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-relative_date"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-static_lookup"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-string"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-truncate"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-url"
},
{
"title": "Extensible format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": { },
"type": {
"type": "string"
}
},
"additionalProperties": false,
"description": "Fallback for custom formatter IDs only. Known formatter IDs must match their dedicated schema and are validated at runtime."
}
],
"description": "Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover."
},
"Kibana_HTTP_APIs_kbn-field-format-boolean": {
"title": "Boolean field format",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"boolean"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a true/false value."
},
"Kibana_HTTP_APIs_kbn-field-format-bytes": {
"title": "Bytes field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"pattern": {
"title": "Numeral pattern",
"type": "string",
"description": "Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more."
}
},
"additionalProperties": false
},
"type": {
"enum": [
"bytes"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a bytes value following the numeral.js format pattern. The default pattern is defined by the format:bytes:defaultPattern advanced setting."
},
"Kibana_HTTP_APIs_kbn-field-format-color": {
"title": "Color field format",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"oneOf": [
{
"required": [
"field_type",
"colors"
],
"type": "object",
"properties": {
"colors": {
"type": "array",
"items": {
"required": [
"text",
"background",
"regex"
],
"type": "object",
"properties": {
"background": {
"title": "Background color",
"type": "string",
"description": "The background color to use for the field."
},
"regex": {
"title": "Regex",
"type": "string",
"description": "When the field type is a string, this regex is used to determine the color."
},
"text": {
"title": "Text color",
"type": "string",
"description": "The text color to use for the field."
}
}
}
},
"field_type": {
"enum": [
"string"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"field_type",
"colors"
],
"type": "object",
"properties": {
"colors": {
"type": "array",
"items": {
"required": [
"text",
"background",
"range"
],
"type": "object",
"properties": {
"background": {
"title": "Background color",
"type": "string",
"description": "The background color to use for the field."
},
"range": {
"title": "Range",
"type": "string",
"description": "When the field type is a number, this range is used to determine the color."
},
"text": {
"title": "Text color",
"type": "string",
"description": "The text color to use for the field."
}
}
}
},
"field_type": {
"enum": [
"number"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"field_type",
"colors"
],
"type": "object",
"properties": {
"colors": {
"type": "array",
"items": {
"required": [
"text",
"background",
"boolean"
],
"type": "object",
"properties": {
"background": {
"title": "Background color",
"type": "string",
"description": "The background color to use for the field."
},
"boolean": {
"title": "Boolean",
"type": "boolean",
"description": "When the field type is a boolean, this boolean is used to determine the color."
},
"text": {
"title": "Text color",
"type": "string",
"description": "The text color to use for the field."
}
}
}
},
"field_type": {
"enum": [
"boolean"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"discriminator": {
"propertyName": "field_type"
}
},
"type": {
"enum": [
"color"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a color value."
},
"Kibana_HTTP_APIs_kbn-field-format-currency": {
"title": "Currency field format",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"currency"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a currency value. The format is determined by the pattern of the format:currency:defaultPattern advanced setting."
},
"Kibana_HTTP_APIs_kbn-field-format-date": {
"title": "Date field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"pattern": {
"title": "Moment.js pattern",
"type": "string",
"description": "Moment.js format pattern. See https://momentjs.com/ to learn more.",
"default": "MMM D, YYYY @ HH:mm:ss.SSS"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"date"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a date value following the defined pattern."
},
"Kibana_HTTP_APIs_kbn-field-format-date_nanos": {
"title": "Date nanos field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"pattern": {
"title": "Moment.js pattern",
"type": "string",
"description": "Moment.js format pattern. See https://momentjs.com/ to learn more.",
"default": "MMM D, YYYY @ HH:mm:ss.SSSSSSSSS"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"date_nanos"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a date nanos value following the defined pattern."
},
"Kibana_HTTP_APIs_kbn-field-format-duration": {
"title": "Duration field format",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"input_format",
"output_format"
],
"type": "object",
"properties": {
"include_space_with_suffix": {
"title": "Include space with suffix",
"type": "boolean",
"description": "When true or not provided, the formatted duration includes a space between the value and suffix. When false, no space is included.",
"default": true
},
"input_format": {
"title": "Input format",
"anyOf": [
{
"title": "Picoseconds",
"enum": [
"picoseconds"
],
"type": "string"
},
{
"title": "Nanoseconds",
"enum": [
"nanoseconds"
],
"type": "string"
},
{
"title": "Microseconds",
"enum": [
"microseconds"
],
"type": "string"
},
{
"title": "Milliseconds",
"enum": [
"milliseconds"
],
"type": "string"
},
{
"title": "Seconds",
"enum": [
"seconds"
],
"type": "string"
},
{
"title": "Minutes",
"enum": [
"minutes"
],
"type": "string"
},
{
"title": "Hours",
"enum": [
"hours"
],
"type": "string"
},
{
"title": "Days",
"enum": [
"days"
],
"type": "string"
},
{
"title": "Weeks",
"enum": [
"weeks"
],
"type": "string"
},
{
"title": "Months",
"enum": [
"months"
],
"type": "string"
},
{
"title": "Years",
"enum": [
"years"
],
"type": "string"
}
],
"description": "The unit of the field value before formatting."
},
"output_format": {
"title": "Output format",
"anyOf": [
{
"title": "Human-readable (approximate)",
"enum": [
"humanize"
],
"type": "string",
"description": "Displays the duration in the largest whole unit that applies, rounded. For example: \"2 hours\" or \"a day\"."
},
{
"title": "Human-readable (precise)",
"enum": [
"humanize_precise"
],
"type": "string",
"description": "Displays the duration in the largest whole unit that applies, with decimal precision. For example: \"2.35 hours\"."
},
{
"title": "Milliseconds",
"enum": [
"as_milliseconds"
],
"type": "string"
},
{
"title": "Seconds",
"enum": [
"as_seconds"
],
"type": "string"
},
{
"title": "Minutes",
"enum": [
"as_minutes"
],
"type": "string"
},
{
"title": "Hours",
"enum": [
"as_hours"
],
"type": "string"
},
{
"title": "Days",
"enum": [
"as_days"
],
"type": "string"
},
{
"title": "Weeks",
"enum": [
"as_weeks"
],
"type": "string"
},
{
"title": "Months",
"enum": [
"as_months"
],
"type": "string"
},
{
"title": "Years",
"enum": [
"as_years"
],
"type": "string"
}
],
"description": "The unit to convert the field value into for display."
},
"output_precision": {
"title": "Output precision",
"type": "number",
"description": "The number of decimal places to display in the duration value.",
"default": 2
},
"show_suffix": {
"title": "Show suffix",
"type": "boolean",
"description": "When true, the formatted duration includes a suffix (such as \"seconds\", \"milliseconds\", or \"years\"). When false or not provided, no suffix is shown."
},
"use_short_suffix": {
"title": "Use short suffix",
"type": "boolean",
"description": "When true, the formatted duration uses short suffixes (such as \"s\", \"ms\", or \"h\"). When false or not provided, full suffixes are used.",
"default": false
}
},
"additionalProperties": false
},
"type": {
"enum": [
"duration"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a duration value."
},
"Kibana_HTTP_APIs_kbn-field-format-geo_point": {
"title": "Geo point field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"required": [
"transform"
],
"type": "object",
"properties": {
"transform": {
"title": "Transform",
"anyOf": [
{
"title": "Lat lon string",
"enum": [
"lat_lon_string"
],
"type": "string",
"description": "Transforms the geo point into a string in the format \"latitude,longitude\". For example \"40.7128,-74.0060\"."
},
{
"title": "WKT",
"enum": [
"wkt"
],
"type": "string",
"description": "Transforms the geo point into a Well-Known Text (WKT) string. For example \"POINT (123.456 78.901)\"."
},
{
"title": "DMS",
"enum": [
"dms"
],
"type": "string",
"description": "Transforms the geo point into a string in the format \"latitude,longitude (degrees, minutes, seconds)\". For example \"40°42′50.2″N 73°59′45.6″W\"."
},
{
"title": "MGRS",
"enum": [
"mgrs"
],
"type": "string",
"description": "Transforms the geo point into a string in the format \"latitude,longitude (Military Grid Reference System)\". For example \"18SUJ1234567890\"."
},
{
"title": "Multi",
"enum": [
"multi"
],
"type": "string",
"description": "Transforms the geo point to all the previous formats. For example: \"Lat Long: 40.7128,-74.0060, WKT: POINT (123.456 78.901), DMS: 40°42′50.2″N 73°59′45.6″W, MGRS: 18SUJ1234567890\"."
}
],
"description": "The transform to apply to the geo point value."
}
},
"additionalProperties": false
},
"type": {
"enum": [
"geo_point"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a geo point value."
},
"Kibana_HTTP_APIs_kbn-field-format-histogram": {
"title": "Histogram field format",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"format"
],
"type": "object",
"properties": {
"format": {
"anyOf": [
{
"enum": [
"bytes"
],
"type": "string"
},
{
"enum": [
"percent"
],
"type": "string"
},
{
"enum": [
"number"
],
"type": "string"
}
]
},
"pattern": {
"title": "Numeral pattern",
"type": "string",
"description": "Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more."
}
},
"additionalProperties": false
},
"type": {
"enum": [
"histogram"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a histogram field into a numeric value following the defined pattern. The default pattern is defined by format:bytes:defaultPattern, format:percent:defaultPattern or format:number:defaultPattern advanced settings depending on the selected format."
},
"Kibana_HTTP_APIs_kbn-field-format-ip": {
"title": "IP field format",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"ip"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into an IP address."
},
"Kibana_HTTP_APIs_kbn-field-format-number": {
"title": "Number field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"pattern": {
"title": "Numeral pattern",
"type": "string",
"description": "Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more."
}
},
"additionalProperties": false
},
"type": {
"enum": [
"number"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a numeric value following the defined pattern. The default pattern is defined by format:number:defaultPattern advanced setting."
},
"Kibana_HTTP_APIs_kbn-field-format-percent": {
"title": "Percent field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"pattern": {
"title": "Numeral pattern",
"type": "string",
"description": "Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more."
}
},
"additionalProperties": false
},
"type": {
"enum": [
"percent"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a percentage value following the defined pattern. The default pattern is defined by format:percent:defaultPattern advanced setting."
},
"Kibana_HTTP_APIs_kbn-field-format-relative_date": {
"title": "Relative date field format",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"relative_date"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a relative date value. For example: \"1 day ago\"."
},
"Kibana_HTTP_APIs_kbn-field-format-static_lookup": {
"title": "Static lookup field format",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"lookup_entries"
],
"type": "object",
"properties": {
"lookup_entries": {
"title": "Lookup entries",
"type": "array",
"items": {
"required": [
"key",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
}
},
"description": "The lookup entries to use for the static lookup. The key refers to the field value, and the value refers to the new value to display."
},
"unknown_key_value": {
"title": "Unknown key value",
"type": "string",
"description": "The value to display for unknown key values. If not provided, the field value will be displayed."
}
},
"additionalProperties": false
},
"type": {
"enum": [
"static_lookup"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a static value based on the lookup entries or the unknown key value."
},
"Kibana_HTTP_APIs_kbn-field-format-string": {
"title": "String field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"transform": {
"anyOf": [
{
"title": "Lower case",
"enum": [
"lower"
],
"type": "string",
"description": "Converts the field value to lowercase. For example: \"Some Text\" -> \"some text\"."
},
{
"title": "Upper case",
"enum": [
"upper"
],
"type": "string",
"description": "Converts the field value to uppercase. For example: \"Some Text\" -> \"SOME TEXT\"."
},
{
"title": "Title",
"enum": [
"title"
],
"type": "string",
"description": "Converts the field value to title case. For example: \"some text\" -> \"Some Text\"."
},
{
"title": "Short dots",
"enum": [
"short"
],
"type": "string",
"description": "Shortens each dot-separated segment of the field value to its first character, except for the last segment. For example: \"dot.notated.string\" -> \"d.n.string\"."
},
{
"title": "Base64 decode",
"enum": [
"base64"
],
"type": "string",
"description": "Decodes the field value from base64. For example: \"U29tZSBUZXh0\" -> \"Some Text\"."
},
{
"title": "URL parameter decode",
"enum": [
"urlparam"
],
"type": "string",
"description": "Decodes the field value from URL parameter. For example: \"Some%20Text\" -> \"Some Text\"."
}
]
}
},
"additionalProperties": false
},
"type": {
"enum": [
"string"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a string value."
},
"Kibana_HTTP_APIs_kbn-field-format-truncate": {
"title": "Truncate field format",
"required": [
"type"
],
"type": "object",
"properties": {
"params": {
"type": "object",
"properties": {
"field_length": {
"type": "number"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"truncate"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Truncates the field value to the specified length. If the field value is longer than the specified length, it will be truncated and the remaining text will be replaced with \"...\"."
},
"Kibana_HTTP_APIs_kbn-field-format-url": {
"title": "URL field format",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"oneOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"label_template": {
"title": "Label template",
"type": "string",
"description": "The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{url}}. For example: \"{{value}}\"."
},
"open_link_in_current_tab": {
"title": "Open link in current tab",
"type": "boolean",
"description": "When true, the URL opens in the current tab. When false or not provided, the URL opens in a new tab."
},
"type": {
"title": "Link",
"enum": [
"a"
],
"type": "string",
"description": "Displays the field value as a hyperlink."
},
"url_template": {
"title": "URL template",
"type": "string",
"description": "The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{risonValue}}. Use {{risonValue}} when embedding the field value inside Kibana app URL rison state (for example: query:'{{risonValue}}'). For example: \"https://example.com/{{value}}\"."
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"height": {
"title": "Height",
"type": "number",
"description": "The height of the image. If not provided, the image will be displayed at the original height."
},
"label_template": {
"title": "Label template",
"type": "string",
"description": "The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{url}}. For example: \"{{value}}\"."
},
"type": {
"title": "Image",
"enum": [
"img"
],
"type": "string",
"description": "Displays the field value as an image."
},
"url_template": {
"title": "URL template",
"type": "string",
"description": "The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{risonValue}}. Use {{risonValue}} when embedding the field value inside Kibana app URL rison state (for example: query:'{{risonValue}}'). For example: \"https://example.com/{{value}}\"."
},
"width": {
"title": "Width",
"type": "number",
"description": "The width of the image. If not provided, the image will be displayed at the original width."
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"label_template": {
"title": "Label template",
"type": "string",
"description": "The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{url}}. For example: \"{{value}}\"."
},
"type": {
"title": "Audio",
"enum": [
"audio"
],
"type": "string",
"description": "Displays the field value as an audio player."
},
"url_template": {
"title": "URL template",
"type": "string",
"description": "The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{risonValue}}. Use {{risonValue}} when embedding the field value inside Kibana app URL rison state (for example: query:'{{risonValue}}'). For example: \"https://example.com/{{value}}\"."
}
},
"additionalProperties": false
}
],
"discriminator": {
"propertyName": "type"
}
},
"type": {
"enum": [
"url"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Formats a field into a link, image or audio."
},
"Kibana_HTTP_APIs_kbn-field-settings-entry": {
"title": "Field settings or runtime field",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-composite-runtime-field-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-field-setting"
}
],
"description": "Display overrides for an indexed field, or a runtime field definition when `type` is set to a runtime field kind."
},
"Kibana_HTTP_APIs_kbn-index-pattern-schema": {
"title": "Index pattern",
"minLength": 1,
"type": "string",
"description": "The index pattern (Elasticsearch index expression) to use as the data source. Example: \"my-index-*\"."
},
"Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink": {
"required": [
"type",
"destination"
],
"type": "object",
"properties": {
"destination": {
"type": "string",
"description": "Linked dashboard saved object ID."
},
"label": {
"type": "string",
"description": "The label of the link displayed in the UI."
},
"options": {
"type": "object",
"properties": {
"open_in_new_tab": {
"type": "boolean",
"description": "When enabled, the dashboard opens in a new browser tab.",
"default": false
},
"use_filters": {
"type": "boolean",
"description": "When enabled, filters are passed to the opening dashboard.",
"default": true
},
"use_time_range": {
"type": "boolean",
"description": "When enabled, time range is passed to the opening dashboard.",
"default": true
}
},
"additionalProperties": false,
"default": {
"open_in_new_tab": false,
"use_filters": true,
"use_time_range": true
}
},
"type": {
"enum": [
"dashboardLink"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Link type. Set to dashboardLink for a link to another dashboard."
},
"Kibana_HTTP_APIs_kbn-link-type-externalLink": {
"required": [
"type",
"destination"
],
"type": "object",
"properties": {
"destination": {
"type": "string",
"description": "The external URL to link to."
},
"label": {
"type": "string",
"description": "The label of the link displayed in the UI."
},
"options": {
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "Whether to escape the URL with percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"description": "Whether to open this link in a new tab when clicked.",
"default": true
}
},
"additionalProperties": false,
"default": {
"encode_url": true,
"open_in_new_tab": true
}
},
"type": {
"enum": [
"externalLink"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Link type. Set to externalLink for a URL outside Kibana."
},
"Kibana_HTTP_APIs_kbn-runtime-field-base-schema": {
"title": "Runtime field base",
"required": [
"type"
],
"type": "object",
"properties": {
"custom_description": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-description"
},
"custom_label": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-label"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format"
},
"type": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-type"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-runtime-field-schema": {
"title": "Runtime field",
"required": [
"type"
],
"type": "object",
"properties": {
"custom_description": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-description"
},
"custom_label": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-label"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-field-format"
},
"script": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-script"
},
"type": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-type"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-runtime-field-script": {
"title": "Script",
"minLength": 1,
"type": "string",
"description": "The script that defines the runtime field. This should be a painless script that computes the field value at query time. Runtime fields without a script retrieve values from _source. If the field doesn't exist in _source, a search request returns no value."
},
"Kibana_HTTP_APIs_kbn-runtime-field-type": {
"title": "Type",
"enum": [
"keyword",
"long",
"double",
"date",
"ip",
"boolean",
"geo_point"
],
"type": "string",
"description": "The type of the runtime field (e.g., \"keyword\", \"long\", \"date\")."
},
"Kibana_HTTP_APIs_kbn-tags-attributes": {
"required": [
"name",
"color"
],
"type": "object",
"properties": {
"color": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The tag color as a hex value (e.g. `#772299`). If omitted, a random color is generated."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Optional description of the tag."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The display name of the tag."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-tags-request-attributes": {
"required": [
"name"
],
"type": "object",
"properties": {
"color": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The tag color as a hex value (e.g. `#772299`). If omitted, a random color is generated."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Optional description of the tag."
},
"name": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The display name of the tag."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_kbn-time-field-schema": {
"title": "Time field",
"type": "string",
"description": "The name of the time field in the index. Used for time-based filtering. Example: \"@timestamp\"."
},
"Kibana_HTTP_APIs_kibana_asset_reference": {
"title": "kibana_asset_reference",
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"deferred": {
"type": "boolean"
},
"id": {
"type": "string"
},
"originId": {
"type": "string"
},
"type": {
"anyOf": [
{
"enum": [
"dashboard",
"lens",
"visualization",
"search",
"index-pattern",
"map",
"ml-module",
"security-rule",
"csp-rule-template",
"osquery-pack-asset",
"osquery-saved-query",
"tag"
],
"type": "string"
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_legacyMetricLibItemNoESQL": {
"title": "Legacy Metric Chart (library)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"apply_color_to": {
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValueAbsolute"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValuePalette"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegacyColorByValueAbsolute"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration based on the metric value.",
"default": {
"type": "auto"
}
},
"labels": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"top",
"bottom"
],
"type": "string",
"description": "Label alignment",
"default": "top"
}
},
"additionalProperties": false,
"description": "Labels configuration"
},
"size": {
"anyOf": [
{
"enum": [
"xs"
],
"type": "string"
},
{
"enum": [
"s"
],
"type": "string"
},
{
"enum": [
"m"
],
"type": "string"
},
{
"enum": [
"l"
],
"type": "string"
},
{
"enum": [
"xl"
],
"type": "string"
},
{
"enum": [
"xxl"
],
"type": "string"
}
],
"description": "Font size for the label and value",
"default": "m"
},
"values": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Value alignment",
"default": "left"
}
},
"additionalProperties": false,
"description": "Values configuration"
}
},
"additionalProperties": false
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"legacy_metric"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_lensApiConfigLibItemNoESQL": {
"title": "Library Visualization Item",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_metricLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_legacyMetricLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_xyLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_gaugeLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_heatmapLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_tagcloudLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_regionMapLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_datatableLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_pieLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_mosaicLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_treemapLibItemNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_waffleLibItemNoESQL"
}
]
},
"Kibana_HTTP_APIs_LinksItemResponse": {
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"required": [
"links",
"title"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"layout": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Whether to display the links in a horizontal or vertical layout."
},
"links": {
"maxItems": 100,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"dashboardLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink",
"externalLink": "#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink"
}
}
},
"description": "The list of links to display."
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs associated with this library item.",
"default": [ ]
},
"title": {
"type": "string"
}
},
"additionalProperties": false
},
"id": {
"maxLength": 250,
"type": "string",
"description": "The unique ID of the links library item, as returned by the create or search endpoints."
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false,
"description": "Response containing a links library item with metadata."
},
"Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting": {
"title": "Log threshold",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Log Threshold Rule Params",
"anyOf": [
{
"required": [
"criteria",
"count",
"timeUnit",
"timeSize",
"logView"
],
"type": "object",
"properties": {
"count": {
"required": [
"comparator",
"value"
],
"type": "object",
"properties": {
"comparator": {
"enum": [
"more than",
"more than or equals",
"less than",
"less than or equals",
"equals",
"does not equal",
"matches",
"does not match",
"matches phrase",
"does not match phrase"
],
"type": "string"
},
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"criteria": {
"type": "array",
"items": {
"required": [
"field",
"comparator",
"value"
],
"type": "object",
"properties": {
"comparator": {
"enum": [
"more than",
"more than or equals",
"less than",
"less than or equals",
"equals",
"does not equal",
"matches",
"does not match",
"matches phrase",
"does not match phrase"
],
"type": "string"
},
"field": {
"type": "string"
},
"value": {
"type": [
"number",
"string"
]
}
},
"additionalProperties": false
}
},
"groupBy": {
"type": "array",
"items": {
"type": "string"
}
},
"logView": {
"required": [
"logViewId",
"type"
],
"type": "object",
"properties": {
"logViewId": {
"type": "string"
},
"type": {
"enum": [
"log-view-reference"
],
"type": "string"
}
},
"additionalProperties": false
},
"timeSize": {
"type": "number"
},
"timeUnit": {
"enum": [
"s",
"m",
"h",
"d"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"criteria",
"count",
"timeUnit",
"timeSize",
"logView"
],
"type": "object",
"properties": {
"count": {
"required": [
"comparator",
"value"
],
"type": "object",
"properties": {
"comparator": {
"enum": [
"more than",
"more than or equals",
"less than",
"less than or equals",
"equals",
"does not equal",
"matches",
"does not match",
"matches phrase",
"does not match phrase"
],
"type": "string"
},
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"criteria": {
"maxItems": 2,
"minItems": 2,
"type": "array",
"items": {
"type": "array",
"items": {
"required": [
"field",
"comparator",
"value"
],
"type": "object",
"properties": {
"comparator": {
"enum": [
"more than",
"more than or equals",
"less than",
"less than or equals",
"equals",
"does not equal",
"matches",
"does not match",
"matches phrase",
"does not match phrase"
],
"type": "string"
},
"field": {
"type": "string"
},
"value": {
"type": [
"number",
"string"
]
}
},
"additionalProperties": false
}
}
},
"groupBy": {
"type": "array",
"items": {
"type": "string"
}
},
"logView": {
"required": [
"logViewId",
"type"
],
"type": "object",
"properties": {
"logViewId": {
"type": "string"
},
"type": {
"enum": [
"log-view-reference"
],
"type": "string"
}
},
"additionalProperties": false
},
"timeSize": {
"type": "number"
},
"timeUnit": {
"enum": [
"s",
"m",
"h",
"d"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "The parameters for the log threshold rule. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`."
},
"rule_type_id": {
"enum": [
"logs.alert.document.count"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_response": {
"title": "maintenance_window_response",
"required": [
"id",
"title",
"enabled",
"created_at",
"updated_at",
"status",
"schedule"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"description": "The date and time when the maintenance window was created."
},
"created_by": {
"type": [
"null",
"string"
],
"description": "The identifier for the user that created the maintenance window.",
"default": "null"
},
"enabled": {
"type": "boolean",
"description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications."
},
"id": {
"type": "string",
"description": "The identifier for the maintenance window."
},
"schedule": {
"required": [
"custom"
],
"type": "object",
"properties": {
"custom": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_response"
}
},
"additionalProperties": false
},
"scope": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_scope"
},
"status": {
"enum": [
"running",
"upcoming",
"finished",
"archived",
"disabled"
],
"type": "string",
"description": "The current status of the maintenance window."
},
"title": {
"type": "string",
"description": "The name of the maintenance window."
},
"updated_at": {
"type": "string",
"description": "The date and time when the maintenance window was last updated."
},
"updated_by": {
"type": [
"null",
"string"
],
"description": "The identifier for the user that last updated this maintenance window.",
"default": "null"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_schedule_recurring_request": {
"title": "maintenance_window_schedule_recurring_request",
"type": "object",
"properties": {
"end": {
"maxLength": 100,
"type": "string",
"description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`."
},
"every": {
"maxLength": 100,
"type": "string",
"description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`."
},
"occurrences": {
"minimum": 1,
"type": "number",
"description": "The total number of recurrences of the schedule."
},
"onMonth": {
"maxItems": 12,
"minItems": 1,
"type": "array",
"items": {
"maximum": 12,
"minimum": 1,
"type": "number"
},
"description": "The specific months for a recurring schedule. Valid values are 1-12."
},
"onMonthDay": {
"maxItems": 31,
"minItems": 1,
"type": "array",
"items": {
"maximum": 31,
"minimum": -1,
"type": "number"
},
"description": "The specific days of the month for a recurring schedule. Valid values are `1` to `31`, or `-1` for the last day of the month."
},
"onWeekDay": {
"maxItems": 77,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 10,
"type": "string"
},
"description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_schedule_recurring_response": {
"title": "maintenance_window_schedule_recurring_response",
"type": "object",
"properties": {
"end": {
"type": "string",
"description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`."
},
"every": {
"type": "string",
"description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`."
},
"occurrences": {
"type": "number",
"description": "The total number of recurrences of the schedule."
},
"onMonth": {
"maxItems": 12,
"type": "array",
"items": {
"type": "number"
},
"description": "The specific months for a recurring schedule. Valid values are 1-12."
},
"onMonthDay": {
"maxItems": 31,
"type": "array",
"items": {
"type": "number"
},
"description": "The specific days of the month for a recurring schedule. Valid values are `1` to `31`, or `-1` for the last day of the month."
},
"onWeekDay": {
"maxItems": 77,
"type": "array",
"items": {
"maxLength": 10,
"type": "string"
},
"description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_schedule_request": {
"title": "maintenance_window_schedule_request",
"required": [
"start",
"duration"
],
"type": "object",
"properties": {
"duration": {
"maxLength": 100,
"type": "string",
"description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`."
},
"recurring": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_recurring_request"
},
"start": {
"maxLength": 100,
"type": "string",
"description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`."
},
"timezone": {
"maxLength": 64,
"type": "string",
"description": "The timezone of the schedule. The default timezone is UTC."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_schedule_response": {
"title": "maintenance_window_schedule_response",
"required": [
"start",
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string",
"description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`."
},
"recurring": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_recurring_response"
},
"start": {
"type": "string",
"description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`."
},
"timezone": {
"type": "string",
"description": "The timezone of the schedule. The default timezone is UTC."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_scope": {
"title": "maintenance_window_scope",
"required": [
"alerting"
],
"type": "object",
"properties": {
"alerting": {
"required": [
"query"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether this maintenance window applies to Alerting V1 alerts. If omitted, is treated as `true`."
},
"query": {
"required": [
"kql"
],
"type": "object",
"properties": {
"kql": {
"type": "string",
"description": "A filter written in Kibana Query Language (KQL). Only alerts matching this query will be suppressed by the maintenance window."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Settings that control how this maintenance window affects Alerting V1 alerts, including an optional KQL filter. Always returned when scope is returned. Check `enabled` to see whether the maintenance window affects these alerts."
},
"alerting_v2": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether the maintenance window applies to Alerting V2 alerts. If omitted, is treated as `true`."
},
"query": {
"required": [
"kql"
],
"type": "object",
"properties": {
"kql": {
"maxLength": 4096,
"type": "string",
"description": "A KQL filter that limits which Alerting V2 alerts this maintenance window affects. It can filter on `alert_id`, `alert_status`, `group_hash`, `last_event_timestamp`, `severity`, and `data.*`. Matching alerts don't send notifications while the window is active. If query isn't returned, the window affects all Alerting V2 alerts."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Settings that control how this maintenance window affects Alerting V2 alerts, including an optional KQL filter. If you omit `alerting_v2`, the maintenance window doesn't affect Alerting V2 alerts."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_maintenance_window_scope_request": {
"title": "maintenance_window_scope_request",
"type": "object",
"properties": {
"alerting": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether this maintenance window applies to Alerting V1 alerts. If omitted, is treated as `true`."
},
"query": {
"required": [
"kql"
],
"type": "object",
"properties": {
"kql": {
"maxLength": 10000,
"type": "string",
"description": "A KQL filter that limits which Alerting V1 alerts this maintenance window affects. Matching alerts don't run rule actions while the window is active. If you omit query, the window affects all alerts."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Settings that control how this maintenance window affects Alerting V1 alerts, including an optional KQL filter. If you include `scope` but omit `alerting`, the maintenance window doesn't affect these alerts."
},
"alerting_v2": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether this maintenance window affects Alerting V2 alerts. Defaults to `true`."
},
"query": {
"required": [
"kql"
],
"type": "object",
"properties": {
"kql": {
"maxLength": 4096,
"type": "string",
"description": "A KQL filter that limits which Alerting V2 alerts this maintenance window affects. You can filter on `alert_id`, `alert_status`, `group_hash`, `last_event_timestamp`, `severity`, and `data.*`. Matching alerts don't send notifications while the window is active. If you omit query, the window affects all Alerting V2 alerts."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Settings that control how this maintenance window affects Alerting V2 alerts, including an optional KQL filter. If you omit `alerting_v2`, the maintenance window doesn't affect Alerting V2 alerts."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_managed_integration": {
"title": "managed_integration",
"required": [
"id",
"name",
"package",
"inputs",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Additional data stream permissions granted to the managed integration."
},
"cloud_connector": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_managed_integration_cloud_connector"
}
]
},
"created_at": {
"maxLength": 64,
"type": "string",
"description": "Creation timestamp (ISO 8601)."
},
"created_by": {
"maxLength": 1024,
"type": "string",
"description": "User who created the policy."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Managed integration description."
},
"global_data_tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"maxLength": 1024,
"type": "string",
"description": "The name of the custom field."
},
"value": {
"anyOf": [
{
"maxLength": 1024,
"type": "string"
},
{
"type": "number"
}
],
"description": "The value of the custom field."
}
},
"additionalProperties": false
},
"description": "Custom data tags applied to all data produced by this policy."
},
"id": {
"maxLength": 255,
"type": "string",
"description": "Managed integration unique identifier."
},
"inputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that input. Defaults to `true` (enabled)."
},
"streams": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that stream. Defaults to `true` (enabled)."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Input streams. Refer to the integration documentation to know which streams are available."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Package policy inputs. Refer to the integration documentation to know which inputs are available."
},
"name": {
"maxLength": 255,
"type": "string",
"description": "Managed integration name."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "Policy namespace. Defaults to the agent policy namespace."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_managed_integration_package"
},
"updated_at": {
"maxLength": 64,
"type": "string",
"description": "Last update timestamp (ISO 8601)."
},
"updated_by": {
"maxLength": 1024,
"type": "string",
"description": "User who last updated the policy."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_managed_integration_cloud_connector": {
"title": "managed_integration_cloud_connector",
"required": [
"enabled",
"cloud_connector_id"
],
"type": "object",
"properties": {
"cloud_connector_id": {
"maxLength": 255,
"type": "string",
"description": "The ID of the cloud connector."
},
"enabled": {
"type": "boolean",
"description": "Whether the cloud connector is active for this policy."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_managed_integration_package": {
"title": "managed_integration_package",
"required": [
"name",
"title",
"version"
],
"type": "object",
"properties": {
"name": {
"maxLength": 255,
"type": "string",
"description": "Integration package name."
},
"title": {
"maxLength": 255,
"type": "string",
"description": "Integration package display title."
},
"version": {
"maxLength": 50,
"type": "string",
"description": "Integration package version."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_managed_integration_response": {
"title": "managed_integration_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_managed_integration"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request": {
"title": "managed_integration_upgrade_dry_run_request",
"required": [
"policyIds"
],
"type": "object",
"properties": {
"pkgVersion": {
"maxLength": 256,
"type": "string",
"description": "Target package version to preview the upgrade against. Defaults to the installed package version."
},
"policyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
},
"description": "IDs of the managed integrations to preview upgrading."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_result": {
"title": "managed_integration_upgrade_dry_run_result",
"required": [
"id",
"hasErrors"
],
"type": "object",
"properties": {
"body": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"maxLength": 4096,
"type": "string",
"description": "Error message when the dry-run failed for this policy."
}
},
"additionalProperties": false
},
"currentVersion": {
"maxLength": 256,
"type": "string",
"description": "The current installed package version of the policy."
},
"errors": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"maxLength": 4096,
"type": "string",
"description": "Human-readable migration error."
}
},
"additionalProperties": false
},
"description": "Migration errors encountered while computing the upgrade."
},
"hasErrors": {
"type": "boolean",
"description": "Whether the dry-run migration produced any errors."
},
"id": {
"maxLength": 256,
"type": "string",
"description": "The ID of the managed integration."
},
"name": {
"maxLength": 256,
"type": "string",
"description": "The name of the managed integration."
},
"proposedPolicy": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_managed_integration"
},
"proposedVersion": {
"maxLength": 256,
"type": "string",
"description": "The package version the policy would be upgraded to."
},
"statusCode": {
"type": "number",
"description": "HTTP-like status code when the dry-run failed for this policy."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_metricLibItemNoESQL": {
"title": "Metric Chart (library)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"breakdown_by": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"columns": {
"type": "number",
"description": "Number of columns.",
"default": 3
}
},
"additionalProperties": false
}
]
},
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metrics": {
"maxItems": 2,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"apply_color_to": {
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
"background_chart": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryViz"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for the primary metric value or background.",
"default": {
"type": "auto"
}
},
"subtitle": {
"type": "string",
"description": "Subtitle below the primary metric value."
},
"type": {
"enum": [
"primary"
],
"type": "string"
}
}
}
]
},
{
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNoColor"
}
],
"default": {
"type": "none"
}
},
"compare": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToBaseline"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToPrimary"
}
],
"description": "Compare the secondary metric to a baseline value or to the primary metric."
},
"type": {
"enum": [
"secondary"
],
"type": "string"
}
}
}
]
}
]
},
"description": "Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"metric"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting": {
"title": "Metric inventory threshold",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Metric Inventory Threshold Rule Params",
"required": [
"criteria",
"nodeType",
"sourceId"
],
"type": "object",
"properties": {
"alertOnNoData": {
"type": "boolean"
},
"criteria": {
"type": "array",
"items": {
"required": [
"threshold",
"comparator",
"timeUnit",
"timeSize",
"metric"
],
"type": "object",
"properties": {
"comparator": {
"type": "string"
},
"customMetric": {
"required": [
"type",
"id",
"field",
"aggregation"
],
"type": "object",
"properties": {
"aggregation": {
"type": "string"
},
"field": {
"type": "string"
},
"id": {
"type": "string"
},
"label": {
"type": "string"
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false
},
"metric": {
"type": "string"
},
"threshold": {
"type": "array",
"items": {
"type": "number"
}
},
"timeSize": {
"type": "number"
},
"timeUnit": {
"type": "string"
},
"warningComparator": {
"type": "string"
},
"warningThreshold": {
"type": "array",
"items": {
"type": "number"
}
}
},
"additionalProperties": false
}
},
"filterQuery": {
"type": "string"
},
"nodeType": {
"type": "string"
},
"schema": {
"type": "string"
},
"sourceId": {
"type": "string"
}
},
"description": "The parameters for the metric inventory threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.inventory.threshold`."
},
"rule_type_id": {
"enum": [
"metrics.alert.inventory.threshold"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting": {
"title": "Metric threshold",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Metric Threshold Rule Params",
"required": [
"criteria",
"sourceId"
],
"type": "object",
"properties": {
"alertOnGroupDisappear": {
"type": "boolean",
"description": "If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically."
},
"alertOnNoData": {
"type": "boolean",
"description": "If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails."
},
"criteria": {
"type": "array",
"items": {
"anyOf": [
{
"required": [
"threshold",
"comparator",
"timeUnit",
"timeSize",
"aggType"
],
"type": "object",
"properties": {
"aggType": {
"enum": [
"count"
],
"type": "string"
},
"comparator": {
"type": "string"
},
"threshold": {
"type": "array",
"items": {
"type": "number"
},
"description": "The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values."
},
"timeSize": {
"type": "number",
"description": "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"timeUnit": {
"type": "string",
"description": "The type of units for the time window: seconds, minutes, hours, or days."
},
"warningComparator": {
"type": "string"
},
"warningThreshold": {
"type": "array",
"items": {
"type": "number",
"description": "The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values."
}
}
},
"additionalProperties": false
},
{
"required": [
"threshold",
"comparator",
"timeUnit",
"timeSize",
"metric",
"aggType"
],
"type": "object",
"properties": {
"aggType": {
"type": "string"
},
"comparator": {
"type": "string"
},
"metric": {
"type": "string"
},
"threshold": {
"type": "array",
"items": {
"type": "number"
},
"description": "The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values."
},
"timeSize": {
"type": "number",
"description": "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"timeUnit": {
"type": "string",
"description": "The type of units for the time window: seconds, minutes, hours, or days."
},
"warningComparator": {
"type": "string"
},
"warningThreshold": {
"type": "array",
"items": {
"type": "number",
"description": "The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values."
}
}
},
"additionalProperties": false
},
{
"required": [
"threshold",
"comparator",
"timeUnit",
"timeSize",
"aggType",
"customMetrics"
],
"type": "object",
"properties": {
"aggType": {
"enum": [
"custom"
],
"type": "string"
},
"comparator": {
"type": "string"
},
"customMetrics": {
"type": "array",
"items": {
"anyOf": [
{
"required": [
"name",
"aggType",
"field"
],
"type": "object",
"properties": {
"aggType": {
"type": "string"
},
"field": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"name",
"aggType"
],
"type": "object",
"properties": {
"aggType": {
"enum": [
"count"
],
"type": "string"
},
"filter": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
]
}
},
"equation": {
"type": "string"
},
"label": {
"type": "string"
},
"threshold": {
"type": "array",
"items": {
"type": "number"
},
"description": "The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values."
},
"timeSize": {
"type": "number",
"description": "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection."
},
"timeUnit": {
"type": "string",
"description": "The type of units for the time window: seconds, minutes, hours, or days."
},
"warningComparator": {
"type": "string"
},
"warningThreshold": {
"type": "array",
"items": {
"type": "number",
"description": "The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values."
}
}
},
"additionalProperties": false
}
]
}
},
"filterQuery": {
"type": "string",
"description": "A query that limits the scope of the rule. The rule evaluates only metric data that matches the query."
},
"groupBy": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host. IMPORTANT: If you include the same field in both the `filterQuery` and `groupBy`, you might receive fewer results than you expect. For example, if you filter by `cloud.region: us-east`, grouping by `cloud.region` will have no effect because the filter query can match only one region."
},
"sourceId": {
"type": "string"
}
},
"description": "The parameters for the metric threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.threshold`."
},
"rule_type_id": {
"enum": [
"metrics.alert.threshold"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_ml_anomaly_charts": {
"required": [
"job_ids"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"job_ids": {
"maxItems": 10000,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 2048,
"minLength": 1,
"type": "string"
},
"description": "Anomaly detection job or group IDs whose results are shown in the charts."
},
"max_series_to_plot": {
"maximum": 50,
"minimum": 1,
"type": "number",
"description": "Maximum number of anomaly series to plot."
},
"severity_threshold": {
"maxItems": 5,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"min",
"max"
],
"type": "object",
"properties": {
"max": {
"enum": [
3
],
"type": "number"
},
"min": {
"enum": [
0
],
"type": "number"
}
},
"additionalProperties": false
},
{
"required": [
"min",
"max"
],
"type": "object",
"properties": {
"max": {
"enum": [
25
],
"type": "number"
},
"min": {
"enum": [
3
],
"type": "number"
}
},
"additionalProperties": false
},
{
"required": [
"min",
"max"
],
"type": "object",
"properties": {
"max": {
"enum": [
50
],
"type": "number"
},
"min": {
"enum": [
25
],
"type": "number"
}
},
"additionalProperties": false
},
{
"required": [
"min",
"max"
],
"type": "object",
"properties": {
"max": {
"enum": [
75
],
"type": "number"
},
"min": {
"enum": [
50
],
"type": "number"
}
},
"additionalProperties": false
},
{
"required": [
"min"
],
"type": "object",
"properties": {
"min": {
"maximum": 100,
"minimum": 0,
"type": "number"
}
},
"additionalProperties": false
}
]
},
"description": "Severity threshold ranges used to filter anomaly results."
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Anomaly Charts embeddable"
},
"Kibana_HTTP_APIs_ml_anomaly_swimlane": {
"anyOf": [
{
"required": [
"job_ids",
"swimlane_type"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"job_ids": {
"maxItems": 10000,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 2048,
"minLength": 1,
"type": "string"
},
"description": "IDs of the anomaly detection jobs or groups whose results are shown in the swim lane."
},
"per_page": {
"minimum": 1,
"type": "number",
"description": "Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes."
},
"severity_threshold": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "Minimum anomaly score (0–100) to show in the swim lane. Anomalies with scores at or above this value are displayed."
},
"swimlane_type": {
"enum": [
"overall"
],
"type": "string"
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false
},
{
"required": [
"job_ids",
"swimlane_type",
"view_by"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"job_ids": {
"maxItems": 10000,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 2048,
"minLength": 1,
"type": "string"
},
"description": "IDs of the anomaly detection jobs or groups whose results are shown in the swim lane."
},
"per_page": {
"minimum": 1,
"type": "number",
"description": "Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes."
},
"severity_threshold": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "Minimum anomaly score (0–100) to show in the swim lane. Anomalies with scores at or above this value are displayed."
},
"swimlane_type": {
"enum": [
"viewBy"
],
"type": "string"
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
},
"view_by": {
"maxLength": 2048,
"minLength": 1,
"type": "string",
"description": "Field name used to split anomalies into a view-by swim lane."
}
},
"additionalProperties": false
}
],
"description": "Anomaly Swim Lane embeddable"
},
"Kibana_HTTP_APIs_ml_single_metric_viewer": {
"required": [
"job_ids"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"forecast_id": {
"maxLength": 2048,
"type": "string",
"description": "Identifier of a forecast to overlay on the chart."
},
"function_description": {
"maxLength": 2048,
"type": "string",
"description": "For detectors that use the `metric` function, selects which value to plot: `min`, `max`, or `mean`. Ignored for other detector functions. When omitted, the viewer derives a default from the highest-scoring anomaly record."
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"job_ids": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 2048,
"minLength": 1,
"type": "string"
},
"description": "Anomaly detection job ID whose results are shown in the single metric viewer."
},
"selected_detector_index": {
"minimum": 0,
"type": "number",
"description": "Zero-based index of the detector (the Elasticsearch detector_index) within the job whose results are shown.",
"default": 0
},
"selected_entities": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
}
]
},
"description": "Values of the partition, by, or over fields that identify the single time series to display."
},
"time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "Single Metric Viewer embeddable"
},
"Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting": {
"title": "Cluster health",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Cluster Health Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the cluster health rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_cluster_health`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_cluster_health"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting": {
"title": "CPU usage",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "CPU Usage Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the CPU usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_cpu_usage`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_cpu_usage"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting": {
"title": "Disk usage",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Disk Usage Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the disk usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_disk_usage`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_disk_usage"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting": {
"title": "Elasticsearch version mismatch",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "ES Version Mismatch Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the ES version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_elasticsearch_version_mismatch`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_elasticsearch_version_mismatch"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting": {
"title": "JVM memory usage",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Memory Usage Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the memory usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_jvm_memory_usage`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_jvm_memory_usage"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting": {
"title": "Kibana version mismatch",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Kibana Version Mismatch Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the Kibana version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_kibana_version_mismatch`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_kibana_version_mismatch"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting": {
"title": "License expiration",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "License Expiration Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the license expiration rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_license_expiration`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_license_expiration"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting": {
"title": "Logstash version mismatch",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Logstash Version Mismatch Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the logstash version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_logstash_version_mismatch`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_logstash_version_mismatch"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting": {
"title": "Missing monitoring data",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Missing Monitoring Data Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the missing monitoring data rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_missing_monitoring_data`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_missing_monitoring_data"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting": {
"title": "Nodes changed",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Nodes Changed Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the nodes changed rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_nodes_changed`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_nodes_changed"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting": {
"title": "Thread pool search rejections",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Thread Pool Search Rejections Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"additionalProperties": false,
"description": "The parameters for the thread pool search rejections rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_thread_pool_search_rejections`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_thread_pool_search_rejections"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting": {
"title": "Thread pool write rejections",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Thread Pool Write Rejections Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"additionalProperties": false,
"description": "The parameters for the thread pool write rejections rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_thread_pool_write_rejections`."
},
"rule_type_id": {
"enum": [
"monitoring_alert_thread_pool_write_rejections"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting": {
"title": "CCR read exceptions",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "CCR Read Exceptions Rule Params",
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the CCR read exceptions rule. These parameters are appropriate when `rule_type_id` is `monitoring_ccr_read_exceptions`."
},
"rule_type_id": {
"enum": [
"monitoring_ccr_read_exceptions"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting": {
"title": "Large shard size",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Large Shard Size Rule Params",
"required": [
"duration",
"indexPattern"
],
"type": "object",
"properties": {
"duration": {
"type": "string"
},
"filterQuery": {
"type": "string"
},
"filterQueryText": {
"type": "string"
},
"indexPattern": {
"type": "string"
},
"limit": {
"type": "string"
},
"threshold": {
"type": "number"
}
},
"description": "The parameters for the large shard size rule. These parameters are appropriate when `rule_type_id` is `monitoring_shard_size`."
},
"rule_type_id": {
"enum": [
"monitoring_shard_size"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_mosaicLibItemNoESQL": {
"title": "Mosaic Chart (library)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_breakdown_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
}
}
}
]
},
"description": "Array of group breakdown dimensions (minimum 1)"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
},
"additionalProperties": false
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicLegend"
},
"metric": {
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"mosaic"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_agent_policy": {
"title": "new_agent_policy",
"required": [
"name",
"namespace"
],
"type": "object",
"properties": {
"advanced_settings": {
"type": "object",
"properties": {
"agent_download_target_directory": { },
"agent_download_timeout": { },
"agent_features_disable_policy_change_acks_enabled": { },
"agent_features_include_tags_in_events_enabled": { },
"agent_internal": { },
"agent_limits_go_max_procs": { },
"agent_logging_files_interval": { },
"agent_logging_files_keepfiles": { },
"agent_logging_files_rotateeverybytes": { },
"agent_logging_level": { },
"agent_logging_metrics_period": { },
"agent_logging_to_files": { },
"agent_monitoring_runtime_experimental": { }
},
"additionalProperties": false
},
"agent_features": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"agentless": {
"type": "object",
"properties": {
"cloud_connectors": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"target_csp": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string"
}
},
"additionalProperties": false
},
"cluster_id": {
"type": "string"
},
"resources": {
"type": "object",
"properties": {
"requests": {
"type": "object",
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"data_output_id": {
"type": [
"null",
"string"
]
},
"description": {
"type": "string"
},
"download_source_id": {
"type": [
"null",
"string"
],
"description": "Use `download_source_ids` instead",
"deprecated": true
},
"download_source_ids": {
"maxItems": 3,
"type": "array",
"items": {
"maxLength": 500,
"type": "string",
"description": "A download source ID, or the reserved value 'default' to dynamically reference whichever source is currently set as default."
}
},
"fleet_server_host_id": {
"type": [
"null",
"string"
]
},
"force": {
"type": "boolean"
},
"global_data_tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"value": {
"type": [
"number",
"string"
]
}
},
"additionalProperties": false
},
"description": "User defined data tags that are added to all of the inputs. The values can be strings or numbers."
},
"has_agent_version_conditions": {
"type": "boolean"
},
"has_fleet_server": {
"type": "boolean"
},
"id": {
"type": "string"
},
"inactivity_timeout": {
"minimum": 0,
"type": "number",
"default": 1209600
},
"is_default": {
"type": "boolean"
},
"is_default_fleet_server": {
"type": "boolean"
},
"is_managed": {
"type": "boolean"
},
"is_protected": {
"type": "boolean"
},
"is_verifier": {
"type": "boolean"
},
"keep_monitoring_alive": {
"type": [
"null",
"boolean"
],
"description": "When set to true, monitoring will be enabled but logs/metrics collection will be disabled"
},
"min_agent_version": {
"type": [
"null",
"string"
]
},
"monitoring_diagnostics": {
"type": "object",
"properties": {
"limit": {
"type": "object",
"properties": {
"burst": {
"type": "number"
},
"interval": {
"type": "string"
}
},
"additionalProperties": false
},
"uploader": {
"type": "object",
"properties": {
"init_dur": {
"type": "string"
},
"max_dur": {
"type": "string"
},
"max_retries": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"monitoring_enabled": {
"maxItems": 3,
"type": "array",
"items": {
"enum": [
"logs",
"metrics",
"traces"
],
"type": "string"
}
},
"monitoring_http": {
"type": "object",
"properties": {
"buffer": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false
},
"enabled": {
"type": "boolean"
},
"host": {
"type": "string"
},
"port": {
"maximum": 65353,
"minimum": 0,
"type": "number"
}
},
"additionalProperties": false
},
"monitoring_output_id": {
"type": [
"null",
"string"
]
},
"monitoring_pprof_enabled": {
"type": "boolean"
},
"name": {
"minLength": 1,
"type": "string"
},
"namespace": {
"minLength": 1,
"type": "string"
},
"overrides": {
"type": [
"null",
"object"
],
"additionalProperties": { },
"description": "Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package_agent_version_conditions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"title",
"version_condition"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"title": {
"type": "string"
},
"version_condition": {
"type": "string"
}
},
"additionalProperties": false
}
},
"required_versions": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"version",
"percentage"
],
"type": "object",
"properties": {
"percentage": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "Target percentage of agents to auto upgrade"
},
"version": {
"type": "string",
"description": "Target version for automatic agent upgrade"
}
},
"additionalProperties": false
}
},
"space_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the agent policy supports agentless integrations. Deprecated in favor of the Fleet managed integrations API.",
"deprecated": true
},
"unenroll_timeout": {
"minimum": 0,
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_connector": {
"title": "new_connector",
"required": [
"name",
"connector_type_id"
],
"type": "object",
"properties": {
"connector_type_id": {
"maxLength": 64,
"type": "string",
"description": "The type of connector."
},
"name": {
"maxLength": 1024,
"type": "string",
"description": "The display name for the connector."
},
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/bedrock_config"
},
{
"$ref": "#/components/schemas/crowdstrike_config"
},
{
"$ref": "#/components/schemas/d3security_config"
},
{
"$ref": "#/components/schemas/email_config"
},
{
"$ref": "#/components/schemas/gemini_config"
},
{
"$ref": "#/components/schemas/resilient_config"
},
{
"$ref": "#/components/schemas/index_config"
},
{
"$ref": "#/components/schemas/jira_config"
},
{
"$ref": "#/components/schemas/genai_azure_config"
},
{
"$ref": "#/components/schemas/genai_openai_config"
},
{
"$ref": "#/components/schemas/genai_openai_other_config"
},
{
"$ref": "#/components/schemas/opsgenie_config"
},
{
"$ref": "#/components/schemas/pagerduty_config"
},
{
"$ref": "#/components/schemas/sentinelone_config"
},
{
"$ref": "#/components/schemas/servicenow_config"
},
{
"$ref": "#/components/schemas/servicenow_itom_config"
},
{
"$ref": "#/components/schemas/slack_api_config"
},
{
"$ref": "#/components/schemas/swimlane_config"
},
{
"$ref": "#/components/schemas/thehive_config"
},
{
"$ref": "#/components/schemas/tines_config"
},
{
"$ref": "#/components/schemas/torq_config"
},
{
"$ref": "#/components/schemas/webhook_config"
},
{
"$ref": "#/components/schemas/cases_webhook_config"
},
{
"$ref": "#/components/schemas/xmatters_config"
}
],
"additionalProperties": { },
"description": "The connector configuration details."
},
"secrets": {
"oneOf": [
{
"$ref": "#/components/schemas/bedrock_secrets"
},
{
"$ref": "#/components/schemas/crowdstrike_secrets"
},
{
"$ref": "#/components/schemas/d3security_secrets"
},
{
"$ref": "#/components/schemas/email_secrets"
},
{
"$ref": "#/components/schemas/gemini_secrets"
},
{
"$ref": "#/components/schemas/resilient_secrets"
},
{
"$ref": "#/components/schemas/jira_secrets"
},
{
"$ref": "#/components/schemas/defender_secrets"
},
{
"$ref": "#/components/schemas/teams_secrets"
},
{
"$ref": "#/components/schemas/genai_secrets"
},
{
"$ref": "#/components/schemas/opsgenie_secrets"
},
{
"$ref": "#/components/schemas/pagerduty_secrets"
},
{
"$ref": "#/components/schemas/sentinelone_secrets"
},
{
"$ref": "#/components/schemas/servicenow_secrets"
},
{
"$ref": "#/components/schemas/slack_api_secrets"
},
{
"$ref": "#/components/schemas/swimlane_secrets"
},
{
"$ref": "#/components/schemas/thehive_secrets"
},
{
"$ref": "#/components/schemas/tines_secrets"
},
{
"$ref": "#/components/schemas/torq_secrets"
},
{
"$ref": "#/components/schemas/webhook_secrets"
},
{
"$ref": "#/components/schemas/cases_webhook_secrets"
},
{
"$ref": "#/components/schemas/xmatters_secrets"
}
],
"additionalProperties": { }
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_enrollment_api_key": {
"title": "new_enrollment_api_key",
"required": [
"policy_id"
],
"type": "object",
"properties": {
"expiration": {
"maxLength": 20,
"type": "string",
"description": "The expiration time for the enrollment token, expressed as a duration (for example, 30d, 24h, 90m). By default, enrollment tokens never expire."
},
"name": {
"type": "string"
},
"policy_id": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_maintenance_window": {
"title": "new_maintenance_window",
"required": [
"title",
"schedule"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications."
},
"schedule": {
"required": [
"custom"
],
"type": "object",
"properties": {
"custom": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_request"
}
},
"additionalProperties": false
},
"scope": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_scope_request"
},
"title": {
"type": "string",
"description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_output_elasticsearch": {
"title": "new_output_elasticsearch",
"required": [
"name",
"type",
"hosts"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"preset": {
"enum": [
"balanced",
"custom",
"throughput",
"scale",
"latency"
],
"type": "string"
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"type": {
"enum": [
"elasticsearch"
],
"type": "string"
},
"write_to_logs_streams": {
"type": [
"null",
"boolean"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_output_kafka": {
"title": "new_output_kafka",
"required": [
"name",
"type",
"hosts",
"auth_type"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"auth_type": {
"enum": [
"none",
"user_pass",
"ssl",
"kerberos"
],
"type": "string"
},
"broker_timeout": {
"type": "number"
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"client_id": {
"type": "string"
},
"compression": {
"enum": [
"gzip",
"snappy",
"lz4",
"none"
],
"type": "string"
},
"compression_level": {
"type": [
"null",
"number"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"connection_type": {
"enum": [
"plaintext",
"encryption"
],
"type": "string"
},
"hash": {
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"random": {
"type": "boolean"
}
},
"additionalProperties": false
},
"headers": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"key",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
},
"additionalProperties": false
}
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"key": {
"type": "string"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"partition": {
"enum": [
"random",
"round_robin",
"hash"
],
"type": "string"
},
"password": {
"type": [
"null",
"string"
]
},
"proxy_id": {
"type": [
"null",
"string"
],
"description": "Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.",
"deprecated": true
},
"random": {
"type": "object",
"properties": {
"group_events": {
"type": "number"
}
},
"additionalProperties": false
},
"required_acks": {
"enum": [
1,
0,
-1
],
"type": "integer"
},
"round_robin": {
"type": "object",
"properties": {
"group_events": {
"type": "number"
}
},
"additionalProperties": false
},
"sasl": {
"type": [
"null",
"object"
],
"properties": {
"mechanism": {
"enum": [
"PLAIN",
"SCRAM-SHA-256",
"SCRAM-SHA-512"
],
"type": "string"
}
},
"additionalProperties": false
},
"secrets": {
"type": "object",
"properties": {
"password": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"ssl": {
"required": [
"key"
],
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"timeout": {
"type": "number"
},
"topic": {
"type": "string"
},
"type": {
"enum": [
"kafka"
],
"type": "string"
},
"username": {
"type": [
"null",
"string"
]
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_output_logstash": {
"title": "new_output_logstash",
"required": [
"name",
"type",
"hosts"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"type": {
"enum": [
"logstash"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_output_otlp": {
"title": "new_output_otlp",
"required": [
"name",
"type",
"otlp_exporter"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otlp_exporter": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter"
}
],
"discriminator": {
"propertyName": "protocol",
"mapping": {
"grpc": "#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter",
"http/protobuf": "#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter"
}
}
},
"secrets": {
"type": "object",
"properties": {
"otlp_exporter": {
"type": "object",
"properties": {
"tls": {
"type": "object",
"properties": {
"key_pem": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"tpm": {
"type": "object",
"properties": {
"auth": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"owner_auth": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"enum": [
"otlp"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_output_remote_elasticsearch": {
"title": "new_output_remote_elasticsearch",
"required": [
"name",
"type",
"hosts"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"kibana_api_key": {
"type": [
"null",
"string"
]
},
"kibana_url": {
"type": [
"null",
"string"
]
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"preset": {
"enum": [
"balanced",
"custom",
"throughput",
"scale",
"latency"
],
"type": "string"
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"service_token": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"service_token": {
"type": [
"null",
"string"
]
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"sync_integrations": {
"type": "boolean"
},
"sync_uninstalled_integrations": {
"type": "boolean"
},
"type": {
"enum": [
"remote_elasticsearch"
],
"type": "string"
},
"write_to_logs_streams": {
"type": [
"null",
"boolean"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_rule": {
"title": "new_rule",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the rule."
},
"rule_type_id": {
"type": "string",
"description": "The rule type identifier."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_new_rule_action": {
"title": "new_rule_action",
"required": [
"id"
],
"type": "object",
"properties": {
"alerts_filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action_alerts_filter"
},
"frequency": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action_frequency"
},
"group": {
"type": "string",
"description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`."
},
"id": {
"type": "string",
"description": "The identifier for the connector saved object."
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context."
},
"use_alert_data_for_template": {
"type": "boolean",
"description": "Indicates whether to use alert data as a template."
},
"uuid": {
"type": "string",
"description": "A universally unique identifier (UUID) for the action."
}
},
"additionalProperties": false,
"description": "An action that runs under defined conditions."
},
"Kibana_HTTP_APIs_new_rule_action_alerts_filter": {
"title": "new_rule_action_alerts_filter",
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerts_filter_query"
},
"timeframe": {
"required": [
"days",
"hours",
"timezone"
],
"type": "object",
"properties": {
"days": {
"type": "array",
"items": {
"enum": [
1,
2,
3,
4,
5,
6,
7
],
"type": "integer"
},
"description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week."
},
"hours": {
"required": [
"start",
"end"
],
"type": "object",
"properties": {
"end": {
"type": "string",
"description": "The end of the time frame, in 24-hour notation (`hh:mm`)."
},
"start": {
"type": "string",
"description": "The start of the time frame, in 24-hour notation (`hh:mm`)."
}
},
"additionalProperties": false,
"description": "Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day."
},
"timezone": {
"type": "string",
"description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended."
}
},
"additionalProperties": false,
"description": "Defines a period that limits whether the action runs."
}
},
"additionalProperties": false,
"description": "Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs."
},
"Kibana_HTTP_APIs_new_rule_action_frequency": {
"title": "new_rule_action_frequency",
"required": [
"summary",
"notify_when"
],
"type": "object",
"properties": {
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval"
],
"type": "string",
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"summary": {
"type": "boolean",
"description": "Indicates whether the action is a summary."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when `notify_when` is set to `onThrottleInterval`. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.",
"default": "null"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting": {
"title": "Custom threshold",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Custom Threshold Rule Params",
"required": [
"criteria",
"searchConfiguration"
],
"type": "object",
"properties": {
"alertOnGroupDisappear": {
"type": "boolean"
},
"alertOnNoData": {
"type": "boolean"
},
"criteria": {
"type": "array",
"items": {
"required": [
"threshold",
"comparator",
"timeUnit",
"timeSize",
"metrics"
],
"type": "object",
"properties": {
"aggType": {
"enum": [
"custom"
],
"type": "string"
},
"comparator": {
"type": "string"
},
"equation": {
"type": "string"
},
"label": {
"type": "string"
},
"metrics": {
"type": "array",
"items": {
"anyOf": [
{
"required": [
"name",
"aggType",
"field"
],
"type": "object",
"properties": {
"aggType": {
"type": "string"
},
"field": {
"type": "string"
},
"filter": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"name",
"aggType"
],
"type": "object",
"properties": {
"aggType": {
"enum": [
"count"
],
"type": "string"
},
"filter": {
"type": "string"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
]
}
},
"threshold": {
"type": "array",
"items": {
"type": "number"
}
},
"timeSize": {
"type": "number"
},
"timeUnit": {
"type": "string"
},
"warningComparator": {
"type": "string"
},
"warningThreshold": {
"maxItems": 2,
"type": "array",
"items": {
"type": "number",
"description": "The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values."
}
}
},
"additionalProperties": false
}
},
"groupBy": {
"anyOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"noDataBehavior": {
"enum": [
"recover",
"remainActive",
"alertOnNoData"
],
"type": "string"
},
"searchConfiguration": {
"required": [
"index",
"query"
],
"type": "object",
"properties": {
"filter": {
"type": "array",
"items": {
"required": [
"meta"
],
"type": "object",
"properties": {
"meta": {
"type": "object",
"additionalProperties": { }
},
"query": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false
}
},
"index": {
"anyOf": [
{
"type": "string"
},
{
"required": [
"title"
],
"type": "object",
"properties": {
"allowHidden": {
"type": "boolean"
},
"allowNoIndex": {
"type": "boolean"
},
"fieldAttrs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"count": {
"type": "number"
},
"customDescription": {
"maxLength": 300,
"type": "string"
},
"customLabel": {
"type": "string"
}
},
"additionalProperties": false
}
},
"fieldFormats": {
"type": "object",
"additionalProperties": {
"required": [
"params"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"params": { }
},
"additionalProperties": false
}
},
"fields": {
"type": "object",
"additionalProperties": {
"required": [
"name"
],
"type": "object",
"properties": {
"aggregatable": {
"type": "boolean"
},
"count": {
"minimum": 0,
"type": "number"
},
"customDescription": {
"maxLength": 300,
"type": "string"
},
"customLabel": {
"type": "string"
},
"esTypes": {
"type": "array",
"items": {
"type": "string"
}
},
"format": {
"required": [
"params"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"params": { }
},
"additionalProperties": false
},
"name": {
"maxLength": 1000,
"type": "string"
},
"readFromDocValues": {
"type": "boolean"
},
"runtimeField": {
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"customDescription": {
"maxLength": 300,
"type": "string"
},
"customLabel": {
"type": "string"
},
"format": {
"required": [
"params"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"params": { }
},
"additionalProperties": false
},
"popularity": {
"minimum": 0,
"type": "number"
},
"script": {
"required": [
"source"
],
"type": "object",
"properties": {
"source": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"keyword",
"long",
"double",
"date",
"ip",
"boolean",
"geo_point"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"fields": {
"type": "object",
"additionalProperties": {
"required": [
"type"
],
"type": "object",
"properties": {
"customDescription": {
"maxLength": 300,
"type": "string"
},
"customLabel": {
"type": "string"
},
"format": {
"required": [
"params"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"params": { }
},
"additionalProperties": false
},
"popularity": {
"minimum": 0,
"type": "number"
},
"type": {
"enum": [
"keyword",
"long",
"double",
"date",
"ip",
"boolean",
"geo_point"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"script": {
"required": [
"source"
],
"type": "object",
"properties": {
"source": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"composite"
],
"type": "string"
}
},
"additionalProperties": false
}
]
},
"script": {
"maxLength": 1000000,
"type": "string"
},
"scripted": {
"type": "boolean"
},
"searchable": {
"type": "boolean"
},
"shortDotsEnable": {
"type": "boolean"
},
"subType": {
"type": "object",
"properties": {
"multi": {
"required": [
"parent"
],
"type": "object",
"properties": {
"parent": {
"type": "string"
}
},
"additionalProperties": false
},
"nested": {
"required": [
"path"
],
"type": "object",
"properties": {
"path": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"maxLength": 1000,
"type": "string",
"default": "string"
}
},
"additionalProperties": false
}
},
"id": {
"type": "string"
},
"managed": {
"type": "boolean"
},
"name": {
"type": "string"
},
"namespaces": {
"type": "array",
"items": {
"type": "string"
}
},
"runtimeFieldMap": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"customDescription": {
"maxLength": 300,
"type": "string"
},
"customLabel": {
"type": "string"
},
"format": {
"required": [
"params"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"params": { }
},
"additionalProperties": false
},
"popularity": {
"minimum": 0,
"type": "number"
},
"script": {
"required": [
"source"
],
"type": "object",
"properties": {
"source": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"keyword",
"long",
"double",
"date",
"ip",
"boolean",
"geo_point"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"fields": {
"type": "object",
"additionalProperties": {
"required": [
"type"
],
"type": "object",
"properties": {
"customDescription": {
"maxLength": 300,
"type": "string"
},
"customLabel": {
"type": "string"
},
"format": {
"required": [
"params"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"params": { }
},
"additionalProperties": false
},
"popularity": {
"minimum": 0,
"type": "number"
},
"type": {
"enum": [
"keyword",
"long",
"double",
"date",
"ip",
"boolean",
"geo_point"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"script": {
"required": [
"source"
],
"type": "object",
"properties": {
"source": {
"type": "string"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"composite"
],
"type": "string"
}
},
"additionalProperties": false
}
]
}
},
"sourceFilters": {
"type": "array",
"items": {
"required": [
"value"
],
"type": "object",
"properties": {
"clientId": {
"type": [
"number",
"string"
]
},
"value": {
"type": "string"
}
},
"additionalProperties": false
}
},
"timeFieldName": {
"type": "string"
},
"title": {
"type": "string"
},
"type": {
"type": "string"
},
"typeMeta": {
"type": "object"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
}
]
},
"query": {
"required": [
"language",
"query"
],
"type": "object",
"properties": {
"language": {
"type": "string"
},
"query": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"description": "The parameters for the custom threshold rule. These parameters are appropriate when `rule_type_id` is `observability.rules.custom_threshold`."
},
"rule_type_id": {
"enum": [
"observability.rules.custom_threshold"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_otlp_grpc_exporter": {
"title": "otlp_grpc_exporter",
"required": [
"endpoint",
"protocol"
],
"type": "object",
"properties": {
"authority": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"balancer_name": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"compression": {
"enum": [
"gzip",
"snappy",
"zstd",
"none"
],
"type": "string"
},
"endpoint": {
"maxLength": 2048,
"type": "string"
},
"headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"maxLength": 1000,
"type": "string"
}
},
"keepalive": {
"type": [
"null",
"object"
],
"properties": {
"permit_without_stream": {
"type": "boolean"
},
"time": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
}
},
"additionalProperties": false
},
"protocol": {
"enum": [
"grpc"
],
"type": "string"
},
"read_buffer_size": {
"type": [
"null",
"number"
]
},
"retry_on_failure": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"initial_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_elapsed_time": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"multiplier": {
"type": [
"null",
"number"
]
},
"randomization_factor": {
"type": [
"null",
"number"
]
}
},
"additionalProperties": false
},
"sending_queue": {
"type": [
"null",
"object"
],
"properties": {
"batch": {
"type": [
"null",
"object"
],
"properties": {
"flush_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_size": {
"type": [
"null",
"number"
]
},
"min_size": {
"type": [
"null",
"number"
]
},
"partition": {
"type": [
"null",
"object"
],
"properties": {
"metadata_keys": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
}
},
"additionalProperties": false
},
"sizer": {
"enum": [
"items",
"bytes"
],
"type": "string"
}
},
"additionalProperties": false
},
"block_on_overflow": {
"type": "boolean"
},
"enabled": {
"type": "boolean"
},
"num_consumers": {
"type": [
"null",
"number"
]
},
"queue_size": {
"type": [
"null",
"number"
]
},
"sizer": {
"enum": [
"requests",
"items",
"bytes"
],
"type": "string"
},
"wait_for_result": {
"type": "boolean"
}
},
"additionalProperties": false
},
"timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"tls": {
"type": [
"null",
"object"
],
"properties": {
"ca_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"ca_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cert_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"cert_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cipher_suites": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
},
"curve_preferences": {
"maxItems": 4,
"type": [
"null",
"array"
],
"items": {
"enum": [
"X25519",
"P521",
"P256",
"P384"
],
"type": "string"
}
},
"include_insecure_cipher_suites": {
"type": "boolean"
},
"include_system_ca_certs_pool": {
"type": "boolean"
},
"insecure": {
"type": "boolean"
},
"insecure_skip_verify": {
"type": "boolean"
},
"key_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"max_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"min_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"reload_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"server_name_override": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"tpm": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"path": {
"maxLength": 4096,
"type": [
"null",
"string"
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"user_agent": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"wait_for_ready": {
"type": "boolean"
},
"write_buffer_size": {
"type": [
"null",
"number"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_otlp_http_exporter": {
"title": "otlp_http_exporter",
"required": [
"endpoint",
"protocol"
],
"type": "object",
"properties": {
"compression": {
"enum": [
"gzip",
"none"
],
"type": "string"
},
"compression_params": {
"type": [
"null",
"object"
],
"properties": {
"level": {
"type": "number"
}
},
"additionalProperties": false
},
"cookies": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
}
},
"additionalProperties": false
},
"disable_keep_alives": {
"type": "boolean"
},
"encoding": {
"enum": [
"proto",
"json"
],
"type": "string"
},
"endpoint": {
"maxLength": 2048,
"type": "string"
},
"force_attempt_http2": {
"type": "boolean"
},
"headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"maxLength": 1000,
"type": "string"
}
},
"http2_ping_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"http2_read_idle_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"idle_conn_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"logs_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"max_conns_per_host": {
"type": [
"null",
"number"
]
},
"max_idle_conns": {
"type": [
"null",
"number"
]
},
"max_idle_conns_per_host": {
"type": [
"null",
"number"
]
},
"metrics_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"profiles_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"protocol": {
"enum": [
"http/protobuf"
],
"type": "string"
},
"proxy_url": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"read_buffer_size": {
"type": [
"null",
"number"
]
},
"retry_on_failure": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"initial_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_elapsed_time": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"multiplier": {
"type": [
"null",
"number"
]
},
"randomization_factor": {
"type": [
"null",
"number"
]
}
},
"additionalProperties": false
},
"sending_queue": {
"type": [
"null",
"object"
],
"properties": {
"batch": {
"type": [
"null",
"object"
],
"properties": {
"flush_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_size": {
"type": [
"null",
"number"
]
},
"min_size": {
"type": [
"null",
"number"
]
},
"partition": {
"type": [
"null",
"object"
],
"properties": {
"metadata_keys": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
}
},
"additionalProperties": false
},
"sizer": {
"enum": [
"items",
"bytes"
],
"type": "string"
}
},
"additionalProperties": false
},
"block_on_overflow": {
"type": "boolean"
},
"enabled": {
"type": "boolean"
},
"num_consumers": {
"type": [
"null",
"number"
]
},
"queue_size": {
"type": [
"null",
"number"
]
},
"sizer": {
"enum": [
"requests",
"items",
"bytes"
],
"type": "string"
},
"wait_for_result": {
"type": "boolean"
}
},
"additionalProperties": false
},
"timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"tls": {
"type": [
"null",
"object"
],
"properties": {
"ca_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"ca_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cert_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"cert_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cipher_suites": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
},
"curve_preferences": {
"maxItems": 4,
"type": [
"null",
"array"
],
"items": {
"enum": [
"X25519",
"P521",
"P256",
"P384"
],
"type": "string"
}
},
"include_insecure_cipher_suites": {
"type": "boolean"
},
"include_system_ca_certs_pool": {
"type": "boolean"
},
"insecure": {
"type": "boolean"
},
"insecure_skip_verify": {
"type": "boolean"
},
"key_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"max_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"min_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"reload_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"server_name_override": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"tpm": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"path": {
"maxLength": 4096,
"type": [
"null",
"string"
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"traces_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"write_buffer_size": {
"type": [
"null",
"number"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_otlp_response_grpc_exporter": {
"title": "otlp_response_grpc_exporter",
"required": [
"endpoint",
"protocol"
],
"type": "object",
"properties": {
"authority": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"balancer_name": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"compression": {
"enum": [
"gzip",
"snappy",
"zstd",
"none"
],
"type": "string"
},
"endpoint": {
"maxLength": 2048,
"type": "string"
},
"headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"maxLength": 1000,
"type": "string"
}
},
"keepalive": {
"type": [
"null",
"object"
],
"properties": {
"permit_without_stream": {
"type": "boolean"
},
"time": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
}
}
},
"protocol": {
"enum": [
"grpc"
],
"type": "string"
},
"read_buffer_size": {
"type": [
"null",
"number"
]
},
"retry_on_failure": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"initial_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_elapsed_time": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"multiplier": {
"type": [
"null",
"number"
]
},
"randomization_factor": {
"type": [
"null",
"number"
]
}
}
},
"sending_queue": {
"type": [
"null",
"object"
],
"properties": {
"batch": {
"type": [
"null",
"object"
],
"properties": {
"flush_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_size": {
"type": [
"null",
"number"
]
},
"min_size": {
"type": [
"null",
"number"
]
},
"partition": {
"type": [
"null",
"object"
],
"properties": {
"metadata_keys": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
}
}
},
"sizer": {
"enum": [
"items",
"bytes"
],
"type": "string"
}
}
},
"block_on_overflow": {
"type": "boolean"
},
"enabled": {
"type": "boolean"
},
"num_consumers": {
"type": [
"null",
"number"
]
},
"queue_size": {
"type": [
"null",
"number"
]
},
"sizer": {
"enum": [
"requests",
"items",
"bytes"
],
"type": "string"
},
"wait_for_result": {
"type": "boolean"
}
}
},
"timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"tls": {
"type": [
"null",
"object"
],
"properties": {
"ca_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"ca_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cert_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"cert_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cipher_suites": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
},
"curve_preferences": {
"maxItems": 4,
"type": [
"null",
"array"
],
"items": {
"enum": [
"X25519",
"P521",
"P256",
"P384"
],
"type": "string"
}
},
"include_insecure_cipher_suites": {
"type": "boolean"
},
"include_system_ca_certs_pool": {
"type": "boolean"
},
"insecure": {
"type": "boolean"
},
"insecure_skip_verify": {
"type": "boolean"
},
"key_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"max_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"min_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"reload_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"server_name_override": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"tpm": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"path": {
"maxLength": 4096,
"type": [
"null",
"string"
]
}
}
}
}
},
"user_agent": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"wait_for_ready": {
"type": "boolean"
},
"write_buffer_size": {
"type": [
"null",
"number"
]
}
}
},
"Kibana_HTTP_APIs_otlp_response_http_exporter": {
"title": "otlp_response_http_exporter",
"required": [
"endpoint",
"protocol"
],
"type": "object",
"properties": {
"compression": {
"enum": [
"gzip",
"none"
],
"type": "string"
},
"compression_params": {
"type": [
"null",
"object"
],
"properties": {
"level": {
"type": "number"
}
}
},
"cookies": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
}
}
},
"disable_keep_alives": {
"type": "boolean"
},
"encoding": {
"enum": [
"proto",
"json"
],
"type": "string"
},
"endpoint": {
"maxLength": 2048,
"type": "string"
},
"force_attempt_http2": {
"type": "boolean"
},
"headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"maxLength": 1000,
"type": "string"
}
},
"http2_ping_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"http2_read_idle_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"idle_conn_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"logs_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"max_conns_per_host": {
"type": [
"null",
"number"
]
},
"max_idle_conns": {
"type": [
"null",
"number"
]
},
"max_idle_conns_per_host": {
"type": [
"null",
"number"
]
},
"metrics_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"profiles_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"protocol": {
"enum": [
"http/protobuf"
],
"type": "string"
},
"proxy_url": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"read_buffer_size": {
"type": [
"null",
"number"
]
},
"retry_on_failure": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"initial_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_elapsed_time": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"multiplier": {
"type": [
"null",
"number"
]
},
"randomization_factor": {
"type": [
"null",
"number"
]
}
}
},
"sending_queue": {
"type": [
"null",
"object"
],
"properties": {
"batch": {
"type": [
"null",
"object"
],
"properties": {
"flush_timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"max_size": {
"type": [
"null",
"number"
]
},
"min_size": {
"type": [
"null",
"number"
]
},
"partition": {
"type": [
"null",
"object"
],
"properties": {
"metadata_keys": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
}
}
},
"sizer": {
"enum": [
"items",
"bytes"
],
"type": "string"
}
}
},
"block_on_overflow": {
"type": "boolean"
},
"enabled": {
"type": "boolean"
},
"num_consumers": {
"type": [
"null",
"number"
]
},
"queue_size": {
"type": [
"null",
"number"
]
},
"sizer": {
"enum": [
"requests",
"items",
"bytes"
],
"type": "string"
},
"wait_for_result": {
"type": "boolean"
}
}
},
"timeout": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"tls": {
"type": [
"null",
"object"
],
"properties": {
"ca_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"ca_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cert_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"cert_pem": {
"maxLength": 65536,
"type": [
"null",
"string"
]
},
"cipher_suites": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
}
},
"curve_preferences": {
"maxItems": 4,
"type": [
"null",
"array"
],
"items": {
"enum": [
"X25519",
"P521",
"P256",
"P384"
],
"type": "string"
}
},
"include_insecure_cipher_suites": {
"type": "boolean"
},
"include_system_ca_certs_pool": {
"type": "boolean"
},
"insecure": {
"type": "boolean"
},
"insecure_skip_verify": {
"type": "boolean"
},
"key_file": {
"maxLength": 4096,
"type": [
"null",
"string"
]
},
"max_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"min_version": {
"maxLength": 10,
"type": [
"null",
"string"
]
},
"reload_interval": {
"maxLength": 64,
"type": [
"null",
"string"
]
},
"server_name_override": {
"maxLength": 256,
"type": [
"null",
"string"
]
},
"tpm": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean"
},
"path": {
"maxLength": 4096,
"type": [
"null",
"string"
]
}
}
}
}
},
"traces_endpoint": {
"maxLength": 2048,
"type": [
"null",
"string"
]
},
"write_buffer_size": {
"type": [
"null",
"number"
]
}
}
},
"Kibana_HTTP_APIs_output_response_elasticsearch": {
"title": "output_response_elasticsearch",
"required": [
"name",
"type",
"hosts"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"preset": {
"enum": [
"balanced",
"custom",
"throughput",
"scale",
"latency"
],
"type": "string"
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
}
}
}
}
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_ssl"
}
]
},
"type": {
"enum": [
"elasticsearch"
],
"type": "string"
},
"write_to_logs_streams": {
"type": [
"null",
"boolean"
]
}
}
},
"Kibana_HTTP_APIs_output_response_kafka": {
"title": "output_response_kafka",
"required": [
"name",
"type",
"hosts",
"auth_type"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"auth_type": {
"enum": [
"none",
"user_pass",
"ssl",
"kerberos"
],
"type": "string"
},
"broker_timeout": {
"type": "number"
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"client_id": {
"type": "string"
},
"compression": {
"enum": [
"gzip",
"snappy",
"lz4",
"none"
],
"type": "string"
},
"compression_level": {
"type": [
"null",
"number"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"connection_type": {
"enum": [
"plaintext",
"encryption"
],
"type": "string"
},
"hash": {
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"random": {
"type": "boolean"
}
}
},
"headers": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"key",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
}
}
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"key": {
"type": "string"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"partition": {
"enum": [
"random",
"round_robin",
"hash"
],
"type": "string"
},
"password": {
"type": [
"null",
"string"
]
},
"proxy_id": {
"type": [
"null",
"string"
],
"description": "Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.",
"deprecated": true
},
"random": {
"type": "object",
"properties": {
"group_events": {
"type": "number"
}
}
},
"required_acks": {
"enum": [
1,
0,
-1
],
"type": "integer"
},
"round_robin": {
"type": "object",
"properties": {
"group_events": {
"type": "number"
}
}
},
"sasl": {
"type": [
"null",
"object"
],
"properties": {
"mechanism": {
"enum": [
"PLAIN",
"SCRAM-SHA-256",
"SCRAM-SHA-512"
],
"type": "string"
}
}
},
"secrets": {
"type": "object",
"properties": {
"password": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
},
"ssl": {
"required": [
"key"
],
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
}
}
}
}
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_ssl"
}
]
},
"timeout": {
"type": "number"
},
"topic": {
"type": "string"
},
"type": {
"enum": [
"kafka"
],
"type": "string"
},
"username": {
"type": [
"null",
"string"
]
},
"version": {
"type": "string"
}
}
},
"Kibana_HTTP_APIs_output_response_logstash": {
"title": "output_response_logstash",
"required": [
"name",
"type",
"hosts"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
}
}
}
}
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_ssl"
}
]
},
"type": {
"enum": [
"logstash"
],
"type": "string"
}
}
},
"Kibana_HTTP_APIs_output_response_otlp": {
"title": "output_response_otlp",
"required": [
"name",
"type",
"otlp_exporter"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otlp_exporter": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_otlp_response_grpc_exporter"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_otlp_response_http_exporter"
}
],
"discriminator": {
"propertyName": "protocol",
"mapping": {
"grpc": "#/components/schemas/Kibana_HTTP_APIs_otlp_response_grpc_exporter",
"http/protobuf": "#/components/schemas/Kibana_HTTP_APIs_otlp_response_http_exporter"
}
}
},
"secrets": {
"type": "object",
"properties": {
"otlp_exporter": {
"type": "object",
"properties": {
"tls": {
"type": "object",
"properties": {
"key_pem": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
},
"tpm": {
"type": "object",
"properties": {
"auth": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
},
"owner_auth": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
}
}
}
}
}
}
}
}
},
"type": {
"enum": [
"otlp"
],
"type": "string"
}
}
},
"Kibana_HTTP_APIs_output_response_remote_elasticsearch": {
"title": "output_response_remote_elasticsearch",
"required": [
"name",
"type",
"hosts"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"kibana_api_key": {
"type": [
"null",
"string"
]
},
"kibana_url": {
"type": [
"null",
"string"
]
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"preset": {
"enum": [
"balanced",
"custom",
"throughput",
"scale",
"latency"
],
"type": "string"
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"service_token": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
},
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
}
},
{
"type": "string"
}
]
}
}
}
}
},
"service_token": {
"type": [
"null",
"string"
]
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_response_ssl"
}
]
},
"sync_integrations": {
"type": "boolean"
},
"sync_uninstalled_integrations": {
"type": "boolean"
},
"type": {
"enum": [
"remote_elasticsearch"
],
"type": "string"
},
"write_to_logs_streams": {
"type": [
"null",
"boolean"
]
}
}
},
"Kibana_HTTP_APIs_output_response_shipper": {
"title": "output_response_shipper",
"type": "object",
"properties": {
"compression_level": {
"type": [
"null",
"number"
],
"default": "null"
},
"disk_queue_compression_enabled": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"disk_queue_enabled": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"disk_queue_encryption_enabled": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"disk_queue_max_size": {
"type": [
"null",
"number"
],
"default": "null"
},
"disk_queue_path": {
"type": [
"null",
"string"
],
"default": "null"
},
"loadbalance": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"max_batch_bytes": {
"type": [
"null",
"number"
],
"default": "null"
},
"mem_queue_events": {
"type": [
"null",
"number"
],
"default": "null"
},
"queue_flush_timeout": {
"type": [
"null",
"number"
],
"default": "null"
}
}
},
"Kibana_HTTP_APIs_output_response_ssl": {
"title": "output_response_ssl",
"type": "object",
"properties": {
"certificate": {
"type": "string"
},
"certificate_authorities": {
"maxItems": 10,
"type": "array",
"items": {
"type": "string"
}
},
"key": {
"type": "string"
},
"verification_mode": {
"enum": [
"full",
"none",
"certificate",
"strict"
],
"type": "string"
}
}
},
"Kibana_HTTP_APIs_output_shipper": {
"title": "output_shipper",
"type": "object",
"properties": {
"compression_level": {
"type": [
"null",
"number"
],
"default": "null"
},
"disk_queue_compression_enabled": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"disk_queue_enabled": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"disk_queue_encryption_enabled": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"disk_queue_max_size": {
"type": [
"null",
"number"
],
"default": "null"
},
"disk_queue_path": {
"type": [
"null",
"string"
],
"default": "null"
},
"loadbalance": {
"type": [
"null",
"boolean"
],
"default": "null"
},
"max_batch_bytes": {
"type": [
"null",
"number"
],
"default": "null"
},
"mem_queue_events": {
"type": [
"null",
"number"
],
"default": "null"
},
"queue_flush_timeout": {
"type": [
"null",
"number"
],
"default": "null"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_output_ssl": {
"title": "output_ssl",
"type": "object",
"properties": {
"certificate": {
"type": "string"
},
"certificate_authorities": {
"maxItems": 10,
"type": "array",
"items": {
"type": "string"
}
},
"key": {
"type": "string"
},
"verification_mode": {
"enum": [
"full",
"none",
"certificate",
"strict"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_icon": {
"title": "package_icon",
"required": [
"src"
],
"type": "object",
"properties": {
"dark_mode": {
"type": "boolean"
},
"path": {
"type": "string"
},
"size": {
"type": "string"
},
"src": {
"type": "string"
},
"title": {
"type": "string"
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_info_conditions_deprecation_info": {
"title": "package_info_conditions_deprecation_info",
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"maxLength": 4096,
"type": "string"
},
"replaced_by": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
}
},
"since": {
"maxLength": 50,
"type": "string"
}
}
},
"Kibana_HTTP_APIs_package_info_deprecation_info": {
"title": "package_info_deprecation_info",
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"maxLength": 4096,
"type": "string"
},
"replaced_by": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
}
},
"since": {
"maxLength": 50,
"type": "string"
}
}
},
"Kibana_HTTP_APIs_package_info_es_asset_reference": {
"title": "package_info_es_asset_reference",
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"customDataStreamOriginDataset": {
"type": "string"
},
"customDataStreamOriginType": {
"type": "string"
},
"deferred": {
"type": "boolean"
},
"id": {
"type": "string"
},
"type": {
"enum": [
"index",
"index_template",
"component_template",
"ingest_pipeline",
"ilm_policy",
"data_stream_ilm_policy",
"transform",
"ml_model",
"knowledge_base",
"esql_view"
],
"type": "string"
},
"version": {
"type": "string"
}
}
},
"Kibana_HTTP_APIs_package_info_icon": {
"title": "package_info_icon",
"required": [
"src"
],
"type": "object",
"properties": {
"dark_mode": {
"type": "boolean"
},
"path": {
"type": "string"
},
"size": {
"type": "string"
},
"src": {
"type": "string"
},
"title": {
"type": "string"
},
"type": {
"type": "string"
}
}
},
"Kibana_HTTP_APIs_package_info_installation_info": {
"title": "package_info_installation_info",
"required": [
"type",
"installed_kibana",
"installed_es",
"name",
"version",
"install_status",
"install_source",
"verification_status"
],
"type": "object",
"properties": {
"additional_spaces_installed_kibana": {
"type": "object",
"additionalProperties": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_kibana_asset_reference"
}
}
},
"created_at": {
"type": "string"
},
"experimental_data_stream_features": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"data_stream",
"features"
],
"type": "object",
"properties": {
"data_stream": {
"maxLength": 1024,
"type": "string"
},
"features": {
"type": "object",
"properties": {
"doc_value_only_numeric": {
"type": "boolean"
},
"doc_value_only_other": {
"type": "boolean"
},
"synthetic_source": {
"type": "boolean"
},
"tsdb": {
"type": "boolean"
}
}
}
}
}
},
"install_format_schema_version": {
"type": "string"
},
"install_source": {
"enum": [
"registry",
"upload",
"bundled",
"custom"
],
"type": "string"
},
"install_status": {
"enum": [
"installed",
"installing",
"install_failed"
],
"type": "string"
},
"installed_es": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_es_asset_reference"
}
},
"installed_kibana": {
"maxItems": 10000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_kibana_asset_reference"
}
},
"installed_kibana_space_id": {
"type": "string"
},
"is_rollback_ttl_expired": {
"type": "boolean"
},
"latest_executed_state": {
"type": "object",
"properties": {
"error": {
"type": "string"
},
"name": {
"type": "string"
},
"started_at": {
"type": "string"
}
}
},
"latest_install_failed_attempts": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"created_at",
"target_version",
"error"
],
"type": "object",
"properties": {
"created_at": {
"type": "string"
},
"error": {
"required": [
"name",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"name": {
"type": "string"
},
"stack": {
"type": "string"
}
}
},
"missing_assets": {
"maxItems": 10000,
"type": "array",
"items": {
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
}
}
}
},
"target_version": {
"type": "string"
}
}
}
},
"name": {
"type": "string"
},
"namespaces": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"previous_version": {
"type": [
"null",
"string"
]
},
"rolled_back": {
"type": "boolean"
},
"type": {
"type": "string"
},
"updated_at": {
"type": "string"
},
"verification_key_id": {
"type": [
"null",
"string"
]
},
"verification_status": {
"enum": [
"unverified",
"verified",
"unknown"
],
"type": "string"
},
"version": {
"type": "string"
}
}
},
"Kibana_HTTP_APIs_package_info_kibana_asset_reference": {
"title": "package_info_kibana_asset_reference",
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"deferred": {
"type": "boolean"
},
"id": {
"type": "string"
},
"originId": {
"type": "string"
},
"type": {
"anyOf": [
{
"enum": [
"dashboard",
"lens",
"visualization",
"search",
"index-pattern",
"map",
"ml-module",
"security-rule",
"csp-rule-template",
"osquery-pack-asset",
"osquery-saved-query",
"tag"
],
"type": "string"
},
{
"type": "string"
}
]
}
}
},
"Kibana_HTTP_APIs_package_list_item": {
"title": "package_list_item",
"required": [
"name",
"version",
"title",
"id"
],
"type": "object",
"properties": {
"categories": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"conditions": {
"type": "object",
"properties": {
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_conditions_deprecation_info"
},
"elastic": {
"type": "object",
"properties": {
"capabilities": {
"maxItems": 10,
"type": "array",
"items": {
"type": "string"
}
},
"subscription": {
"type": "string"
}
}
},
"kibana": {
"type": "object",
"properties": {
"version": {
"type": "string"
}
}
}
}
},
"data_streams": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_deprecation_info"
},
"description": {
"type": "string"
},
"discovery": {
"type": "object",
"properties": {
"datasets": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
},
"fields": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
}
}
},
"download": {
"type": "string"
},
"format_version": {
"type": "string"
},
"icons": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_icon"
}
},
"id": {
"type": "string"
},
"installationInfo": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_info_installation_info"
},
"integration": {
"type": "string"
},
"internal": {
"type": "boolean"
},
"latestVersion": {
"type": "string"
},
"name": {
"type": "string"
},
"owner": {
"type": "object",
"properties": {
"github": {
"type": "string"
},
"type": {
"enum": [
"elastic",
"partner",
"community"
],
"type": "string"
}
}
},
"path": {
"type": "string"
},
"policy_templates": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
},
"readme": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"signature_path": {
"type": "string"
},
"source": {
"required": [
"license"
],
"type": "object",
"properties": {
"license": {
"type": "string"
}
}
},
"status": {
"type": "string"
},
"title": {
"type": "string"
},
"type": {
"anyOf": [
{
"enum": [
"integration"
],
"type": "string"
},
{
"enum": [
"input"
],
"type": "string"
},
{
"enum": [
"content"
],
"type": "string"
},
{
"type": "string"
}
]
},
"var_groups": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"title",
"selector_title",
"options"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"name": {
"type": "string"
},
"options": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"title",
"vars"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"hide_in_deployment_modes": {
"maxItems": 2,
"type": "array",
"items": {
"enum": [
"default",
"agentless"
],
"type": "string"
}
},
"name": {
"type": "string"
},
"title": {
"type": "string"
},
"vars": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"selector_title": {
"type": "string"
},
"title": {
"type": "string"
}
}
}
},
"vars": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
}
},
"version": {
"type": "string"
}
}
},
"Kibana_HTTP_APIs_package_metadata": {
"title": "package_metadata",
"required": [
"has_policies"
],
"type": "object",
"properties": {
"has_policies": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_policy_input_deprecation_info": {
"title": "package_policy_input_deprecation_info",
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"maxLength": 4096,
"type": "string"
},
"replaced_by": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
}
},
"since": {
"maxLength": 50,
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_policy_package": {
"title": "package_policy_package",
"required": [
"name",
"version"
],
"type": "object",
"properties": {
"experimental_data_stream_features": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"data_stream",
"features"
],
"type": "object",
"properties": {
"data_stream": {
"maxLength": 1024,
"type": "string"
},
"features": {
"type": "object",
"properties": {
"doc_value_only_numeric": {
"type": "boolean"
},
"doc_value_only_other": {
"type": "boolean"
},
"synthetic_source": {
"type": "boolean"
},
"tsdb": {
"type": "boolean"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"fips_compatible": {
"type": "boolean"
},
"name": {
"maxLength": 255,
"type": "string",
"description": "Package name"
},
"requires_root": {
"type": "boolean"
},
"title": {
"maxLength": 255,
"type": "string"
},
"version": {
"maxLength": 50,
"type": "string",
"description": "Package version"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_policy_response": {
"title": "package_policy_response",
"required": [
"name",
"enabled",
"inputs",
"id",
"revision",
"updated_at",
"updated_by",
"created_at",
"created_by"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"agents": {
"type": "number"
},
"cloud_connector_id": {
"type": [
"null",
"string"
],
"description": "ID of the cloud connector associated with this package policy."
},
"cloud_connector_name": {
"maxLength": 255,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "Transient field for cloud connector name during creation."
},
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this integration to its inputs."
},
"created_at": {
"type": "string"
},
"created_by": {
"type": "string"
},
"description": {
"type": "string",
"description": "Package policy description"
},
"elasticsearch": {
"type": "object",
"properties": {
"privileges": {
"type": "object",
"properties": {
"cluster": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
"enabled": {
"type": "boolean"
},
"global_data_tags": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the custom field. Cannot contain spaces."
},
"value": {
"type": [
"number",
"string"
],
"description": "The value of the custom field."
}
},
"additionalProperties": false
}
},
"id": {
"type": "string",
"description": "Package policy unique identifier."
},
"inputs": {
"anyOf": [
{
"maxItems": 100,
"type": "array",
"items": {
"required": [
"type",
"enabled",
"streams",
"compiled_input"
],
"type": "object",
"properties": {
"compiled_input": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"name": {
"type": "string"
},
"policy_template": {
"type": "string"
},
"streams": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"enabled",
"data_stream",
"compiled_stream"
],
"type": "object",
"properties": {
"compiled_stream": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"elasticsearch": {
"type": "object",
"properties": {
"dynamic_dataset": {
"type": "boolean"
},
"dynamic_namespace": {
"type": "boolean"
},
"privileges": {
"type": "object",
"properties": {
"indices": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"type": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
{
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that input. Defaults to `true` (enabled)."
},
"streams": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that stream. Defaults to `true` (enabled)."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Input streams. Refer to the integration documentation to know which streams are available."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Package policy inputs. Refer to the integration documentation to know which inputs are available."
}
],
"description": "Package policy inputs."
},
"is_managed": {
"type": "boolean"
},
"name": {
"type": "string",
"description": "Unique name for the package policy."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "The package policy namespace. Leave blank to inherit the agent policy's namespace."
},
"output_id": {
"type": [
"null",
"string"
]
},
"overrides": {
"type": [
"null",
"object"
],
"properties": {
"inputs": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"package_agent_version_condition": {
"type": "string"
},
"policy_id": {
"type": [
"null",
"string"
],
"description": "ID of the agent policy which the package policy will be added to.",
"deprecated": true
},
"policy_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "IDs of the agent policies that the package policy will be added to."
}
},
"revision": {
"type": "number",
"description": "Package policy revision."
},
"secret_references": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"spaceIds": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy belongs to an agentless agent policy."
},
"supports_cloud_connector": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy supports cloud connectors."
},
"updated_at": {
"type": "string"
},
"updated_by": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"anyOf": [
{
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
{
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
],
"description": "Package level variable."
},
"version": {
"type": "string",
"description": "Package policy ES version."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_policy_status_response": {
"title": "package_policy_status_response",
"required": [
"id",
"success"
],
"type": "object",
"properties": {
"body": {
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
}
},
"additionalProperties": false
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"statusCode": {
"type": "number"
},
"success": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_package_policy_stream_deprecation_info": {
"title": "package_policy_stream_deprecation_info",
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"maxLength": 4096,
"type": "string"
},
"replaced_by": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
}
},
"since": {
"maxLength": 50,
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_pieLibItemNoESQL": {
"title": "Pie Chart (library)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
}
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metric configurations (minimum 1)"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"pie"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_profiling_setup_status_response": {
"title": "profiling_setup_status_response",
"required": [
"profiling_enabled",
"has_setup",
"has_data",
"pre_8_9_1_data",
"has_required_role"
],
"type": "object",
"properties": {
"has_data": {
"type": "boolean",
"description": "Whether Universal Profiling has ingested any data."
},
"has_required_role": {
"type": "boolean",
"description": "Whether the current user has the privileges required to run Universal Profiling setup."
},
"has_setup": {
"type": "boolean",
"description": "Whether every resource Universal Profiling requires has already been created."
},
"pre_8_9_1_data": {
"type": "boolean",
"description": "Whether data ingested before version 8.9.1 is present. That data cannot be read by the current version."
},
"profiling_enabled": {
"type": "boolean",
"description": "Whether the Universal Profiling plugin is enabled in the Elasticsearch cluster."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_QueryStreamUpsertRequest": {
"required": [
"dashboards",
"rules",
"stream"
],
"type": "object",
"properties": {
"dashboards": {
"type": "array",
"items": {
"type": "string"
}
},
"rules": {
"type": "array",
"items": {
"type": "string"
}
},
"stream": {
"required": [
"description",
"type",
"query"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"field_descriptions": {
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"query": {
"required": [
"view",
"esql"
],
"type": "object",
"properties": {
"esql": {
"type": "string"
},
"view": {
"type": "string"
}
},
"additionalProperties": false
},
"query_streams": {
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
},
"type": {
"enum": [
"query"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_reauthorize_transform_request": {
"title": "reauthorize_transform_request",
"required": [
"transforms"
],
"type": "object",
"properties": {
"transforms": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"transformId"
],
"type": "object",
"properties": {
"transformId": {
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_RecursiveRecord": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"anyOf": [
{
"maxLength": 65535,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{ }
]
},
{
"type": "array",
"items": {
"anyOf": [
{
"maxLength": 65535,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{ }
]
}
},
{
"type": "array",
"items": {
"anyOf": [
{
"anyOf": [
{
"maxLength": 65535,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{ }
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord"
}
]
}
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord"
}
]
}
},
"Kibana_HTTP_APIs_regionMapLibItemNoESQL": {
"title": "Region Map Chart (library)",
"required": [
"type",
"data_source",
"metric",
"region"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"title": "Field Metric or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation or a mathematical formula."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"region": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"ems": {
"required": [
"boundaries",
"join"
],
"type": "object",
"properties": {
"boundaries": {
"type": "string",
"description": "EMS boundaries"
},
"join": {
"type": "string",
"description": "EMS join field"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
]
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"region_map"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_review_upgrade_request": {
"title": "review_upgrade_request",
"required": [
"action",
"target_version"
],
"type": "object",
"properties": {
"action": {
"enum": [
"accept",
"decline",
"pending"
],
"type": "string"
},
"target_version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_review_upgrade_response": {
"title": "review_upgrade_response",
"required": [
"success"
],
"type": "object",
"properties": {
"success": {
"type": "boolean"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_rollback_package_response": {
"title": "rollback_package_response",
"required": [
"version",
"success"
],
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_rule_flapping": {
"title": "rule_flapping",
"required": [
"look_back_window",
"status_change_threshold"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state."
},
"look_back_window": {
"maximum": 20,
"minimum": 2,
"type": "number",
"description": "The minimum number of runs in which the threshold must be met."
},
"status_change_threshold": {
"maximum": 20,
"minimum": 2,
"type": "number",
"description": "The minimum number of times an alert must switch states within the defined look back window time."
}
},
"additionalProperties": false,
"description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced."
},
"Kibana_HTTP_APIs_rule_response": {
"title": "rule_response",
"required": [
"id",
"enabled",
"name",
"tags",
"rule_type_id",
"consumer",
"schedule",
"actions",
"params",
"created_at",
"updated_at",
"mute_all",
"muted_alert_ids",
"execution_status",
"revision"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"required": [
"id",
"connector_type_id",
"params"
],
"type": "object",
"properties": {
"alerts_filter": {
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerts_filter_query"
},
"timeframe": {
"required": [
"days",
"hours",
"timezone"
],
"type": "object",
"properties": {
"days": {
"type": "array",
"items": {
"enum": [
1,
2,
3,
4,
5,
6,
7
],
"type": "integer"
},
"description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week."
},
"hours": {
"required": [
"start",
"end"
],
"type": "object",
"properties": {
"end": {
"type": "string",
"description": "The end of the time frame, in 24-hour notation (`hh:mm`)."
},
"start": {
"type": "string",
"description": "The start of the time frame, in 24-hour notation (`hh:mm`)."
}
},
"additionalProperties": false
},
"timezone": {
"type": "string",
"description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Defines a period that limits whether the action runs."
},
"connector_type_id": {
"type": "string",
"description": "The type of connector. This property appears in responses but cannot be set in requests."
},
"frequency": {
"required": [
"summary",
"notify_when"
],
"type": "object",
"properties": {
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval"
],
"type": "string",
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"summary": {
"type": "boolean",
"description": "Indicates whether the action is a summary."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when 'notify_when' is set to 'onThrottleInterval'. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.",
"default": "null"
}
},
"additionalProperties": false
},
"group": {
"type": "string",
"description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`."
},
"id": {
"type": "string",
"description": "The identifier for the connector saved object."
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context."
},
"use_alert_data_for_template": {
"type": "boolean",
"description": "Indicates whether to use alert data as a template."
},
"uuid": {
"type": "string",
"description": "A universally unique identifier (UUID) for the action."
}
},
"additionalProperties": false
}
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"api_key_created_by_user": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the API key that is associated with the rule was created by the user."
},
"api_key_owner": {
"type": [
"null",
"string"
],
"description": "The owner of the API key that is associated with the rule and used to run background tasks.",
"default": "null"
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"type": "string",
"description": "User-created content that describes alert causes and remediation."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"created_at": {
"type": "string",
"description": "The date and time that the rule was created."
},
"created_by": {
"type": [
"null",
"string"
],
"description": "The identifier for the user that created the rule.",
"default": "null"
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created."
},
"execution_status": {
"required": [
"status",
"last_execution_date"
],
"type": "object",
"properties": {
"error": {
"required": [
"reason",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "Error message."
},
"reason": {
"enum": [
"read",
"decrypt",
"execute",
"unknown",
"license",
"timeout",
"disabled",
"validate"
],
"type": "string",
"description": "Reason for error."
}
},
"additionalProperties": false
},
"last_duration": {
"type": "number",
"description": "Duration of last rule execution."
},
"last_execution_date": {
"type": "string",
"description": "The date and time of the last rule execution."
},
"status": {
"enum": [
"ok",
"active",
"error",
"warning",
"pending",
"unknown"
],
"type": "string",
"description": "Status of rule execution."
},
"warning": {
"required": [
"reason",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "Warning message."
},
"reason": {
"enum": [
"maxExecutableActions",
"maxAlerts",
"maxQueuedActions",
"ruleExecution"
],
"type": "string",
"description": "Reason for warning."
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"id": {
"type": "string",
"description": "The identifier for the rule."
},
"last_run": {
"required": [
"outcome",
"alerts_count"
],
"type": [
"null",
"object"
],
"properties": {
"alerts_count": {
"type": "object",
"properties": {
"active": {
"type": [
"null",
"number"
],
"description": "Number of active alerts during last run."
},
"ignored": {
"type": [
"null",
"number"
],
"description": "Number of ignored alerts during last run."
},
"new": {
"type": [
"null",
"number"
],
"description": "Number of new alerts during last run."
},
"recovered": {
"type": [
"null",
"number"
],
"description": "Number of recovered alerts during last run."
}
},
"additionalProperties": false
},
"outcome": {
"enum": [
"succeeded",
"warning",
"failed"
],
"type": "string",
"description": "Outcome of the last rule run. Value can be succeeded, warning, or failed."
},
"outcome_msg": {
"type": [
"null",
"array"
],
"items": {
"type": "string",
"description": "Outcome message generated during last rule run."
}
},
"outcome_order": {
"type": "number",
"description": "Order of the outcome."
},
"warning": {
"enum": [
"read",
"decrypt",
"execute",
"unknown",
"license",
"timeout",
"disabled",
"validate",
"maxExecutableActions",
"maxAlerts",
"maxQueuedActions",
"ruleExecution",
"null"
],
"type": [
"null",
"string"
],
"description": "Warning of last rule execution."
}
},
"additionalProperties": false
},
"mapped_params": {
"type": "object",
"additionalProperties": { }
},
"mute_all": {
"type": "boolean",
"description": "Indicates whether all alerts are muted."
},
"muted_alert_ids": {
"type": "array",
"items": {
"type": "string",
"description": "List of identifiers of muted alerts. "
}
},
"name": {
"type": "string",
"description": " The name of the rule."
},
"next_run": {
"type": [
"null",
"string"
],
"description": "Date and time of the next rule run."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the rule."
},
"revision": {
"type": "number",
"description": "The rule revision number."
},
"rule_type_id": {
"type": "string",
"description": "The rule type identifier."
},
"running": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the rule is running."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false
},
"scheduled_task_id": {
"type": "string",
"description": "Identifier of the scheduled task."
},
"tags": {
"type": "array",
"items": {
"type": "string",
"description": "The tags for the rule."
}
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.",
"deprecated": true
},
"updated_at": {
"type": "string",
"description": "The date and time of the latest updates to the rule."
},
"updated_by": {
"type": [
"null",
"string"
],
"description": "The identifier for the user who was the last to update the rule.",
"default": "null"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_schedule_request": {
"title": "schedule_request",
"required": [
"start",
"duration"
],
"type": "object",
"properties": {
"duration": {
"maxLength": 100,
"type": "string",
"description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`."
},
"recurring": {
"type": "object",
"properties": {
"end": {
"maxLength": 100,
"type": "string",
"description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`."
},
"every": {
"maxLength": 100,
"type": "string",
"description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`."
},
"occurrences": {
"minimum": 1,
"type": "number",
"description": "The total number of recurrences of the schedule."
},
"onMonth": {
"maxItems": 12,
"minItems": 1,
"type": "array",
"items": {
"maximum": 12,
"minimum": 1,
"type": "number"
},
"description": "The specific months for a recurring schedule. Valid values are 1-12."
},
"onMonthDay": {
"maxItems": 31,
"minItems": 1,
"type": "array",
"items": {
"maximum": 31,
"minimum": 1,
"type": "number"
},
"description": "The specific days of the month for a recurring schedule. Valid values are 1-31."
},
"onWeekDay": {
"maxItems": 77,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 10,
"type": "string"
},
"description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule."
}
},
"additionalProperties": false
},
"start": {
"maxLength": 100,
"type": "string",
"description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`."
},
"timezone": {
"maxLength": 64,
"type": "string",
"description": "The timezone of the schedule. The default timezone is UTC."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_security_bulk_create_or_update_roles_response": {
"title": "security_bulk_create_or_update_roles_response",
"type": "object",
"properties": {
"created": {
"type": "array",
"items": {
"type": "string",
"description": "The name of a role that was created."
}
},
"errors": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_bulk_roles_error_detail"
}
},
"noop": {
"type": "array",
"items": {
"type": "string",
"description": "The name of a role that was unchanged by the request."
}
},
"updated": {
"type": "array",
"items": {
"type": "string",
"description": "The name of a role that was updated."
}
}
},
"additionalProperties": false,
"description": "The response payload for the bulk create-or-update roles API."
},
"Kibana_HTTP_APIs_security_bulk_roles_error_detail": {
"title": "security_bulk_roles_error_detail",
"required": [
"type",
"reason"
],
"type": "object",
"properties": {
"reason": {
"type": "string",
"description": "A human readable error reason."
},
"type": {
"type": "string",
"description": "The error type."
}
},
"additionalProperties": false,
"description": "Error information for a single role in a bulk create-or-update request."
},
"Kibana_HTTP_APIs_security_query_roles_body": {
"title": "security_query_roles_body",
"type": "object",
"properties": {
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_query_roles_filters"
},
"from": {
"type": "number"
},
"query": {
"type": "string"
},
"size": {
"type": "number"
},
"sort": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_query_roles_sort"
}
},
"additionalProperties": false,
"description": "The request body for querying roles."
},
"Kibana_HTTP_APIs_security_query_roles_filters": {
"title": "security_query_roles_filters",
"type": "object",
"properties": {
"showReservedRoles": {
"type": "boolean"
}
},
"additionalProperties": false,
"description": "The filter criteria for the query."
},
"Kibana_HTTP_APIs_security_query_roles_response": {
"title": "security_query_roles_response",
"required": [
"roles",
"count",
"total"
],
"type": "object",
"properties": {
"count": {
"type": "number",
"description": "The number of roles returned in this response page."
},
"roles": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_response"
}
},
"total": {
"type": "number",
"description": "The total number of roles that match the query."
}
},
"additionalProperties": false,
"description": "The response payload for a roles query."
},
"Kibana_HTTP_APIs_security_query_roles_sort": {
"title": "security_query_roles_sort",
"required": [
"field",
"direction"
],
"type": "object",
"properties": {
"direction": {
"enum": [
"asc",
"desc"
],
"type": "string"
},
"field": {
"type": "string"
}
},
"additionalProperties": false,
"description": "The sort criteria for the query."
},
"Kibana_HTTP_APIs_security_role_data_source_privileges": {
"title": "security_role_data_source_privileges",
"required": [
"names",
"privileges"
],
"type": "object",
"properties": {
"names": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 1000,
"type": "string",
"description": "A list of data source names or wildcard patterns to which the permissions in this entry apply."
}
},
"privileges": {
"maxItems": 5,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"create",
"read_metadata",
"delete",
"read",
"manage"
],
"type": "string"
},
"description": "The data source privileges that role members have for the specified data sources."
}
},
"additionalProperties": false,
"description": "The data source privileges entry."
},
"Kibana_HTTP_APIs_security_role_elasticsearch": {
"title": "security_role_elasticsearch",
"type": "object",
"properties": {
"cluster": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Cluster privileges that define the cluster level actions that users can perform."
}
},
"global": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_global_privileges"
},
"indices": {
"maxItems": 1000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_indices_privileges"
}
},
"remote_cluster": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_remote_cluster_privileges"
}
},
"remote_indices": {
"maxItems": 1000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_remote_indices_privileges"
}
},
"run_as": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "A username that members of this role can impersonate."
}
}
},
"additionalProperties": false,
"description": "The Elasticsearch cluster, index, and remote cluster security privileges for the role."
},
"Kibana_HTTP_APIs_security_role_global_privileges": {
"title": "security_role_global_privileges",
"type": "object",
"properties": {
"application": {
"type": "object",
"properties": {
"manage": {
"required": [
"applications"
],
"type": "object",
"properties": {
"applications": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 100,
"type": "string",
"description": "A list of application names that the role can manage at the global privilege scope."
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"data_source": {
"maxItems": 1000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_data_source_privileges"
}
},
"profile": {
"type": "object",
"properties": {
"write": {
"required": [
"applications"
],
"type": "object",
"properties": {
"applications": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 100,
"type": "string",
"description": "A list of application names whose user profile data the role can write at the global privilege scope."
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"role": {
"type": "object",
"description": "Global role privileges."
}
},
"additionalProperties": false,
"description": "Global privileges for the role."
},
"Kibana_HTTP_APIs_security_role_indices_privileges": {
"title": "security_role_indices_privileges",
"required": [
"names",
"privileges"
],
"type": "object",
"properties": {
"allow_restricted_indices": {
"type": "boolean",
"description": "Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too."
},
"field_security": {
"type": "object",
"additionalProperties": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "The document fields that the role members have read access to."
}
}
},
"names": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*)."
}
},
"privileges": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "The index level privileges that the role members have for the data streams and indices."
}
},
"query": {
"type": "string",
"description": "A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members."
}
},
"additionalProperties": false,
"description": "The indices privileges entry."
},
"Kibana_HTTP_APIs_security_role_kibana_application": {
"title": "security_role_kibana_application",
"required": [
"application",
"privileges",
"resources"
],
"type": "object",
"properties": {
"application": {
"type": "string"
},
"privileges": {
"type": "array",
"items": {
"type": "string"
}
},
"resources": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false,
"description": "A raw Elasticsearch application privilege entry tied to Kibana."
},
"Kibana_HTTP_APIs_security_role_kibana_privilege": {
"title": "security_role_kibana_privilege",
"required": [
"base"
],
"type": "object",
"properties": {
"base": {
"anyOf": [
{
"type": "array",
"items": { }
},
{
"type": "boolean"
},
{
"type": "number"
},
{
"type": "object"
},
{
"type": "string"
}
],
"oneOf": [
{
"maxItems": 50,
"type": "array",
"items": {
"type": "string",
"description": "A base privilege that grants applies to all spaces."
}
},
{
"maxItems": 50,
"type": "array",
"items": {
"type": "string",
"description": "A base privilege that applies to specific spaces."
}
}
]
},
"feature": {
"type": "object",
"additionalProperties": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "The privileges that the role member has for the feature."
}
}
},
"spaces": {
"anyOf": [
{
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"*"
],
"type": "string"
}
},
{
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "A space that the privilege applies to."
}
}
],
"default": [
"*"
]
}
},
"additionalProperties": false,
"description": "The Kibana privilege entry for the role."
},
"Kibana_HTTP_APIs_security_role_kibana_privilege_response": {
"title": "security_role_kibana_privilege_response",
"required": [
"spaces",
"base",
"feature"
],
"type": "object",
"properties": {
"_reserved": {
"type": "array",
"items": {
"type": "string",
"description": "A reserved Kibana privilege granted globally."
}
},
"base": {
"type": "array",
"items": {
"type": "string",
"description": "A base Kibana privilege."
}
},
"feature": {
"type": "object",
"additionalProperties": {
"type": "array",
"items": {
"type": "string",
"description": "A privilege the role member has for the feature."
}
}
},
"spaces": {
"type": "array",
"items": {
"type": "string",
"description": "A space that the privilege applies to. The wildcard `*` indicates all spaces."
}
}
},
"additionalProperties": false,
"description": "A Kibana privilege entry returned for a role."
},
"Kibana_HTTP_APIs_security_role_put_payload": {
"title": "security_role_put_payload",
"required": [
"elasticsearch"
],
"type": "object",
"properties": {
"description": {
"maxLength": 2048,
"type": "string",
"description": "A description for the role."
},
"elasticsearch": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_elasticsearch"
},
"kibana": {
"maxItems": 1000,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_privilege"
}
},
"metadata": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "The role definition to create or update."
},
"Kibana_HTTP_APIs_security_role_remote_cluster_privileges": {
"title": "security_role_remote_cluster_privileges",
"required": [
"privileges",
"clusters"
],
"type": "object",
"properties": {
"clusters": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions."
}
},
"privileges": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges."
}
}
},
"additionalProperties": false,
"description": "The remote cluster privileges entry."
},
"Kibana_HTTP_APIs_security_role_remote_indices_privileges": {
"title": "security_role_remote_indices_privileges",
"required": [
"clusters",
"names",
"privileges"
],
"type": "object",
"properties": {
"allow_restricted_indices": {
"type": "boolean",
"description": "Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too."
},
"clusters": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions."
}
},
"field_security": {
"type": "object",
"additionalProperties": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "The document fields that the role members have read access to."
}
}
},
"names": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*)."
}
},
"privileges": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "The index level privileges that role members have for the specified indices."
}
},
"query": {
"type": "string",
"description": "A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. "
}
},
"additionalProperties": false,
"description": "The remote indices privileges entry."
},
"Kibana_HTTP_APIs_security_role_response": {
"title": "security_role_response",
"required": [
"name",
"elasticsearch",
"kibana"
],
"type": "object",
"properties": {
"_transform_error": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_transform_error"
}
},
"_unrecognized_applications": {
"type": "array",
"items": {
"type": "string",
"description": "Application names found on the role that are not recognized by Kibana."
}
},
"description": {
"type": "string",
"description": "A description for the role."
},
"elasticsearch": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_elasticsearch"
},
"kibana": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_privilege_response"
}
},
"metadata": {
"type": "object",
"additionalProperties": { }
},
"name": {
"type": "string",
"description": "The role name."
},
"transient_metadata": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "A Kibana role definition returned by the Roles API."
},
"Kibana_HTTP_APIs_security_role_transform_error": {
"title": "security_role_transform_error",
"required": [
"reason"
],
"type": "object",
"properties": {
"reason": {
"type": "string",
"description": "The reason the role could not be fully transformed."
},
"state": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_application"
}
}
},
"additionalProperties": false,
"description": "Diagnostic information about a role whose Kibana privileges could not be transformed."
},
"Kibana_HTTP_APIs_security_roles_bulk_create_or_update_payload": {
"title": "security_roles_bulk_create_or_update_payload",
"required": [
"roles"
],
"type": "object",
"properties": {
"roles": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_security_role_put_payload"
}
}
},
"additionalProperties": false,
"description": "The request body for bulk creating or updating roles."
},
"Kibana_HTTP_APIs_simplified_create_package_policy_request": {
"title": "simplified_create_package_policy_request",
"required": [
"name",
"package"
],
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"maxLength": 256,
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this integration to its inputs."
},
"create_dataset_templates": {
"type": "boolean",
"description": "When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages."
},
"description": {
"maxLength": 2048,
"type": "string",
"description": "Policy description."
},
"force": {
"type": "boolean",
"description": "Force package policy creation even if the package is not verified, or if the agent policy is managed."
},
"id": {
"maxLength": 255,
"type": "string",
"description": "Policy unique identifier."
},
"inputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that input. Defaults to `true` (enabled)."
},
"streams": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean",
"description": "Enable or disable that stream. Defaults to `true` (enabled)."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Input streams. Refer to the integration documentation to know which streams are available."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"description": "Package policy inputs. Refer to the integration documentation to know which inputs are available."
},
"name": {
"maxLength": 255,
"type": "string",
"description": "Unique name for the policy."
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "Policy namespace. When not specified, it inherits the agent policy namespace."
},
"output_id": {
"maxLength": 255,
"type": [
"null",
"string"
]
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"policy_id": {
"maxLength": 255,
"type": [
"null",
"string"
],
"description": "Deprecated. Use policy_ids instead.",
"deprecated": true
},
"policy_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 255,
"type": "string"
},
"description": "IDs of the agent policies that the package policy will be added to."
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.",
"deprecated": true
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"anyOf": [
{
"maxLength": 10000,
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 10000,
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
},
{
"required": [
"id",
"isSecretRef"
],
"type": "object",
"properties": {
"id": {
"maxLength": 255,
"type": "string"
},
"isSecretRef": {
"type": "boolean"
}
},
"additionalProperties": false
}
],
"default": "null"
},
"description": "Input/stream level variable. Refer to the integration documentation for more information."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info": {
"title": "simplified_package_policy_input_deprecation_info",
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"maxLength": 4096,
"type": "string"
},
"replaced_by": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
}
},
"since": {
"maxLength": 50,
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info": {
"title": "simplified_package_policy_stream_deprecation_info",
"required": [
"description"
],
"type": "object",
"properties": {
"description": {
"maxLength": 4096,
"type": "string"
},
"replaced_by": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
}
},
"since": {
"maxLength": 50,
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_slo-alerts-embeddable": {
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"slos": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"slo_id"
],
"type": "object",
"properties": {
"slo_id": {
"maxLength": 64,
"type": "string",
"description": "SLO ID"
},
"slo_instance_id": {
"maxLength": 512,
"type": "string",
"description": "SLO instance ID",
"default": "*"
}
},
"additionalProperties": false
},
"description": "List of SLOs to display alerts for",
"default": [ ]
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "SLO Alerts embeddable schema"
},
"Kibana_HTTP_APIs_slo-burn-rate-embeddable": {
"required": [
"slo_id",
"duration"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"duration": {
"maxLength": 32,
"type": "string",
"description": "Duration for the burn rate chart in the format [value][unit], e.g. 5m, 3h, or 6d"
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"slo_id": {
"maxLength": 64,
"type": "string",
"description": "The ID of the SLO to display the burn rate for"
},
"slo_instance_id": {
"maxLength": 512,
"type": "string",
"description": "ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances).",
"default": "*"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "SLO Burn Rate embeddable schema"
},
"Kibana_HTTP_APIs_slo-error-budget-embeddable": {
"required": [
"slo_id"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"slo_id": {
"maxLength": 64,
"type": "string",
"description": "The ID of the SLO to display the error budget for"
},
"slo_instance_id": {
"maxLength": 512,
"type": "string",
"description": "ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances).",
"default": "*"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "SLO Error Budget embeddable schema"
},
"Kibana_HTTP_APIs_slo-group-overview-embeddable": {
"required": [
"overview_mode"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"group_filters": {
"type": "object",
"properties": {
"filters": {
"maxItems": 500,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema"
}
},
"group_by": {
"anyOf": [
{
"enum": [
"slo.tags"
],
"type": "string"
},
{
"enum": [
"status"
],
"type": "string"
},
{
"enum": [
"slo.indicator.type"
],
"type": "string"
},
{
"enum": [
"_index"
],
"type": "string"
}
],
"default": "status"
},
"groups": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
},
"kql_query": {
"maxLength": 2048,
"type": "string"
}
},
"additionalProperties": false,
"default": {
"group_by": "status"
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"overview_mode": {
"enum": [
"groups"
],
"type": "string"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "SLO Group Overview embeddable schema"
},
"Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting": {
"title": "SLO burn rate",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "SLO Burn Rate Rule Params",
"required": [
"sloId",
"windows"
],
"type": "object",
"properties": {
"dependencies": {
"type": "array",
"items": {
"required": [
"ruleId",
"actionGroupsToSuppressOn"
],
"type": "object",
"properties": {
"actionGroupsToSuppressOn": {
"type": "array",
"items": {
"type": "string"
}
},
"ruleId": {
"type": "string"
}
},
"additionalProperties": false
}
},
"sloId": {
"type": "string"
},
"windows": {
"type": "array",
"items": {
"required": [
"id",
"burnRateThreshold",
"longWindow",
"shortWindow",
"actionGroup"
],
"type": "object",
"properties": {
"actionGroup": {
"type": "string"
},
"burnRateThreshold": {
"type": "number"
},
"id": {
"type": "string"
},
"longWindow": {
"required": [
"value",
"unit"
],
"type": "object",
"properties": {
"unit": {
"type": "string"
},
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"maxBurnRateThreshold": {
"type": [
"null",
"number"
],
"default": "null"
},
"shortWindow": {
"required": [
"value",
"unit"
],
"type": "object",
"properties": {
"unit": {
"type": "string"
},
"value": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false,
"description": "The parameters for the slo burn rate rule. These parameters are appropriate when `rule_type_id` is `slo.rules.burnRate`."
},
"rule_type_id": {
"enum": [
"slo.rules.burnRate"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_slo-single-overview-embeddable": {
"required": [
"slo_id",
"overview_mode"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A short description of the panel."
},
"drilldowns": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"title": "url_drilldown",
"allOf": [
{
"required": [
"url"
],
"type": "object",
"properties": {
"encode_url": {
"type": "boolean",
"description": "When true, URL is escaped using percent encoding",
"default": true
},
"open_in_new_tab": {
"type": "boolean",
"default": true
},
"url": {
"type": "string",
"description": "Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable"
}
},
"additionalProperties": false
},
{
"required": [
"label",
"trigger",
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string"
},
"trigger": {
"anyOf": [
{
"enum": [
"on_open_panel_menu"
],
"type": "string"
}
]
},
"type": {
"enum": [
"url_drilldown"
],
"type": "string"
}
}
}
]
}
]
}
},
"hide_border": {
"type": "boolean",
"description": "When true, the panel border is hidden. Defaults to false."
},
"hide_title": {
"type": "boolean",
"description": "When true, the panel title is hidden. Defaults to false."
},
"overview_mode": {
"enum": [
"single"
],
"type": "string"
},
"remote_name": {
"maxLength": 256,
"type": "string",
"description": "The name of the remote SLO"
},
"slo_id": {
"maxLength": 64,
"type": "string",
"description": "The ID of the SLO"
},
"slo_instance_id": {
"maxLength": 512,
"type": "string",
"description": "ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances).",
"default": "*"
},
"title": {
"type": "string",
"description": "The panel title."
}
},
"additionalProperties": false,
"description": "SLO Single Overview embeddable schema"
},
"Kibana_HTTP_APIs_StreamlangConditionBlock": {
"required": [
"condition"
],
"type": "object",
"properties": {
"condition": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ConditionWithSteps"
},
"customIdentifier": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_StreamlangStep": {
"anyOf": [
{
"anyOf": [
{
"required": [
"action",
"from",
"patterns"
],
"type": "object",
"properties": {
"action": {
"enum": [
"grok"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field to parse with grok patterns"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"pattern_definitions": {
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"patterns": {
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"description": "Grok patterns applied in order to extract fields"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Grok processor - Extract fields from text using grok patterns"
},
{
"required": [
"action",
"from",
"pattern"
],
"type": "object",
"properties": {
"action": {
"enum": [
"dissect"
],
"type": "string"
},
"append_separator": {
"minLength": 1,
"type": "string",
"description": "Separator inserted when target fields are concatenated"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field to parse with dissect pattern"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"pattern": {
"minLength": 1,
"type": "string",
"description": "Dissect pattern describing field boundaries"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Dissect processor - Extract fields from text using a lightweight, delimiter-based parser"
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"uri_parts"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field holding the URI string to parse"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"keep_original": {
"type": "boolean",
"description": "If true (default), preserve the original URI string alongside the extracted parts"
},
"remove_if_successful": {
"type": "boolean",
"description": "If true, remove the source field after a successful parse. Source field is kept on failure."
},
"to": {
"minLength": 1,
"type": "string",
"description": "Target field / column prefix for the extracted URI components (defaults to \"url\"). May equal `from` — the canonical ECS shape parses the `url` field in place. Note: combining `to === from` with `remove_if_successful: true` nulls the parsed object after writing it."
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...)"
},
{
"required": [
"action",
"from",
"formats"
],
"type": "object",
"properties": {
"action": {
"enum": [
"date"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"formats": {
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"description": "Accepted input date formats, tried in order"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field containing the date/time text"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"locale": {
"minLength": 1,
"type": "string",
"description": "Optional locale for date parsing"
},
"output_format": {
"minLength": 1,
"type": "string",
"description": "Optional output format for storing the parsed date as text"
},
"timezone": {
"minLength": 1,
"type": "string",
"description": "Optional timezone for date parsing"
},
"to": {
"minLength": 1,
"type": "string",
"description": "Target field for the parsed date (defaults to source)"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Date processor - Parse dates from strings using one or more expected formats"
},
{
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"drop_document"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"expression",
"to"
],
"type": "object",
"properties": {
"action": {
"enum": [
"math"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"expression": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from",
"to"
],
"type": "object",
"properties": {
"action": {
"enum": [
"rename"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Existing source field to rename or move"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip when source field is missing"
},
"override": {
"type": "boolean",
"description": "Allow overwriting the target field if it already exists"
},
"to": {
"minLength": 1,
"type": "string",
"description": "New field name or destination path"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Rename processor - Change a field name and optionally its location"
},
{
"required": [
"action",
"to"
],
"type": "object",
"properties": {
"action": {
"enum": [
"set"
],
"type": "string"
},
"copy_from": {
"minLength": 1,
"type": "string",
"description": "Copy value from another field instead of providing a literal"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"override": {
"type": "boolean",
"description": "Allow overwriting an existing target field"
},
"to": {
"minLength": 1,
"type": "string",
"description": "Target field to set or create"
},
"value": {
"description": "Literal value to assign to the target field"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)"
},
{
"required": [
"action",
"to",
"value"
],
"type": "object",
"properties": {
"action": {
"enum": [
"append"
],
"type": "string"
},
"allow_duplicates": {
"type": "boolean",
"description": "If true, do not deduplicate appended values"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"to": {
"minLength": 1,
"type": "string",
"description": "Array field to append values to"
},
"value": {
"minItems": 1,
"type": "array",
"items": { },
"description": "Values to append (must be literal, no templates)"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Append processor - Append one or more values to an existing or new array field"
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"remove_by_prefix"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Field to remove along with all its nested fields"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
}
},
"additionalProperties": false,
"description": "Remove by prefix processor - Remove a field and all nested fields matching the prefix"
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"remove"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Field to remove from the document"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Remove processor - Delete one or more fields from the document"
},
{
"required": [
"action",
"from",
"pattern",
"replacement"
],
"type": "object",
"properties": {
"action": {
"enum": [
"replace"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"pattern": {
"minLength": 1,
"type": "string"
},
"replacement": {
"type": "string"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from",
"patterns"
],
"type": "object",
"properties": {
"action": {
"enum": [
"redact"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field to redact sensitive data from"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing (defaults to true)"
},
"pattern_definitions": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Custom pattern definitions to use in the patterns"
},
"patterns": {
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"description": "Grok patterns to match sensitive data (for example, \"%{IP:client}\", \"%{EMAILADDRESS:email}\")"
},
"prefix": {
"type": "string",
"description": "Prefix to prepend to the redacted pattern name (defaults to \"<\")"
},
"suffix": {
"type": "string",
"description": "Suffix to append to the redacted pattern name (defaults to \">\")"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Redact processor - Mask sensitive data using Grok patterns"
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"uppercase"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"lowercase"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"trim"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from",
"delimiter",
"to"
],
"type": "object",
"properties": {
"action": {
"enum": [
"join"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"delimiter": {
"type": "string"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string"
}
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from",
"separator"
],
"type": "object",
"properties": {
"action": {
"enum": [
"split"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field to split into an array"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"preserve_trailing": {
"type": "boolean",
"description": "Preserve empty trailing fields in the split result"
},
"separator": {
"minLength": 1,
"type": "string",
"description": "Regex separator used to split the field value into an array"
},
"to": {
"minLength": 1,
"type": "string",
"description": "Target field for the split array (defaults to source)"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Split processor - Split a field value into an array using a separator"
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"sort"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Array field to sort"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"order": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "Sort order - \"asc\" (ascending) or \"desc\" (descending). Defaults to \"asc\""
},
"to": {
"minLength": 1,
"type": "string",
"description": "Target field for the sorted array (defaults to source)"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from",
"type"
],
"type": "object",
"properties": {
"action": {
"enum": [
"convert"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minLength": 1,
"type": "string",
"description": "Source field to convert to a different data type"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"to": {
"minLength": 1,
"type": "string",
"description": "Target field for the converted value (defaults to source)"
},
"type": {
"enum": [
"integer",
"long",
"double",
"boolean",
"string"
],
"type": "string",
"description": "Target data type: integer, long, double, boolean, or string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)"
},
{
"required": [
"action",
"from",
"to"
],
"type": "object",
"properties": {
"action": {
"enum": [
"concat"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"from": {
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"field"
],
"type": "string"
},
"value": {
"minLength": 1,
"type": "string"
}
}
},
{
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"literal"
],
"type": "string"
},
"value": {
"type": "string"
}
}
}
]
}
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"allOf": [
{
"required": [
"action",
"source_ip",
"destination_ip"
],
"type": "object",
"properties": {
"action": {
"enum": [
"network_direction"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"destination_ip": {
"minLength": 1,
"type": "string"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"source_ip": {
"minLength": 1,
"type": "string"
},
"target_field": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"anyOf": [
{
"required": [
"internal_networks"
],
"type": "object",
"properties": {
"internal_networks": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
{
"required": [
"internal_networks_field"
],
"type": "object",
"properties": {
"internal_networks_field": {
"minLength": 1,
"type": "string"
}
},
"additionalProperties": false
}
]
}
]
},
{
"required": [
"action",
"field",
"extractions"
],
"type": "object",
"properties": {
"action": {
"enum": [
"json_extract"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"extractions": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"selector",
"target_field"
],
"type": "object",
"properties": {
"selector": {
"minLength": 1,
"type": "string",
"description": "JSONPath-like selector to extract value (e.g., \"user.id\", \"$.metadata.client.ip\", \"items[0].name\")"
},
"target_field": {
"minLength": 1,
"type": "string",
"description": "Target field to store the extracted value"
},
"type": {
"enum": [
"keyword",
"integer",
"long",
"double",
"boolean"
],
"type": "string",
"description": "Data type for the extracted value. Defaults to \"keyword\". Ensures consistent types across transpilers."
}
},
"description": "A single extraction specification"
},
"description": "List of extraction specifications"
},
"field": {
"minLength": 1,
"type": "string",
"description": "Source field containing the JSON string to parse"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors"
},
{
"required": [
"action",
"policy_name",
"to"
],
"type": "object",
"properties": {
"action": {
"enum": [
"enrich"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean"
},
"override": {
"type": "boolean"
},
"policy_name": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"to": {
"minLength": 1,
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false
},
{
"required": [
"action",
"from"
],
"type": "object",
"properties": {
"action": {
"enum": [
"user_agent"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"extract_device_type": {
"type": "boolean",
"description": "Extracts device type from the user agent string"
},
"from": {
"minLength": 1,
"type": "string",
"description": "The field containing the user agent string"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when source field is missing"
},
"properties": {
"type": "array",
"items": {
"enum": [
"name",
"os",
"device",
"original",
"version"
],
"type": "string"
},
"description": "Specific properties to extract (defaults to all)"
},
"regex_file": {
"minLength": 1,
"type": "string",
"description": "Custom regex file name containing the regular expressions for parsing the user agent string"
},
"to": {
"minLength": 1,
"type": "string",
"description": "The field that will be filled with the user agent details"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "User agent processor - Extract browser, OS, and device details from a user agent string"
},
{
"required": [
"action",
"expression",
"prefix"
],
"type": "object",
"properties": {
"action": {
"enum": [
"registered_domain"
],
"type": "string"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"expression": {
"minLength": 1,
"type": "string",
"description": "The string expression containing the FQDN to parse"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"ignore_missing": {
"type": "boolean",
"description": "Skip processing when expression field is missing"
},
"prefix": {
"minLength": 1,
"type": "string",
"description": "The prefix for the output columns. The extracted parts are available as prefix.part_name"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN"
},
{
"required": [
"action",
"processors"
],
"type": "object",
"properties": {
"action": {
"enum": [
"manual_ingest_pipeline"
],
"type": "string",
"description": "Manual ingest pipeline - executes raw Elasticsearch ingest processors"
},
"customIdentifier": {
"minLength": 1,
"type": "string",
"description": "Custom identifier to correlate this processor across outputs"
},
"description": {
"type": "string",
"description": "Human-readable notes about this processor step"
},
"ignore_failure": {
"type": "boolean",
"description": "Continue pipeline execution if this processor fails"
},
"on_failure": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
},
"description": "Fallback processors to run when a processor fails"
},
"processors": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": { }
},
"description": "List of raw Elasticsearch ingest processors to run"
},
"tag": {
"type": "string",
"description": "Optional ingest processor tag for Elasticsearch"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
},
"additionalProperties": false,
"description": "Manual ingest pipeline wrapper around native Elasticsearch processors"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_StreamlangConditionBlock"
}
]
},
"Kibana_HTTP_APIs_StreamUpsertRequest": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_WiredStreamUpsertRequest"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_ClassicStreamUpsertRequest"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_QueryStreamUpsertRequest"
}
]
},
"Kibana_HTTP_APIs_tagcloudLibItemNoESQL": {
"title": "Tag Cloud Chart (library)",
"required": [
"type",
"data_source",
"metric",
"tag_by"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTagcloudStyling"
},
"tag_by": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
},
"additionalProperties": false
}
]
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"tag_cloud"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_transform-health-create-rule-body-alerting": {
"title": "Transform health",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Transform Health Rule Params",
"required": [
"includeTransforms"
],
"type": "object",
"properties": {
"excludeTransforms": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"default": "null"
},
"includeTransforms": {
"type": "array",
"items": {
"type": "string"
}
},
"testsConfig": {
"type": [
"null",
"object"
],
"properties": {
"errorMessages": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false,
"default": "null"
},
"healthCheck": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false,
"default": "null"
},
"notStarted": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false,
"default": "null"
}
},
"additionalProperties": false,
"default": "null"
}
},
"additionalProperties": false,
"description": "The parameters for the transform health rule. These parameters are appropriate when `rule_type_id` is `transform_health`."
},
"rule_type_id": {
"enum": [
"transform_health"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_treemapLibItemNoESQL": {
"title": "Treemap Chart (library)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
}
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metric configurations (minimum 1)"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"treemap"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_agent_policy_request_body": {
"title": "update_agent_policy_request_body",
"required": [
"name",
"namespace"
],
"type": "object",
"properties": {
"advanced_settings": {
"type": "object",
"properties": {
"agent_download_target_directory": { },
"agent_download_timeout": { },
"agent_features_disable_policy_change_acks_enabled": { },
"agent_features_include_tags_in_events_enabled": { },
"agent_internal": { },
"agent_limits_go_max_procs": { },
"agent_logging_files_interval": { },
"agent_logging_files_keepfiles": { },
"agent_logging_files_rotateeverybytes": { },
"agent_logging_level": { },
"agent_logging_metrics_period": { },
"agent_logging_to_files": { },
"agent_monitoring_runtime_experimental": { }
},
"additionalProperties": false
},
"agent_features": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"name": {
"type": "string"
}
},
"additionalProperties": false
}
},
"agentless": {
"type": "object",
"properties": {
"cloud_connectors": {
"required": [
"enabled"
],
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"target_csp": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string"
}
},
"additionalProperties": false
},
"cluster_id": {
"type": "string"
},
"resources": {
"type": "object",
"properties": {
"requests": {
"type": "object",
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"bumpRevision": {
"type": "boolean"
},
"data_output_id": {
"type": [
"null",
"string"
]
},
"description": {
"type": "string"
},
"download_source_id": {
"type": [
"null",
"string"
],
"description": "Use `download_source_ids` instead",
"deprecated": true
},
"download_source_ids": {
"maxItems": 3,
"type": "array",
"items": {
"maxLength": 500,
"type": "string",
"description": "A download source ID, or the reserved value 'default' to dynamically reference whichever source is currently set as default."
}
},
"fleet_server_host_id": {
"type": [
"null",
"string"
]
},
"force": {
"type": "boolean"
},
"global_data_tags": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"value": {
"type": [
"number",
"string"
]
}
},
"additionalProperties": false
},
"description": "User defined data tags that are added to all of the inputs. The values can be strings or numbers."
},
"has_agent_version_conditions": {
"type": "boolean"
},
"has_fleet_server": {
"type": "boolean"
},
"id": {
"type": "string"
},
"inactivity_timeout": {
"minimum": 0,
"type": "number",
"default": 1209600
},
"is_default": {
"type": "boolean"
},
"is_default_fleet_server": {
"type": "boolean"
},
"is_managed": {
"type": "boolean"
},
"is_protected": {
"type": "boolean"
},
"is_verifier": {
"type": "boolean"
},
"keep_monitoring_alive": {
"type": [
"null",
"boolean"
],
"description": "When set to true, monitoring will be enabled but logs/metrics collection will be disabled"
},
"min_agent_version": {
"type": [
"null",
"string"
]
},
"monitoring_diagnostics": {
"type": "object",
"properties": {
"limit": {
"type": "object",
"properties": {
"burst": {
"type": "number"
},
"interval": {
"type": "string"
}
},
"additionalProperties": false
},
"uploader": {
"type": "object",
"properties": {
"init_dur": {
"type": "string"
},
"max_dur": {
"type": "string"
},
"max_retries": {
"type": "number"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"monitoring_enabled": {
"maxItems": 3,
"type": "array",
"items": {
"enum": [
"logs",
"metrics",
"traces"
],
"type": "string"
}
},
"monitoring_http": {
"type": "object",
"properties": {
"buffer": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false
},
"enabled": {
"type": "boolean"
},
"host": {
"type": "string"
},
"port": {
"maximum": 65353,
"minimum": 0,
"type": "number"
}
},
"additionalProperties": false
},
"monitoring_output_id": {
"type": [
"null",
"string"
]
},
"monitoring_pprof_enabled": {
"type": "boolean"
},
"name": {
"minLength": 1,
"type": "string"
},
"namespace": {
"minLength": 1,
"type": "string"
},
"overrides": {
"type": [
"null",
"object"
],
"additionalProperties": { },
"description": "Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package_agent_version_conditions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"title",
"version_condition"
],
"type": "object",
"properties": {
"name": {
"type": "string"
},
"title": {
"type": "string"
},
"version_condition": {
"type": "string"
}
},
"additionalProperties": false
}
},
"required_versions": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"version",
"percentage"
],
"type": "object",
"properties": {
"percentage": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "Target percentage of agents to auto upgrade"
},
"version": {
"type": "string",
"description": "Target version for automatic agent upgrade"
}
},
"additionalProperties": false
}
},
"space_ids": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the agent policy supports agentless integrations. Deprecated in favor of the Fleet managed integrations API.",
"deprecated": true
},
"unenroll_timeout": {
"minimum": 0,
"type": "number"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_connector": {
"title": "update_connector",
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"maxLength": 1024,
"type": "string",
"description": "The display name for the connector."
},
"config": {
"oneOf": [
{
"$ref": "#/components/schemas/bedrock_config"
},
{
"$ref": "#/components/schemas/crowdstrike_config"
},
{
"$ref": "#/components/schemas/d3security_config"
},
{
"$ref": "#/components/schemas/email_config"
},
{
"$ref": "#/components/schemas/gemini_config"
},
{
"$ref": "#/components/schemas/resilient_config"
},
{
"$ref": "#/components/schemas/index_config"
},
{
"$ref": "#/components/schemas/jira_config"
},
{
"$ref": "#/components/schemas/defender_config"
},
{
"$ref": "#/components/schemas/genai_azure_config"
},
{
"$ref": "#/components/schemas/genai_openai_config"
},
{
"$ref": "#/components/schemas/opsgenie_config"
},
{
"$ref": "#/components/schemas/pagerduty_config"
},
{
"$ref": "#/components/schemas/sentinelone_config"
},
{
"$ref": "#/components/schemas/servicenow_config"
},
{
"$ref": "#/components/schemas/servicenow_itom_config"
},
{
"$ref": "#/components/schemas/slack_api_config"
},
{
"$ref": "#/components/schemas/swimlane_config"
},
{
"$ref": "#/components/schemas/thehive_config"
},
{
"$ref": "#/components/schemas/tines_config"
},
{
"$ref": "#/components/schemas/torq_config"
},
{
"$ref": "#/components/schemas/webhook_config"
},
{
"$ref": "#/components/schemas/cases_webhook_config"
},
{
"$ref": "#/components/schemas/xmatters_config"
}
],
"additionalProperties": { },
"description": "The connector configuration details."
},
"secrets": {
"oneOf": [
{
"$ref": "#/components/schemas/bedrock_secrets"
},
{
"$ref": "#/components/schemas/crowdstrike_secrets"
},
{
"$ref": "#/components/schemas/d3security_secrets"
},
{
"$ref": "#/components/schemas/email_secrets"
},
{
"$ref": "#/components/schemas/gemini_secrets"
},
{
"$ref": "#/components/schemas/resilient_secrets"
},
{
"$ref": "#/components/schemas/jira_secrets"
},
{
"$ref": "#/components/schemas/teams_secrets"
},
{
"$ref": "#/components/schemas/genai_secrets"
},
{
"$ref": "#/components/schemas/opsgenie_secrets"
},
{
"$ref": "#/components/schemas/pagerduty_secrets"
},
{
"$ref": "#/components/schemas/sentinelone_secrets"
},
{
"$ref": "#/components/schemas/servicenow_secrets"
},
{
"$ref": "#/components/schemas/slack_api_secrets"
},
{
"$ref": "#/components/schemas/swimlane_secrets"
},
{
"$ref": "#/components/schemas/thehive_secrets"
},
{
"$ref": "#/components/schemas/tines_secrets"
},
{
"$ref": "#/components/schemas/torq_secrets"
},
{
"$ref": "#/components/schemas/webhook_secrets"
},
{
"$ref": "#/components/schemas/cases_webhook_secrets"
},
{
"$ref": "#/components/schemas/xmatters_secrets"
}
],
"additionalProperties": { }
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_maintenance_window": {
"title": "update_maintenance_window",
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications."
},
"schedule": {
"required": [
"custom"
],
"type": "object",
"properties": {
"custom": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_request"
}
},
"additionalProperties": false
},
"scope": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_maintenance_window_scope_request"
},
"title": {
"type": "string",
"description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_output_elasticsearch": {
"title": "update_output_elasticsearch",
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean"
},
"is_default_monitoring": {
"type": "boolean"
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"preset": {
"enum": [
"balanced",
"custom",
"throughput",
"scale",
"latency"
],
"type": "string"
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"type": {
"enum": [
"elasticsearch"
],
"type": "string"
},
"write_to_logs_streams": {
"type": [
"null",
"boolean"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_output_kafka": {
"title": "update_output_kafka",
"required": [
"name"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"auth_type": {
"enum": [
"none",
"user_pass",
"ssl",
"kerberos"
],
"type": "string"
},
"broker_timeout": {
"type": "number"
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"client_id": {
"type": "string"
},
"compression": {
"enum": [
"gzip",
"snappy",
"lz4",
"none"
],
"type": "string"
},
"compression_level": {
"type": [
"null",
"number"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"connection_type": {
"enum": [
"plaintext",
"encryption"
],
"type": "string"
},
"hash": {
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"random": {
"type": "boolean"
}
},
"additionalProperties": false
},
"headers": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"key",
"value"
],
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
},
"additionalProperties": false
}
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean",
"default": false
},
"is_default_monitoring": {
"type": "boolean",
"default": false
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"key": {
"type": "string"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"partition": {
"enum": [
"random",
"round_robin",
"hash"
],
"type": "string"
},
"password": {
"type": [
"null",
"string"
]
},
"proxy_id": {
"type": [
"null",
"string"
],
"description": "Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.",
"deprecated": true
},
"random": {
"type": "object",
"properties": {
"group_events": {
"type": "number"
}
},
"additionalProperties": false
},
"required_acks": {
"enum": [
1,
0,
-1
],
"type": "integer"
},
"round_robin": {
"type": "object",
"properties": {
"group_events": {
"type": "number"
}
},
"additionalProperties": false
},
"sasl": {
"type": [
"null",
"object"
],
"properties": {
"mechanism": {
"enum": [
"PLAIN",
"SCRAM-SHA-256",
"SCRAM-SHA-512"
],
"type": "string"
}
},
"additionalProperties": false
},
"secrets": {
"type": "object",
"properties": {
"password": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"ssl": {
"required": [
"key"
],
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"timeout": {
"type": "number"
},
"topic": {
"type": "string"
},
"type": {
"enum": [
"kafka"
],
"type": "string"
},
"username": {
"type": [
"null",
"string"
]
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_output_logstash": {
"title": "update_output_logstash",
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean"
},
"is_default_monitoring": {
"type": "boolean"
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"type": {
"enum": [
"logstash"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_output_otlp": {
"title": "update_output_otlp",
"required": [
"otlp_exporter"
],
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean"
},
"is_default_monitoring": {
"type": "boolean"
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"name": {
"type": "string"
},
"otlp_exporter": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter"
}
],
"discriminator": {
"propertyName": "protocol",
"mapping": {
"grpc": "#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter",
"http/protobuf": "#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter"
}
}
},
"secrets": {
"type": "object",
"properties": {
"otlp_exporter": {
"type": "object",
"properties": {
"tls": {
"type": "object",
"properties": {
"key_pem": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"tpm": {
"type": "object",
"properties": {
"auth": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"owner_auth": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"enum": [
"otlp"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_output_remote_elasticsearch": {
"title": "update_output_remote_elasticsearch",
"type": "object",
"properties": {
"allow_edit": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
},
"ca_sha256": {
"type": [
"null",
"string"
]
},
"ca_trusted_fingerprint": {
"type": [
"null",
"string"
]
},
"config_yaml": {
"type": [
"null",
"string"
]
},
"hosts": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"format": "uri"
}
},
"id": {
"type": "string"
},
"is_default": {
"type": "boolean"
},
"is_default_monitoring": {
"type": "boolean"
},
"is_internal": {
"type": "boolean"
},
"is_preconfigured": {
"type": "boolean"
},
"kibana_api_key": {
"type": [
"null",
"string"
]
},
"kibana_url": {
"type": [
"null",
"string"
]
},
"name": {
"type": "string"
},
"otel_disable_beatsauth": {
"type": [
"null",
"boolean"
]
},
"otel_exporter_config_yaml": {
"type": [
"null",
"string"
]
},
"preset": {
"enum": [
"balanced",
"custom",
"throughput",
"scale",
"latency"
],
"type": "string"
},
"proxy_id": {
"type": [
"null",
"string"
]
},
"secrets": {
"type": "object",
"properties": {
"service_token": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"ssl": {
"type": "object",
"properties": {
"key": {
"anyOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"id": {
"type": "string"
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"service_token": {
"type": [
"null",
"string"
]
},
"shipper": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_shipper"
}
]
},
"ssl": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_output_ssl"
}
]
},
"sync_integrations": {
"type": "boolean"
},
"sync_uninstalled_integrations": {
"type": "boolean"
},
"type": {
"enum": [
"remote_elasticsearch"
],
"type": "string"
},
"write_to_logs_streams": {
"type": [
"null",
"boolean"
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_package_policy_request": {
"title": "update_package_policy_request",
"type": "object",
"properties": {
"additional_datastreams_permissions": {
"maxItems": 1000,
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Additional data stream permissions that will be added to the agent policy."
},
"cloud_connector_id": {
"type": [
"null",
"string"
],
"description": "ID of the cloud connector associated with this package policy."
},
"cloud_connector_name": {
"maxLength": 255,
"minLength": 1,
"type": [
"null",
"string"
],
"description": "Transient field for cloud connector name during creation."
},
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this integration to its inputs."
},
"description": {
"type": "string",
"description": "Package policy description"
},
"enabled": {
"type": "boolean"
},
"force": {
"type": "boolean"
},
"global_data_tags": {
"maxItems": 100,
"type": [
"null",
"array"
],
"items": {
"required": [
"name",
"value"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the custom field. Cannot contain spaces."
},
"value": {
"type": [
"number",
"string"
],
"description": "The value of the custom field."
}
},
"additionalProperties": false
}
},
"inputs": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"type",
"enabled"
],
"type": "object",
"properties": {
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this input."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"name": {
"type": "string"
},
"policy_template": {
"type": "string"
},
"streams": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"enabled",
"data_stream",
"compiled_stream"
],
"type": "object",
"properties": {
"compiled_stream": { },
"condition": {
"maxLength": 10000,
"type": [
"null",
"string"
],
"description": "Agent condition expression to evaluate whether to apply this stream."
},
"config": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"data_stream": {
"required": [
"dataset"
],
"type": "object",
"properties": {
"dataset": {
"type": "string"
},
"elasticsearch": {
"type": "object",
"properties": {
"dynamic_dataset": {
"type": "boolean"
},
"dynamic_namespace": {
"type": "boolean"
},
"privileges": {
"type": "object",
"properties": {
"indices": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"type": {
"type": "string"
}
},
"additionalProperties": false
},
"deprecated": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info"
},
"enabled": {
"type": "boolean"
},
"id": {
"type": "string"
},
"keep_enabled": {
"type": "boolean"
},
"migrate_from": {
"type": "string"
},
"release": {
"enum": [
"ga",
"beta",
"experimental"
],
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"type": {
"type": "string"
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
}
},
"additionalProperties": false
}
},
"is_managed": {
"type": "boolean"
},
"name": {
"type": "string"
},
"namespace": {
"maxLength": 100,
"type": "string",
"description": "The package policy namespace. Leave blank to inherit the agent policy's namespace."
},
"output_id": {
"type": [
"null",
"string"
]
},
"overrides": {
"type": [
"null",
"object"
],
"properties": {
"inputs": {
"type": "object",
"additionalProperties": { }
}
},
"additionalProperties": false,
"description": "Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure."
},
"package": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_package_policy_package"
},
"package_agent_version_condition": {
"type": "string"
},
"policy_id": {
"type": [
"null",
"string"
],
"description": "ID of the agent policy which the package policy will be added to.",
"deprecated": true
},
"policy_ids": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string",
"description": "IDs of the agent policies that the package policy will be added to."
}
},
"spaceIds": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"supports_agentless": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy belongs to an agentless agent policy."
},
"supports_cloud_connector": {
"type": [
"null",
"boolean"
],
"description": "Indicates whether the package policy supports cloud connectors."
},
"var_group_selections": {
"type": "object",
"additionalProperties": {
"maxLength": 1024,
"type": "string"
},
"description": "Variable group selections. Maps var_group name to the selected option name within that group."
},
"vars": {
"type": "object",
"additionalProperties": {
"required": [
"value"
],
"type": "object",
"properties": {
"frozen": {
"type": "boolean"
},
"type": {
"type": "string"
},
"value": { }
},
"additionalProperties": false
},
"description": "Package variable (see integration documentation for more information)"
},
"version": {
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_package_request": {
"title": "update_package_request",
"type": "object",
"properties": {
"keepPoliciesUpToDate": {
"type": "boolean"
},
"namespace_customization_enabled_for": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 100,
"type": "string"
},
"description": "Namespaces for which namespace-level customization is enabled on this package."
},
"namespace_customization_settings": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"ilm_policy": {
"maxLength": 1024,
"minLength": 1,
"type": "string"
}
}
},
"description": "Per-namespace managed settings (for example, ILM policy) for this package. Keyed by namespace name."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_package_response": {
"title": "update_package_response",
"required": [
"item"
],
"type": "object",
"properties": {
"item": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_get_package_info"
},
"warnings": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"dataStreamName",
"namespace",
"baseTemplateName",
"nsTemplateName",
"conflictingTemplates"
],
"type": "object",
"properties": {
"baseTemplateName": {
"maxLength": 1000,
"type": "string"
},
"conflictingTemplates": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"name",
"priority",
"conflictType"
],
"type": "object",
"properties": {
"conflictType": {
"enum": [
"overrides_fleet",
"blocked_by_same_priority",
"overridden_by_fleet"
],
"type": "string"
},
"name": {
"maxLength": 1000,
"type": "string"
},
"priority": {
"type": "number"
}
},
"additionalProperties": false
}
},
"dataStreamName": {
"maxLength": 1000,
"type": "string"
},
"namespace": {
"maxLength": 255,
"type": "string"
},
"nsTemplateName": {
"maxLength": 1000,
"type": "string"
}
},
"additionalProperties": false
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_rule": {
"title": "update_rule",
"required": [
"name",
"schedule"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_update_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the rule."
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false
},
"tags": {
"type": "array",
"items": {
"type": "string",
"description": "The tags for the rule."
},
"default": [ ]
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_rule_action": {
"title": "update_rule_action",
"required": [
"id"
],
"type": "object",
"properties": {
"alerts_filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_update_rule_action_alerts_filter"
},
"frequency": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_update_rule_action_frequency"
},
"group": {
"type": "string",
"description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`."
},
"id": {
"type": "string",
"description": "The identifier for the connector saved object."
},
"params": {
"type": "object",
"additionalProperties": { },
"description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context."
},
"use_alert_data_for_template": {
"type": "boolean",
"description": "Indicates whether to use alert data as a template."
},
"uuid": {
"type": "string",
"description": "A universally unique identifier (UUID) for the action."
}
},
"additionalProperties": false,
"description": "An action that runs under defined conditions."
},
"Kibana_HTTP_APIs_update_rule_action_alerts_filter": {
"title": "update_rule_action_alerts_filter",
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_alerts_filter_query"
},
"timeframe": {
"required": [
"days",
"hours",
"timezone"
],
"type": "object",
"properties": {
"days": {
"type": "array",
"items": {
"enum": [
1,
2,
3,
4,
5,
6,
7
],
"type": "integer"
},
"description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week."
},
"hours": {
"required": [
"start",
"end"
],
"type": "object",
"properties": {
"end": {
"type": "string",
"description": "The end of the time frame, in 24-hour notation (`hh:mm`)."
},
"start": {
"type": "string",
"description": "The start of the time frame, in 24-hour notation (`hh:mm`)."
}
},
"additionalProperties": false,
"description": "Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day."
},
"timezone": {
"type": "string",
"description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended."
}
},
"additionalProperties": false,
"description": "Defines a period that limits whether the action runs."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_update_rule_action_frequency": {
"title": "update_rule_action_frequency",
"required": [
"summary",
"notify_when"
],
"type": "object",
"properties": {
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval"
],
"type": "string",
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"summary": {
"type": "boolean",
"description": "Indicates whether the action is a summary."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when `notify_when` is set to `onThrottleInterval`. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.",
"default": "null"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_upgrade_package_policies_request": {
"title": "upgrade_package_policies_request",
"required": [
"packagePolicyIds"
],
"type": "object",
"properties": {
"packagePolicyIds": {
"maxItems": 1000,
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visApiConfig": {
"title": "Visualizations",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegacyMetricNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTagcloudChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRegionMapChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapChart"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleChart"
}
],
"description": "Visualization configuration. Use the `type` field to specify the chart type. Each chart type has its own set of required and optional fields."
},
"Kibana_HTTP_APIs_visApiDirection": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "Direction"
},
"Kibana_HTTP_APIs_visApiDomainCustom": {
"required": [
"type",
"min",
"max"
],
"type": "object",
"properties": {
"max": {
"type": "number",
"description": "Max domain value"
},
"min": {
"type": "number",
"description": "Min domain value"
},
"rounding": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainRounding"
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Uses explicitly provided domain bounds (min and max)."
},
"Kibana_HTTP_APIs_visApiDomainFit": {
"required": [
"type"
],
"type": "object",
"properties": {
"rounding": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainRounding"
},
"type": {
"enum": [
"fit"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion."
},
"Kibana_HTTP_APIs_visApiDomainFull": {
"required": [
"type"
],
"type": "object",
"properties": {
"rounding": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainRounding"
},
"type": {
"enum": [
"full"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series)."
},
"Kibana_HTTP_APIs_visApiDomainRounding": {
"type": "boolean",
"description": "Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.",
"default": true
},
"Kibana_HTTP_APIs_visApiOrientation": {
"enum": [
"horizontal",
"vertical",
"angled"
],
"type": "string",
"description": "Orientation"
},
"Kibana_HTTP_APIs_visApiSimpleOrientation": {
"enum": [
"horizontal",
"vertical"
],
"type": "string",
"description": "Orientation"
},
"Kibana_HTTP_APIs_visApiXyAxisConfig": {
"title": "Axis",
"type": "object",
"properties": {
"x": {
"type": "object",
"properties": {
"domain": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom"
}
],
"description": "X-axis domain configuration"
},
"grid": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show grid lines for this axis"
}
},
"additionalProperties": false,
"description": "Axis grid lines configuration"
},
"labels": {
"type": "object",
"properties": {
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiOrientation"
}
},
"additionalProperties": false,
"description": "Label configuration"
},
"scale": {
"anyOf": [
{
"enum": [
"ordinal"
],
"type": "string"
},
{
"enum": [
"temporal"
],
"type": "string"
},
{
"enum": [
"linear"
],
"type": "string"
}
],
"description": "X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields."
},
"ticks": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show tick marks on the axis"
}
},
"additionalProperties": false,
"description": "Axis tick marks configuration"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Axis title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title."
}
},
"additionalProperties": false,
"description": "Axis title configuration"
}
},
"additionalProperties": false,
"description": "X-axis configuration"
},
"y": {
"type": "object",
"properties": {
"domain": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom"
}
],
"description": "Y-axis domain configuration",
"default": {
"rounding": true,
"type": "full"
},
"discriminator": {
"propertyName": "type",
"mapping": {
"custom": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom",
"fit": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit",
"full": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull"
}
}
},
"grid": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show grid lines for this axis"
}
},
"additionalProperties": false,
"description": "Axis grid lines configuration"
},
"labels": {
"type": "object",
"properties": {
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiOrientation"
}
},
"additionalProperties": false,
"description": "Label configuration"
},
"scale": {
"anyOf": [
{
"enum": [
"linear"
],
"type": "string"
},
{
"enum": [
"log"
],
"type": "string"
},
{
"enum": [
"sqrt"
],
"type": "string"
}
],
"description": "Y-axis scale type for data transformation"
},
"ticks": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show tick marks on the axis"
}
},
"additionalProperties": false,
"description": "Axis tick marks configuration"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Axis title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title."
}
},
"additionalProperties": false,
"description": "Axis title configuration"
}
},
"additionalProperties": false,
"description": "Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts)."
},
"y2": {
"type": "object",
"properties": {
"domain": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom"
}
],
"description": "Y-axis domain configuration",
"default": {
"rounding": true,
"type": "full"
},
"discriminator": {
"propertyName": "type",
"mapping": {
"custom": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom",
"fit": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit",
"full": "#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull"
}
}
},
"grid": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show grid lines for this axis"
}
},
"additionalProperties": false,
"description": "Axis grid lines configuration"
},
"labels": {
"type": "object",
"properties": {
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiOrientation"
}
},
"additionalProperties": false,
"description": "Label configuration"
},
"scale": {
"anyOf": [
{
"enum": [
"linear"
],
"type": "string"
},
{
"enum": [
"log"
],
"type": "string"
},
{
"enum": [
"sqrt"
],
"type": "string"
}
],
"description": "Y-axis scale type for data transformation"
},
"ticks": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show tick marks on the axis"
}
},
"additionalProperties": false,
"description": "Axis tick marks configuration"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Axis title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title."
}
},
"additionalProperties": false,
"description": "Axis title configuration"
}
},
"additionalProperties": false,
"description": "Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts)."
}
},
"additionalProperties": false,
"description": "Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side."
},
"Kibana_HTTP_APIs_visAutoColor": {
"title": "Auto Color",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"auto"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Coloring determined at runtime based on chart defaults"
},
"Kibana_HTTP_APIs_visByteFormat": {
"title": "Byte Format",
"required": [
"type"
],
"type": "object",
"properties": {
"decimals": {
"type": "number",
"description": "Number of decimal places to display.",
"default": 2
},
"suffix": {
"type": "string",
"description": "Suffix appended to the formatted value."
},
"type": {
"anyOf": [
{
"enum": [
"bits"
],
"type": "string"
},
{
"enum": [
"bytes"
],
"type": "string"
}
],
"description": "Data size unit: `bits` or `bytes`."
}
},
"additionalProperties": false,
"description": "Data size format in bits or bytes, with optional decimal places and suffix."
},
"Kibana_HTTP_APIs_visCategoricalColorMapping": {
"title": "Categorical Color Mapping",
"required": [
"mode",
"palette",
"mapping"
],
"type": "object",
"properties": {
"mapping": {
"maxItems": 1000,
"type": "array",
"items": {
"required": [
"values",
"color"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorFromPalette"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorCode"
}
]
},
"values": {
"maxItems": 1000,
"type": "array",
"items": {
"anyOf": [
{
"type": "string"
},
{
"type": "number"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangeKey"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMultiFieldKey"
}
]
}
}
},
"additionalProperties": false
}
},
"mode": {
"enum": [
"categorical"
],
"type": "string"
},
"palette": {
"type": "string",
"description": "Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`."
},
"unassigned": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUnassignedColorSchema"
}
},
"additionalProperties": false,
"description": "Palette color assignment for specific categorical values. Unmapped values receive the unassigned color."
},
"Kibana_HTTP_APIs_visCollapseBy": {
"anyOf": [
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"sum"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
},
{
"enum": [
"min"
],
"type": "string"
}
],
"description": "Aggregation function used to collapse a breakdown dimension into a single value."
},
"Kibana_HTTP_APIs_visColorByValue": {
"title": "Color By Value",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValueAbsolute"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValuePercentage"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValuePalette"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegacyColorByValue"
}
],
"description": "Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes."
},
"Kibana_HTTP_APIs_visColorByValueAbsolute": {
"title": "Color By Value (Absolute)",
"required": [
"type",
"range",
"steps"
],
"type": "object",
"properties": {
"range": {
"enum": [
"absolute"
],
"type": "string"
},
"steps": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"color"
],
"type": "object",
"properties": {
"color": {
"type": "string",
"description": "The color to use for this step."
},
"gte": {
"type": [
"null",
"number"
],
"description": "The lower bound of range from which this color applies (inclusive)."
},
"lt": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (exclusive)."
},
"lte": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (inclusive)."
}
},
"additionalProperties": false
},
"description": "Array of ordered color steps defining the range each color is applied."
},
"type": {
"enum": [
"dynamic"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Color by absolute value configuration"
},
"Kibana_HTTP_APIs_visColorByValuePalette": {
"title": "Color By Value (Palette)",
"required": [
"type",
"palette"
],
"type": "object",
"properties": {
"palette": {
"anyOf": [
{
"enum": [
"status"
],
"type": "string"
},
{
"enum": [
"temperature"
],
"type": "string"
},
{
"enum": [
"complementary"
],
"type": "string"
},
{
"enum": [
"negative"
],
"type": "string"
},
{
"enum": [
"positive"
],
"type": "string"
},
{
"enum": [
"cool"
],
"type": "string"
},
{
"enum": [
"warm"
],
"type": "string"
},
{
"enum": [
"gray"
],
"type": "string"
}
],
"description": "The name of the palette to apply across the value range."
},
"type": {
"enum": [
"distributed_palette"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Color by value using a palette, with colors distributed across the range of values."
},
"Kibana_HTTP_APIs_visColorByValuePercentage": {
"title": "Color By Value (Percentage)",
"required": [
"type",
"range",
"steps"
],
"type": "object",
"properties": {
"range": {
"enum": [
"percentage"
],
"type": "string"
},
"steps": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"color"
],
"type": "object",
"properties": {
"color": {
"type": "string",
"description": "The color to use for this step."
},
"gte": {
"type": [
"null",
"number"
],
"description": "The lower bound of range from which this color applies (inclusive)."
},
"lt": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (exclusive)."
},
"lte": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (inclusive)."
}
},
"additionalProperties": false
},
"description": "Array of ordered color steps defining the range each color is applied."
},
"type": {
"enum": [
"dynamic"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Color by percentage value configuration"
},
"Kibana_HTTP_APIs_visColorCode": {
"title": "Color Code",
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"color_code"
],
"type": "string"
},
"value": {
"type": "string",
"description": "The static color value to use."
}
},
"additionalProperties": false,
"description": "A color specified as a hex or CSS color code string."
},
"Kibana_HTTP_APIs_visColorFromPalette": {
"title": "Color From Palette",
"required": [
"type",
"index"
],
"type": "object",
"properties": {
"index": {
"type": "number",
"description": "The index of the color in the palette."
},
"palette": {
"type": "string",
"description": "Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`."
},
"type": {
"enum": [
"from_palette"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Color at a fixed index position in a named palette."
},
"Kibana_HTTP_APIs_visColorMapping": {
"title": "Color Mapping",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCategoricalColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGradientColorMapping"
}
],
"description": "Color mapping for dimension values, either categorical (for specific values) or as a gradient.",
"default": {
"mapping": [ ],
"mode": "categorical",
"palette": "default"
}
},
"Kibana_HTTP_APIs_visCounterRateOperation": {
"title": "Counter Rate Operation",
"required": [
"field",
"operation"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"counter_rate"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visCountMetricOperation": {
"title": "Count Metric Operation",
"required": [
"operation"
],
"type": "object",
"properties": {
"empty_as_null": {
"type": "boolean",
"description": "When `true`, treats empty buckets as null instead of zero.",
"default": false
},
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"count"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visCumulativeSumOperation": {
"title": "Cumulative Sum Operation",
"required": [
"operation"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records."
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"cumulative_sum"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visCustomFormat": {
"title": "Custom Format",
"required": [
"type",
"pattern"
],
"type": "object",
"properties": {
"pattern": {
"type": "string",
"description": "Kibana field format pattern string."
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Custom format using a Kibana field format pattern string."
},
"Kibana_HTTP_APIs_visDatatableChart": {
"title": "Datatable",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableESQL"
}
],
"description": "Datatable chart configuration: DSL or ES|QL query based"
},
"Kibana_HTTP_APIs_visDatatableDensity": {
"type": "object",
"properties": {
"height": {
"type": "object",
"properties": {
"header": {
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"auto"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"max_lines": {
"maximum": 5,
"minimum": 1,
"type": "number",
"default": 3
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "Number of lines before the header is truncated."
},
"value": {
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"auto"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"lines": {
"maximum": 20,
"minimum": 1,
"type": "number",
"default": 1
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "Number of lines to display per table body cell."
}
},
"additionalProperties": false
},
"mode": {
"anyOf": [
{
"enum": [
"compact"
],
"type": "string"
},
{
"enum": [
"default"
],
"type": "string"
},
{
"enum": [
"expanded"
],
"type": "string"
}
],
"description": "Display density mode.",
"default": "default"
}
},
"additionalProperties": false,
"description": "Density configuration for the datatable."
},
"Kibana_HTTP_APIs_visDatatableESQL": {
"title": "Datatable (ES|QL)",
"required": [
"type",
"data_source"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metrics": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableESQLMetric"
},
"description": "Array of metrics to display as columns in the datatable"
},
"rows": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment of the rows.",
"default": "left"
},
"apply_color_to": {
"anyOf": [
{
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
{
"enum": [
"badge"
],
"type": "string"
}
],
"description": "Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay."
},
"click_filter": {
"type": "boolean",
"description": "When `true`, enables one-click filtering on cell values.",
"default": false
},
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for ESQL datatable rows. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.",
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"visible": {
"type": "boolean",
"description": "When `false`, hides the column from the datatable.",
"default": true
},
"width": {
"minimum": 0,
"type": "number",
"description": "Column width in pixels."
}
}
},
"description": "Array of operations to split the datatable rows by"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"split_metrics_by": {
"maxItems": 20,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of operations to split the metric columns by"
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"data_table"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Datatable state configuration for ES|QL queries"
},
"Kibana_HTTP_APIs_visDatatableESQLMetric": {
"title": "Datatable Metric (ES|QL)",
"required": [
"column"
],
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment of the columns.",
"default": "right"
},
"apply_color_to": {
"anyOf": [
{
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
{
"enum": [
"badge"
],
"type": "string"
}
],
"description": "Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay."
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.",
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"summary": {
"required": [
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Summary row label."
},
"type": {
"anyOf": [
{
"enum": [
"sum"
],
"type": "string"
},
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"count"
],
"type": "string"
},
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
}
],
"description": "Type of summary function to apply to the column."
}
},
"additionalProperties": false,
"description": "Summary row configuration"
},
"visible": {
"type": "boolean",
"description": "When `false`, hides the column from the datatable.",
"default": true
},
"width": {
"minimum": 0,
"type": "number",
"description": "Column width in pixels."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visDatatableMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visDatatableMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visDatatableNoESQL": {
"title": "Datatable (DSL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metrics": {
"maxItems": 1000,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment of the columns.",
"default": "right"
},
"apply_color_to": {
"anyOf": [
{
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
{
"enum": [
"badge"
],
"type": "string"
}
],
"description": "Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay."
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.",
"default": {
"type": "auto"
}
},
"summary": {
"required": [
"type"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Summary row label."
},
"type": {
"anyOf": [
{
"enum": [
"sum"
],
"type": "string"
},
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"count"
],
"type": "string"
},
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
}
],
"description": "Type of summary function to apply to the column."
}
},
"additionalProperties": false,
"description": "Summary row configuration"
},
"visible": {
"type": "boolean",
"description": "When `false`, hides the column from the datatable.",
"default": true
},
"width": {
"minimum": 0,
"type": "number",
"description": "Column width in pixels."
}
},
"additionalProperties": false
}
]
},
"description": "Array of metrics to display as columns in the datatable"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"rows": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment of the rows.",
"default": "left"
},
"apply_color_to": {
"anyOf": [
{
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
{
"enum": [
"badge"
],
"type": "string"
}
],
"description": "Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay."
},
"click_filter": {
"type": "boolean",
"description": "When `true`, enables one-click filtering on cell values.",
"default": false
},
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"visible": {
"type": "boolean",
"description": "When `false`, hides the column from the datatable.",
"default": true
},
"width": {
"minimum": 0,
"type": "number",
"description": "Column width in pixels."
}
},
"additionalProperties": false
}
]
},
"description": "Array of operations to split the datatable rows by"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"split_metrics_by": {
"maxItems": 20,
"minItems": 1,
"type": "array",
"items": {
"title": "Breakdown Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
],
"description": "Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters."
},
"description": "Array of operations to split the metric columns by"
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"data_table"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Datatable state configuration for standard queries"
},
"Kibana_HTTP_APIs_visDatatableRowDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visDatatableRowFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visDatatableRowHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visDatatableRowRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visDatatableRowTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visDatatableStyling": {
"title": "Datatable styling",
"type": "object",
"properties": {
"density": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDatatableDensity"
},
"paging": {
"anyOf": [
{
"enum": [
10
],
"type": "number"
},
{
"enum": [
20
],
"type": "number"
},
{
"enum": [
30
],
"type": "number"
},
{
"enum": [
50
],
"type": "number"
},
{
"enum": [
100
],
"type": "number"
}
],
"description": "Rows per page. When set, pagination is enabled with the specified number of rows."
},
"row_numbers": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "When `true`, displays row numbers."
}
},
"additionalProperties": false,
"description": "Configuration for row numbers"
},
"sort_by": {
"anyOf": [
{
"required": [
"column_type",
"index",
"direction"
],
"type": "object",
"properties": {
"column_type": {
"anyOf": [
{
"enum": [
"metric"
],
"type": "string"
},
{
"enum": [
"row"
],
"type": "string"
}
],
"description": "Type of column to sort by."
},
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"index": {
"minimum": 0,
"type": "number",
"description": "Index of the column or row to sort by (0-based)."
}
},
"additionalProperties": false,
"description": "Sort by a metric or row column"
},
{
"required": [
"column_type",
"index",
"values",
"direction"
],
"type": "object",
"properties": {
"column_type": {
"enum": [
"pivoted_metric"
],
"type": "string"
},
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"index": {
"minimum": 0,
"type": "number",
"description": "0-based index into the \"metrics\" array for the metric to sort; use \"values\" to identify the pivoted column"
},
"values": {
"maxItems": 20,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of pivot values, one for each split_metrics_by column in order"
}
},
"additionalProperties": false,
"description": "Sort by a pivoted metric column (created when metrics are pivoted by split_metrics_by)"
}
],
"description": "Sorting configuration. Only one column can be sorted at a time. Use \"column_type\" to specify the column type."
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visDateHistogramOperation": {
"title": "Date Histogram Operation",
"required": [
"operation",
"field"
],
"type": "object",
"properties": {
"drop_partial_intervals": {
"type": "boolean",
"description": "When `true`, drops partial intervals from the results.",
"default": false
},
"field": {
"type": "string",
"description": "Field to be used for the date histogram."
},
"include_empty_rows": {
"type": "boolean",
"description": "When `true`, includes empty rows in the results.",
"default": true
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"date_histogram"
],
"type": "string"
},
"suggested_interval": {
"type": "string",
"description": "Suggested time interval.",
"default": "auto"
},
"use_original_time_range": {
"type": "boolean",
"description": "When `true`, uses the original time range instead of the current query time range.",
"default": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visDifferencesOperation": {
"title": "Differences Operation",
"required": [
"operation",
"of"
],
"type": "object",
"properties": {
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"of": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
"operation": {
"enum": [
"differences"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visDurationFormat": {
"title": "Duration Format",
"required": [
"type",
"from",
"to"
],
"type": "object",
"properties": {
"compact": {
"type": "boolean",
"description": "When `true`, uses short unit suffixes (for example, `ms` instead of `Milliseconds`). Defaults to `true`. Ignored for `auto-approximate`."
},
"decimals": {
"type": "number",
"description": "Number of decimal places to display. Defaults to `0`. Ignored for `auto-approximate`."
},
"from": {
"enum": [
"ps",
"ns",
"us",
"ms",
"s",
"min",
"h",
"d",
"w",
"mo",
"y"
],
"type": "string",
"description": "Source time unit of the raw field value, including fine-grained units (`ps`, `ns`, `us`) in addition to standard units. This describes how the stored data is encoded, not a query duration literal."
},
"suffix": {
"type": "string",
"description": "Suffix appended to the formatted value."
},
"to": {
"enum": [
"auto",
"auto-approximate",
"ms",
"s",
"min",
"h",
"d",
"w",
"mo",
"y"
],
"type": "string",
"description": "Display time unit: `auto` (precise), `auto-approximate`, or a fixed conversion unit."
},
"type": {
"enum": [
"duration"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Duration format between time units."
},
"Kibana_HTTP_APIs_visFieldMetricOperations": {
"title": "Field Metric Operations",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
"Kibana_HTTP_APIs_visFilterSimple": {
"title": "Filter",
"required": [
"expression"
],
"type": "object",
"properties": {
"expression": {
"type": "string",
"description": "A query expression in KQL or Lucene syntax"
},
"language": {
"anyOf": [
{
"enum": [
"kql"
],
"type": "string"
},
{
"enum": [
"lucene"
],
"type": "string"
}
],
"description": "Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`.",
"default": "kql"
}
},
"additionalProperties": false,
"description": "A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters."
},
"Kibana_HTTP_APIs_visFiltersOperation": {
"title": "Filters Operation",
"required": [
"operation",
"filters"
],
"type": "object",
"properties": {
"filters": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterWithLabel"
}
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"filters"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visFilterWithLabel": {
"title": "Filter with Label",
"required": [
"filter"
],
"type": "object",
"properties": {
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"label": {
"type": "string",
"description": "Label for the filter"
}
},
"additionalProperties": false,
"description": "A KQL or Lucene filter with an optional display label."
},
"Kibana_HTTP_APIs_visFormatType": {
"title": "Format Type",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNumericFormat"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visByteFormat"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDurationFormat"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCustomFormat"
}
],
"description": "Number display format for the dimension value."
},
"Kibana_HTTP_APIs_visFormulaOperation": {
"title": "Formula Operation",
"required": [
"operation",
"formula"
],
"type": "object",
"properties": {
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"formula": {
"type": "string",
"description": "Formula"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"formula"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"anyOf": [
{
"enum": [
"s"
],
"type": "string"
},
{
"enum": [
"m"
],
"type": "string"
},
{
"enum": [
"h"
],
"type": "string"
},
{
"enum": [
"d"
],
"type": "string"
}
],
"description": "Time scale"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visGaugeChart": {
"title": "Gauge Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeESQL"
}
],
"description": "A gauge chart with a metric value and optional minimum, maximum, and goal markers, in bullet or circular shape."
},
"Kibana_HTTP_APIs_visGaugeESQL": {
"title": "Gauge Chart (ES|QL)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"required": [
"column"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNoColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for the gauge fill.",
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"goal": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"max": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"min": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"subtitle": {
"type": "string",
"description": "Subtitle below the gauge value."
},
"ticks": {
"type": "object",
"properties": {
"mode": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"bands"
],
"type": "string"
}
],
"description": "Tick placement mode.",
"default": "bands"
},
"visible": {
"type": "boolean",
"description": "When `true`, displays tick marks on the gauge.",
"default": true
}
},
"additionalProperties": false,
"description": "Ticks configuration"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title.",
"default": true
}
},
"additionalProperties": false,
"description": "Title configuration"
}
},
"additionalProperties": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"gauge"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Gauge configuration using an ES|QL query."
},
"Kibana_HTTP_APIs_visGaugeMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visGaugeMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visGaugeNoESQL": {
"title": "Gauge Chart (DSL)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNoColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for the gauge fill.",
"default": {
"type": "auto"
}
},
"goal": {
"title": "Field Metric, Static Value, or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation, a static value, or a mathematical formula."
},
"max": {
"title": "Field Metric, Static Value, or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation, a static value, or a mathematical formula."
},
"min": {
"title": "Field Metric, Static Value, or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation, a static value, or a mathematical formula."
},
"subtitle": {
"type": "string",
"description": "Subtitle below the gauge value."
},
"ticks": {
"type": "object",
"properties": {
"mode": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"bands"
],
"type": "string"
}
],
"description": "Tick placement mode.",
"default": "bands"
},
"visible": {
"type": "boolean",
"description": "When `true`, displays tick marks on the gauge.",
"default": true
}
},
"additionalProperties": false,
"description": "Ticks configuration"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title.",
"default": true
}
},
"additionalProperties": false,
"description": "Title configuration"
}
},
"additionalProperties": false
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"gauge"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Gauge configuration using a data view."
},
"Kibana_HTTP_APIs_visGaugeShapeBullet": {
"title": "Shape (Bullet)",
"required": [
"type"
],
"type": "object",
"properties": {
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiSimpleOrientation"
},
"type": {
"enum": [
"bullet"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Bullet gauge shape."
},
"Kibana_HTTP_APIs_visGaugeShapeCircular": {
"title": "Shape (Circular)",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"circle",
"semi_circle",
"arc"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Circular gauge shape."
},
"Kibana_HTTP_APIs_visGaugeStyling": {
"title": "Gauge styling",
"type": "object",
"properties": {
"shape": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeShapeBullet"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visGaugeShapeCircular"
}
],
"default": {
"orientation": "horizontal",
"type": "bullet"
}
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visGradientColorMapping": {
"title": "Gradient Color Mapping",
"required": [
"mode",
"palette"
],
"type": "object",
"properties": {
"gradient": {
"maxItems": 3,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorFromPalette"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorCode"
}
]
}
},
"mapping": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"values"
],
"type": "object",
"properties": {
"values": {
"maxItems": 100,
"type": "array",
"items": {
"anyOf": [
{
"type": "string"
},
{
"type": "number"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangeKey"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMultiFieldKey"
}
]
}
}
},
"additionalProperties": false
}
},
"mode": {
"enum": [
"gradient"
],
"type": "string"
},
"palette": {
"type": "string",
"description": "Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`."
},
"sort": {
"anyOf": [
{
"enum": [
"asc"
],
"type": "string"
},
{
"enum": [
"desc"
],
"type": "string"
}
],
"description": "Sort direction"
},
"unassigned": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUnassignedColorSchema"
}
},
"additionalProperties": false,
"description": "Gradient color mapping across categorical values."
},
"Kibana_HTTP_APIs_visHeatmapAxes": {
"title": "Axes",
"type": "object",
"properties": {
"x": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapXAxis"
},
"y": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapYAxis"
}
},
"additionalProperties": false,
"description": "Axis configuration for X and Y axes"
},
"Kibana_HTTP_APIs_visHeatmapCells": {
"title": "Cells",
"type": "object",
"properties": {
"labels": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show cell labels",
"default": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Cells configuration"
},
"Kibana_HTTP_APIs_visHeatmapChart": {
"title": "Heatmap Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapESQL"
}
],
"description": "A grid of colored cells where color intensity represents the metric value at each X/Y intersection."
},
"Kibana_HTTP_APIs_visHeatmapESQL": {
"title": "Heatmap Chart (ES|QL)",
"required": [
"type",
"x",
"data_source",
"metric"
],
"type": "object",
"properties": {
"axis": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapAxes"
},
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapLegend"
},
"metric": {
"required": [
"column"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color scale configuration for the heatmap cells.",
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"heatmap"
],
"type": "string"
},
"x": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"y": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Heatmap configuration using an ES|QL query."
},
"Kibana_HTTP_APIs_visHeatmapLegend": {
"title": "Legend",
"type": "object",
"properties": {
"position": {
"enum": [
"top",
"bottom",
"left",
"right"
],
"type": "string"
},
"size": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendSize"
},
"truncate_after_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
},
"visibility": {
"anyOf": [
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Legend configuration"
},
"Kibana_HTTP_APIs_visHeatmapMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visHeatmapMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visHeatmapNoESQL": {
"title": "Heatmap Chart (DSL)",
"required": [
"type",
"x",
"data_source",
"metric"
],
"type": "object",
"properties": {
"axis": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapAxes"
},
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapLegend"
},
"metric": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color scale configuration for the heatmap cells.",
"default": {
"type": "auto"
}
}
},
"additionalProperties": false
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"heatmap"
],
"type": "string"
},
"x": {
"title": "Breakdown Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
],
"description": "Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters."
},
"y": {
"title": "Breakdown Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
],
"description": "Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters."
}
},
"additionalProperties": false,
"description": "Heatmap configuration using a data view."
},
"Kibana_HTTP_APIs_visHeatmapStyling": {
"title": "Heatmap styling",
"type": "object",
"properties": {
"cells": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHeatmapCells"
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visHeatmapXAxis": {
"title": "X Axis",
"required": [
"scale"
],
"type": "object",
"properties": {
"labels": {
"type": "object",
"properties": {
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiOrientation"
},
"visible": {
"type": "boolean",
"description": "Show axis labels",
"default": true
}
},
"additionalProperties": false
},
"scale": {
"anyOf": [
{
"enum": [
"ordinal"
],
"type": "string"
},
{
"enum": [
"temporal"
],
"type": "string"
},
{
"enum": [
"linear"
],
"type": "string"
}
],
"description": "X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields."
},
"sort": {
"anyOf": [
{
"enum": [
"asc"
],
"type": "string"
},
{
"enum": [
"desc"
],
"type": "string"
}
],
"description": "Axis sort order; omit or use undefined for no sorting"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Axis title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "X axis configuration"
},
"Kibana_HTTP_APIs_visHeatmapYAxis": {
"title": "Y Axis",
"type": "object",
"properties": {
"labels": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show axis labels",
"default": true
}
},
"additionalProperties": false
},
"sort": {
"anyOf": [
{
"enum": [
"asc"
],
"type": "string"
},
{
"enum": [
"desc"
],
"type": "string"
}
],
"description": "Axis sort order; omit or use undefined for no sorting"
},
"title": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Axis title text."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the title."
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Y axis configuration"
},
"Kibana_HTTP_APIs_visHistogramOperation": {
"title": "Histogram Operation",
"required": [
"operation",
"field"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the histogram."
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"granularity": {
"anyOf": [
{
"minimum": 1,
"type": "number",
"description": "Target number of histogram buckets (bars). The maximum is controlled by the `histogram:maxBars` advanced setting, which defaults to 1000."
},
{
"enum": [
"auto"
],
"type": "string"
}
],
"default": "auto"
},
"include_empty_rows": {
"type": "boolean",
"description": "When `true`, includes empty rows in the results.",
"default": true
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"histogram"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visLastValueOperation": {
"title": "Last Value Operation",
"required": [
"field",
"operation",
"time_field"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"multi_value": {
"type": "boolean",
"description": "Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.",
"default": false
},
"operation": {
"enum": [
"last_value"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_field": {
"type": "string",
"description": "Time field used to determine document recency"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visLegacyColorByValue": {
"title": "Legacy color by value",
"required": [
"type",
"range",
"steps",
"palette",
"shift"
],
"type": "object",
"properties": {
"palette": {
"type": "string",
"description": "The legacy palette name."
},
"range": {
"enum": [
"absolute",
"percentage"
],
"type": "string",
"description": "Determines whether the range is interpreted as absolute or as a percentage of the data."
},
"shift": {
"type": "boolean",
"description": "When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`."
},
"steps": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"color"
],
"type": "object",
"properties": {
"color": {
"type": "string",
"description": "The color to use for this step."
},
"gte": {
"type": [
"null",
"number"
],
"description": "The lower bound of range from which this color applies (inclusive)."
},
"lt": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (exclusive)."
},
"lte": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (inclusive)."
}
},
"additionalProperties": false
},
"description": "Array of ordered color steps defining the range each color is applied."
},
"type": {
"enum": [
"legacy_dynamic"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Legacy color by value configuration",
"deprecated": true
},
"Kibana_HTTP_APIs_visLegacyColorByValueAbsolute": {
"title": "Legacy color by value (absolute)",
"required": [
"type",
"range",
"steps",
"palette",
"shift"
],
"type": "object",
"properties": {
"palette": {
"type": "string",
"description": "The legacy palette name."
},
"range": {
"enum": [
"absolute"
],
"type": "string"
},
"shift": {
"type": "boolean",
"description": "When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`."
},
"steps": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"color"
],
"type": "object",
"properties": {
"color": {
"type": "string",
"description": "The color to use for this step."
},
"gte": {
"type": [
"null",
"number"
],
"description": "The lower bound of range from which this color applies (inclusive)."
},
"lt": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (exclusive)."
},
"lte": {
"type": [
"null",
"number"
],
"description": "The upper bound of range to which this color applies (inclusive)."
}
},
"additionalProperties": false
},
"description": "Array of ordered color steps defining the range each color is applied."
},
"type": {
"enum": [
"legacy_dynamic"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Legacy color by absolute value configuration",
"deprecated": true
},
"Kibana_HTTP_APIs_visLegacyMetricChart": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegacyMetricNoESQL"
},
"Kibana_HTTP_APIs_visLegacyMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricNoESQL": {
"title": "Legacy Metric Chart (DSL)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"apply_color_to": {
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValueAbsolute"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValuePalette"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegacyColorByValueAbsolute"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration based on the metric value.",
"default": {
"type": "auto"
}
},
"labels": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"top",
"bottom"
],
"type": "string",
"description": "Label alignment",
"default": "top"
}
},
"additionalProperties": false,
"description": "Labels configuration"
},
"size": {
"anyOf": [
{
"enum": [
"xs"
],
"type": "string"
},
{
"enum": [
"s"
],
"type": "string"
},
{
"enum": [
"m"
],
"type": "string"
},
{
"enum": [
"l"
],
"type": "string"
},
{
"enum": [
"xl"
],
"type": "string"
},
{
"enum": [
"xxl"
],
"type": "string"
}
],
"description": "Font size for the label and value",
"default": "m"
},
"values": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Value alignment",
"default": "left"
}
},
"additionalProperties": false,
"description": "Values configuration"
}
},
"additionalProperties": false
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"legacy_metric"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Legacy Metric configuration using a data view. Superseded by the Metric chart type."
},
"Kibana_HTTP_APIs_visLegacyMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visLegacyMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visLegendPosition": {
"title": "Legend Position",
"enum": [
"top",
"bottom",
"left",
"right"
],
"type": "string",
"description": "Legend Position.",
"default": "right"
},
"Kibana_HTTP_APIs_visLegendSize": {
"title": "Legend Size",
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"s"
],
"type": "string"
},
{
"enum": [
"m"
],
"type": "string"
},
{
"enum": [
"l"
],
"type": "string"
},
{
"enum": [
"xl"
],
"type": "string"
}
],
"description": "Legend size."
},
"Kibana_HTTP_APIs_visLegendTruncateAfterLines": {
"maximum": 10,
"minimum": 1,
"type": "number",
"description": "Number of lines before legend items are truncated.",
"default": 1
},
"Kibana_HTTP_APIs_visMetricBreakdownDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visMetricBreakdownFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visMetricBreakdownHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visMetricBreakdownRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visMetricBreakdownTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visMetricChart": {
"title": "Metric Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricESQL"
}
],
"description": "One or two metric values with optional color coding, trend line, and breakdown by dimension."
},
"Kibana_HTTP_APIs_visMetricCompareToBaseline": {
"title": "Compare To Baseline",
"required": [
"to"
],
"type": "object",
"properties": {
"baseline": {
"type": "number",
"description": "Baseline value.",
"default": 0
},
"icon": {
"type": "boolean",
"description": "When `true`, displays the icon for the secondary value.",
"default": true
},
"palette": {
"type": "string",
"description": "Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`.",
"default": "compare_to"
},
"to": {
"enum": [
"baseline"
],
"type": "string"
},
"value": {
"type": "boolean",
"description": "When `true`, displays the secondary value.",
"default": true
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visMetricCompareToPrimary": {
"title": "Compare To Primary",
"required": [
"to"
],
"type": "object",
"properties": {
"icon": {
"type": "boolean",
"description": "When `true`, displays the icon for the secondary value.",
"default": true
},
"palette": {
"type": "string",
"description": "Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`.",
"default": "compare_to"
},
"to": {
"enum": [
"primary"
],
"type": "string"
},
"value": {
"type": "boolean",
"description": "When `true`, displays the secondary value.",
"default": true
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visMetricComplementaryBar": {
"title": "Complementary Bar",
"required": [
"type",
"max_value"
],
"type": "object",
"properties": {
"max_value": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiSimpleOrientation"
},
"type": {
"enum": [
"bar"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visMetricComplementaryTrend": {
"title": "Complementary Trend",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"trend"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visMetricComplementaryViz": {
"title": "Complementary Visualization",
"anyOf": [
{
"required": [
"type",
"max_value"
],
"type": "object",
"properties": {
"max_value": {
"title": "Metric Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
],
"description": "Metric dimension configuration, supporting field-based aggregations (count, sum, average, median, standard deviation, unique count, last value), percentile operations, time-series operations (differences, moving average, cumulative sum, counter rate), and mathematical formulas."
},
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiSimpleOrientation"
},
"type": {
"enum": [
"bar"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"trend"
],
"type": "string"
}
},
"additionalProperties": false
}
],
"description": "Secondary visualization displayed behind the primary metric value, either a bar chart (with optional max value) or a trend line."
},
"Kibana_HTTP_APIs_visMetricComplementaryVizESQL": {
"title": "Complementary Visualization",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryBar"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryTrend"
}
],
"description": "Bar chart or trendline shown behind the primary metric value."
},
"Kibana_HTTP_APIs_visMetricESQL": {
"title": "Metric Chart (ES|QL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"breakdown_by": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"column": {
"type": "string",
"description": "Column to use"
},
"columns": {
"type": "number",
"description": "Number of columns.",
"default": 3
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metrics": {
"maxItems": 2,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"required": [
"column",
"type"
],
"type": "object",
"properties": {
"apply_color_to": {
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
"background_chart": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryVizESQL"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for the primary metric value or background.",
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"subtitle": {
"type": "string",
"description": "Subtitle below the primary metric value."
},
"type": {
"enum": [
"primary"
],
"type": "string"
}
}
},
{
"required": [
"column",
"type"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNoColor"
}
],
"default": {
"type": "none"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"compare": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToBaseline"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToPrimary"
}
],
"description": "Compare the secondary metric to a baseline value or to the primary metric."
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"type": {
"enum": [
"secondary"
],
"type": "string"
}
}
}
]
},
"description": "Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric."
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"metric"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Metric chart configuration for ES|QL queries"
},
"Kibana_HTTP_APIs_visMetricIconConfig": {
"title": "Icon Configuration",
"required": [
"name"
],
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"right"
],
"type": "string",
"description": "Icon alignment. Accepted values: `left`, `right`. Defaults to `right`.",
"default": "right"
},
"name": {
"anyOf": [
{
"enum": [
"alert"
],
"type": "string"
},
{
"enum": [
"asterisk"
],
"type": "string"
},
{
"enum": [
"bell"
],
"type": "string"
},
{
"enum": [
"bolt"
],
"type": "string"
},
{
"enum": [
"bug"
],
"type": "string"
},
{
"enum": [
"compute"
],
"type": "string"
},
{
"enum": [
"editor_comment"
],
"type": "string"
},
{
"enum": [
"flag"
],
"type": "string"
},
{
"enum": [
"globe"
],
"type": "string"
},
{
"enum": [
"heart"
],
"type": "string"
},
{
"enum": [
"map_marker"
],
"type": "string"
},
{
"enum": [
"pin"
],
"type": "string"
},
{
"enum": [
"sort_down"
],
"type": "string"
},
{
"enum": [
"sort_up"
],
"type": "string"
},
{
"enum": [
"star_empty"
],
"type": "string"
},
{
"enum": [
"tag"
],
"type": "string"
},
{
"enum": [
"temperature"
],
"type": "string"
}
],
"description": "Icon name"
}
},
"additionalProperties": false,
"description": "Icon configuration for the metric chart"
},
"Kibana_HTTP_APIs_visMetricNoESQL": {
"title": "Metric Chart (DSL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"breakdown_by": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"columns": {
"type": "number",
"description": "Number of columns.",
"default": 3
}
},
"additionalProperties": false
}
]
},
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metrics": {
"maxItems": 2,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"apply_color_to": {
"enum": [
"value",
"background"
],
"type": "string",
"description": "Color target: `value` colors the metric text, `background` colors the cell or panel background."
},
"background_chart": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryViz"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorByValue"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"description": "Color configuration for the primary metric value or background.",
"default": {
"type": "auto"
}
},
"subtitle": {
"type": "string",
"description": "Subtitle below the primary metric value."
},
"type": {
"enum": [
"primary"
],
"type": "string"
}
}
}
]
},
{
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visNoColor"
}
],
"default": {
"type": "none"
}
},
"compare": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToBaseline"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToPrimary"
}
],
"description": "Compare the secondary metric to a baseline value or to the primary metric."
},
"type": {
"enum": [
"secondary"
],
"type": "string"
}
}
}
]
}
]
},
"description": "Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"metric"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Metric chart configuration for standard queries"
},
"Kibana_HTTP_APIs_visMetricPrimaryCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visMetricPrimarySumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visMetricPrimaryUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visMetricSecondarySumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visMetricSecondaryUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visMetricStyling": {
"type": "object",
"properties": {
"density": {
"anyOf": [
{
"enum": [
"compact"
],
"type": "string"
},
{
"enum": [
"default"
],
"type": "string"
}
],
"description": "Density preset for the metric chart layout. Use `compact` for a compact layout, or `default` for increased padding, element spacing, and font size.",
"default": "default"
},
"icon": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMetricIconConfig"
},
"primary": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Horizontal alignment for the title and subtitle text. Accepted values: `left`, `center`, `right`. Defaults to `left`.",
"default": "left"
}
},
"additionalProperties": false,
"description": "Labels (title and subtitle) configuration"
},
"position": {
"enum": [
"top",
"middle",
"bottom"
],
"type": "string",
"description": "Position of the primary metric value (top, middle, or bottom).",
"default": "bottom"
},
"value": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment for the primary metric value. Accepted values: `left`, `center`, `right`. Defaults to `right`.",
"default": "right"
},
"sizing": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"fill"
],
"type": "string"
}
],
"description": "Controls how the primary value text is sized within the panel. 'auto' selects a font size from predefined breakpoints based on panel height, then shrinks if the text overflows horizontally. 'fill' scales the text to be as large as possible, filling all available space.",
"default": "auto"
}
},
"additionalProperties": false,
"description": "Primary metric value configuration"
}
},
"additionalProperties": false
},
"secondary": {
"type": "object",
"properties": {
"label": {
"type": "object",
"properties": {
"placement": {
"enum": [
"before",
"after",
"tooltip"
],
"type": "string",
"description": "How the secondary metric name is shown: before the value, after the value, or in a tooltip. Ignored when the label is not visible.",
"default": "before"
},
"visible": {
"type": "boolean",
"description": "When `true`, displays the secondary metric name as its label.",
"default": false
}
},
"additionalProperties": false
},
"value": {
"type": "object",
"properties": {
"alignment": {
"enum": [
"left",
"center",
"right"
],
"type": "string",
"description": "Alignment for secondary values. Accepted values: `left`, `center`, `right`. Defaults to `right`.",
"default": "right"
}
},
"additionalProperties": false,
"description": "Secondary metric value configuration"
}
},
"additionalProperties": false
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation": {
"title": "Stats Metric Operation",
"required": [
"field",
"operation"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"min",
"max",
"average",
"median",
"standard_deviation"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visMosaicChart": {
"title": "Mosaic Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicESQL"
}
],
"description": "Mosaic chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes"
},
"Kibana_HTTP_APIs_visMosaicESQL": {
"title": "Mosaic Chart (ES|QL)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_breakdown_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of group breakdown dimensions (minimum 1)"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicLegend"
},
"metric": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false,
"description": "Metric configuration for ES|QL mode, combining generic options, primary metric options, and column selection"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"mosaic"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Mosaic chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration"
},
"Kibana_HTTP_APIs_visMosaicGroupBreakdownByDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupBreakdownByFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupBreakdownByHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupBreakdownByRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupBreakdownByTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupByDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupByFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupByHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupByRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visMosaicGroupByTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visMosaicLegend": {
"title": "Legend",
"type": "object",
"properties": {
"nested": {
"type": "boolean",
"description": "Show nested legend with hierarchical breakdown levels",
"default": false
},
"position": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendPosition"
},
"size": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendSize"
},
"truncate_after_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Legend configuration for mosaic chart appearance and behavior"
},
"Kibana_HTTP_APIs_visMosaicMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visMosaicMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visMosaicNoESQL": {
"title": "Mosaic Chart (DSL)",
"required": [
"type",
"data_source",
"metric"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_breakdown_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
}
}
}
]
},
"description": "Array of group breakdown dimensions (minimum 1)"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
},
"additionalProperties": false
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicLegend"
},
"metric": {
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMosaicStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"mosaic"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Mosaic chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions"
},
"Kibana_HTTP_APIs_visMosaicStyling": {
"title": "Mosaic styling",
"type": "object",
"properties": {
"values": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visValueDisplay"
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visMovingAverageOperation": {
"title": "Moving Average Operation",
"required": [
"operation",
"of"
],
"type": "object",
"properties": {
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"of": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
"operation": {
"enum": [
"moving_average"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
},
"window": {
"type": "number",
"description": "Window",
"default": 5
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visMultiFieldKey": {
"title": "Multi Field Key",
"required": [
"type",
"keys"
],
"type": "object",
"properties": {
"keys": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
"type": {
"enum": [
"multi_field_key"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visNoColor": {
"title": "No Color",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"none"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Explicitly disables coloring"
},
"Kibana_HTTP_APIs_visNumericFormat": {
"title": "Numeric Format",
"required": [
"type"
],
"type": "object",
"properties": {
"compact": {
"type": "boolean",
"description": "When `true`, uses compact notation (for example, 1.2k instead of 1,200). Defaults to `false`.",
"default": false
},
"decimals": {
"type": "number",
"description": "Number of decimal places to display.",
"default": 2
},
"suffix": {
"type": "string",
"description": "Suffix appended to the formatted value."
},
"type": {
"enum": [
"number",
"percent"
],
"type": "string",
"description": "Value format type: `number` for plain numbers, `percent` for percentages."
}
},
"additionalProperties": false,
"description": "Number or percentage format with optional decimal places, suffix, and compact notation."
},
"Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting": {
"title": "Operation Reduced Time Range Setting",
"type": "string",
"description": "Reduced time range"
},
"Kibana_HTTP_APIs_visOperationTimeScaleSetting": {
"title": "Operation Time Scale Setting",
"anyOf": [
{
"enum": [
"s"
],
"type": "string"
},
{
"enum": [
"m"
],
"type": "string"
},
{
"enum": [
"h"
],
"type": "string"
},
{
"enum": [
"d"
],
"type": "string"
}
],
"description": "Time scale"
},
"Kibana_HTTP_APIs_visOperationTimeShiftSetting": {
"title": "Operation Time Shift Setting",
"type": "string",
"description": "Time shift"
},
"Kibana_HTTP_APIs_visPanelFilters": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema"
},
"description": "Filters applied to the panel"
},
"Kibana_HTTP_APIs_visPercentileOperation": {
"title": "Percentile Operation",
"required": [
"field",
"operation"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"percentile"
],
"type": "string"
},
"percentile": {
"type": "number",
"description": "Percentile",
"default": 95
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visPercentileRanksOperation": {
"title": "Percentile Ranks Operation",
"required": [
"field",
"operation"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"percentile_rank"
],
"type": "string"
},
"rank": {
"type": "number",
"description": "Percentile Rank",
"default": 0
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visPieChart": {
"title": "Pie Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieESQL"
}
],
"description": "Pie chart state: standard query or ES|QL query"
},
"Kibana_HTTP_APIs_visPieESQL": {
"title": "Pie Chart (ES|QL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"description": "ES|QL column reference for primary metric"
},
"description": "Array of metric configurations (minimum 1)"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"pie"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Pie chart configuration for ES|QL queries"
},
"Kibana_HTTP_APIs_visPieGroupByDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visPieGroupByFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visPieGroupByHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visPieGroupByRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visPieGroupByTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visPieLegend": {
"title": "Legend",
"type": "object",
"properties": {
"nested": {
"type": "boolean",
"description": "Show nested legend with hierarchical breakdown levels",
"default": false
},
"position": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendPosition"
},
"size": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendSize"
},
"truncate_after_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Legend configuration for pie chart"
},
"Kibana_HTTP_APIs_visPieMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visPieMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visPieMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visPieMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visPieMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visPieMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visPieMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visPieMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visPieMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visPieMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visPieMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visPieMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visPieNoESQL": {
"title": "Pie Chart (DSL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
}
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metric configurations (minimum 1)"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPieStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"pie"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Pie chart configuration for standard queries"
},
"Kibana_HTTP_APIs_visPieStyling": {
"title": "Pie chart styling",
"type": "object",
"properties": {
"donut_hole": {
"anyOf": [
{
"enum": [
"none"
],
"type": "string"
},
{
"enum": [
"s"
],
"type": "string"
},
{
"enum": [
"m"
],
"type": "string"
},
{
"enum": [
"l"
],
"type": "string"
}
],
"description": "Donut hole size. Accepted values: `none` (full pie), `s`, `m`, `l`."
},
"labels": {
"type": "object",
"properties": {
"position": {
"anyOf": [
{
"enum": [
"inside"
],
"type": "string"
},
{
"enum": [
"outside"
],
"type": "string"
}
],
"description": "Slice label position: `inside` or `outside`."
},
"visible": {
"type": "boolean",
"description": "When `true`, displays slice labels."
}
},
"additionalProperties": false,
"description": "Label configuration for pie chart slice labels inside or outside the pie"
},
"values": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visValueDisplay"
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visRangeKey": {
"title": "Range Key",
"required": [
"type",
"from",
"to",
"ranges"
],
"type": "object",
"properties": {
"from": {
"type": [
"number",
"string"
]
},
"ranges": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"from",
"to",
"label"
],
"type": "object",
"properties": {
"from": {
"type": [
"number",
"string"
]
},
"label": {
"type": "string"
},
"to": {
"type": [
"number",
"string"
]
}
},
"additionalProperties": false
}
},
"to": {
"type": [
"number",
"string"
]
},
"type": {
"enum": [
"range_key"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visRangesOperation": {
"title": "Ranges Operation",
"required": [
"operation",
"field",
"ranges"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field to be used for the range."
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"range"
],
"type": "string"
},
"ranges": {
"maxItems": 100,
"type": "array",
"items": {
"type": "object",
"properties": {
"gt": {
"type": "number",
"description": "Greater than."
},
"label": {
"type": "string",
"description": "Label."
},
"lte": {
"type": "number",
"description": "Less than or equal to."
}
}
}
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visRegionMapChart": {
"title": "Region Map",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRegionMapNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRegionMapESQL"
}
],
"description": "A choropleth map with geographic regions colored by the aggregated metric value."
},
"Kibana_HTTP_APIs_visRegionMapESQL": {
"title": "Region Map (ES|QL)",
"required": [
"type",
"data_source",
"metric",
"region"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"region": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"ems": {
"required": [
"boundaries",
"join"
],
"type": "object",
"properties": {
"boundaries": {
"type": "string",
"description": "EMS boundaries"
},
"join": {
"type": "string",
"description": "EMS join field"
}
},
"additionalProperties": false
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"region_map"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Region Map configuration using an ES|QL query, mapping metric values to geographic regions by color."
},
"Kibana_HTTP_APIs_visRegionMapNoESQL": {
"title": "Region Map (DSL)",
"required": [
"type",
"data_source",
"metric",
"region"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"title": "Field Metric or Formula Operation",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
],
"description": "Metric dimension using a field-based aggregation or a mathematical formula."
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"region": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"ems": {
"required": [
"boundaries",
"join"
],
"type": "object",
"properties": {
"boundaries": {
"type": "string",
"description": "EMS boundaries"
},
"join": {
"type": "string",
"description": "EMS join field"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
]
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"region_map"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Region Map configuration using a data view, mapping metric values to geographic regions by color."
},
"Kibana_HTTP_APIs_visRegionMapRegionDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visRegionMapRegionFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visRegionMapRegionHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visRegionMapRegionRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visRegionMapRegionTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visResponseItem": {
"title": "Visualization Response",
"required": [
"id",
"data",
"meta"
],
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_lensApiConfigLibItemNoESQL"
},
"id": {
"type": "string"
},
"meta": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visStaticColor": {
"title": "Static Color",
"required": [
"type",
"color"
],
"type": "object",
"properties": {
"color": {
"type": "string",
"description": "The static color to be used for all values."
},
"type": {
"enum": [
"static"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Fixed color for all values in the dimension."
},
"Kibana_HTTP_APIs_visStaticOperationDefinition": {
"title": "Static Operation Definition",
"required": [
"operation"
],
"type": "object",
"properties": {
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"static_value"
],
"type": "string"
},
"value": {
"type": "number",
"description": "Static value",
"default": 100
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visSumMetricOperation": {
"title": "Sum Metric Operation",
"required": [
"field",
"operation"
],
"type": "object",
"properties": {
"empty_as_null": {
"type": "boolean",
"description": "When `true`, treats empty buckets as null instead of zero.",
"default": false
},
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"sum"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visTagcloudChart": {
"title": "Tag Cloud Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTagcloudNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTagcloudESQL"
}
],
"description": "A word cloud with terms sized by metric value."
},
"Kibana_HTTP_APIs_visTagcloudESQL": {
"title": "Tag Cloud Chart (ES|QL)",
"required": [
"type",
"data_source",
"metric",
"tag_by"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTagcloudStyling"
},
"tag_by": {
"required": [
"column"
],
"type": "object",
"properties": {
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"tag_cloud"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Tag Cloud configuration using an ES|QL query."
},
"Kibana_HTTP_APIs_visTagcloudMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visTagcloudMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visTagcloudNoESQL": {
"title": "Tag Cloud Chart (DSL)",
"required": [
"type",
"data_source",
"metric",
"tag_by"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"metric": {
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTagcloudStyling"
},
"tag_by": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
},
"additionalProperties": false
}
]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"tag_cloud"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Tag Cloud configuration using a data view."
},
"Kibana_HTTP_APIs_visTagcloudStyling": {
"title": "Tag cloud styling",
"type": "object",
"properties": {
"caption": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "When `true`, displays the caption.",
"default": true
}
},
"additionalProperties": false,
"description": "Caption configuration representing the metric and the tag_by operations labels"
},
"font_size": {
"type": "object",
"properties": {
"max": {
"maximum": 120,
"type": "number",
"description": "Maximum font size.",
"default": 72
},
"min": {
"minimum": 1,
"type": "number",
"description": "Minimum font size.",
"default": 18
}
},
"additionalProperties": false,
"description": "Font size range for tags."
},
"orientation": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiOrientation"
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visTagcloudTagDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visTagcloudTagFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visTagcloudTagHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visTagcloudTagRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visTagcloudTagTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visTermsOperation": {
"title": "Terms Operation",
"required": [
"operation",
"fields"
],
"type": "object",
"properties": {
"excludes": {
"required": [
"values"
],
"type": "object",
"properties": {
"as_regex": {
"type": "boolean",
"description": "When `true`, treats the values as regular expressions."
},
"values": {
"anyOf": [
{
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
}
],
"description": "Values to exclude."
}
},
"additionalProperties": false
},
"fields": {
"maxItems": 4,
"minItems": 1,
"type": "array",
"items": {
"type": "string",
"description": "Fields to be used for the terms."
}
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"includes": {
"required": [
"values"
],
"type": "object",
"properties": {
"as_regex": {
"type": "boolean",
"description": "When `true`, treats the values as regular expressions."
},
"values": {
"anyOf": [
{
"maxItems": 100,
"type": "array",
"items": {
"type": "string"
}
},
{
"maxItems": 100,
"type": "array",
"items": {
"type": "number"
}
}
],
"description": "Values to include."
}
},
"additionalProperties": false
},
"increase_accuracy": {
"type": "boolean",
"description": "When `true`, increases accuracy at the cost of performance."
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"limit": {
"type": "number",
"description": "Number of terms to return.",
"default": 5
},
"operation": {
"enum": [
"terms"
],
"type": "string"
},
"other_bucket": {
"required": [
"include_documents_without_field"
],
"type": "object",
"properties": {
"include_documents_without_field": {
"type": "boolean",
"description": "When `true`, includes documents that do not have the specified field."
}
},
"additionalProperties": false
},
"rank_by": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByAlphabetical"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByRare"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankBySignificant"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByMetric"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByCustomOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByCustomLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByCustomCountOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsRankByPercentileRankOperation"
}
]
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visTermsRankByAlphabetical": {
"title": "Terms Rank By Alphabetical",
"required": [
"type",
"direction"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"type": {
"enum": [
"alphabetical"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked alphabetically."
},
"Kibana_HTTP_APIs_visTermsRankByAlphabeticalDirection": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"Kibana_HTTP_APIs_visTermsRankByCustomCountOperation": {
"title": "Terms Rank By Custom Count Operation",
"required": [
"type",
"direction",
"operation"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"field": {
"type": "string",
"description": "Numeric field to be used for the custom operation."
},
"operation": {
"enum": [
"count"
],
"type": "string"
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by count, either of all documents or of a specific field."
},
"Kibana_HTTP_APIs_visTermsRankByCustomDirection": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"Kibana_HTTP_APIs_visTermsRankByCustomLastValueOperation": {
"title": "Terms Rank By Custom Last Value Operation",
"required": [
"type",
"field",
"direction",
"operation"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"field": {
"type": "string",
"description": "Numeric field to be used for the custom operation."
},
"operation": {
"enum": [
"last_value"
],
"type": "string"
},
"time_field": {
"minLength": 1,
"type": "string",
"description": "Time field used to determine document recency for the last-value ranking."
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by the last value of a field."
},
"Kibana_HTTP_APIs_visTermsRankByCustomOperation": {
"title": "Terms Rank By Custom Operation",
"required": [
"type",
"field",
"direction",
"operation"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"field": {
"type": "string",
"description": "Numeric field to be used for the custom operation."
},
"operation": {
"enum": [
"min",
"max",
"average",
"median",
"standard_deviation",
"unique_count",
"sum"
],
"type": "string"
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by custom operation."
},
"Kibana_HTTP_APIs_visTermsRankByMetric": {
"title": "Terms Rank By Metric",
"required": [
"type",
"direction"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"metric_index": {
"minimum": 0,
"type": "number",
"description": "Zero-based index into the metrics array identifying which metric to rank by.",
"default": 0
},
"type": {
"enum": [
"metric"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by a linked metric."
},
"Kibana_HTTP_APIs_visTermsRankByMetricDirection": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"Kibana_HTTP_APIs_visTermsRankByPercentileOperation": {
"title": "Terms Rank By Percentile Operation",
"required": [
"type",
"field",
"direction",
"operation"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"field": {
"type": "string",
"description": "Numeric field to be used for the custom operation."
},
"operation": {
"enum": [
"percentile"
],
"type": "string"
},
"percentile": {
"type": "number",
"description": "The percentile threshold (0–100) at which to compute the field value used for ranking terms.",
"default": 95
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by a percentile of a numeric field, for example the 95th percentile of response time."
},
"Kibana_HTTP_APIs_visTermsRankByPercentileRankOperation": {
"title": "Terms Rank By Percentile Rank Operation",
"required": [
"type",
"field",
"direction",
"operation"
],
"type": "object",
"properties": {
"direction": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiDirection"
},
"field": {
"type": "string",
"description": "Numeric field to be used for the custom operation."
},
"operation": {
"enum": [
"percentile_rank"
],
"type": "string"
},
"rank": {
"type": "number",
"description": "The numeric value for which to compute the percentile rank (the percentage of field values at or below this value).",
"default": 0
},
"type": {
"enum": [
"custom"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by the percentile rank of a single value: the proportion of field values at or below that value."
},
"Kibana_HTTP_APIs_visTermsRankByRare": {
"title": "Terms Rank By Rarity",
"required": [
"type",
"max"
],
"type": "object",
"properties": {
"max": {
"type": "number",
"description": "Maximum number of rare terms to include."
},
"type": {
"enum": [
"rare"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by rarity."
},
"Kibana_HTTP_APIs_visTermsRankBySignificant": {
"title": "Terms Rank By Significance",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"significant"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Terms ranked by significance."
},
"Kibana_HTTP_APIs_visTreemapChart": {
"title": "Treemap Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapESQL"
}
],
"description": "Treemap chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes"
},
"Kibana_HTTP_APIs_visTreemapESQL": {
"title": "Treemap Chart (ES|QL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of metric configurations (minimum 1)"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"treemap"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Treemap chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration"
},
"Kibana_HTTP_APIs_visTreemapGroupByDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visTreemapGroupByFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visTreemapGroupByHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visTreemapGroupByRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visTreemapGroupByTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visTreemapLegend": {
"title": "Legend",
"type": "object",
"properties": {
"nested": {
"type": "boolean",
"description": "Show nested legend with hierarchical breakdown levels",
"default": false
},
"position": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendPosition"
},
"size": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendSize"
},
"truncate_after_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Configuration for the treemap chart legend appearance and behavior"
},
"Kibana_HTTP_APIs_visTreemapMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visTreemapMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visTreemapNoESQL": {
"title": "Treemap Chart (DSL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
}
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metric configurations (minimum 1)"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTreemapStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"treemap"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Treemap chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions"
},
"Kibana_HTTP_APIs_visTreemapStyling": {
"title": "Treemap styling",
"type": "object",
"properties": {
"labels": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show category labels"
}
},
"additionalProperties": false,
"description": "Labels configuration"
},
"values": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visValueDisplay"
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visUnassignedColorSchema": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorFromPalette"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorCode"
}
],
"description": "The color to use for unassigned values."
},
"Kibana_HTTP_APIs_visUniqueCountMetricOperation": {
"title": "Unique Count Metric Operation",
"required": [
"field",
"operation"
],
"type": "object",
"properties": {
"empty_as_null": {
"type": "boolean",
"description": "When `true`, treats empty buckets as null instead of zero.",
"default": false
},
"field": {
"type": "string",
"description": "Field to be used for the metric"
},
"filter": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"unique_count"
],
"type": "string"
},
"reduced_time_range": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting"
},
"time_scale": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting"
},
"time_shift": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_visValueDisplay": {
"type": "object",
"properties": {
"mode": {
"anyOf": [
{
"enum": [
"absolute"
],
"type": "string"
},
{
"enum": [
"percentage"
],
"type": "string"
}
],
"description": "How to format values when visible."
},
"percent_decimals": {
"maximum": 10,
"minimum": 0,
"type": "number",
"description": "Decimal places for percentage display (0-10)",
"default": 2
},
"visible": {
"type": "boolean",
"description": "Show metric values on the chart"
}
},
"additionalProperties": false,
"description": "Configure the visibility and the format of the values rendered on each chart partition section"
},
"Kibana_HTTP_APIs_visWaffleChart": {
"title": "Waffle Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleESQL"
}
],
"description": "Waffle chart configuration: DSL or ES|QL query based"
},
"Kibana_HTTP_APIs_visWaffleESQL": {
"title": "Waffle Chart (ES|QL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of ES|QL breakdown columns (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
}
},
"description": "Array of metric configurations (minimum 1)"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"waffle"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Waffle chart configuration for ES|QL queries"
},
"Kibana_HTTP_APIs_visWaffleGroupByDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visWaffleGroupByFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visWaffleGroupByHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visWaffleGroupByRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visWaffleGroupByTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visWaffleLegend": {
"title": "Legend",
"type": "object",
"properties": {
"position": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendPosition"
},
"size": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendSize"
},
"truncate_after_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
},
"values": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"absolute"
],
"type": "string",
"description": "Legend value display mode: absolute (show raw metric values in legend)"
}
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Legend configuration for waffle chart"
},
"Kibana_HTTP_APIs_visWaffleMetricCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visWaffleMetricUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visWaffleNoESQL": {
"title": "Waffle Chart (DSL)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
}
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metric configurations (minimum 1)"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"waffle"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Waffle chart configuration for standard queries"
},
"Kibana_HTTP_APIs_visWaffleStyling": {
"title": "Waffle styling",
"type": "object",
"properties": {
"values": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visValueDisplay"
}
},
"additionalProperties": false,
"description": "Visual chart styling options"
},
"Kibana_HTTP_APIs_visXyAnnotationByRefLayer": {
"title": "Annotation Layer (By Reference)",
"required": [
"type",
"group_id"
],
"type": "object",
"properties": {
"group_id": {
"type": "string",
"description": "ID of the linked annotation group from the library"
},
"type": {
"enum": [
"annotation_group"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Reference to a library annotation group"
},
"Kibana_HTTP_APIs_visXyAnnotationLayerESQL": {
"title": "Annotation Layer (ES|QL)",
"required": [
"type",
"events"
],
"type": "object",
"properties": {
"events": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationManualEvent"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationManualRange"
}
]
},
"description": "Array of static annotation configurations"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"type": {
"enum": [
"annotations"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Layer containing annotations (points and ranges)"
},
"Kibana_HTTP_APIs_visXyAnnotationLayerNoESQL": {
"title": "Annotation Layer (DSL)",
"required": [
"type",
"events"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"events": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationQuery"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationManualEvent"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationManualRange"
}
]
},
"description": "Array of annotation configurations"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"type": {
"enum": [
"annotations"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Layer containing annotations (query-based, points, and ranges)"
},
"Kibana_HTTP_APIs_visXyAnnotationManualEvent": {
"required": [
"type",
"timestamp"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"icon": {
"anyOf": [
{
"enum": [
"asterisk"
],
"type": "string"
},
{
"enum": [
"alert"
],
"type": "string"
},
{
"enum": [
"bell"
],
"type": "string"
},
{
"enum": [
"bolt"
],
"type": "string"
},
{
"enum": [
"bug"
],
"type": "string"
},
{
"enum": [
"circle"
],
"type": "string"
},
{
"enum": [
"editor_comment"
],
"type": "string"
},
{
"enum": [
"flag"
],
"type": "string"
},
{
"enum": [
"heart"
],
"type": "string"
},
{
"enum": [
"map_marker"
],
"type": "string"
},
{
"enum": [
"pin_filled"
],
"type": "string"
},
{
"enum": [
"star_empty"
],
"type": "string"
},
{
"enum": [
"star_filled"
],
"type": "string"
},
{
"enum": [
"tag"
],
"type": "string"
},
{
"enum": [
"triangle"
],
"type": "string"
}
],
"description": "Icon to display at the annotation point"
},
"label": {
"type": "string",
"description": "Label text for the annotation"
},
"line": {
"required": [
"stroke_width",
"stroke_dash"
],
"type": "object",
"properties": {
"stroke_dash": {
"anyOf": [
{
"enum": [
"solid"
],
"type": "string"
},
{
"enum": [
"dashed"
],
"type": "string"
},
{
"enum": [
"dotted"
],
"type": "string"
}
],
"description": "Vertical line style"
},
"stroke_width": {
"maximum": 10,
"minimum": 1,
"type": "number",
"description": "Vertical line width in pixels"
}
},
"additionalProperties": false,
"description": "Vertical line configuration for point annotation"
},
"text": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show text label on the annotation"
}
},
"additionalProperties": false,
"description": "Annotation text label visibility"
},
"timestamp": {
"anyOf": [
{
"type": "number",
"description": "Unix timestamp in milliseconds"
},
{
"type": "string",
"description": "ISO date string"
}
]
},
"type": {
"enum": [
"point"
],
"type": "string"
},
"visible": {
"type": "boolean",
"description": "Show the annotation"
}
},
"additionalProperties": false,
"description": "Manual point annotation at specific timestamp"
},
"Kibana_HTTP_APIs_visXyAnnotationManualRange": {
"required": [
"type",
"interval"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"fill": {
"anyOf": [
{
"enum": [
"inside"
],
"type": "string"
},
{
"enum": [
"outside"
],
"type": "string"
}
],
"description": "Fill direction for range",
"default": "inside"
},
"interval": {
"required": [
"from",
"to"
],
"type": "object",
"properties": {
"from": {
"anyOf": [
{
"type": "number",
"description": "Unix timestamp in milliseconds"
},
{
"type": "string",
"description": "ISO date string"
}
]
},
"to": {
"anyOf": [
{
"type": "number",
"description": "Unix timestamp in milliseconds"
},
{
"type": "string",
"description": "ISO date string"
}
]
}
},
"additionalProperties": false,
"description": "Time range for annotation"
},
"label": {
"type": "string",
"description": "Label text for the annotation"
},
"type": {
"enum": [
"range"
],
"type": "string"
},
"visible": {
"type": "boolean",
"description": "Show the annotation"
}
},
"additionalProperties": false,
"description": "Manual range annotation spanning time interval"
},
"Kibana_HTTP_APIs_visXyAnnotationQuery": {
"required": [
"type",
"query",
"time_field"
],
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"extra_fields": {
"maxItems": 100,
"type": "array",
"items": {
"type": "string",
"description": "Additional field to include in tooltip"
},
"description": "Additional fields for annotation tooltip"
},
"icon": {
"anyOf": [
{
"enum": [
"asterisk"
],
"type": "string"
},
{
"enum": [
"alert"
],
"type": "string"
},
{
"enum": [
"bell"
],
"type": "string"
},
{
"enum": [
"bolt"
],
"type": "string"
},
{
"enum": [
"bug"
],
"type": "string"
},
{
"enum": [
"circle"
],
"type": "string"
},
{
"enum": [
"editor_comment"
],
"type": "string"
},
{
"enum": [
"flag"
],
"type": "string"
},
{
"enum": [
"heart"
],
"type": "string"
},
{
"enum": [
"map_marker"
],
"type": "string"
},
{
"enum": [
"pin_filled"
],
"type": "string"
},
{
"enum": [
"star_empty"
],
"type": "string"
},
{
"enum": [
"star_filled"
],
"type": "string"
},
{
"enum": [
"tag"
],
"type": "string"
},
{
"enum": [
"triangle"
],
"type": "string"
}
],
"description": "Icon to display at the annotation point"
},
"label": {
"type": "string",
"description": "Label text for the annotation"
},
"line": {
"required": [
"stroke_width",
"stroke_dash"
],
"type": "object",
"properties": {
"stroke_dash": {
"anyOf": [
{
"enum": [
"solid"
],
"type": "string"
},
{
"enum": [
"dashed"
],
"type": "string"
},
{
"enum": [
"dotted"
],
"type": "string"
}
],
"description": "Vertical line style"
},
"stroke_width": {
"maximum": 10,
"minimum": 1,
"type": "number",
"description": "Vertical line width in pixels"
}
},
"additionalProperties": false,
"description": "Vertical line configuration for point annotation"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"text": {
"required": [
"visible"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Field name for text label source"
},
"visible": {
"type": "boolean",
"description": "Show text label on the annotation"
}
},
"additionalProperties": false,
"description": "Annotation text label configuration"
},
"time_field": {
"type": "string",
"description": "Field containing the timestamp"
},
"type": {
"enum": [
"query"
],
"type": "string"
},
"visible": {
"type": "boolean",
"description": "Show the annotation"
}
},
"additionalProperties": false,
"description": "Annotation from query results matching a filter"
},
"Kibana_HTTP_APIs_visXyBreakdownDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visXyBreakdownFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visXyBreakdownHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visXyBreakdownRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visXyBreakdownTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visXyChart": {
"title": "XY Chart",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyChartNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyChartESQL"
}
],
"description": "XY chart configuration"
},
"Kibana_HTTP_APIs_visXyChartESQL": {
"title": "XY Chart (ES|QL)",
"required": [
"type",
"layers"
],
"type": "object",
"properties": {
"axis": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiXyAxisConfig"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"layers": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLayersESQL"
},
"description": "ES|QL chart layers"
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegend"
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"xy"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "XY chart configuration for ES|QL queries"
},
"Kibana_HTTP_APIs_visXyChartNoESQL": {
"title": "XY Chart (DSL)",
"required": [
"type",
"layers"
],
"type": "object",
"properties": {
"axis": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiXyAxisConfig"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"layers": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLayersNoESQL"
},
"description": "Chart layers"
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegend"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStyling"
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"xy"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "XY chart configuration for DSL queries"
},
"Kibana_HTTP_APIs_visXyFitting": {
"required": [
"type"
],
"type": "object",
"properties": {
"emphasize": {
"type": "boolean",
"description": "Visually distinguish fitted segments with a dashed line style and reduced area opacity"
},
"extend": {
"anyOf": [
{
"enum": [
"none"
],
"type": "string"
},
{
"enum": [
"zero"
],
"type": "string"
},
{
"enum": [
"nearest"
],
"type": "string"
}
],
"description": "How to render line and area edges when data does not cover the full X domain"
},
"type": {
"anyOf": [
{
"enum": [
"none"
],
"type": "string"
},
{
"enum": [
"zero"
],
"type": "string"
},
{
"enum": [
"linear"
],
"type": "string"
},
{
"enum": [
"carry"
],
"type": "string"
},
{
"enum": [
"lookahead"
],
"type": "string"
},
{
"enum": [
"average"
],
"type": "string"
},
{
"enum": [
"nearest"
],
"type": "string"
}
],
"description": "Fitting function type for missing data"
}
},
"additionalProperties": false,
"description": "Missing data interpolation configuration for line and area series"
},
"Kibana_HTTP_APIs_visXyLayerESQL": {
"title": "Layer (ES|QL)",
"required": [
"data_source",
"type",
"y"
],
"type": "object",
"properties": {
"breakdown_by": {
"required": [
"column"
],
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false,
"description": "ES|QL column for breakdown"
},
"data_source": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_esqlDataSource"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"type": {
"anyOf": [
{
"enum": [
"area"
],
"type": "string"
},
{
"enum": [
"area_percentage"
],
"type": "string"
},
{
"enum": [
"area_stacked"
],
"type": "string"
},
{
"enum": [
"bar"
],
"type": "string"
},
{
"enum": [
"bar_horizontal"
],
"type": "string"
},
{
"enum": [
"bar_horizontal_stacked"
],
"type": "string"
},
{
"enum": [
"bar_horizontal_percentage"
],
"type": "string"
},
{
"enum": [
"bar_percentage"
],
"type": "string"
},
{
"enum": [
"bar_stacked"
],
"type": "string"
},
{
"enum": [
"line"
],
"type": "string"
}
],
"description": "Chart type for the data layer"
},
"x": {
"required": [
"column"
],
"type": "object",
"properties": {
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false
},
"y": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"column"
],
"type": "object",
"properties": {
"axis": {
"anyOf": [
{
"enum": [
"y"
],
"type": "string"
},
{
"enum": [
"y2"
],
"type": "string"
}
],
"description": "The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side.",
"default": "y"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"column": {
"type": "string",
"description": "Column to use"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"label": {
"type": "string",
"description": "Label for the operation"
}
},
"additionalProperties": false,
"description": "ES|QL column for Y-axis metric"
},
"description": "Array of ES|QL columns for Y-axis metrics"
}
},
"additionalProperties": false,
"description": "Data layer for ES|QL queries with column references"
},
"Kibana_HTTP_APIs_visXyLayerNoESQL": {
"title": "Layer (DSL)",
"required": [
"data_source",
"type",
"y"
],
"type": "object",
"properties": {
"breakdown_by": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"aggregate_first": {
"type": "boolean",
"description": "When `true`, aggregates data before splitting into series. Defaults to `false`."
},
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
},
"additionalProperties": false
}
]
},
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"type": {
"anyOf": [
{
"enum": [
"area"
],
"type": "string"
},
{
"enum": [
"area_percentage"
],
"type": "string"
},
{
"enum": [
"area_stacked"
],
"type": "string"
},
{
"enum": [
"bar"
],
"type": "string"
},
{
"enum": [
"bar_horizontal"
],
"type": "string"
},
{
"enum": [
"bar_horizontal_stacked"
],
"type": "string"
},
{
"enum": [
"bar_horizontal_percentage"
],
"type": "string"
},
{
"enum": [
"bar_percentage"
],
"type": "string"
},
{
"enum": [
"bar_stacked"
],
"type": "string"
},
{
"enum": [
"line"
],
"type": "string"
}
],
"description": "Chart type for the data layer"
},
"x": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
"y": {
"maxItems": 100,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"axis": {
"anyOf": [
{
"enum": [
"y"
],
"type": "string"
},
{
"enum": [
"y2"
],
"type": "string"
}
],
"description": "The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side.",
"default": "y"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metrics to display on Y-axis"
}
},
"additionalProperties": false,
"description": "Data layer for standard queries with metrics and buckets"
},
"Kibana_HTTP_APIs_visXyLayersESQL": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLayerESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyReferenceLineLayerESQLStatic"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationLayerESQL"
}
],
"description": "XY chart layer types for ES|QL queries."
},
"Kibana_HTTP_APIs_visXyLayersNoESQL": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLayerNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyReferenceLineLayerNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationLayerNoESQL"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationByRefLayer"
}
],
"description": "XY chart layer types for DSL queries"
},
"Kibana_HTTP_APIs_visXyLegend": {
"title": "Legend",
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegendOutsideHorizontal"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegendOutsideVertical"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegendInside"
}
],
"description": "Legend configuration for XY chart"
},
"Kibana_HTTP_APIs_visXyLegendInside": {
"title": "Inside",
"required": [
"placement"
],
"type": "object",
"properties": {
"columns": {
"maximum": 5,
"minimum": 1,
"type": "number",
"description": "Number of legend columns"
},
"layout": {
"required": [
"type"
],
"type": "object",
"properties": {
"truncate": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable truncation of legend items"
},
"max_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"grid"
],
"type": "string"
}
},
"additionalProperties": false
},
"placement": {
"enum": [
"inside"
],
"type": "string"
},
"position": {
"enum": [
"top_left",
"top_right",
"bottom_left",
"bottom_right"
],
"type": "string",
"description": "Legend position inside the chart"
},
"series_header": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegendSeriesHeader"
},
"statistics": {
"maxItems": 17,
"type": "array",
"items": {
"anyOf": [
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
},
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"median"
],
"type": "string"
},
{
"enum": [
"range"
],
"type": "string"
},
{
"enum": [
"last_value"
],
"type": "string"
},
{
"enum": [
"last_non_null_value"
],
"type": "string"
},
{
"enum": [
"first_value"
],
"type": "string"
},
{
"enum": [
"first_non_null_value"
],
"type": "string"
},
{
"enum": [
"difference"
],
"type": "string"
},
{
"enum": [
"difference_percentage"
],
"type": "string"
},
{
"enum": [
"count"
],
"type": "string"
},
{
"enum": [
"total"
],
"type": "string"
},
{
"enum": [
"standard_deviation"
],
"type": "string"
},
{
"enum": [
"variance"
],
"type": "string"
},
{
"enum": [
"distinct_count"
],
"type": "string"
},
{
"enum": [
"current_and_last_value"
],
"type": "string"
}
],
"description": "Statistical functions that can be displayed in chart legend for data series"
},
"description": "Statistics to display in legend"
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Inside legend"
},
"Kibana_HTTP_APIs_visXyLegendOutsideHorizontal": {
"title": "Outside horizontal",
"type": "object",
"properties": {
"layout": {
"anyOf": [
{
"required": [
"type"
],
"type": "object",
"properties": {
"truncate": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable truncation of legend items"
},
"max_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"grid"
],
"type": "string"
}
},
"additionalProperties": false
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"list"
],
"type": "string"
}
},
"additionalProperties": false
}
]
},
"placement": {
"enum": [
"outside"
],
"type": "string"
},
"position": {
"enum": [
"top",
"bottom"
],
"type": "string"
},
"series_header": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegendSeriesHeader"
},
"statistics": {
"maxItems": 17,
"type": "array",
"items": {
"anyOf": [
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
},
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"median"
],
"type": "string"
},
{
"enum": [
"range"
],
"type": "string"
},
{
"enum": [
"last_value"
],
"type": "string"
},
{
"enum": [
"last_non_null_value"
],
"type": "string"
},
{
"enum": [
"first_value"
],
"type": "string"
},
{
"enum": [
"first_non_null_value"
],
"type": "string"
},
{
"enum": [
"difference"
],
"type": "string"
},
{
"enum": [
"difference_percentage"
],
"type": "string"
},
{
"enum": [
"count"
],
"type": "string"
},
{
"enum": [
"total"
],
"type": "string"
},
{
"enum": [
"standard_deviation"
],
"type": "string"
},
{
"enum": [
"variance"
],
"type": "string"
},
{
"enum": [
"distinct_count"
],
"type": "string"
},
{
"enum": [
"current_and_last_value"
],
"type": "string"
}
],
"description": "Statistical functions that can be displayed in chart legend for data series"
},
"description": "Statistics to display in legend"
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Outside legend positioned horizontal (top/bottom) of the chart"
},
"Kibana_HTTP_APIs_visXyLegendOutsideVertical": {
"title": "Outside vertical",
"type": "object",
"properties": {
"layout": {
"required": [
"type"
],
"type": "object",
"properties": {
"truncate": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable truncation of legend items"
},
"max_lines": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines"
}
},
"additionalProperties": false
},
"type": {
"enum": [
"grid"
],
"type": "string"
}
},
"additionalProperties": false
},
"placement": {
"enum": [
"outside"
],
"type": "string"
},
"position": {
"enum": [
"left",
"right"
],
"type": "string"
},
"series_header": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegendSeriesHeader"
},
"size": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLegendSize"
},
"statistics": {
"maxItems": 17,
"type": "array",
"items": {
"anyOf": [
{
"enum": [
"min"
],
"type": "string"
},
{
"enum": [
"max"
],
"type": "string"
},
{
"enum": [
"avg"
],
"type": "string"
},
{
"enum": [
"median"
],
"type": "string"
},
{
"enum": [
"range"
],
"type": "string"
},
{
"enum": [
"last_value"
],
"type": "string"
},
{
"enum": [
"last_non_null_value"
],
"type": "string"
},
{
"enum": [
"first_value"
],
"type": "string"
},
{
"enum": [
"first_non_null_value"
],
"type": "string"
},
{
"enum": [
"difference"
],
"type": "string"
},
{
"enum": [
"difference_percentage"
],
"type": "string"
},
{
"enum": [
"count"
],
"type": "string"
},
{
"enum": [
"total"
],
"type": "string"
},
{
"enum": [
"standard_deviation"
],
"type": "string"
},
{
"enum": [
"variance"
],
"type": "string"
},
{
"enum": [
"distinct_count"
],
"type": "string"
},
{
"enum": [
"current_and_last_value"
],
"type": "string"
}
],
"description": "Statistical functions that can be displayed in chart legend for data series"
},
"description": "Statistics to display in legend"
},
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Legend visibility."
}
},
"additionalProperties": false,
"description": "Outside legend positioned vertical (left/right) of the chart"
},
"Kibana_HTTP_APIs_visXyLegendSeriesHeader": {
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Legend table series header text."
},
"visible": {
"type": "boolean",
"description": "When true, shows the legend table series header."
}
},
"additionalProperties": false,
"description": "Legend table series header configuration."
},
"Kibana_HTTP_APIs_visXyReferenceLineLayerESQLStatic": {
"title": "Reference Line Layer (ES|QL, static values)",
"required": [
"data_source",
"type",
"thresholds"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"thresholds": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"required": [
"operation"
],
"type": "object",
"properties": {
"axis": {
"anyOf": [
{
"enum": [
"x"
],
"type": "string"
},
{
"enum": [
"y"
],
"type": "string"
},
{
"enum": [
"y2"
],
"type": "string"
}
],
"description": "The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis.",
"default": "y"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"fill": {
"anyOf": [
{
"enum": [
"above"
],
"type": "string"
},
{
"enum": [
"below"
],
"type": "string"
}
],
"description": "Fill direction for reference line"
},
"format": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormatType"
},
"icon": {
"anyOf": [
{
"enum": [
"asterisk"
],
"type": "string"
},
{
"enum": [
"alert"
],
"type": "string"
},
{
"enum": [
"bell"
],
"type": "string"
},
{
"enum": [
"bolt"
],
"type": "string"
},
{
"enum": [
"bug"
],
"type": "string"
},
{
"enum": [
"circle"
],
"type": "string"
},
{
"enum": [
"editor_comment"
],
"type": "string"
},
{
"enum": [
"flag"
],
"type": "string"
},
{
"enum": [
"heart"
],
"type": "string"
},
{
"enum": [
"map_marker"
],
"type": "string"
},
{
"enum": [
"pin_filled"
],
"type": "string"
},
{
"enum": [
"star_empty"
],
"type": "string"
},
{
"enum": [
"star_filled"
],
"type": "string"
},
{
"enum": [
"tag"
],
"type": "string"
},
{
"enum": [
"triangle"
],
"type": "string"
}
],
"description": "Icon to display on the reference line"
},
"label": {
"type": "string",
"description": "Label for the operation"
},
"operation": {
"enum": [
"static_value"
],
"type": "string"
},
"position": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"left"
],
"type": "string"
},
{
"enum": [
"right"
],
"type": "string"
}
],
"description": "Position of the icon and label relative to the reference line"
},
"stroke_dash": {
"anyOf": [
{
"enum": [
"solid"
],
"type": "string"
},
{
"enum": [
"dashed"
],
"type": "string"
},
{
"enum": [
"dotted"
],
"type": "string"
}
],
"description": "Line style"
},
"stroke_width": {
"maximum": 10,
"minimum": 1,
"type": "number",
"description": "Line width in pixels"
},
"text": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show text label on the reference line"
}
},
"additionalProperties": false,
"description": "Reference line text label configuration"
},
"value": {
"type": "number",
"description": "Static value",
"default": 100
}
}
},
"description": "Array of static value reference line thresholds"
},
"type": {
"enum": [
"reference_lines"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Reference line layer with static value thresholds. Field-based threshold operations are not supported on ES|QL charts yet."
},
"Kibana_HTTP_APIs_visXyReferenceLineLayerNoESQL": {
"title": "Reference Line Layer (DSL)",
"required": [
"data_source",
"type",
"thresholds"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"thresholds": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"axis": {
"anyOf": [
{
"enum": [
"x"
],
"type": "string"
},
{
"enum": [
"y"
],
"type": "string"
},
{
"enum": [
"y2"
],
"type": "string"
}
],
"description": "The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis.",
"default": "y"
},
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
},
"fill": {
"anyOf": [
{
"enum": [
"above"
],
"type": "string"
},
{
"enum": [
"below"
],
"type": "string"
}
],
"description": "Fill direction for reference line"
},
"icon": {
"anyOf": [
{
"enum": [
"asterisk"
],
"type": "string"
},
{
"enum": [
"alert"
],
"type": "string"
},
{
"enum": [
"bell"
],
"type": "string"
},
{
"enum": [
"bolt"
],
"type": "string"
},
{
"enum": [
"bug"
],
"type": "string"
},
{
"enum": [
"circle"
],
"type": "string"
},
{
"enum": [
"editor_comment"
],
"type": "string"
},
{
"enum": [
"flag"
],
"type": "string"
},
{
"enum": [
"heart"
],
"type": "string"
},
{
"enum": [
"map_marker"
],
"type": "string"
},
{
"enum": [
"pin_filled"
],
"type": "string"
},
{
"enum": [
"star_empty"
],
"type": "string"
},
{
"enum": [
"star_filled"
],
"type": "string"
},
{
"enum": [
"tag"
],
"type": "string"
},
{
"enum": [
"triangle"
],
"type": "string"
}
],
"description": "Icon to display on the reference line"
},
"position": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"left"
],
"type": "string"
},
{
"enum": [
"right"
],
"type": "string"
}
],
"description": "Position of the icon and label relative to the reference line"
},
"stroke_dash": {
"anyOf": [
{
"enum": [
"solid"
],
"type": "string"
},
{
"enum": [
"dashed"
],
"type": "string"
},
{
"enum": [
"dotted"
],
"type": "string"
}
],
"description": "Line style"
},
"stroke_width": {
"maximum": 10,
"minimum": 1,
"type": "number",
"description": "Line width in pixels"
},
"text": {
"required": [
"visible"
],
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show text label on the reference line"
}
},
"additionalProperties": false,
"description": "Reference line text label configuration"
}
}
}
]
},
"description": "Array of reference line thresholds"
},
"type": {
"enum": [
"reference_lines"
],
"type": "string"
}
},
"additionalProperties": false,
"description": "Reference line layer for standard queries"
},
"Kibana_HTTP_APIs_visXyRefLineCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visXyRefLineFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visXyRefLineLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visXyRefLinePercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visXyRefLinePercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visXyRefLineStatic": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition"
},
"Kibana_HTTP_APIs_visXyRefLineStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visXyRefLineSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visXyRefLineUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_visXyStyling": {
"type": "object",
"properties": {
"areas": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStylingAreas"
},
"bars": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStylingBars"
},
"fitting": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyFitting"
},
"interpolation": {
"anyOf": [
{
"enum": [
"linear"
],
"type": "string"
},
{
"enum": [
"smooth"
],
"type": "string"
},
{
"enum": [
"stepped"
],
"type": "string"
}
],
"description": "Curve interpolation method for line and area series. Defaults to linear."
},
"overlays": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStylingOverlays"
},
"points": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStylingPoints"
}
},
"additionalProperties": false,
"description": "Visual styling options for the chart"
},
"Kibana_HTTP_APIs_visXyStylingAreas": {
"type": "object",
"properties": {
"fill": {
"enum": [
"solid",
"gradient"
],
"type": "string",
"description": "Area fill type: solid or gradient. Defaults to solid.",
"default": "solid",
"x-state": "Added in 9.6.0"
},
"fill_opacity": {
"maximum": 2,
"minimum": 0,
"type": "number",
"description": "Area fill opacity (0-1 typical, max 2 for legacy)",
"default": 0.3
}
},
"additionalProperties": false,
"description": "Area-specific rendering settings"
},
"Kibana_HTTP_APIs_visXyStylingBars": {
"type": "object",
"properties": {
"data_labels": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Display value labels on bar data points",
"default": false
}
},
"additionalProperties": false,
"description": "Data label configuration for bar series"
},
"minimum_height": {
"minimum": 0,
"type": "number",
"description": "Minimum bar height in pixels",
"default": 1
}
},
"additionalProperties": false,
"description": "Bar-specific rendering settings"
},
"Kibana_HTTP_APIs_visXyStylingOverlays": {
"type": "object",
"properties": {
"current_time_marker": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show current time marker line",
"default": false
}
},
"additionalProperties": false,
"description": "Current time marker configuration"
},
"partial_buckets": {
"type": "object",
"properties": {
"visible": {
"type": "boolean",
"description": "Show partial bucket indicators at time range edges",
"default": false
}
},
"additionalProperties": false,
"description": "Partial (incomplete) bucket indicator configuration"
}
},
"additionalProperties": false,
"description": "Visual overlays drawn on top of the chart canvas"
},
"Kibana_HTTP_APIs_visXyStylingPoints": {
"type": "object",
"properties": {
"visibility": {
"anyOf": [
{
"enum": [
"auto"
],
"type": "string"
},
{
"enum": [
"visible"
],
"type": "string"
},
{
"enum": [
"hidden"
],
"type": "string"
}
],
"description": "Data point marker visibility on line and area series",
"default": "auto"
}
},
"additionalProperties": false,
"description": "Data point marker settings for line and area series"
},
"Kibana_HTTP_APIs_visXyXDateHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
"Kibana_HTTP_APIs_visXyXFilters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
},
"Kibana_HTTP_APIs_visXyXHistogram": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
"Kibana_HTTP_APIs_visXyXRanges": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
"Kibana_HTTP_APIs_visXyXTerms": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
"Kibana_HTTP_APIs_visXyYCounterRate": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
},
"Kibana_HTTP_APIs_visXyYCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
"Kibana_HTTP_APIs_visXyYCumulativeSum": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
"Kibana_HTTP_APIs_visXyYDifferences": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
"Kibana_HTTP_APIs_visXyYFormula": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
},
"Kibana_HTTP_APIs_visXyYLastValue": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
"Kibana_HTTP_APIs_visXyYMovingAverage": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
"Kibana_HTTP_APIs_visXyYPercentile": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
"Kibana_HTTP_APIs_visXyYPercentileRanks": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
},
"Kibana_HTTP_APIs_visXyYStatsMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
"Kibana_HTTP_APIs_visXyYSumMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
"Kibana_HTTP_APIs_visXyYUniqueCountMetric": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
"Kibana_HTTP_APIs_waffleLibItemNoESQL": {
"title": "Waffle Chart (library)",
"required": [
"type",
"data_source",
"metrics"
],
"type": "object",
"properties": {
"data_source": {
"oneOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"data_view_reference": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema",
"data_view_spec": "#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema"
}
}
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"group_by": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visTermsOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visRangesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation"
}
]
},
{
"type": "object",
"properties": {
"collapse_by": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCollapseBy"
},
"color": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visColorMapping"
}
}
}
]
},
"description": "Array of breakdown dimensions (minimum 1)"
},
"ignore_global_filters": {
"type": "boolean",
"description": "When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.",
"default": false
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleLegend"
},
"metrics": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"allOf": [
{
"anyOf": [
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation"
}
]
},
{
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation"
}
]
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation"
}
]
},
{
"type": "object",
"properties": {
"color": {
"anyOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visStaticColor"
},
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visAutoColor"
}
],
"default": {
"type": "auto"
}
}
}
}
]
},
"description": "Array of metric configurations (minimum 1)"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"sampling": {
"maximum": 1,
"minimum": 0,
"type": "number",
"description": "Sampling factor between 0 (no sampling) and 1 (full sampling).",
"default": 1
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visWaffleStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"waffle"
],
"type": "string"
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_WiredStreamUpsertRequest": {
"required": [
"dashboards",
"rules",
"stream"
],
"type": "object",
"properties": {
"dashboards": {
"type": "array",
"items": {
"type": "string"
}
},
"rules": {
"type": "array",
"items": {
"type": "string"
}
},
"stream": {
"required": [
"description",
"ingest",
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string"
},
"ingest": {
"required": [
"lifecycle",
"processing",
"settings",
"failure_store",
"wired"
],
"type": "object",
"properties": {
"failure_store": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_FailureStore"
},
"lifecycle": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle"
},
"processing": {
"required": [
"steps"
],
"type": "object",
"properties": {
"steps": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_StreamlangStep"
}
}
},
"additionalProperties": false
},
"settings": {
"type": "object",
"properties": {
"index.number_of_replicas": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"index.number_of_shards": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"type": "number"
}
},
"additionalProperties": false
},
"index.refresh_interval": {
"required": [
"value"
],
"type": "object",
"properties": {
"value": {
"anyOf": [
{
"type": "string"
},
{
"enum": [
-1
],
"type": "number"
}
]
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"wired": {
"required": [
"fields",
"routing"
],
"type": "object",
"properties": {
"draft": {
"type": "boolean"
},
"fields": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_FieldDefinition"
},
"routing": {
"type": "array",
"items": {
"required": [
"destination",
"where"
],
"type": "object",
"properties": {
"destination": {
"minLength": 1,
"type": "string",
"description": "A non-empty string."
},
"draft": {
"type": "boolean"
},
"status": {
"enum": [
"enabled",
"disabled"
],
"type": "string"
},
"where": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_Condition"
}
}
}
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"query_streams": {
"type": "array",
"items": {
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string"
}
}
}
},
"type": {
"enum": [
"wired"
],
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting": {
"title": "Anomaly detection",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Anomaly Detection Rule Params",
"required": [
"jobSelection",
"severity",
"resultType"
],
"type": "object",
"properties": {
"includeInterim": {
"type": "boolean",
"default": true
},
"jobSelection": {
"type": "object",
"properties": {
"groupIds": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
},
"jobIds": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
}
},
"additionalProperties": false
},
"kqlQueryString": {
"type": [
"null",
"string"
],
"default": "null"
},
"lookbackInterval": {
"type": [
"null",
"string"
],
"default": "null"
},
"resultType": {
"enum": [
"record",
"bucket",
"influencer"
],
"type": "string"
},
"severity": {
"maximum": 100,
"minimum": 0,
"type": "number"
},
"topNBuckets": {
"minimum": 1,
"type": [
"null",
"number"
],
"default": "null"
}
},
"additionalProperties": false,
"description": "The parameters for the anomaly detection rule. These parameters are appropriate when `rule_type_id` is `xpack.ml.anomaly_detection_alert\"`."
},
"rule_type_id": {
"enum": [
"xpack.ml.anomaly_detection_alert"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting": {
"title": "Anomaly detection jobs health",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Anomaly Detection Jobs Health Rule Params",
"required": [
"includeJobs"
],
"type": "object",
"properties": {
"excludeJobs": {
"type": [
"null",
"object"
],
"properties": {
"groupIds": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
},
"jobIds": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
}
},
"additionalProperties": false,
"default": "null"
},
"includeJobs": {
"type": "object",
"properties": {
"groupIds": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
},
"jobIds": {
"type": "array",
"items": {
"type": "string"
},
"default": [ ]
}
},
"additionalProperties": false
},
"testsConfig": {
"type": [
"null",
"object"
],
"properties": {
"behindRealtime": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
},
"timeInterval": {
"type": [
"null",
"string"
],
"default": "null"
}
},
"additionalProperties": false,
"default": "null"
},
"datafeed": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false,
"default": "null"
},
"delayedData": {
"type": [
"null",
"object"
],
"properties": {
"docsCount": {
"minimum": 1,
"type": [
"null",
"number"
],
"default": "null"
},
"docsCountPercentage": {
"maximum": 100,
"minimum": 0,
"type": [
"null",
"number"
],
"default": "null"
},
"enabled": {
"type": "boolean",
"default": true
},
"thresholdType": {
"enum": [
"count",
"percentage"
],
"type": "string"
},
"timeInterval": {
"type": [
"null",
"string"
],
"default": "null"
}
},
"additionalProperties": false,
"default": "null"
},
"errorMessages": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false,
"default": "null"
},
"mml": {
"type": [
"null",
"object"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
}
},
"additionalProperties": false,
"default": "null"
}
},
"additionalProperties": false,
"default": "null"
}
},
"additionalProperties": false,
"description": "The parameters for the anomaly detection jobs health rule. These parameters are appropriate when `rule_type_id` is `xpack.ml.anomaly_detection_jobs_health\"`."
},
"rule_type_id": {
"enum": [
"xpack.ml.anomaly_detection_jobs_health"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting": {
"title": "Synthetics monitor status",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Synthetics Monitor Status Rule Params",
"type": "object",
"properties": {
"condition": {
"required": [
"window"
],
"type": "object",
"properties": {
"alertOnNoData": {
"type": "boolean"
},
"downThreshold": {
"type": "number"
},
"groupBy": {
"type": "string"
},
"includeRetests": {
"type": "boolean"
},
"locationsThreshold": {
"type": "number"
},
"pendingThreshold": {
"maximum": 100,
"minimum": 1,
"type": "number"
},
"recoveryStrategy": {
"enum": [
"firstUp",
"conditionNotMet"
],
"type": "string"
},
"window": {
"anyOf": [
{
"required": [
"time"
],
"type": "object",
"properties": {
"time": {
"type": "object",
"properties": {
"size": {
"type": "number",
"default": 5
},
"unit": {
"enum": [
"s",
"m",
"h",
"d"
],
"type": "string",
"default": "m"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
{
"type": "object",
"properties": {
"numberOfChecks": {
"maximum": 100,
"minimum": 1,
"type": "number",
"default": 5
}
},
"additionalProperties": false
}
]
}
},
"additionalProperties": false
},
"kqlQuery": {
"type": "string"
},
"locations": {
"type": "array",
"items": {
"type": "string"
}
},
"monitorIds": {
"type": "array",
"items": {
"type": "string"
}
},
"monitorTypes": {
"type": "array",
"items": {
"type": "string"
}
},
"projects": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false,
"description": "The parameters for the synthetics monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.synthetics.alerts.monitorStatus`."
},
"rule_type_id": {
"enum": [
"xpack.synthetics.alerts.monitorStatus"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting": {
"title": "Synthetics TLS",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Synthetics TLS Rule Params",
"type": "object",
"properties": {
"browserResourceTypes": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 1024,
"type": "string"
}
},
"certAgeThreshold": {
"type": "number"
},
"certExpirationThreshold": {
"type": "number"
},
"certOrigin": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
},
"includeBrowserCerts": {
"type": "boolean"
},
"issuers": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 4096,
"type": "string"
}
},
"kqlQuery": {
"type": "string"
},
"locations": {
"type": "array",
"items": {
"type": "string"
}
},
"monitorIds": {
"type": "array",
"items": {
"type": "string"
}
},
"monitorTypes": {
"type": "array",
"items": {
"type": "string"
}
},
"projects": {
"type": "array",
"items": {
"type": "string"
}
},
"search": {
"type": "string"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false,
"description": "The parameters for the synthetics tls rule. These parameters are appropriate when `rule_type_id` is `xpack.synthetics.alerts.tls`."
},
"rule_type_id": {
"enum": [
"xpack.synthetics.alerts.tls"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting": {
"title": "Uptime duration anomaly",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Uptime Duration Anomaly Rule Params",
"required": [
"monitorId",
"severity"
],
"type": "object",
"properties": {
"monitorId": {
"type": "string"
},
"severity": {
"type": "number"
},
"stackVersion": {
"type": "string"
}
},
"additionalProperties": false,
"description": "The parameters for the uptime duration anomaly rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.durationAnomaly`."
},
"rule_type_id": {
"enum": [
"xpack.uptime.alerts.durationAnomaly"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting": {
"title": "Uptime monitor status",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Uptime Monitor Status Rule Params",
"required": [
"numTimes",
"shouldCheckStatus",
"shouldCheckAvailability"
],
"type": "object",
"properties": {
"availability": {
"required": [
"range",
"rangeUnit",
"threshold"
],
"type": "object",
"properties": {
"range": {
"type": "number"
},
"rangeUnit": {
"type": "string"
},
"threshold": {
"type": "string"
}
},
"additionalProperties": false
},
"filters": {
"anyOf": [
{
"type": "object",
"properties": {
"monitor.type": {
"type": "array",
"items": {
"type": "string"
}
},
"observer.geo.name": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"url.port": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": false
},
{
"type": "string"
}
]
},
"isAutoGenerated": {
"type": "boolean"
},
"locations": {
"type": "array",
"items": {
"type": "string"
}
},
"numTimes": {
"type": "number"
},
"search": {
"type": "string"
},
"shouldCheckAvailability": {
"type": "boolean"
},
"shouldCheckStatus": {
"type": "boolean"
},
"stackVersion": {
"type": "string"
},
"timerange": {
"required": [
"from",
"to"
],
"type": "object",
"properties": {
"from": {
"type": "string"
},
"to": {
"type": "string"
}
},
"additionalProperties": false
},
"timerangeCount": {
"type": "number"
},
"timerangeUnit": {
"type": "string"
},
"version": {
"type": "number"
}
},
"additionalProperties": false,
"description": "The parameters for the uptime monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.monitorStatus`."
},
"rule_type_id": {
"enum": [
"xpack.uptime.alerts.monitorStatus"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting": {
"title": "Uptime TLS certificate",
"required": [
"name",
"consumer",
"schedule",
"rule_type_id",
"params"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_new_rule_action"
},
"default": [ ]
},
"alert_delay": {
"required": [
"active"
],
"type": "object",
"properties": {
"active": {
"type": "number",
"description": "The number of consecutive runs that must meet the rule conditions."
}
},
"additionalProperties": false,
"description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions."
},
"artifacts": {
"type": "object",
"properties": {
"dashboards": {
"maxItems": 10,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
}
},
"additionalProperties": false
}
},
"investigation_guide": {
"required": [
"blob"
],
"type": "object",
"properties": {
"blob": {
"maxLength": 10000,
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"consumer": {
"type": "string",
"description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`."
},
"enabled": {
"type": "boolean",
"description": "Indicates whether you want the rule to run on an interval basis after it is created.",
"default": true
},
"flapping": {
"allOf": [
{
"$ref": "#/components/schemas/Kibana_HTTP_APIs_rule_flapping"
}
]
},
"name": {
"type": "string",
"description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule."
},
"notify_when": {
"enum": [
"onActionGroupChange",
"onActiveAlert",
"onThrottleInterval",
"null"
],
"type": [
"null",
"string"
],
"description": "Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values."
},
"params": {
"title": "Uptime TLS Rule Params",
"type": "object",
"properties": {
"certAgeThreshold": {
"type": "number"
},
"certExpirationThreshold": {
"type": "number"
},
"search": {
"type": "string"
},
"stackVersion": {
"type": "string"
}
},
"additionalProperties": false,
"description": "The parameters for the uptime tls rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.tlsCertificate`."
},
"rule_type_id": {
"enum": [
"xpack.uptime.alerts.tlsCertificate"
],
"type": "string"
},
"schedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The interval is specified in seconds, minutes, hours, or days."
}
},
"additionalProperties": false,
"description": "The check interval, which specifies how frequently the rule conditions are checked."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the rule.",
"default": [ ]
},
"template_id": {
"maxLength": 1024,
"type": "string",
"description": "The identifier for the rule template this rule was created from, when known."
},
"throttle": {
"type": [
"null",
"string"
],
"description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values."
}
},
"additionalProperties": false
},
"Kibana_HTTP_APIs_xyLibItemNoESQL": {
"title": "XY Chart (library)",
"required": [
"type",
"layers"
],
"type": "object",
"properties": {
"axis": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visApiXyAxisConfig"
},
"description": {
"type": "string",
"description": "The description of the chart. Optional. Any string value or undefined."
},
"filters": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visPanelFilters"
},
"layers": {
"maxItems": 100,
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLayersNoESQL"
},
"description": "Chart layers"
},
"legend": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyLegend"
},
"query": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visFilterSimple"
},
"styling": {
"$ref": "#/components/schemas/Kibana_HTTP_APIs_visXyStyling"
},
"tags": {
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 250,
"type": "string"
},
"description": "Tag IDs to associate with this visualization.",
"default": [ ]
},
"title": {
"type": "string",
"description": "The title of the chart displayed in the panel. Optional. Any string value or undefined."
},
"type": {
"enum": [
"xy"
],
"type": "string"
}
},
"additionalProperties": false
},
"Machine_learning_APIs_mlSync200Response": {
"title": "Successful sync API response",
"type": "object",
"properties": {
"datafeedsAdded": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds"
},
"description": "If a saved object for an anomaly detection job is missing a datafeed identifier, it is added when you run the sync machine learning saved objects API."
},
"datafeedsRemoved": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds"
},
"description": "If a saved object for an anomaly detection job references a datafeed that no longer exists, it is deleted when you run the sync machine learning saved objects API."
},
"savedObjectsCreated": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsCreated"
},
"savedObjectsDeleted": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted"
}
}
},
"Machine_learning_APIs_mlSync4xxResponse": {
"title": "Unsuccessful sync API response",
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Unauthorized"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer",
"example": 401
}
}
},
"Machine_learning_APIs_mlSyncResponseAnomalyDetectors": {
"title": "Sync API response for anomaly detection jobs",
"type": "object",
"properties": {
"success": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess"
}
},
"description": "The sync machine learning saved objects API response contains this object when there are anomaly detection jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status."
},
"Machine_learning_APIs_mlSyncResponseDatafeeds": {
"title": "Sync API response for datafeeds",
"type": "object",
"properties": {
"success": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess"
}
},
"description": "The sync machine learning saved objects API response contains this object when there are datafeeds affected by the synchronization. There is an object for each relevant datafeed, which contains the synchronization status."
},
"Machine_learning_APIs_mlSyncResponseDataFrameAnalytics": {
"title": "Sync API response for data frame analytics jobs",
"type": "object",
"properties": {
"success": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess"
}
},
"description": "The sync machine learning saved objects API response contains this object when there are data frame analytics jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status."
},
"Machine_learning_APIs_mlSyncResponseSavedObjectsCreated": {
"title": "Sync API response for created saved objects",
"type": "object",
"properties": {
"anomaly-detector": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors"
},
"description": "If saved objects are missing for anomaly detection jobs, they are created."
},
"data-frame-analytics": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics"
},
"description": "If saved objects are missing for data frame analytics jobs, they are created."
},
"trained-model": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels"
},
"description": "If saved objects are missing for trained models, they are created."
}
},
"description": "If saved objects are missing for machine learning jobs or trained models, they are created when you run the sync machine learning saved objects API."
},
"Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted": {
"title": "Sync API response for deleted saved objects",
"type": "object",
"properties": {
"anomaly-detector": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors"
},
"description": "If there are saved objects exist for nonexistent anomaly detection jobs, they are deleted."
},
"data-frame-analytics": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics"
},
"description": "If there are saved objects exist for nonexistent data frame analytics jobs, they are deleted."
},
"trained-model": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels"
},
"description": "If there are saved objects exist for nonexistent trained models, they are deleted."
}
},
"description": "If saved objects exist for machine learning jobs or trained models that no longer exist, they are deleted when you run the sync machine learning saved objects API."
},
"Machine_learning_APIs_mlSyncResponseSuccess": {
"type": "boolean",
"description": "The success or failure of the synchronization."
},
"Machine_learning_APIs_mlSyncResponseTrainedModels": {
"title": "Sync API response for trained models",
"type": "object",
"properties": {
"success": {
"$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess"
}
},
"description": "The sync machine learning saved objects API response contains this object when there are trained models affected by the synchronization. There is an object for each relevant trained model, which contains the synchronization status."
},
"Observability_AI_Assistant_API_Function": {
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "The description of the function."
},
"name": {
"type": "string",
"description": "The name of the function."
},
"parameters": {
"type": "object",
"description": "The parameters of the function."
}
}
},
"Observability_AI_Assistant_API_FunctionCall": {
"required": [
"name",
"trigger"
],
"type": "object",
"properties": {
"arguments": {
"type": "string",
"description": "The arguments for the function call."
},
"name": {
"type": "string",
"description": "The name of the function."
},
"trigger": {
"enum": [
"assistant",
"user",
"elastic"
],
"type": "string",
"description": "The trigger of the function call."
}
},
"description": "Details of the function call within the message."
},
"Observability_AI_Assistant_API_Instruction": {
"oneOf": [
{
"type": "string",
"description": "A simple instruction represented as a string."
},
{
"required": [
"id",
"text"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "A unique identifier for the instruction."
},
"text": {
"type": "string",
"description": "The text of the instruction."
}
},
"description": "A detailed instruction with an ID and text."
}
]
},
"Observability_AI_Assistant_API_Message": {
"title": "Message",
"required": [
"@timestamp",
"message"
],
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"description": "The timestamp when the message was created."
},
"message": {
"required": [
"role"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The content of the message."
},
"data": {
"type": "string",
"description": "Additional data associated with the message."
},
"event": {
"type": "string",
"description": "The event related to the message."
},
"function_call": {
"$ref": "#/components/schemas/Observability_AI_Assistant_API_FunctionCall"
},
"name": {
"type": "string",
"description": "The name associated with the message."
},
"role": {
"$ref": "#/components/schemas/Observability_AI_Assistant_API_MessageRoleEnum"
}
},
"description": "The main content of the message."
}
}
},
"Observability_AI_Assistant_API_MessageRoleEnum": {
"enum": [
"system",
"assistant",
"function",
"user",
"elastic"
],
"type": "string",
"description": "The role of the message sender."
},
"Saved_objects_400_response": {
"title": "Bad request",
"required": [
"error",
"message",
"statusCode"
],
"type": "object",
"properties": {
"error": {
"enum": [
"Bad Request"
],
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"enum": [
400
],
"type": "integer"
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldCreateProps": {
"required": [
"field"
],
"type": "object",
"properties": {
"allowed": {
"type": "boolean",
"description": "Whether this field is allowed to be sent to the model.",
"example": true
},
"anonymized": {
"type": "boolean",
"description": "Whether this field should be anonymized.",
"example": false
},
"field": {
"type": "string",
"description": "Name of the anonymization field to create.",
"example": "host.name"
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldDetailsInError": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The ID of the anonymization field.",
"example": "field12"
},
"name": {
"type": "string",
"description": "Name of the anonymization field.",
"example": "host.name"
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldResponse": {
"required": [
"id",
"field"
],
"type": "object",
"properties": {
"allowed": {
"type": "boolean",
"description": "Whether this field is allowed to be sent to the model.",
"example": true
},
"anonymized": {
"type": "boolean",
"description": "Whether this field should be anonymized.",
"example": false
},
"createdAt": {
"type": "string",
"description": "Timestamp of when the anonymization field was created.",
"example": "2023-10-31T12:00:00Z"
},
"createdBy": {
"type": "string",
"description": "Username of the person who created the anonymization field.",
"example": "user1"
},
"field": {
"type": "string",
"description": "Name of the anonymization field.",
"example": "url.domain"
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"namespace": {
"type": "string",
"description": "Kibana space in which this anonymization field exists.",
"example": "default"
},
"timestamp": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp"
},
"updatedAt": {
"type": "string",
"description": "Timestamp of the last update.",
"example": "2023-10-31T12:00:00Z"
},
"updatedBy": {
"type": "string",
"description": "Username of the person who last updated the field.",
"example": "user1"
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason": {
"enum": [
"ANONYMIZATION_FIELD_NOT_MODIFIED"
],
"type": "string",
"description": "Reason why the anonymization field was not modified."
},
"Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult": {
"required": [
"id",
"skip_reason"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The ID of the anonymization field that was not modified.",
"example": "field4"
},
"name": {
"type": "string",
"description": "Name of the anonymization field that was not modified.",
"example": "user.name"
},
"skip_reason": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason"
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse": {
"required": [
"attributes"
],
"type": "object",
"properties": {
"anonymization_fields_count": {
"type": "integer",
"description": "Total number of anonymization fields processed.",
"example": 5
},
"attributes": {
"required": [
"results",
"summary"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NormalizedAnonymizationFieldError"
},
"description": "List of errors that occurred during the bulk operation."
},
"results": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults"
},
"summary": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary"
}
}
},
"message": {
"type": "string",
"description": "Message providing information about the bulk action result.",
"example": "Bulk action completed successfully"
},
"status_code": {
"type": "integer",
"description": "HTTP status code returned.",
"example": 200
},
"success": {
"type": "boolean",
"description": "Indicates if the bulk action was successful.",
"example": true
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults": {
"required": [
"updated",
"created",
"deleted",
"skipped"
],
"type": "object",
"properties": {
"created": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse"
},
"description": "List of anonymization fields successfully created."
},
"deleted": {
"type": "array",
"items": {
"type": "string",
"description": "Array of IDs of anonymization fields that were deleted.",
"example": "field3"
}
},
"skipped": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult"
},
"description": "List of anonymization fields that were skipped during the operation."
},
"updated": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse"
},
"description": "List of anonymization fields successfully updated."
}
}
},
"Security_AI_Assistant_API_AnonymizationFieldUpdateProps": {
"required": [
"id"
],
"type": "object",
"properties": {
"allowed": {
"type": "boolean",
"description": "Whether this field is allowed to be sent to the model.",
"example": true
},
"anonymized": {
"type": "boolean",
"description": "Whether this field should be anonymized.",
"example": false
},
"id": {
"type": "string",
"description": "The ID of the anonymization field to update.",
"example": "field8"
}
}
},
"Security_AI_Assistant_API_ApiConfig": {
"required": [
"connectorId",
"actionTypeId"
],
"type": "object",
"properties": {
"actionTypeId": {
"type": "string",
"description": "Action type ID",
"example": "actionType456"
},
"connectorId": {
"type": "string",
"description": "Connector ID",
"example": "connector123"
},
"defaultSystemPromptId": {
"type": "string",
"description": "Default system prompt ID",
"example": "systemPrompt001"
},
"model": {
"type": "string",
"description": "Model",
"example": "gpt-4"
},
"provider": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Provider"
}
}
},
"Security_AI_Assistant_API_BaseContentReference": {
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Id of the content reference",
"example": "content123"
},
"type": {
"type": "string",
"description": "Type of the content reference",
"example": "SecurityAlert"
}
},
"description": "The basis of a content reference"
},
"Security_AI_Assistant_API_BaseInterruptResumeValue": {
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_InterruptType"
}
},
"description": "The basis of an interrupt resume value"
},
"Security_AI_Assistant_API_BaseInterruptValue": {
"required": [
"type",
"threadId"
],
"type": "object",
"properties": {
"expired": {
"type": "boolean",
"description": "Whether the interrupt has expired and can no longer be resumed.",
"example": false
},
"threadId": {
"type": "string",
"description": "Thread ID of the graph execution that produced this message.",
"example": ""
},
"type": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_InterruptType"
}
},
"description": "The basis of an agent interrupt"
},
"Security_AI_Assistant_API_BulkCrudActionSummary": {
"required": [
"failed",
"skipped",
"succeeded",
"total"
],
"type": "object",
"properties": {
"failed": {
"type": "integer",
"description": "The number of failed actions.",
"example": 0
},
"skipped": {
"type": "integer",
"description": "The number of skipped actions.",
"example": 1
},
"succeeded": {
"type": "integer",
"description": "The number of successfully performed actions.",
"example": 10
},
"total": {
"type": "integer",
"description": "The total number of actions attempted.",
"example": 12
}
}
},
"Security_AI_Assistant_API_ChatCompleteProps": {
"required": [
"messages",
"persist",
"connectorId"
],
"type": "object",
"properties": {
"connectorId": {
"type": "string",
"description": "Required connector identifier to route the request.",
"example": "conn-001"
},
"conversationId": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"isStream": {
"type": "boolean",
"description": "If true, the response will be streamed in chunks.",
"example": true
},
"langSmithApiKey": {
"type": "string",
"description": "API key for LangSmith integration.",
"example": ""
},
"langSmithProject": {
"type": "string",
"description": "LangSmith project name for tracing.",
"example": "security_ai_project"
},
"messages": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ChatMessage"
},
"description": "List of chat messages exchanged so far."
},
"model": {
"type": "string",
"description": "Model ID or name to use for the response.",
"example": "gpt-4"
},
"persist": {
"type": "boolean",
"description": "Whether to persist the chat and response to storage.",
"example": true
},
"promptId": {
"type": "string",
"description": "Prompt template identifier.",
"example": "prompt_001"
},
"responseLanguage": {
"type": "string",
"description": "ISO language code for the assistant's response.",
"example": "en"
}
},
"description": "The request payload for creating a chat completion.",
"example": {
"connectorId": "conn-001",
"conversationId": "abc123",
"isStream": true,
"langSmithApiKey": "",
"langSmithProject": "security_ai_project",
"messages": [
{
"content": "How do I detect ransomware on my endpoints?",
"data": {
"device_id": "device-567"
},
"fields_to_anonymize": [
"device.name",
"file.path"
],
"role": "user"
}
],
"model": "gpt-4",
"persist": true,
"promptId": "prompt_456",
"responseLanguage": "en"
}
},
"Security_AI_Assistant_API_ChatMessage": {
"required": [
"role"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "The textual content of the message.",
"example": "What security incidents have been reported today?"
},
"data": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_MessageData"
},
"fields_to_anonymize": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of field names within the data object that should be anonymized.",
"example": [
"user.name",
"source.ip"
]
},
"role": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ChatMessageRole"
}
},
"description": "A message exchanged within the AI chat conversation."
},
"Security_AI_Assistant_API_ChatMessageRole": {
"enum": [
"system",
"user",
"assistant"
],
"type": "string",
"description": "The role associated with the message in the chat.",
"example": "user"
},
"Security_AI_Assistant_API_ContentReferences": {
"type": "object",
"additionalProperties": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryContentReference"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_SecurityAlertContentReference"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_SecurityAlertsPageContentReference"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_ProductDocumentationContentReference"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_EsqlContentReference"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_HrefContentReference"
}
]
},
"description": "A union of all content reference types"
},
"Security_AI_Assistant_API_ConversationCategory": {
"enum": [
"assistant",
"insights"
],
"type": "string",
"description": "The conversation category.",
"example": "assistant"
},
"Security_AI_Assistant_API_ConversationCreateProps": {
"required": [
"title"
],
"type": "object",
"properties": {
"apiConfig": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ApiConfig"
},
"category": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCategory"
},
"excludeFromLastConversationStorage": {
"type": "boolean",
"description": "Exclude from last conversation storage."
},
"id": {
"type": "string",
"description": "The conversation id.",
"example": "conversation123"
},
"messages": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Message"
},
"description": "The conversation messages."
},
"replacements": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Replacements"
},
"title": {
"type": "string",
"description": "The conversation title.",
"example": "Security AI Assistant Setup"
}
}
},
"Security_AI_Assistant_API_ConversationResponse": {
"required": [
"id",
"title",
"createdAt",
"createdBy",
"users",
"namespace",
"category"
],
"type": "object",
"properties": {
"apiConfig": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ApiConfig"
},
"category": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCategory"
},
"createdAt": {
"type": "string",
"description": "The time conversation was created.",
"example": "2025-04-30T14:00:00Z"
},
"createdBy": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"excludeFromLastConversationStorage": {
"type": "boolean",
"description": "Exclude from last conversation storage."
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"messages": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Message"
},
"description": "The conversation messages."
},
"namespace": {
"type": "string",
"description": "Kibana space",
"example": "default"
},
"replacements": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Replacements"
},
"timestamp": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp"
},
"title": {
"type": "string",
"description": "The conversation title.",
"example": "Security AI Assistant Setup"
},
"updatedAt": {
"type": "string",
"description": "The last time conversation was updated.",
"example": "2025-04-30T16:30:00Z"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
}
}
}
},
"Security_AI_Assistant_API_ConversationUpdateProps": {
"required": [
"id"
],
"type": "object",
"properties": {
"apiConfig": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ApiConfig"
},
"category": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCategory"
},
"excludeFromLastConversationStorage": {
"type": "boolean",
"description": "Exclude from last conversation storage."
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"messages": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Message"
},
"description": "The conversation messages."
},
"replacements": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Replacements"
},
"title": {
"type": "string",
"description": "The conversation title.",
"example": "Updated Security AI Assistant Setup"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
}
}
}
},
"Security_AI_Assistant_API_DeleteResponseFields": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
}
}
},
"Security_AI_Assistant_API_DocumentEntry": {
"allOf": [
{
"required": [
"name",
"namespace",
"global",
"users"
],
"type": "object",
"properties": {
"global": {
"type": "boolean",
"description": "Whether this Knowledge Base Entry is global, defaults to false.",
"example": false
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry.",
"example": "Example Entry"
},
"namespace": {
"type": "string",
"description": "Kibana Space, defaults to 'default' space.",
"example": "default"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users."
}
}
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields"
}
]
},
"Security_AI_Assistant_API_DocumentEntryCreateFields": {
"allOf": [
{
"required": [
"name"
],
"type": "object",
"properties": {
"global": {
"type": "boolean",
"description": "Whether this Knowledge Base Entry is global, defaults to false.",
"example": false
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry.",
"example": "Example Entry"
},
"namespace": {
"type": "string",
"description": "Kibana Space, defaults to 'default' space.",
"example": "default"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users."
}
}
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields"
}
]
},
"Security_AI_Assistant_API_DocumentEntryOptionalFields": {
"type": "object",
"properties": {
"required": {
"type": "boolean",
"description": "Whether this resource should always be included, defaults to false.",
"example": false
},
"vector": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Vector"
}
}
},
"Security_AI_Assistant_API_DocumentEntryRequiredFields": {
"required": [
"type",
"kbResource",
"source",
"text"
],
"type": "object",
"properties": {
"kbResource": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResource"
},
"source": {
"type": "string",
"description": "Source document name or filepath.",
"example": "/documents/example.txt"
},
"text": {
"type": "string",
"description": "Knowledge Base Entry content.",
"example": "This is the content of the document."
},
"type": {
"enum": [
"document"
],
"type": "string",
"description": "Entry type.",
"example": "document"
}
}
},
"Security_AI_Assistant_API_DocumentEntryResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields"
}
]
},
"Security_AI_Assistant_API_DocumentEntryUpdateFields": {
"allOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"global": {
"type": "boolean",
"description": "Whether this Knowledge Base Entry is global, defaults to false.",
"example": false
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry.",
"example": "Example Entry"
},
"namespace": {
"type": "string",
"description": "Kibana Space, defaults to 'default' space.",
"example": "default"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users."
}
}
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields"
}
]
},
"Security_AI_Assistant_API_EsqlContentReference": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference"
},
{
"required": [
"type",
"query",
"label"
],
"type": "object",
"properties": {
"label": {
"type": "string",
"description": "Label of the query",
"example": "High Severity Alerts"
},
"query": {
"type": "string",
"description": "An ESQL query",
"example": "SELECT * FROM alerts WHERE severity = \"high\""
},
"timerange": {
"required": [
"from",
"to"
],
"type": "object",
"properties": {
"from": {
"type": "string",
"example": "2025-04-01T00:00:00Z"
},
"to": {
"type": "string",
"example": "2025-04-30T23:59:59Z"
}
},
"description": "Time range to select in the time picker."
},
"type": {
"enum": [
"EsqlQuery"
],
"type": "string",
"example": "EsqlQuery"
}
}
}
],
"description": "References an ESQL query"
},
"Security_AI_Assistant_API_FindAnonymizationFieldsSortField": {
"enum": [
"created_at",
"anonymized",
"allowed",
"field",
"updated_at"
],
"type": "string"
},
"Security_AI_Assistant_API_FindConversationsSortField": {
"enum": [
"created_at",
"title",
"updated_at"
],
"type": "string",
"description": "The field by which to sort the conversations. Possible values are `created_at`, `title`, and `updated_at`.",
"example": "created_at"
},
"Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField": {
"enum": [
"created_at",
"is_default",
"title",
"updated_at"
],
"type": "string",
"description": "Fields available for sorting Knowledge Base Entries.",
"example": "title"
},
"Security_AI_Assistant_API_FindPromptsSortField": {
"enum": [
"created_at",
"is_default",
"name",
"updated_at"
],
"type": "string",
"description": "Field by which to sort the prompts.",
"example": "created_at"
},
"Security_AI_Assistant_API_HrefContentReference": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference"
},
{
"required": [
"type",
"href"
],
"type": "object",
"properties": {
"href": {
"type": "string",
"description": "URL to the external resource"
},
"label": {
"type": "string",
"description": "Label of the query"
},
"type": {
"enum": [
"Href"
],
"type": "string"
}
}
}
],
"description": "References an external URL"
},
"Security_AI_Assistant_API_IndexEntry": {
"allOf": [
{
"required": [
"name",
"namespace",
"global",
"users"
],
"type": "object",
"properties": {
"global": {
"type": "boolean",
"description": "Whether this Knowledge Base Entry is global, defaults to false.",
"example": false
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry.",
"example": "Example Entry"
},
"namespace": {
"type": "string",
"description": "Kibana Space, defaults to 'default' space.",
"example": "default"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users."
}
}
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields"
}
]
},
"Security_AI_Assistant_API_IndexEntryCreateFields": {
"allOf": [
{
"required": [
"name"
],
"type": "object",
"properties": {
"global": {
"type": "boolean",
"description": "Whether this Knowledge Base Entry is global, defaults to false.",
"example": false
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry.",
"example": "Example Entry"
},
"namespace": {
"type": "string",
"description": "Kibana Space, defaults to 'default' space.",
"example": "default"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users."
}
}
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields"
}
]
},
"Security_AI_Assistant_API_IndexEntryOptionalFields": {
"type": "object",
"properties": {
"inputSchema": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_InputSchema"
},
"outputFields": {
"type": "array",
"items": {
"type": "string"
},
"description": "Fields to extract from the query result, defaults to all fields if not provided or empty.",
"example": [
"title",
"author"
]
}
}
},
"Security_AI_Assistant_API_IndexEntryRequiredFields": {
"required": [
"type",
"index",
"field",
"description",
"queryDescription"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.",
"example": "Query this index for general knowledge base content."
},
"field": {
"type": "string",
"description": "Field to query for Knowledge Base content.",
"example": "content"
},
"index": {
"type": "string",
"description": "Index or Data Stream to query for Knowledge Base content.",
"example": "knowledge_base_index"
},
"queryDescription": {
"type": "string",
"description": "Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.",
"example": "Search for documents containing the specified keywords."
},
"type": {
"enum": [
"index"
],
"type": "string",
"description": "Entry type.",
"example": "index"
}
}
},
"Security_AI_Assistant_API_IndexEntryResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields"
}
]
},
"Security_AI_Assistant_API_IndexEntryUpdateFields": {
"allOf": [
{
"required": [
"id"
],
"type": "object",
"properties": {
"global": {
"type": "boolean",
"description": "Whether this Knowledge Base Entry is global, defaults to false.",
"example": false
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry.",
"example": "Example Entry"
},
"namespace": {
"type": "string",
"description": "Kibana Space, defaults to 'default' space.",
"example": "default"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users."
}
}
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields"
}
]
},
"Security_AI_Assistant_API_InputSchema": {
"type": "array",
"items": {
"required": [
"fieldName",
"fieldType",
"description"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Description of the field.",
"example": "The title of the document."
},
"fieldName": {
"type": "string",
"description": "Name of the field.",
"example": "title"
},
"fieldType": {
"type": "string",
"description": "Type of the field.",
"example": "string"
}
}
},
"description": "Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval."
},
"Security_AI_Assistant_API_InputTextInterruptResumeValue": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseInterruptResumeValue"
},
{
"required": [
"value",
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"INPUT_TEXT"
],
"type": "string",
"example": "INPUT_TEXT"
},
"value": {
"type": "string",
"description": "Text value used to resume the graph execution with.",
"example": ".logs*"
}
}
}
],
"description": "A resume value for input text"
},
"Security_AI_Assistant_API_InputTextInterruptValue": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseInterruptValue"
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Description of action required",
"example": "What is the index you would like to use for the query."
},
"placeholder": {
"type": "string",
"description": "Placeholder text for the input field",
"example": "Enter index pattern here..."
},
"type": {
"enum": [
"INPUT_TEXT"
],
"type": "string",
"example": "INPUT_TEXT"
}
}
}
],
"description": "Interrupt that requests user to provide text input"
},
"Security_AI_Assistant_API_InterruptResumeValue": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptResumeValue"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_InputTextInterruptResumeValue"
}
],
"description": "Union of the interrupt resume values"
},
"Security_AI_Assistant_API_InterruptType": {
"enum": [
"SELECT_OPTION",
"INPUT_TEXT"
],
"type": "string",
"description": "The type of interrupt"
},
"Security_AI_Assistant_API_InterruptValue": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptValue"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_InputTextInterruptValue"
}
],
"description": "Union of the interrupt values"
},
"Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason": {
"enum": [
"KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED"
],
"type": "string",
"description": "Reason why a Knowledge Base Entry was skipped during the bulk action."
},
"Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult": {
"required": [
"id",
"skip_reason"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "ID of the skipped Knowledge Base Entry.",
"example": "123"
},
"name": {
"type": "string",
"description": "Name of the skipped Knowledge Base Entry.",
"example": "Skipped Entry"
},
"skip_reason": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason"
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse": {
"required": [
"attributes"
],
"type": "object",
"properties": {
"attributes": {
"required": [
"results",
"summary"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError"
},
"description": "List of errors encountered during the bulk action.",
"example": [
{
"err_code": "UPDATE_FAILED",
"knowledgeBaseEntries": [
{
"id": "456",
"name": "Error Entry"
}
],
"message": "Failed to update entry.",
"statusCode": 400
}
]
},
"results": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults"
},
"summary": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary"
}
}
},
"knowledgeBaseEntriesCount": {
"type": "integer",
"description": "Total number of Knowledge Base Entries processed.",
"example": 8
},
"message": {
"type": "string",
"description": "Message describing the result of the bulk action.",
"example": "Bulk action completed successfully."
},
"statusCode": {
"type": "integer",
"description": "HTTP status code of the response.",
"example": 200
},
"success": {
"type": "boolean",
"description": "Indicates whether the bulk action was successful.",
"example": true
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults": {
"required": [
"updated",
"created",
"deleted",
"skipped"
],
"type": "object",
"properties": {
"created": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse"
},
"description": "List of Knowledge Base Entries that were successfully created.",
"example": [
{
"id": "456",
"kbResource": "user",
"name": "New Entry",
"source": "manual",
"text": "This is the content of the new entry.",
"type": "document"
}
]
},
"deleted": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of IDs of Knowledge Base Entries that were successfully deleted.",
"example": [
"789"
]
},
"skipped": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult"
},
"description": "List of Knowledge Base Entries that were skipped during the bulk action.",
"example": [
{
"id": "123",
"name": "Skipped Entry",
"skip_reason": "KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED"
}
]
},
"updated": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse"
},
"description": "List of Knowledge Base Entries that were successfully updated.",
"example": [
{
"id": "123",
"kbResource": "user",
"name": "Updated Entry",
"source": "manual",
"text": "Updated content.",
"type": "document"
}
]
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary": {
"required": [
"failed",
"skipped",
"succeeded",
"total"
],
"type": "object",
"properties": {
"failed": {
"type": "integer",
"description": "Number of Knowledge Base Entries that failed during the bulk action.",
"example": 2
},
"skipped": {
"type": "integer",
"description": "Number of Knowledge Base Entries that were skipped during the bulk action.",
"example": 1
},
"succeeded": {
"type": "integer",
"description": "Number of Knowledge Base Entries that were successfully processed during the bulk action.",
"example": 5
},
"total": {
"type": "integer",
"description": "Total number of Knowledge Base Entries involved in the bulk action.",
"example": 8
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryContentReference": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference"
},
{
"required": [
"type",
"knowledgeBaseEntryId",
"knowledgeBaseEntryName"
],
"type": "object",
"properties": {
"knowledgeBaseEntryId": {
"type": "string",
"description": "Id of the Knowledge Base Entry",
"example": "kbentry456"
},
"knowledgeBaseEntryName": {
"type": "string",
"description": "Name of the knowledge base entry",
"example": "Network Security Best Practices"
},
"type": {
"enum": [
"KnowledgeBaseEntry"
],
"type": "string",
"example": "KnowledgeBaseEntry"
}
}
}
],
"description": "References a knowledge base entry"
},
"Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"document": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields",
"index": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields"
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "ID of the Knowledge Base Entry that encountered an error.",
"example": "456"
},
"name": {
"type": "string",
"description": "Name of the Knowledge Base Entry that encountered an error.",
"example": "Error Entry"
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema": {
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type or category.",
"example": "Not Found"
},
"message": {
"type": "string",
"description": "Detailed error message.",
"example": "The requested Knowledge Base Entry was not found."
},
"statusCode": {
"type": "number",
"description": "HTTP status code of the error.",
"example": 404
}
},
"additionalProperties": false
},
"Security_AI_Assistant_API_KnowledgeBaseEntryResponse": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntry"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntry"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"document": "#/components/schemas/Security_AI_Assistant_API_DocumentEntry",
"index": "#/components/schemas/Security_AI_Assistant_API_IndexEntry"
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"document": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields",
"index": "#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields"
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields"
},
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"document": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields",
"index": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields"
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseReadResponse200": {
"type": "object",
"properties": {
"defend_insights_exists": {
"type": "boolean",
"description": "Indicates if Defend Insights documentation exists in the KnowledgeBase.",
"example": true
},
"elser_exists": {
"type": "boolean",
"description": "Indicates if the ELSER model exists for the KnowledgeBase.",
"example": true
},
"is_setup_available": {
"type": "boolean",
"description": "Indicates if the setup process is available for the KnowledgeBase.",
"example": true
},
"is_setup_in_progress": {
"type": "boolean",
"description": "Indicates if the setup process is currently in progress.",
"example": false
},
"product_documentation_status": {
"type": "string",
"description": "The status of the product documentation in the KnowledgeBase.",
"example": "complete"
},
"security_labs_exists": {
"type": "boolean",
"description": "Indicates if Security Labs documentation exists in the KnowledgeBase.",
"example": true
},
"user_data_exists": {
"type": "boolean",
"description": "Indicates if user data exists in the KnowledgeBase.",
"example": false
}
}
},
"Security_AI_Assistant_API_KnowledgeBaseResource": {
"enum": [
"security_labs",
"defend_insights",
"user"
],
"type": "string",
"description": "Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.",
"example": "security_labs"
},
"Security_AI_Assistant_API_KnowledgeBaseResponse": {
"type": "object",
"properties": {
"success": {
"type": "boolean",
"description": "Identify the success of the method execution.",
"example": true
}
},
"description": "AI assistant KnowledgeBase."
},
"Security_AI_Assistant_API_KnowledgeBaseResponse400": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "A short description of the error.",
"example": "Bad Request"
},
"message": {
"type": "string",
"description": "A detailed error message.",
"example": "Invalid resource ID provided."
},
"statusCode": {
"type": "number",
"description": "The HTTP status code of the error.",
"example": 400
}
}
},
"Security_AI_Assistant_API_Message": {
"required": [
"timestamp",
"content",
"role"
],
"type": "object",
"properties": {
"content": {
"type": "string",
"description": "Message content.",
"example": "Hello, how can I assist you today?"
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"isError": {
"type": "boolean",
"description": "Is error message.",
"example": false
},
"metadata": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_MessageMetadata"
},
"reader": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_Reader"
},
"refusal": {
"type": "string",
"description": "Refusal reason returned by the model when content is filtered."
},
"role": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_MessageRole"
},
"timestamp": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp"
},
"traceData": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_TraceData"
},
"user": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
}
},
"description": "AI assistant conversation message."
},
"Security_AI_Assistant_API_MessageData": {
"type": "object",
"description": "ECS-style metadata attached to the message.",
"example": {
"alert_id": "alert-456",
"user_id": "abc123"
}
},
"Security_AI_Assistant_API_MessageMetadata": {
"type": "object",
"properties": {
"contentReferences": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_ContentReferences"
},
"interruptResumeValue": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_InterruptResumeValue"
},
"interruptValue": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_InterruptValue"
}
},
"description": "Message metadata"
},
"Security_AI_Assistant_API_MessageRole": {
"enum": [
"system",
"user",
"assistant"
],
"type": "string",
"description": "Message role.",
"example": "assistant"
},
"Security_AI_Assistant_API_NonEmptyString": {
"minLength": 1,
"type": "string",
"description": "A string that does not contain only whitespace characters.",
"format": "nonempty",
"example": "I am a string"
},
"Security_AI_Assistant_API_NonEmptyTimestamp": {
"minLength": 1,
"type": "string",
"description": "A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.",
"format": "nonempty",
"example": "2023-10-31T12:00:00Z"
},
"Security_AI_Assistant_API_NormalizedAnonymizationFieldError": {
"required": [
"message",
"status_code",
"anonymization_fields"
],
"type": "object",
"properties": {
"anonymization_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldDetailsInError"
},
"description": "Array of anonymization fields that caused the error."
},
"err_code": {
"type": "string",
"description": "Error code indicating the type of failure.",
"example": "UPDATE_FAILED"
},
"message": {
"type": "string",
"description": "Error message.",
"example": "Failed to update anonymization field."
},
"status_code": {
"type": "integer",
"description": "Status code of the response.",
"example": 400
}
}
},
"Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError": {
"required": [
"message",
"statusCode",
"knowledgeBaseEntries"
],
"type": "object",
"properties": {
"err_code": {
"type": "string",
"description": "Specific error code for the issue.",
"example": "UPDATE_FAILED"
},
"knowledgeBaseEntries": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError"
},
"description": "List of Knowledge Base Entries that encountered the error."
},
"message": {
"type": "string",
"description": "Error message describing the issue.",
"example": "Failed to update entry."
},
"statusCode": {
"type": "integer",
"description": "HTTP status code associated with the error.",
"example": 400
}
}
},
"Security_AI_Assistant_API_NormalizedPromptError": {
"required": [
"message",
"status_code",
"prompts"
],
"type": "object",
"properties": {
"err_code": {
"type": "string",
"description": "A code representing the error type."
},
"message": {
"type": "string",
"description": "A message describing the error encountered."
},
"prompts": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptDetailsInError"
},
"description": "List of prompts that encountered errors."
},
"status_code": {
"type": "integer",
"description": "The HTTP status code associated with the error."
}
}
},
"Security_AI_Assistant_API_ProductDocumentationContentReference": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference"
},
{
"required": [
"type",
"title",
"url"
],
"type": "object",
"properties": {
"title": {
"type": "string",
"description": "Title of the documentation",
"example": "Getting Started with Security AI Assistant"
},
"type": {
"enum": [
"ProductDocumentation"
],
"type": "string",
"example": "ProductDocumentation"
},
"url": {
"type": "string",
"description": "URL to the documentation",
"example": "https://docs.example.com/security-ai-assistant"
}
}
}
],
"description": "References the product documentation"
},
"Security_AI_Assistant_API_PromptCreateProps": {
"required": [
"name",
"content",
"promptType"
],
"type": "object",
"properties": {
"categories": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of categories for the prompt.",
"example": [
"security",
"verification"
]
},
"color": {
"type": "string",
"description": "The color associated with the prompt.",
"example": "blue"
},
"consumer": {
"type": "string",
"description": "The consumer associated with the prompt.",
"example": "admin"
},
"content": {
"type": "string",
"description": "The content of the prompt.",
"example": "Please verify the security settings."
},
"isDefault": {
"type": "boolean",
"description": "Whether this prompt should be the default.",
"example": false
},
"isNewConversationDefault": {
"type": "boolean",
"description": "Whether this prompt should be the default for new conversations.",
"example": true
},
"name": {
"type": "string",
"description": "The name of the prompt.",
"example": "New Security Prompt"
},
"promptType": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptType"
}
}
},
"Security_AI_Assistant_API_PromptDetailsInError": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The ID of the prompt that encountered an error."
},
"name": {
"type": "string",
"description": "The name of the prompt that encountered an error."
}
}
},
"Security_AI_Assistant_API_PromptResponse": {
"required": [
"id",
"name",
"promptType",
"content"
],
"type": "object",
"properties": {
"categories": {
"type": "array",
"items": {
"type": "string"
},
"description": "Categories associated with the prompt."
},
"color": {
"type": "string",
"description": "The color associated with the prompt."
},
"consumer": {
"type": "string",
"description": "The consumer that the prompt is associated with."
},
"content": {
"type": "string",
"description": "The content of the prompt."
},
"createdAt": {
"type": "string",
"description": "The timestamp of when the prompt was created."
},
"createdBy": {
"type": "string",
"description": "The user who created the prompt."
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"isDefault": {
"type": "boolean",
"description": "Whether this prompt is the default."
},
"isNewConversationDefault": {
"type": "boolean",
"description": "Whether this prompt is the default for new conversations."
},
"name": {
"type": "string",
"description": "The name of the prompt."
},
"namespace": {
"type": "string",
"description": "Kibana space where the prompt is located."
},
"promptType": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptType"
},
"timestamp": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp"
},
"updatedAt": {
"type": "string",
"description": "The timestamp of when the prompt was last updated."
},
"updatedBy": {
"type": "string",
"description": "The user who last updated the prompt."
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_User"
},
"description": "List of users associated with the prompt."
}
}
},
"Security_AI_Assistant_API_PromptsBulkActionSkipReason": {
"enum": [
"PROMPT_FIELD_NOT_MODIFIED"
],
"type": "string",
"description": "Reason why a prompt was skipped during the bulk action."
},
"Security_AI_Assistant_API_PromptsBulkActionSkipResult": {
"required": [
"id",
"skip_reason"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The ID of the prompt that was skipped."
},
"name": {
"type": "string",
"description": "The name of the prompt that was skipped."
},
"skip_reason": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipReason"
}
}
},
"Security_AI_Assistant_API_PromptsBulkCrudActionResponse": {
"required": [
"attributes"
],
"type": "object",
"properties": {
"attributes": {
"required": [
"results",
"summary"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NormalizedPromptError"
}
},
"results": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResults"
},
"summary": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary"
}
}
},
"message": {
"type": "string",
"description": "A message describing the result of the bulk action.",
"example": "Bulk action completed successfully."
},
"prompts_count": {
"type": "integer",
"description": "The number of prompts processed in the bulk action.",
"example": 6
},
"status_code": {
"type": "integer",
"description": "The HTTP status code of the response.",
"example": 200
},
"success": {
"type": "boolean",
"description": "Indicates if the bulk action was successful.",
"example": true
}
}
},
"Security_AI_Assistant_API_PromptsBulkCrudActionResults": {
"required": [
"updated",
"created",
"deleted",
"skipped"
],
"type": "object",
"properties": {
"created": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptResponse"
},
"description": "List of prompts that were created."
},
"deleted": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of IDs of prompts that were deleted."
},
"skipped": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipResult"
},
"description": "List of prompts that were skipped."
},
"updated": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_PromptResponse"
},
"description": "List of prompts that were updated."
}
}
},
"Security_AI_Assistant_API_PromptType": {
"enum": [
"system",
"quick"
],
"type": "string",
"description": "Type of the prompt (either system or quick)."
},
"Security_AI_Assistant_API_PromptUpdateProps": {
"required": [
"id"
],
"type": "object",
"properties": {
"categories": {
"type": "array",
"items": {
"type": "string"
},
"description": "The updated categories for the prompt.",
"example": [
"security",
"alert"
]
},
"color": {
"type": "string",
"description": "The updated color associated with the prompt.",
"example": "green"
},
"consumer": {
"type": "string",
"description": "The updated consumer for the prompt.",
"example": "user123"
},
"content": {
"type": "string",
"description": "The updated content for the prompt.",
"example": "Updated content for security prompt."
},
"id": {
"type": "string",
"description": "The ID of the prompt to update.",
"example": "prompt123"
},
"isDefault": {
"type": "boolean",
"description": "Whether this prompt should be the default.",
"example": true
},
"isNewConversationDefault": {
"type": "boolean",
"description": "Whether the prompt should be the default for new conversations.",
"example": false
}
}
},
"Security_AI_Assistant_API_Provider": {
"enum": [
"OpenAI",
"Azure OpenAI",
"Other"
],
"type": "string",
"description": "Provider",
"example": "OpenAI"
},
"Security_AI_Assistant_API_Reader": {
"type": "object"
},
"Security_AI_Assistant_API_Replacements": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Replacements object used to anonymize/deanonymize messages"
},
"Security_AI_Assistant_API_ResponseFields": {
"required": [
"id",
"createdAt",
"createdBy",
"updatedAt",
"updatedBy"
],
"type": "object",
"properties": {
"createdAt": {
"type": "string",
"description": "Time the Knowledge Base Entry was created.",
"example": "2023-01-01T12:00:00Z"
},
"createdBy": {
"type": "string",
"description": "User who created the Knowledge Base Entry.",
"example": "admin"
},
"id": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString"
},
"updatedAt": {
"type": "string",
"description": "Time the Knowledge Base Entry was last updated.",
"example": "2023-01-02T12:00:00Z"
},
"updatedBy": {
"type": "string",
"description": "User who last updated the Knowledge Base Entry.",
"example": "editor"
}
}
},
"Security_AI_Assistant_API_SecurityAlertContentReference": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference"
},
{
"required": [
"type",
"alertId"
],
"type": "object",
"properties": {
"alertId": {
"type": "string",
"description": "ID of the Alert",
"example": "alert789"
},
"type": {
"enum": [
"SecurityAlert"
],
"type": "string",
"example": "SecurityAlert"
}
}
}
],
"description": "References a security alert"
},
"Security_AI_Assistant_API_SecurityAlertsPageContentReference": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference"
},
{
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"SecurityAlertsPage"
],
"type": "string",
"example": "SecurityAlertsPage"
}
}
}
],
"description": "References the security alerts page"
},
"Security_AI_Assistant_API_SelectOptionInterruptOption": {
"required": [
"label",
"value"
],
"type": "object",
"properties": {
"buttonColor": {
"enum": [
"text",
"accent",
"accentSecondary",
"primary",
"success",
"warning",
"danger",
"neutral",
"risk"
],
"type": "string",
"example": "danger"
},
"label": {
"type": "string",
"example": "Option 1"
},
"value": {
"type": "string",
"example": "option_1"
}
},
"description": "A request approval option"
},
"Security_AI_Assistant_API_SelectOptionInterruptResumeValue": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseInterruptResumeValue"
},
{
"required": [
"value",
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"SELECT_OPTION"
],
"type": "string",
"example": "SELECT_OPTION"
},
"value": {
"type": "string",
"description": "The value of the selected option to resume the graph execution with",
"example": "option_1"
}
}
}
],
"description": "A request approval resume schema"
},
"Security_AI_Assistant_API_SelectOptionInterruptValue": {
"allOf": [
{
"$ref": "#/components/schemas/Security_AI_Assistant_API_BaseInterruptValue"
},
{
"required": [
"type",
"description",
"options"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "Description of action required",
"example": "Select one of the options"
},
"options": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptOption"
},
"description": "List of actions to choose from",
"example": [
{
"label": "Option 1"
},
{
"label": "Option 2"
}
]
},
"type": {
"enum": [
"SELECT_OPTION"
],
"type": "string",
"example": "SELECT_OPTION"
}
}
}
],
"description": "Interrupt that requests user to select one of the provided options"
},
"Security_AI_Assistant_API_SortOrder": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The order in which results are sorted.",
"example": "asc"
},
"Security_AI_Assistant_API_TraceData": {
"type": "object",
"properties": {
"traceId": {
"type": "string",
"description": "Could be any string, not necessarily a UUID",
"example": "d9876543-f0a1-2345-6789-abcdef123456"
},
"transactionId": {
"type": "string",
"description": "Could be any string, not necessarily a UUID",
"example": "a1234567-bc89-0def-1234-56789abcdef0"
}
},
"description": "Trace Data"
},
"Security_AI_Assistant_API_User": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "User id.",
"example": "user123"
},
"name": {
"type": "string",
"description": "User name.",
"example": "John Doe"
}
},
"description": "Could be any string, not necessarily a UUID."
},
"Security_AI_Assistant_API_Vector": {
"required": [
"modelId",
"tokens"
],
"type": "object",
"properties": {
"modelId": {
"type": "string",
"description": "ID of the model used to create the embeddings.",
"example": "bert-base-uncased"
},
"tokens": {
"type": "object",
"additionalProperties": {
"type": "number"
},
"description": "Tokens with their corresponding values.",
"example": {
"token1": 0.123,
"token2": 0.456
}
}
},
"description": "Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings."
},
"Security_Attack_discovery_API_AnonymizationFieldResponse": {
"required": [
"id",
"field"
],
"type": "object",
"properties": {
"allowed": {
"type": "boolean",
"description": "Whether this field is allowed to be sent to the model.",
"example": true
},
"anonymized": {
"type": "boolean",
"description": "Whether this field should be anonymized.",
"example": false
},
"createdAt": {
"type": "string",
"description": "Timestamp of when the anonymization field was created.",
"example": "2023-10-31T12:00:00Z"
},
"createdBy": {
"type": "string",
"description": "Username of the person who created the anonymization field.",
"example": "user1"
},
"field": {
"type": "string",
"description": "Name of the anonymization field.",
"example": "url.domain"
},
"id": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"namespace": {
"type": "string",
"description": "Kibana space in which this anonymization field exists.",
"example": "default"
},
"timestamp": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyTimestamp"
},
"updatedAt": {
"type": "string",
"description": "Timestamp of the last update.",
"example": "2023-10-31T12:00:00Z"
},
"updatedBy": {
"type": "string",
"description": "Username of the person who last updated the field.",
"example": "user1"
}
}
},
"Security_Attack_discovery_API_ApiConfig": {
"required": [
"connectorId",
"actionTypeId"
],
"type": "object",
"properties": {
"actionTypeId": {
"type": "string",
"description": "Action type ID",
"example": "actionType456"
},
"connectorId": {
"type": "string",
"description": "Connector ID",
"example": "connector123"
},
"defaultSystemPromptId": {
"type": "string",
"description": "Default system prompt ID",
"example": "systemPrompt001"
},
"model": {
"type": "string",
"description": "Model",
"example": "gpt-4"
},
"provider": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_Provider"
}
}
},
"Security_Attack_discovery_API_AttackDiscoveryApiAlert": {
"required": [
"alert_ids",
"connector_id",
"connector_name",
"details_markdown",
"generation_uuid",
"id",
"summary_markdown",
"timestamp",
"title"
],
"type": "object",
"properties": {
"alert_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "The alert IDs that the attack discovery is based on"
},
"alert_rule_uuid": {
"type": "string",
"description": "The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)"
},
"alert_start": {
"type": "string",
"description": "The optional time the attack discovery alert was created"
},
"alert_updated_at": {
"type": "string",
"description": "The optional time the attack discovery alert was last updated"
},
"alert_updated_by_user_id": {
"type": "string",
"description": "The optional id of the user who last updated the attack discovery alert"
},
"alert_updated_by_user_name": {
"type": "string",
"description": "The optional username of the user who updated the attack discovery alert"
},
"alert_workflow_reason": {
"type": "string",
"description": "The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed"
},
"alert_workflow_status": {
"type": "string",
"description": "The optional kibana.alert.workflow_status of this attack discovery"
},
"alert_workflow_status_updated_at": {
"type": "string",
"description": "The optional time the attack discovery alert workflow status was last updated"
},
"assignees": {
"type": "array",
"items": {
"type": "string"
},
"description": "The optional array of user-IDs who have been assigned the attack"
},
"connector_id": {
"type": "string",
"description": "The ID of the connector that generated the attack discovery"
},
"connector_name": {
"type": "string",
"description": "The (human readable) name of the connector that generated the attack discovery"
},
"details_markdown": {
"type": "string",
"description": "Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data."
},
"entity_summary_markdown": {
"type": "string",
"description": "An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax"
},
"generation_uuid": {
"type": "string",
"description": "The generation ID of the run that created the attack discovery"
},
"id": {
"type": "string",
"description": "The unique ID of the attack discovery"
},
"index": {
"type": "string",
"description": "The concrete Elasticsearch index where this attack discovery is stored"
},
"mitre_attack_tactics": {
"type": "array",
"items": {
"type": "string"
},
"description": "An optional array of MITRE ATT&CK tactic for the attack discovery"
},
"replacements": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_Replacements"
},
"risk_score": {
"type": "integer",
"description": "The optional, (but typically populated after generation) risk score of the alert"
},
"summary_markdown": {
"type": "string",
"description": "A markdown summary of attack discovery, using the same syntax"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The optional array of tags assigned the attack"
},
"timestamp": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyTimestamp"
},
"title": {
"type": "string",
"description": "A title for the attack discovery, in plain text"
},
"user_id": {
"type": "string",
"description": "The optional id of the user who generated the attack discovery"
},
"user_name": {
"type": "string",
"description": "The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)"
},
"users": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_User"
},
"description": "The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery."
}
},
"description": "An attack discovery that's also an alert (Public API with snake_case)"
},
"Security_Attack_discovery_API_AttackDiscoveryApiSchedule": {
"required": [
"id",
"name",
"created_by",
"updated_by",
"created_at",
"updated_at",
"enabled",
"params",
"schedule",
"actions"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction"
},
"description": "The Attack Discovery schedule actions"
},
"created_at": {
"type": "string",
"description": "The date the schedule was created",
"format": "date-time"
},
"created_by": {
"type": "string",
"description": "The name of the user that created the schedule"
},
"enabled": {
"type": "boolean",
"description": "Indicates whether the schedule is enabled"
},
"id": {
"type": "string",
"description": "UUID of Attack Discovery schedule"
},
"last_execution": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution"
},
"name": {
"type": "string",
"description": "The name of the schedule"
},
"params": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams"
},
"schedule": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule"
},
"updated_at": {
"type": "string",
"description": "The date the schedule was updated",
"format": "date-time"
},
"updated_by": {
"type": "string",
"description": "The name of the user that updated the schedule"
}
},
"description": "An Attack Discovery schedule"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction"
},
{
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction"
}
]
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter": {
"type": "object"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency": {
"required": [
"summary",
"notify_when",
"throttle"
],
"type": "object",
"properties": {
"notify_when": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen"
},
"summary": {
"type": "boolean",
"description": "Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert"
},
"throttle": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle"
}
},
"description": "The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals)."
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup": {
"type": "string",
"description": "Groups actions by use cases. Use `default` for alert notifications."
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId": {
"type": "string",
"description": "The connector ID."
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen": {
"enum": [
"onActiveAlert",
"onThrottleInterval",
"onActionGroupChange"
],
"type": "string",
"description": "The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams": {
"type": "object",
"description": "Object containing the allowed connector fields, which varies according to the connector type."
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle": {
"pattern": "^[1-9]\\d*[smhd]$",
"type": "string",
"description": "Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.",
"example": "1h"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps": {
"required": [
"name",
"params",
"schedule"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction"
},
"description": "The Attack Discovery schedule actions"
},
"enabled": {
"type": "boolean",
"description": "Indicates whether the schedule is enabled"
},
"name": {
"type": "string",
"description": "The name of the schedule"
},
"params": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams"
},
"schedule": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule"
}
},
"description": "An Attack Discovery schedule create properties"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution": {
"required": [
"date",
"status",
"last_duration"
],
"type": "object",
"properties": {
"date": {
"type": "string",
"description": "Date of the execution",
"format": "date-time"
},
"duration": {
"type": "number",
"description": "Duration of the execution"
},
"message": {
"type": "string"
},
"status": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus"
}
},
"description": "An Attack Discovery schedule execution information"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus": {
"enum": [
"ok",
"active",
"error",
"unknown",
"warning"
],
"type": "string",
"description": "An Attack Discovery schedule execution status"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction": {
"required": [
"action_type_id",
"group",
"id",
"params"
],
"type": "object",
"properties": {
"action_type_id": {
"type": "string",
"description": "The action type used for sending notifications."
},
"alerts_filter": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter"
},
"frequency": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency"
},
"group": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup"
},
"id": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId"
},
"params": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams"
},
"uuid": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
}
}
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams": {
"required": [
"alerts_index_pattern",
"api_config",
"size"
],
"type": "object",
"properties": {
"alerts_index_pattern": {
"type": "string",
"description": "The index pattern to get alerts from"
},
"api_config": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Attack_discovery_API_ApiConfig"
},
{
"required": [
"name"
],
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the connector"
}
}
}
],
"description": "LLM API configuration."
},
"combined_filter": {
"type": "object"
},
"end": {
"type": "string"
},
"filters": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_Filters"
},
"query": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_Query"
},
"size": {
"type": "number"
},
"start": {
"type": "string"
}
},
"description": "An Attack Discovery schedule params"
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction": {
"required": [
"action_type_id",
"id",
"params"
],
"type": "object",
"properties": {
"action_type_id": {
"type": "string",
"description": "The action type used for sending notifications."
},
"id": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId"
},
"params": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams"
},
"uuid": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
}
}
},
"Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps": {
"required": [
"name",
"params",
"schedule",
"actions"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction"
},
"description": "The Attack Discovery schedule actions"
},
"name": {
"type": "string",
"description": "The name of the schedule"
},
"params": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams"
},
"schedule": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule"
}
},
"description": "An Attack Discovery schedule update properties"
},
"Security_Attack_discovery_API_AttackDiscoveryFindSortField": {
"enum": [
"@timestamp"
],
"type": "string",
"description": "Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values."
},
"Security_Attack_discovery_API_AttackDiscoveryGeneration": {
"required": [
"connector_id",
"discoveries",
"execution_uuid",
"start",
"status"
],
"type": "object",
"properties": {
"alerts_context_count": {
"type": "number",
"description": "The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation"
},
"connector_id": {
"type": "string",
"description": "The connector id (event.dataset) for this generation"
},
"connector_stats": {
"type": "object",
"properties": {
"average_successful_duration_nanoseconds": {
"type": "number",
"description": "The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user"
},
"successful_generations": {
"type": "number",
"description": "The number of successful generations for the same connector id, for the current user"
}
},
"description": "Stats applicable to the connector for this generation"
},
"conversation_id": {
"type": "string",
"description": "Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)"
},
"discoveries": {
"type": "number",
"description": "The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation"
},
"duplicates_dropped_count": {
"type": "integer",
"description": "The number of attack discoveries dropped as duplicates during the persist step"
},
"end": {
"type": "string",
"description": "When generation ended (max event.end)"
},
"error_category": {
"type": "string",
"description": "Structured error category from server classification (optional; absent for successful generations)"
},
"execution_uuid": {
"type": "string",
"description": "The unique identifier (kibana.alert.rule.execution.uuid) for the generation"
},
"failed_workflow_id": {
"type": "string",
"description": "Workflow ID that caused the failure (optional; absent for successful generations)"
},
"generated_count": {
"type": "integer",
"description": "The number of attack discoveries generated before deduplication and hallucination filtering"
},
"hallucinations_filtered_count": {
"type": "integer",
"description": "The number of attack discoveries filtered as hallucinations during the validation step"
},
"loading_message": {
"type": "string",
"description": "Generation loading message (kibana.alert.rule.execution.status)"
},
"persisted_count": {
"type": "integer",
"description": "The number of attack discoveries successfully persisted after deduplication and hallucination filtering"
},
"reason": {
"type": "string",
"description": "Reason for failed generations (event.reason)"
},
"source_metadata": {
"type": [
"null",
"object"
],
"properties": {
"action_execution_uuid": {
"type": "string",
"description": "The action execution UUID from the alerting framework"
},
"rule_id": {
"type": "string",
"description": "The ID of the alerting rule that triggered this generation"
},
"rule_name": {
"type": "string",
"description": "The name of the alerting rule that triggered this generation"
}
},
"description": "Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)"
},
"start": {
"type": "string",
"description": "When generation started (min event.start)"
},
"status": {
"enum": [
"canceled",
"dismissed",
"failed",
"started",
"succeeded"
],
"type": "string",
"description": "The status of the attack discovery generation"
},
"step_event_actions": {
"type": "array",
"items": {
"type": "string"
},
"description": "Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status."
},
"workflow_executions": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionsTracking"
},
"workflow_id": {
"type": "string",
"description": "The workflow definition ID for deep linking"
},
"workflow_run_id": {
"type": "string",
"description": "The workflow execution ID for monitoring"
}
}
},
"Security_Attack_discovery_API_AttackDiscoveryGenerationConfig": {
"required": [
"apiConfig",
"alertsIndexPattern",
"anonymizationFields",
"size",
"subAction"
],
"type": "object",
"properties": {
"alertsIndexPattern": {
"type": "string",
"description": "The (space specific) index pattern that contains the alerts to use as\ncontext for the attack discovery.\nExample: .alerts-security.alerts-default\n"
},
"anonymizationFields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_AnonymizationFieldResponse"
},
"description": "The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the `/api/security_ai_assistant/anonymization_fields/_find` API (for a specific Kibana space) to provide this value."
},
"apiConfig": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_ApiConfig"
},
"connectorName": {
"type": "string"
},
"end": {
"type": "string"
},
"filter": {
"type": "object",
"description": "An Elasticsearch-style query DSL object used to filter alerts. For example:\n```json {\n \"filter\": {\n \"bool\": {\n \"must\": [],\n \"filter\": [\n {\n \"bool\": {\n \"should\": [\n {\n \"term\": {\n \"user.name\": { \"value\": \"james\" }\n }\n }\n ],\n \"minimum_should_match\": 1\n }\n }\n ],\n \"should\": [],\n \"must_not\": []\n }\n }\n} ```"
},
"model": {
"type": "string"
},
"replacements": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_Replacements"
},
"size": {
"type": "number"
},
"start": {
"type": "string"
},
"subAction": {
"enum": [
"invokeAI",
"invokeStream"
],
"type": "string"
}
}
},
"Security_Attack_discovery_API_AttackDiscoveryGenericError": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error type",
"example": "Bad Request"
},
"message": {
"type": "string",
"description": "Human-readable error message describing what went wrong",
"example": "Invalid request parameters."
},
"status_code": {
"type": "number",
"description": "HTTP status code",
"example": 400
}
},
"description": "Error response for Attack discovery schedule operations when the request is rejected. Uses `status_code` (snake_case), `error`, and `message` to match the implementation."
},
"Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesError": {
"required": [
"message",
"rule"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "The error message returned for the failed schedule."
},
"rule": {
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"name": {
"type": "string",
"description": "The name of the failed schedule."
}
}
},
"status": {
"type": "number",
"description": "Optional HTTP status associated with the failed schedule operation."
}
}
},
"Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody": {
"required": [
"ids"
],
"type": "object",
"properties": {
"ids": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"description": "The unique identifiers of the Attack Discovery schedules to update."
}
}
},
"Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse": {
"required": [
"ids",
"errors",
"total"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesError"
}
},
"ids": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_NonEmptyString"
},
"description": "The unique identifiers of the schedules successfully affected by the bulk action."
},
"total": {
"type": "number",
"description": "The total number of schedules matched by the bulk action."
}
}
},
"Security_Attack_discovery_API_Filters": {
"type": "array",
"items": { },
"description": "The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array."
},
"Security_Attack_discovery_API_IntervalApiSchedule": {
"required": [
"interval"
],
"type": "object",
"properties": {
"interval": {
"type": "string",
"description": "The schedule interval"
}
}
},
"Security_Attack_discovery_API_NonEmptyString": {
"minLength": 1,
"type": "string",
"description": "A string that does not contain only whitespace characters.",
"format": "nonempty",
"example": "I am a string"
},
"Security_Attack_discovery_API_NonEmptyTimestamp": {
"minLength": 1,
"type": "string",
"description": "A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.",
"format": "nonempty",
"example": "2023-10-31T12:00:00Z"
},
"Security_Attack_discovery_API_Provider": {
"enum": [
"OpenAI",
"Azure OpenAI",
"Other"
],
"type": "string",
"description": "Provider",
"example": "OpenAI"
},
"Security_Attack_discovery_API_Query": {
"required": [
"query",
"language"
],
"type": "object",
"properties": {
"language": {
"type": "string"
},
"query": {
"type": [
"string",
"object"
]
}
},
"description": "An query condition to filter alerts"
},
"Security_Attack_discovery_API_Replacements": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Replacements object used to anonymize/deanonymize messages"
},
"Security_Attack_discovery_API_SortOrder": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "The order in which results are sorted.",
"example": "asc"
},
"Security_Attack_discovery_API_User": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "User id.",
"example": "user123"
},
"name": {
"type": "string",
"description": "User name.",
"example": "John Doe"
}
},
"description": "Could be any string, not necessarily a UUID."
},
"Security_Attack_discovery_API_WorkflowExecutionReference": {
"required": [
"workflowId",
"workflowRunId"
],
"type": "object",
"properties": {
"workflowId": {
"type": "string",
"description": "The workflow definition ID"
},
"workflowName": {
"type": "string",
"description": "The human-readable workflow name (optional; used by the UI to display a label)"
},
"workflowRunId": {
"type": "string",
"description": "The workflow execution ID"
}
}
},
"Security_Attack_discovery_API_WorkflowExecutionsTracking": {
"type": "object",
"properties": {
"alertRetrieval": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference"
},
"description": "Alert retrieval workflow executions (one per workflow invoked)"
},
"gate": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference"
},
"description": "Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers"
},
"generation": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference"
},
"validation": {
"$ref": "#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference"
}
},
"description": "Workflow execution tracking for manual orchestration"
},
"Security_Detections_API_AlertAssignees": {
"required": [
"add",
"remove"
],
"type": "object",
"properties": {
"add": {
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "A list of user profile `uid`s to assign. Users need to activate their user profile by logging into Kibana at least once.",
"format": "nonempty"
}
},
"remove": {
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "A list of user profile `uid`s to unassign. Users need to activate their user profile by logging into Kibana at least once.",
"format": "nonempty"
}
}
}
},
"Security_Detections_API_AlertIds": {
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"format": "nonempty"
},
"description": "A list of alerts `id`s."
},
"Security_Detections_API_AlertsIndex": {
"type": "string",
"description": "(deprecated) Has no effect.",
"deprecated": true
},
"Security_Detections_API_AlertsIndexMigrationError": {
"required": [
"index",
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"message",
"status_code"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "string"
}
}
},
"index": {
"type": "string"
}
}
},
"Security_Detections_API_AlertsIndexMigrationSuccess": {
"required": [
"index",
"migration_id",
"migration_index"
],
"type": "object",
"properties": {
"index": {
"type": "string"
},
"migration_id": {
"type": "string"
},
"migration_index": {
"type": "string"
}
}
},
"Security_Detections_API_AlertsIndexNamespace": {
"type": "string",
"description": "Has no effect."
},
"Security_Detections_API_AlertsReindexOptions": {
"type": "object",
"properties": {
"requests_per_second": {
"minimum": 1,
"type": "integer",
"description": "The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API."
},
"size": {
"minimum": 1,
"type": "integer",
"description": "Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API."
},
"slices": {
"minimum": 1,
"type": "integer",
"description": "The number of subtasks for the migration task. Corresponds to slices on the Reindex API."
}
}
},
"Security_Detections_API_AlertsSort": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_AlertsSortCombinations"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsSortCombinations"
}
}
]
},
"Security_Detections_API_AlertsSortCombinations": {
"type": [
"string",
"object"
]
},
"Security_Detections_API_AlertStatusExceptClosed": {
"enum": [
"open",
"acknowledged",
"in-progress"
],
"type": "string",
"description": "The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`."
},
"Security_Detections_API_AlertSuppression": {
"required": [
"group_by"
],
"type": "object",
"properties": {
"duration": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionDuration"
},
"group_by": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionGroupBy"
},
"missing_fields_strategy": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionMissingFieldsStrategy"
}
},
"description": "Defines alert suppression configuration."
},
"Security_Detections_API_AlertSuppressionDuration": {
"required": [
"value",
"unit"
],
"type": "object",
"properties": {
"unit": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionDurationUnit"
},
"value": {
"minimum": 1,
"type": "integer"
}
}
},
"Security_Detections_API_AlertSuppressionDurationUnit": {
"enum": [
"s",
"m",
"h"
],
"type": "string",
"description": "Time unit"
},
"Security_Detections_API_AlertSuppressionGroupBy": {
"maxItems": 3,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
},
"Security_Detections_API_AlertSuppressionMissingFieldsStrategy": {
"enum": [
"doNotSuppress",
"suppress"
],
"type": "string",
"description": "Describes how alerts will be generated for documents with missing suppress by fields:\ndoNotSuppress - per each document a separate alert will be created\nsuppress - only alert will be created per suppress by bucket"
},
"Security_Detections_API_AlertTag": {
"minLength": 1,
"type": "string",
"description": "Use alert tags to organize related alerts into categories that you can filter and group.",
"format": "nonempty"
},
"Security_Detections_API_AlertTags": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_AlertTag"
},
"description": "List of keywords to organize related alerts into categories that you can filter and group."
},
"Security_Detections_API_AlertVersion": {
"required": [
"version",
"count"
],
"type": "object",
"properties": {
"count": {
"type": "integer"
},
"version": {
"type": "integer"
}
}
},
"Security_Detections_API_AnomalyThreshold": {
"minimum": 0,
"type": "integer",
"description": "Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100."
},
"Security_Detections_API_BuildingBlockType": {
"type": "string",
"description": "Determines if the rule acts as a building block. If yes, the value must be `default`.\nBy default, building-block alerts are not displayed in the UI. These rules are used as a foundation for other rules that do generate alerts.\nFor more information, refer to [About building block rules](https://www.elastic.co/docs/solutions/security/detect-and-alert/about-building-block-rules).\n"
},
"Security_Detections_API_BulkActionEditPayload": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadTags"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadIndexPatterns"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadInvestigationFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadTimeline"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadRuleActions"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadSchedule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadAlertSuppression"
}
]
},
"Security_Detections_API_BulkActionEditPayloadAlertSuppression": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppression"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression"
}
]
},
"Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression": {
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"delete_alert_suppression"
],
"type": "string"
}
}
},
"Security_Detections_API_BulkActionEditPayloadIndexPatterns": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"overwrite_data_views": {
"type": "boolean",
"description": "Resets the data view for the rule."
},
"type": {
"enum": [
"add_index_patterns",
"delete_index_patterns",
"set_index_patterns"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
}
},
"description": "Edits index patterns of rulesClient.\n\n- `add_index_patterns` adds index patterns to rules. If an index pattern already exists for a rule, no changes are made.\n- `delete_index_patterns` removes index patterns from rules. If an index pattern does not exist for a rule, no changes are made.\n- `set_index_patterns` sets index patterns for rules, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.\n"
},
"Security_Detections_API_BulkActionEditPayloadInvestigationFields": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"add_investigation_fields",
"delete_investigation_fields",
"set_investigation_fields"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
}
},
"description": "Edits investigation fields of rules.\n\n- `add_investigation_fields` adds investigation fields to rules. If an investigation field already exists for a rule, no changes are made.\n- `delete_investigation_fields` removes investigation fields from rules. If an investigation field does not exist for a rule, no changes are made.\n- `set_investigation_fields` sets investigation fields for rules. If the set of investigation fields is the same as the existing investigation fields, no changes are made.\n"
},
"Security_Detections_API_BulkActionEditPayloadRuleActions": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"add_rule_actions",
"set_rule_actions"
],
"type": "string"
},
"value": {
"required": [
"actions"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_NormalizedRuleAction"
}
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_ThrottleForBulkActions"
}
}
}
},
"description": "Edits rule actions of rules.\n\n- `add_rule_actions` adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exists for a rule, it will be added again with a new unique ID.\n- `set_rule_actions` sets rule actions for rules. This action is non-idempotent, meaning that even if the same set of rule actions already exists for a rule, it will be set again and the actions will receive new unique IDs.\n"
},
"Security_Detections_API_BulkActionEditPayloadSchedule": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"set_schedule"
],
"type": "string"
},
"value": {
"required": [
"interval",
"lookback"
],
"type": "object",
"properties": {
"interval": {
"pattern": "^[1-9]\\d*[smh]$",
"type": "string",
"description": "Interval in which the rule runs. For example, `\"1h\"` means the rule runs every hour.",
"example": "1h"
},
"lookback": {
"pattern": "^[1-9]\\d*[smh]$",
"type": "string",
"description": "Lookback time for the rules.\n\nAdditional look-back time that the rule analyzes. For example, \"10m\" means the rule analyzes the last 10 minutes of data in addition to the frequency interval.\n",
"example": "1h"
}
}
}
},
"description": "Overwrites schedule of rules. \n\n- `set_schedule` sets a schedule for rules. If the same schedule already exists for a rule, no changes are made.\n\nBoth `interval` and `lookback` have a format of \"{integer}{time_unit}\", where accepted time units are `s` for seconds, `m` for minutes, and `h` for hours. The integer must be positive and larger than 0. Examples: \"45s\", \"30m\", \"6h\"\n"
},
"Security_Detections_API_BulkActionEditPayloadSetAlertSuppression": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"set_alert_suppression"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
}
}
},
"Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"set_alert_suppression_for_threshold"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_ThresholdAlertSuppression"
}
}
},
"Security_Detections_API_BulkActionEditPayloadTags": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"add_tags",
"delete_tags",
"set_tags"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
}
},
"description": "Edits tags of rules.\n\n- `add_tags` adds tags to rules. If a tag already exists for a rule, no changes are made.\n- `delete_tags` removes tags from rules. If a tag does not exist for a rule, no changes are made.\n- `set_tags` sets tags for rules, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.\n"
},
"Security_Detections_API_BulkActionEditPayloadTimeline": {
"required": [
"type",
"value"
],
"type": "object",
"properties": {
"type": {
"enum": [
"set_timeline"
],
"type": "string"
},
"value": {
"required": [
"timeline_id",
"timeline_title"
],
"type": "object",
"properties": {
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
}
}
}
},
"description": "Edits timeline of rules.\n\n- `set_timeline` sets a timeline for rules. If the same timeline already exists for a rule, no changes are made.\n"
},
"Security_Detections_API_BulkActionsDryRunErrCode": {
"enum": [
"IMMUTABLE",
"PREBUILT_CUSTOMIZATION_LICENSE",
"MACHINE_LEARNING_AUTH",
"MACHINE_LEARNING_INDEX_PATTERN",
"ESQL_INDEX_PATTERN",
"MANUAL_RULE_RUN_FEATURE",
"MANUAL_RULE_RUN_DISABLED_RULE",
"THRESHOLD_RULE_TYPE_IN_SUPPRESSION",
"UNSUPPORTED_RULE_IN_SUPPRESSION_FOR_THRESHOLD",
"RULE_FILL_GAPS_DISABLED_RULE",
"USER_INSUFFICIENT_RULE_PRIVILEGES"
],
"type": "string"
},
"Security_Detections_API_BulkActionSkipResult": {
"required": [
"id",
"skip_reason"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"skip_reason": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_BulkEditSkipReason"
},
{
"$ref": "#/components/schemas/Security_Detections_API_BulkGapsFillingSkipReason"
}
]
}
}
},
"Security_Detections_API_BulkDeleteRules": {
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"delete"
],
"type": "string"
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkDisableRules": {
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"disable"
],
"type": "string"
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkDuplicateRules": {
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"duplicate"
],
"type": "string"
},
"duplicate": {
"required": [
"include_exceptions",
"include_expired_exceptions"
],
"type": "object",
"properties": {
"include_exceptions": {
"type": "boolean",
"description": "Whether to copy exceptions from the original rule"
},
"include_expired_exceptions": {
"type": "boolean",
"description": "Whether to copy expired exceptions from the original rule"
}
},
"description": "Duplicate object that describes applying an update action."
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkEditActionResponse": {
"required": [
"attributes"
],
"type": "object",
"properties": {
"attributes": {
"required": [
"results",
"summary"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_NormalizedRuleError"
}
},
"results": {
"$ref": "#/components/schemas/Security_Detections_API_BulkEditActionResults"
},
"summary": {
"$ref": "#/components/schemas/Security_Detections_API_BulkEditActionSummary"
}
}
},
"message": {
"type": "string"
},
"rules_count": {
"type": "integer"
},
"status_code": {
"type": "integer"
},
"success": {
"type": "boolean"
}
}
},
"Security_Detections_API_BulkEditActionResults": {
"required": [
"updated",
"created",
"deleted",
"skipped"
],
"type": "object",
"properties": {
"created": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
}
},
"deleted": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
}
},
"skipped": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_BulkActionSkipResult"
}
},
"updated": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleResponse"
}
}
}
},
"Security_Detections_API_BulkEditActionSummary": {
"required": [
"failed",
"skipped",
"succeeded",
"total"
],
"type": "object",
"properties": {
"failed": {
"type": "integer"
},
"skipped": {
"type": "integer"
},
"succeeded": {
"type": "integer"
},
"total": {
"type": "integer"
}
},
"description": "A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the `edit` action is used to add a tag to a rule that already has that tag, or to delete an index pattern that is not specified in a rule. Objects returned in `attributes.results.skipped` will only include rules' `id`, `name`, and `skip_reason`."
},
"Security_Detections_API_BulkEditRules": {
"required": [
"action",
"edit"
],
"type": "object",
"properties": {
"action": {
"enum": [
"edit"
],
"type": "string"
},
"edit": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayload"
},
"description": "Array of objects containing the edit operations"
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkEditSkipReason": {
"enum": [
"RULE_NOT_MODIFIED"
],
"type": "string"
},
"Security_Detections_API_BulkEnableRules": {
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"enable"
],
"type": "string"
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkExportActionResponse": {
"type": "string"
},
"Security_Detections_API_BulkExportRules": {
"required": [
"action"
],
"type": "object",
"properties": {
"action": {
"enum": [
"export"
],
"type": "string"
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkGapsFillingSkipReason": {
"enum": [
"NO_GAPS_TO_FILL"
],
"type": "string"
},
"Security_Detections_API_BulkManualRuleFillGaps": {
"required": [
"action",
"fill_gaps"
],
"type": "object",
"properties": {
"action": {
"enum": [
"fill_gaps"
],
"type": "string"
},
"fill_gaps": {
"required": [
"start_date",
"end_date"
],
"type": "object",
"properties": {
"end_date": {
"type": "string",
"description": "End date of the manual gap fill"
},
"start_date": {
"type": "string",
"description": "Start date of the manual gap fill"
}
},
"description": "Object that describes applying a manual gap fill action for the specified time range."
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
}
}
},
"Security_Detections_API_BulkManualRuleRun": {
"required": [
"action",
"run"
],
"type": "object",
"properties": {
"action": {
"enum": [
"run"
],
"type": "string"
},
"gap_auto_fill_scheduler_id": {
"type": "string",
"description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
},
"gap_fill_statuses": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_GapFillStatus"
},
"description": "Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*)."
},
"gaps_range_end": {
"type": "string",
"description": "Gaps range end, valid only when query is provided"
},
"gaps_range_start": {
"type": "string",
"description": "Gaps range start, valid only when query is provided"
},
"ids": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
},
"query": {
"type": "string",
"description": "Query to filter rules."
},
"run": {
"required": [
"start_date",
"end_date"
],
"type": "object",
"properties": {
"end_date": {
"type": "string",
"description": "End date of the manual rule run"
},
"start_date": {
"type": "string",
"description": "Start date of the manual rule run"
}
},
"description": "Object that describes applying a manual rule run action."
}
}
},
"Security_Detections_API_CloseAlertsByIds": {
"required": [
"signal_ids",
"status"
],
"type": "object",
"properties": {
"reason": {
"$ref": "#/components/schemas/Security_Detections_API_Reason"
},
"signal_ids": {
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"format": "nonempty"
},
"description": "List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts."
},
"status": {
"enum": [
"closed"
],
"type": "string"
}
}
},
"Security_Detections_API_CloseAlertsByQuery": {
"required": [
"query",
"status"
],
"type": "object",
"properties": {
"conflicts": {
"enum": [
"abort",
"proceed"
],
"type": "string",
"default": "abort"
},
"query": {
"type": "object"
},
"reason": {
"$ref": "#/components/schemas/Security_Detections_API_Reason"
},
"runtime_fields": {
"maxProperties": 100,
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldType"
},
"description": "Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected."
},
"runtime_mappings": {
"maxProperties": 100,
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldMapping"
},
"description": "Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected."
},
"status": {
"enum": [
"closed"
],
"type": "string"
}
}
},
"Security_Detections_API_CloseAttacksByIds": {
"required": [
"ids",
"status"
],
"type": "object",
"properties": {
"ids": {
"$ref": "#/components/schemas/Security_Detections_API_AlertIds"
},
"reason": {
"$ref": "#/components/schemas/Security_Detections_API_Reason"
},
"status": {
"enum": [
"closed"
],
"type": "string"
},
"update_related_alerts": {
"$ref": "#/components/schemas/Security_Detections_API_UpdateRelatedAlerts"
}
}
},
"Security_Detections_API_ConcurrentSearches": {
"minimum": 1,
"type": "integer"
},
"Security_Detections_API_DataViewId": {
"type": "string"
},
"Security_Detections_API_DefaultParams": {
"required": [
"command"
],
"type": "object",
"properties": {
"command": {
"enum": [
"isolate"
],
"type": "string"
},
"comment": {
"maxLength": 30000,
"type": "string"
}
}
},
"Security_Detections_API_EcsMapping": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"field": {
"maxLength": 2000,
"type": "string"
},
"value": {
"oneOf": [
{
"maxLength": 30000,
"type": "string"
},
{
"type": "array",
"items": {
"maxLength": 30000,
"type": "string"
}
}
]
}
}
},
"description": "Map Osquery results columns or static values to Elastic Common Schema (ECS) fields. Example: \"ecs_mapping\": {\"process.pid\": {\"field\": \"pid\"}}"
},
"Security_Detections_API_EndpointResponseAction": {
"required": [
"action_type_id",
"params"
],
"type": "object",
"properties": {
"action_type_id": {
"enum": [
".endpoint"
],
"type": "string"
},
"params": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_DefaultParams"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ProcessesParams"
},
{
"$ref": "#/components/schemas/Security_Detections_API_RunscriptParams"
}
]
}
}
},
"Security_Detections_API_EqlOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
},
"data_view_id": {
"$ref": "#/components/schemas/Security_Detections_API_DataViewId"
},
"event_category_override": {
"$ref": "#/components/schemas/Security_Detections_API_EventCategoryOverride"
},
"filters": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray"
},
"index": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
},
"tiebreaker_field": {
"$ref": "#/components/schemas/Security_Detections_API_TiebreakerField"
},
"timestamp_field": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampField"
}
}
},
"Security_Detections_API_EqlQueryLanguage": {
"enum": [
"eql"
],
"type": "string"
},
"Security_Detections_API_EqlRequiredFields": {
"required": [
"type",
"query",
"language"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_EqlQueryLanguage"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"type": {
"enum": [
"eql"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_EqlRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRuleResponseFields"
}
]
},
"Security_Detections_API_EqlRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlOptionalFields"
}
]
},
"Security_Detections_API_EqlRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateFields"
}
]
},
"Security_Detections_API_EqlRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_EqlQueryLanguage"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"type": {
"enum": [
"eql"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlOptionalFields"
}
]
},
"Security_Detections_API_EqlRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRulePatchFields"
}
]
},
"Security_Detections_API_EqlRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlOptionalFields"
}
]
},
"Security_Detections_API_EqlRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateFields"
}
]
},
"Security_Detections_API_ErrorSchema": {
"required": [
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"minimum": 400,
"type": "integer"
}
}
},
"id": {
"type": "string"
},
"item_id": {
"minLength": 1,
"type": "string"
},
"list_id": {
"minLength": 1,
"type": "string"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
}
},
"additionalProperties": false
},
"Security_Detections_API_EsqlQueryLanguage": {
"enum": [
"esql"
],
"type": "string"
},
"Security_Detections_API_EsqlRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleResponseFields"
}
]
},
"Security_Detections_API_EsqlRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields"
}
]
},
"Security_Detections_API_EsqlRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateFields"
}
]
},
"Security_Detections_API_EsqlRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
}
}
},
"Security_Detections_API_EsqlRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"language": {
"$ref": "#/components/schemas/Security_Detections_API_EsqlQueryLanguage"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"type": {
"enum": [
"esql"
],
"type": "string",
"description": "Rule type"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields"
}
]
},
"Security_Detections_API_EsqlRuleRequiredFields": {
"required": [
"type",
"language",
"query"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_EsqlQueryLanguage"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"type": {
"enum": [
"esql"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_EsqlRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields"
}
]
},
"Security_Detections_API_EsqlRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateFields"
}
]
},
"Security_Detections_API_EventCategoryOverride": {
"type": "string"
},
"Security_Detections_API_ExceptionListType": {
"enum": [
"detection",
"rule_default",
"endpoint",
"endpoint_trusted_apps",
"endpoint_trusted_devices",
"endpoint_events",
"endpoint_host_isolation_exceptions",
"endpoint_blocklists",
"endpoint_custom_yara_signatures"
],
"type": "string",
"description": "The exception type"
},
"Security_Detections_API_ExternalRuleCustomizedFields": {
"type": "array",
"items": {
"required": [
"field_name"
],
"type": "object",
"properties": {
"field_name": {
"type": "string",
"description": "Name of a user-modified field in the rule object."
}
}
},
"description": "An array of customized field names — that is, fields that the user has modified from their base value. Defaults to an empty array."
},
"Security_Detections_API_ExternalRuleHasBaseVersion": {
"type": "boolean",
"description": "Determines whether an external/prebuilt rule has its original, unmodified version present when the calculation of its customization status is performed (`rule_source.is_customized` and `rule_source.customized_fields`)."
},
"Security_Detections_API_ExternalRuleSource": {
"required": [
"type",
"is_customized",
"has_base_version",
"customized_fields"
],
"type": "object",
"properties": {
"customized_fields": {
"$ref": "#/components/schemas/Security_Detections_API_ExternalRuleCustomizedFields"
},
"has_base_version": {
"$ref": "#/components/schemas/Security_Detections_API_ExternalRuleHasBaseVersion"
},
"is_customized": {
"$ref": "#/components/schemas/Security_Detections_API_IsExternalRuleCustomized"
},
"type": {
"enum": [
"external"
],
"type": "string"
}
},
"description": "Type of rule source for externally sourced rules, i.e. rules that have an external source, such as the Elastic Prebuilt rules repo."
},
"Security_Detections_API_FindRulesSortField": {
"enum": [
"created_at",
"createdAt",
"enabled",
"execution_summary.last_execution.date",
"execution_summary.last_execution.metrics.execution_gap_duration_s",
"execution_summary.last_execution.metrics.total_indexing_duration_ms",
"execution_summary.last_execution.metrics.total_search_duration_ms",
"execution_summary.last_execution.status",
"name",
"risk_score",
"riskScore",
"severity",
"updated_at",
"updatedAt"
],
"type": "string"
},
"Security_Detections_API_GapFillStatus": {
"enum": [
"unfilled",
"in_progress",
"filled",
"error"
],
"type": "string"
},
"Security_Detections_API_HistoryWindowStart": {
"minLength": 1,
"type": "string",
"description": "Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.",
"format": "nonempty"
},
"Security_Detections_API_IndexMigrationStatus": {
"required": [
"index",
"version",
"signal_versions",
"migrations",
"is_outdated"
],
"type": "object",
"properties": {
"index": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"is_outdated": {
"type": "boolean"
},
"migrations": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_MigrationStatus"
}
},
"signal_versions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_AlertVersion"
}
},
"version": {
"type": "integer"
}
}
},
"Security_Detections_API_IndexPatternArray": {
"type": "array",
"items": {
"type": "string"
},
"description": "Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanced Settings → `securitySolution:defaultIndex`).\n> info\n> This field is not supported for ES|QL rules.\n"
},
"Security_Detections_API_InternalRuleSource": {
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"internal"
],
"type": "string"
}
},
"description": "Type of rule source for internally sourced rules, i.e. created within the Kibana apps."
},
"Security_Detections_API_InvestigationFields": {
"required": [
"field_names"
],
"type": "object",
"properties": {
"field_names": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
}
},
"description": "Schema for fields relating to investigation fields. These are user defined fields we use to highlight\nin various features in the UI such as alert details flyout and exceptions auto-population from alert.\n"
},
"Security_Detections_API_InvestigationGuide": {
"type": "string",
"description": "Notes to help investigate alerts produced by the rule."
},
"Security_Detections_API_IsExternalRuleCustomized": {
"type": "boolean",
"description": "Determines whether an external/prebuilt rule has been customized by the user (i.e. any of its fields have been modified and diverged from the base value)."
},
"Security_Detections_API_IsRuleEnabled": {
"type": "boolean",
"description": "Determines whether the rule is enabled. Defaults to true."
},
"Security_Detections_API_IsRuleImmutable": {
"type": "boolean",
"description": "This field determines whether the rule is a prebuilt Elastic rule. It will be replaced with the `rule_source` field.",
"deprecated": true
},
"Security_Detections_API_ItemsPerSearch": {
"minimum": 1,
"type": "integer"
},
"Security_Detections_API_KillProcessParams": {
"required": [
"command",
"config"
],
"type": "object",
"properties": {
"command": {
"enum": [
"kill-process"
],
"type": "string",
"description": "To run an endpoint response action, specify a value for the command field. Example: \"command\": \"kill-process\""
},
"comment": {
"maxLength": 30000,
"type": "string",
"description": "Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: \"comment\": \"Check processes\""
},
"config": {
"required": [
"field"
],
"type": "object",
"properties": {
"field": {
"maxLength": 2000,
"type": "string",
"description": "Field to use instead of `process.pid`"
},
"kill_descendants": {
"type": "boolean",
"description": "Whether to also terminate the descendant processes of the targeted process.",
"x-state": "Added in 9.6.0"
},
"overwrite": {
"type": "boolean",
"description": "Whether to overwrite field with `process.pid`",
"default": true
}
}
}
}
},
"Security_Detections_API_KqlQueryLanguage": {
"enum": [
"kuery",
"lucene"
],
"type": "string"
},
"Security_Detections_API_MachineLearningJobId": {
"oneOf": [
{
"type": "string"
},
{
"minItems": 1,
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Machine learning job ID(s) the rule monitors for anomaly scores."
},
"Security_Detections_API_MachineLearningRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleResponseFields"
}
]
},
"Security_Detections_API_MachineLearningRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields"
}
]
},
"Security_Detections_API_MachineLearningRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields"
}
]
},
"Security_Detections_API_MachineLearningRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
}
}
},
"Security_Detections_API_MachineLearningRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"anomaly_threshold": {
"$ref": "#/components/schemas/Security_Detections_API_AnomalyThreshold"
},
"machine_learning_job_id": {
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningJobId"
},
"type": {
"enum": [
"machine_learning"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields"
}
]
},
"Security_Detections_API_MachineLearningRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRulePatchFields"
}
]
},
"Security_Detections_API_MachineLearningRuleRequiredFields": {
"required": [
"type",
"machine_learning_job_id",
"anomaly_threshold"
],
"type": "object",
"properties": {
"anomaly_threshold": {
"$ref": "#/components/schemas/Security_Detections_API_AnomalyThreshold"
},
"machine_learning_job_id": {
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningJobId"
},
"type": {
"enum": [
"machine_learning"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_MachineLearningRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields"
}
]
},
"Security_Detections_API_MachineLearningRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields"
}
]
},
"Security_Detections_API_MaxSignals": {
"minimum": 1,
"type": "integer",
"description": "Maximum number of alerts the rule can create during a single run (the rule’s Max alerts per run [advanced setting](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#rule-ui-advanced-params) value). Defaults to `100`.\n> info\n> This setting can be superseded by the [Kibana configuration setting](https://www.elastic.co/docs/reference/kibana/configuration-reference/alerting-settings) `xpack.alerting.rules.run.alerts.max`, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, the rule can generate no more than 1000 alerts even if `max_signals` is set higher.\n"
},
"Security_Detections_API_MigrationCleanupResult": {
"required": [
"id",
"destinationIndex",
"status",
"sourceIndex",
"version",
"updated"
],
"type": "object",
"properties": {
"destinationIndex": {
"type": "string"
},
"error": {
"required": [
"message",
"status_code"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"id": {
"type": "string"
},
"sourceIndex": {
"type": "string"
},
"status": {
"enum": [
"success",
"failure",
"pending"
],
"type": "string"
},
"updated": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "string"
}
}
},
"Security_Detections_API_MigrationFinalizationResult": {
"required": [
"id",
"completed",
"destinationIndex",
"status",
"sourceIndex",
"version",
"updated"
],
"type": "object",
"properties": {
"completed": {
"type": "boolean"
},
"destinationIndex": {
"type": "string"
},
"error": {
"required": [
"message",
"status_code"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"id": {
"type": "string"
},
"sourceIndex": {
"type": "string"
},
"status": {
"enum": [
"success",
"failure",
"pending"
],
"type": "string"
},
"updated": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "string"
}
}
},
"Security_Detections_API_MigrationStatus": {
"required": [
"id",
"status",
"version",
"updated"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"status": {
"enum": [
"success",
"failure",
"pending"
],
"type": "string"
},
"updated": {
"type": "string",
"format": "date-time"
},
"version": {
"type": "integer"
}
}
},
"Security_Detections_API_NewTermsFields": {
"maxItems": 3,
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Fields to monitor for new values."
},
"Security_Detections_API_NewTermsRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleResponseFields"
}
]
},
"Security_Detections_API_NewTermsRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields"
}
]
},
"Security_Detections_API_NewTermsRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields"
}
]
},
"Security_Detections_API_NewTermsRuleDefaultableFields": {
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
},
"Security_Detections_API_NewTermsRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
},
"data_view_id": {
"$ref": "#/components/schemas/Security_Detections_API_DataViewId"
},
"filters": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray"
},
"index": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
}
}
},
"Security_Detections_API_NewTermsRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"history_window_start": {
"$ref": "#/components/schemas/Security_Detections_API_HistoryWindowStart"
},
"new_terms_fields": {
"$ref": "#/components/schemas/Security_Detections_API_NewTermsFields"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"type": {
"enum": [
"new_terms"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields"
}
]
},
"Security_Detections_API_NewTermsRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRulePatchFields"
}
]
},
"Security_Detections_API_NewTermsRuleRequiredFields": {
"required": [
"type",
"query",
"new_terms_fields",
"history_window_start"
],
"type": "object",
"properties": {
"history_window_start": {
"$ref": "#/components/schemas/Security_Detections_API_HistoryWindowStart"
},
"new_terms_fields": {
"$ref": "#/components/schemas/Security_Detections_API_NewTermsFields"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"type": {
"enum": [
"new_terms"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_NewTermsRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields"
},
{
"required": [
"language"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
}
]
},
"Security_Detections_API_NewTermsRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields"
}
]
},
"Security_Detections_API_NonEmptyString": {
"minLength": 1,
"type": "string",
"description": "A string that does not contain only whitespace characters",
"format": "nonempty"
},
"Security_Detections_API_NormalizedRuleAction": {
"required": [
"id",
"params"
],
"type": "object",
"properties": {
"alerts_filter": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionAlertsFilter"
},
"frequency": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionFrequency"
},
"group": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionGroup"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionId"
},
"params": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionParams"
}
},
"additionalProperties": false
},
"Security_Detections_API_NormalizedRuleError": {
"required": [
"message",
"status_code",
"rules"
],
"type": "object",
"properties": {
"err_code": {
"$ref": "#/components/schemas/Security_Detections_API_BulkActionsDryRunErrCode"
},
"message": {
"type": "string"
},
"rules": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDetailsInError"
}
},
"status_code": {
"type": "integer"
}
}
},
"Security_Detections_API_OsqueryParams": {
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_EcsMapping"
},
"pack_id": {
"maxLength": 256,
"type": "string",
"description": "To specify a query pack, use the packId field. Example: \"packId\": \"processes_elastic\""
},
"queries": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_OsqueryQuery"
}
},
"query": {
"maxLength": 30000,
"type": "string",
"description": "To run a single query, use the query field and enter a SQL query. Example: \"query\": \"SELECT * FROM processes;\""
},
"saved_query_id": {
"maxLength": 256,
"type": "string",
"description": "To run a saved query, use the saved_query_id field and specify the saved query ID. Example: \"saved_query_id\": \"processes_elastic\""
},
"timeout": {
"type": "number",
"description": "A timeout period, in seconds, after which the query will stop running. Overwriting the default timeout allows you to support queries that require more time to complete. The default and minimum supported value is 60. The maximum supported value is 900. Example: \"timeout\": 120."
}
}
},
"Security_Detections_API_OsqueryQuery": {
"required": [
"id",
"query"
],
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_EcsMapping"
},
"id": {
"maxLength": 256,
"type": "string",
"description": "Query ID"
},
"platform": {
"maxLength": 256,
"type": "string"
},
"query": {
"maxLength": 30000,
"type": "string",
"description": "Query to run"
},
"removed": {
"type": "boolean"
},
"snapshot": {
"type": "boolean"
},
"version": {
"maxLength": 256,
"type": "string",
"description": "Query version"
}
}
},
"Security_Detections_API_OsqueryResponseAction": {
"required": [
"action_type_id",
"params"
],
"type": "object",
"properties": {
"action_type_id": {
"enum": [
".osquery"
],
"type": "string"
},
"params": {
"$ref": "#/components/schemas/Security_Detections_API_OsqueryParams"
}
}
},
"Security_Detections_API_PlatformErrorResponse": {
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer"
}
}
},
"Security_Detections_API_ProcessesParams": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_KillProcessParams"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SuspendProcessParams"
}
],
"discriminator": {
"propertyName": "command",
"mapping": {
"kill-process": "#/components/schemas/Security_Detections_API_KillProcessParams",
"suspend-process": "#/components/schemas/Security_Detections_API_SuspendProcessParams"
}
}
},
"Security_Detections_API_QueryAlertsBodyParams": {
"type": "object",
"properties": {
"_source": {
"oneOf": [
{
"type": "boolean"
},
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
]
},
"aggs": {
"type": "object"
},
"fields": {
"type": "array",
"items": {
"type": "string"
}
},
"query": {
"type": "object"
},
"runtime_mappings": {
"type": "object"
},
"size": {
"minimum": 0,
"type": "integer"
},
"sort": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsSort"
},
"track_total_hits": {
"type": "boolean"
}
}
},
"Security_Detections_API_QueryRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleResponseFields"
}
]
},
"Security_Detections_API_QueryRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields"
}
]
},
"Security_Detections_API_QueryRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateFields"
}
]
},
"Security_Detections_API_QueryRuleDefaultableFields": {
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
}
}
},
"Security_Detections_API_QueryRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
},
"data_view_id": {
"$ref": "#/components/schemas/Security_Detections_API_DataViewId"
},
"filters": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray"
},
"index": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
},
"saved_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryId"
}
}
},
"Security_Detections_API_QueryRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"type": {
"enum": [
"query"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields"
}
]
},
"Security_Detections_API_QueryRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRulePatchFields"
}
]
},
"Security_Detections_API_QueryRuleRequiredFields": {
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"query"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_QueryRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleOptionalFields"
},
{
"required": [
"query",
"language"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
}
}
}
]
},
"Security_Detections_API_QueryRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateFields"
}
]
},
"Security_Detections_API_Reason": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_ReasonEnum"
},
{
"maxLength": 1024,
"minLength": 1,
"type": "string"
}
],
"description": "The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings."
},
"Security_Detections_API_ReasonEnum": {
"enum": [
"false_positive",
"duplicate",
"true_positive",
"benign_positive",
"automated_closure",
"other"
],
"type": "string"
},
"Security_Detections_API_RelatedIntegration": {
"required": [
"package",
"version"
],
"type": "object",
"properties": {
"integration": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"package": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
},
"description": "Related integration is a potential dependency of a rule. It's assumed that if the user installs\none of the related integrations of a rule, the rule might start to work properly because it will\nhave source events (generated by this integration) potentially matching the rule's query.\n\nNOTE: Proper work is not guaranteed, because a related integration, if installed, can be\nconfigured differently or generate data that is not necessarily relevant for this rule.\n\nRelated integration is a combination of a Fleet package and (optionally) one of the\npackage's \"integrations\" that this package contains. It is represented by 3 properties:\n\n- `package`: name of the package (required, unique id)\n- `version`: version of the package (required, semver-compatible)\n- `integration`: name of the integration of this package (optional, id within the package)\n\nThere are Fleet packages like `windows` that contain only one integration; in this case,\n`integration` should be unspecified. There are also packages like `aws` and `azure` that contain\nseveral integrations; in this case, `integration` should be specified.\n",
"example": {
"integration": "activitylogs",
"package": "azure",
"version": "~1.1.6"
}
},
"Security_Detections_API_RelatedIntegrationArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegration"
}
},
"Security_Detections_API_RequiredField": {
"required": [
"name",
"type",
"ecs"
],
"type": "object",
"properties": {
"ecs": {
"type": "boolean",
"description": "Indicates whether the field is ECS-compliant. This property is only present in responses. Its value is computed based on field’s name and type."
},
"name": {
"minLength": 1,
"type": "string",
"description": "Name of an Elasticsearch field",
"format": "nonempty"
},
"type": {
"minLength": 1,
"type": "string",
"description": "Type of the Elasticsearch field",
"format": "nonempty"
}
},
"description": "Describes an Elasticsearch field that is needed for the rule to function.\n\nAlmost all types of Security rules check source event documents for a match to some kind of\nquery or filter. If a document has certain field with certain values, then it's a match and\nthe rule will generate an alert.\n\nRequired field is an event field that must be present in the source indices of a given rule.\n\n@example\nconst standardEcsField: RequiredField = {\n name: 'event.action',\n type: 'keyword',\n ecs: true,\n};\n\n@example\nconst nonEcsField: RequiredField = {\n name: 'winlog.event_data.AttributeLDAPDisplayName',\n type: 'keyword',\n ecs: false,\n};\n"
},
"Security_Detections_API_RequiredFieldArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredField"
}
},
"Security_Detections_API_RequiredFieldInput": {
"required": [
"name",
"type"
],
"type": "object",
"properties": {
"name": {
"minLength": 1,
"type": "string",
"description": "Name of an Elasticsearch field",
"format": "nonempty"
},
"type": {
"minLength": 1,
"type": "string",
"description": "Type of the Elasticsearch field",
"format": "nonempty"
}
},
"description": "Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type."
},
"Security_Detections_API_ResponseAction": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_OsqueryResponseAction"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EndpointResponseAction"
}
],
"discriminator": {
"propertyName": "action_type_id",
"mapping": {
".endpoint": "#/components/schemas/Security_Detections_API_EndpointResponseAction",
".osquery": "#/components/schemas/Security_Detections_API_OsqueryResponseAction"
}
}
},
"Security_Detections_API_ResponseFields": {
"required": [
"id",
"rule_id",
"immutable",
"rule_source",
"updated_at",
"updated_by",
"created_at",
"created_by",
"revision",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": "string"
},
"created_by_profile_uid": {
"type": "string",
"description": "The user profile UID of the user who created the rule. Only present when the rule was created through an authenticated Kibana session. Resolve it to a display name with the user profiles API."
},
"execution_summary": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExecutionSummary"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"immutable": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleImmutable"
},
"required_fields": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldArray"
},
"revision": {
"$ref": "#/components/schemas/Security_Detections_API_RuleRevision"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_source": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSource"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": "string"
},
"updated_by_profile_uid": {
"type": "string",
"description": "The user profile UID of the user who last updated the rule. Only present when the rule was updated through an authenticated Kibana session. Resolve it to a display name with the user profiles API."
}
}
},
"Security_Detections_API_RiskScore": {
"maximum": 100,
"minimum": 0,
"type": "integer",
"description": "A numerical representation of the alert's severity from 0 to 100, where:\n* `0` - `21` represents low severity\n* `22` - `47` represents medium severity\n* `48` - `73` represents high severity\n* `74` - `100` represents critical severity\n"
},
"Security_Detections_API_RiskScoreMapping": {
"type": "array",
"items": {
"required": [
"field",
"operator",
"value"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Source event field used to override the default `risk_score`."
},
"operator": {
"enum": [
"equals"
],
"type": "string"
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"value": {
"type": "string"
}
}
},
"description": "Overrides generated alerts' risk_score with a value from the source event"
},
"Security_Detections_API_RuleAction": {
"required": [
"action_type_id",
"id",
"params"
],
"type": "object",
"properties": {
"action_type_id": {
"type": "string",
"description": "The action type used for sending notifications, can be:\n\n - `.slack`\n - `.slack_api`\n - `.email`\n - `.index`\n - `.pagerduty`\n - `.swimlane`\n - `.webhook`\n - `.servicenow`\n - `.servicenow-itom`\n - `.servicenow-sir`\n - `.jira`\n - `.resilient`\n - `.opsgenie`\n - `.teams`\n - `.torq`\n - `.tines`\n - `.d3security`\n"
},
"alerts_filter": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionAlertsFilter"
},
"frequency": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionFrequency"
},
"group": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionGroup"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionId"
},
"params": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionParams"
},
"uuid": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
}
},
"Security_Detections_API_RuleActionAlertsFilter": {
"type": "object",
"description": "Object containing an action’s conditional filters.\n\n- `timeframe` (object, optional): Object containing the time frame for when this action can be run.\n - `days` (array of integers, required): List of days of the week on which this action will be run. Days of the week are expressed as numbers between `1-7`, where `1` is Monday and `7` is Sunday. To select all days of the week, enter an empty array.\n - `hours` (object, required): The hours of the day during which this action will run. Hours of the day are expressed as two strings in the format `hh:mm` in `24` hour time. A start of `00:00` and an end of `24:00` means the action can run all day.\n - start (string, required): Start time in `hh:mm` format.\n - end (string, required): End time in `hh:mm` format.\n - `timezone` (string, required): An ISO timezone name, such as `Europe/Madrid` or `America/New_York`. Specific offsets such as `UTC` or `UTC+1` will also work, but lack built-in DST.\n- `query` (object, optional): Object containing a query filter which gets applied to an action and determines whether the action should run.\n - `kql` (string, required): A KQL string.\n - `filters` (array of objects, required): Array of filter objects, as defined in the `kbn-es-query` package.\n"
},
"Security_Detections_API_RuleActionFrequency": {
"required": [
"summary",
"notifyWhen",
"throttle"
],
"type": "object",
"properties": {
"notifyWhen": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionNotifyWhen"
},
"summary": {
"type": "boolean",
"description": "Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
}
},
"description": "The action frequency defines when the action runs (for example, only on rule execution or at specific time intervals)."
},
"Security_Detections_API_RuleActionGroup": {
"type": "string",
"description": "Optionally groups actions by use cases. Use `default` for alert notifications."
},
"Security_Detections_API_RuleActionId": {
"type": "string",
"description": "The connector ID."
},
"Security_Detections_API_RuleActionNotifyWhen": {
"enum": [
"onActiveAlert",
"onThrottleInterval",
"onActionGroupChange"
],
"type": "string",
"description": "Defines how often rules run actions."
},
"Security_Detections_API_RuleActionParams": {
"type": "object",
"description": "Object containing the allowed connector fields, which varies according to the connector type.\n\nFor Slack:\n\n - `message` (string, required): The notification message.\n\nFor email:\n\n - `to`, `cc`, `bcc` (string): Email addresses to which the notifications are sent. At least one field must have a value.\n - `subject` (string, optional): Email subject line.\n - `message` (string, required): Email body text.\n\nFor Webhook:\n\n - `body` (string, required): JSON payload.\n\nFor PagerDuty:\n\n - `severity` (string, required): Severity of on the alert notification, can be: `Critical`, `Error`, `Warning` or `Info`.\n - `eventAction` (string, required): Event [action type](https://v2.developer.pagerduty.com/docs/events-api-v2#event-action), which can be `trigger`, `resolve`, or `acknowledge`.\n - `dedupKey` (string, optional): Groups alert notifications with the same PagerDuty alert.\n - `timestamp` (DateTime, optional): ISO-8601 format [timestamp](https://v2.developer.pagerduty.com/docs/types#datetime).\n - `component` (string, optional): Source machine component responsible for the event, for example `security-solution`.\n - `group` (string, optional): Enables logical grouping of service components.\n - `source` (string, optional): The affected system. Defaults to the Kibana saved object ID of the action.\n - `summary` (string, options): Summary of the event. Defaults to `No summary provided`. Maximum length is 1024 characters.\n - `class` (string, optional): Value indicating the class/type of the event.\n"
},
"Security_Detections_API_RuleActionThrottle": {
"oneOf": [
{
"enum": [
"no_actions",
"rule"
],
"type": "string"
},
{
"pattern": "^[1-9]\\d*[smhd]$",
"type": "string",
"description": "Time interval in seconds, minutes, hours, or days.",
"example": "1h"
}
],
"description": "Defines how often rule actions are taken."
},
"Security_Detections_API_RuleAuthorArray": {
"type": "array",
"items": {
"type": "string"
},
"description": "The rule’s author."
},
"Security_Detections_API_RuleCreateProps": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateProps"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"eql": "#/components/schemas/Security_Detections_API_EqlRuleCreateProps",
"esql": "#/components/schemas/Security_Detections_API_EsqlRuleCreateProps",
"machine_learning": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps",
"new_terms": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps",
"query": "#/components/schemas/Security_Detections_API_QueryRuleCreateProps",
"saved_query": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps",
"threat_match": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps",
"threshold": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps"
}
}
},
"Security_Detections_API_RuleDescription": {
"minLength": 1,
"type": "string",
"description": "The rule’s description.",
"example": "Detects anomalous Windows process creation events."
},
"Security_Detections_API_RuleDetailsInError": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"Security_Detections_API_RuleExceptionList": {
"required": [
"id",
"list_id",
"type",
"namespace_type"
],
"type": "object",
"properties": {
"id": {
"minLength": 1,
"type": "string",
"description": "ID of the exception container",
"format": "nonempty"
},
"list_id": {
"minLength": 1,
"type": "string",
"description": "List ID of the exception container",
"format": "nonempty"
},
"namespace_type": {
"enum": [
"agnostic",
"single"
],
"type": "string",
"description": "Determines the exceptions validity in rule's Kibana space"
},
"type": {
"$ref": "#/components/schemas/Security_Detections_API_ExceptionListType"
}
},
"description": "Array of [exception containers](https://www.elastic.co/docs/solutions/security/detect-and-alert/detection-rule-concepts), which define exceptions that prevent the rule from generating alerts even when its other criteria are met.\n"
},
"Security_Detections_API_RuleExecutionMetrics": {
"type": "object",
"properties": {
"execution_gap_duration_s": {
"minimum": 0,
"type": "integer",
"description": "Duration in seconds of execution gap"
},
"frozen_indices_queried_count": {
"minimum": 0,
"type": "integer",
"description": "Count of frozen indices queried during the rule execution. These indices could not be entirely excluded after applying the time range filter."
},
"gap_range": {
"required": [
"gte",
"lte"
],
"type": "object",
"properties": {
"gte": {
"type": "string",
"description": "Start date of the execution gap"
},
"lte": {
"type": "string",
"description": "End date of the execution gap"
}
},
"description": "Range of the execution gap"
},
"gap_reason": {
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"rule_disabled",
"rule_did_not_run"
],
"type": "string",
"description": "The type of reason for the gap (rule_disabled or rule_did_not_run)"
}
},
"description": "Detected reason for the execution gap"
},
"total_enrichment_duration_ms": {
"minimum": 0,
"type": "integer",
"description": "Total time spent enriching documents during current rule execution cycle"
},
"total_indexing_duration_ms": {
"minimum": 0,
"type": "integer",
"description": "Total time spent indexing documents during current rule execution cycle"
},
"total_search_duration_ms": {
"minimum": 0,
"type": "integer",
"description": "Total time spent performing ES searches as measured by Kibana; includes network latency and time spent serializing/deserializing request/response"
}
}
},
"Security_Detections_API_RuleExecutionStatus": {
"enum": [
"going to run",
"running",
"partial failure",
"failed",
"succeeded"
],
"type": "string",
"description": "Custom execution status of Security rules that is different from the status used in the Alerting Framework. We merge our custom status with the Framework's status to determine the resulting status of a rule.\n- going to run - @deprecated Replaced by the 'running' status but left for backwards compatibility with rule execution events already written to Event Log in the prior versions of Kibana. Don't use when writing rule status changes.\n- running - Rule execution started but not reached any intermediate or final status.\n- partial failure - Rule can partially fail for various reasons either in the middle of an execution (in this case we update its status right away) or in the end of it. So currently this status can be both intermediate and final at the same time. A typical reason for a partial failure: not all the indices that the rule searches over actually exist.\n- failed - Rule failed to execute due to unhandled exception or a reason defined in the business logic of its executor function.\n- succeeded - Rule executed successfully without any issues. Note: this status is just an indication of a rule's \"health\". The rule might or might not generate any alerts despite of it."
},
"Security_Detections_API_RuleExecutionStatusOrder": {
"type": "integer"
},
"Security_Detections_API_RuleExecutionSummary": {
"required": [
"last_execution"
],
"type": "object",
"properties": {
"last_execution": {
"required": [
"date",
"status",
"status_order",
"message",
"metrics"
],
"type": "object",
"properties": {
"date": {
"type": "string",
"description": "Date of the last execution",
"format": "date-time"
},
"message": {
"type": "string"
},
"metrics": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExecutionMetrics"
},
"status": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExecutionStatus"
},
"status_order": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExecutionStatusOrder"
}
}
}
},
"description": "Summary of the last execution of a rule.\n> info\n> This field is under development and its usage or schema may change\n"
},
"Security_Detections_API_RuleFalsePositiveArray": {
"type": "array",
"items": {
"type": "string"
},
"description": "String array used to describe common reasons why the rule may issue false-positive alerts. Defaults to an empty array."
},
"Security_Detections_API_RuleFilterArray": {
"type": "array",
"items": { },
"description": "The query and filter context array used to define the conditions for when alerts are created from events. Defaults to an empty array.\n> info\n> This field is not supported for ES|QL rules.\n"
},
"Security_Detections_API_RuleInterval": {
"type": "string",
"description": "Frequency of rule execution, using a date math range. For example, \"1h\" means the rule runs every hour. Defaults to 5m (5 minutes)."
},
"Security_Detections_API_RuleIntervalFrom": {
"type": "string",
"description": "Time from which data is analyzed each time the rule runs, using a date math range. For example, now-4200s means the rule analyzes data from 70 minutes before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).",
"format": "date-math"
},
"Security_Detections_API_RuleIntervalTo": {
"type": "string"
},
"Security_Detections_API_RuleLicense": {
"type": "string",
"description": "The rule's license."
},
"Security_Detections_API_RuleMetadata": {
"type": "object",
"description": "Placeholder for metadata about the rule.\n> info\n> This field is overwritten when you save changes to the rule’s settings.\n"
},
"Security_Detections_API_RuleName": {
"minLength": 1,
"type": "string",
"description": "A human-readable name for the rule.",
"example": "Anomalous Windows Process Creation"
},
"Security_Detections_API_RuleNameOverride": {
"type": "string",
"description": "Sets which field in the source event is used to populate the alert's `signal.rule.name` value (in the UI, this value is displayed on the Rules page in the Rule column). When unspecified, the rule’s `name` value is used. The source field must be a string data type."
},
"Security_Detections_API_RuleObjectId": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"Security_Detections_API_RulePatchProps": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRulePatchProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRulePatchProps"
}
]
},
"Security_Detections_API_RulePreviewLoggedRequest": {
"type": "object",
"properties": {
"description": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"duration": {
"type": "integer"
},
"request": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"request_type": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
}
},
"Security_Detections_API_RulePreviewLogs": {
"required": [
"errors",
"warnings",
"duration"
],
"type": "object",
"properties": {
"duration": {
"type": "integer",
"description": "Execution duration in milliseconds"
},
"errors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
},
"requests": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RulePreviewLoggedRequest"
}
},
"startedAt": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"warnings": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
}
}
},
"Security_Detections_API_RulePreviewParams": {
"required": [
"invocationCount",
"timeframeEnd"
],
"type": "object",
"properties": {
"invocationCount": {
"type": "integer"
},
"timeframeEnd": {
"type": "string",
"format": "date-time"
}
}
},
"Security_Detections_API_RuleQuery": {
"type": "string",
"description": "[Query](https://www.elastic.co/docs/explore-analyze/query-filter) used by the rule to create alerts.\n\n- For indicator match rules, only the query’s results are used to determine whether an alert is generated.\n- ES|QL rules have additional query requirements. Refer to [Create ES|QL](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#create-esql-rule) rules for more information.\n"
},
"Security_Detections_API_RuleReferenceArray": {
"type": "array",
"items": {
"type": "string"
},
"description": "Array containing notes about or references to relevant information about the rule. Defaults to an empty array."
},
"Security_Detections_API_RuleResponse": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRule"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRule"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"eql": "#/components/schemas/Security_Detections_API_EqlRule",
"esql": "#/components/schemas/Security_Detections_API_EsqlRule",
"machine_learning": "#/components/schemas/Security_Detections_API_MachineLearningRule",
"new_terms": "#/components/schemas/Security_Detections_API_NewTermsRule",
"query": "#/components/schemas/Security_Detections_API_QueryRule",
"saved_query": "#/components/schemas/Security_Detections_API_SavedQueryRule",
"threat_match": "#/components/schemas/Security_Detections_API_ThreatMatchRule",
"threshold": "#/components/schemas/Security_Detections_API_ThresholdRule"
}
}
},
"Security_Detections_API_RuleRevision": {
"minimum": 0,
"type": "integer",
"description": "The rule's revision number.\n\nIt represents the version of rule's object in Kibana. It is set to `0` when the rule is installed or created and then gets incremented on each update.\n> info\n> Not all updates to any rule fields will increment the revision. Only those fields that are considered static `rule parameters` can trigger revision increments. For example, an update to a rule's query or index fields will increment the rule's revision by `1`. However, changes to dynamic or technical fields like enabled or execution_summary will not cause revision increments.\n"
},
"Security_Detections_API_RuleSignatureId": {
"type": "string",
"description": "A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s."
},
"Security_Detections_API_RuleSource": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_ExternalRuleSource"
},
{
"$ref": "#/components/schemas/Security_Detections_API_InternalRuleSource"
}
],
"description": "Discriminated union that determines whether the rule is internally sourced (created within the Kibana app) or has an external source, such as the Elastic Prebuilt rules repo.",
"discriminator": {
"propertyName": "type"
}
},
"Security_Detections_API_RuleTagArray": {
"type": "array",
"items": {
"type": "string"
},
"description": "String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array."
},
"Security_Detections_API_RuleUpdateProps": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_EqlRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_QueryRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps"
},
{
"$ref": "#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"eql": "#/components/schemas/Security_Detections_API_EqlRuleUpdateProps",
"esql": "#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps",
"machine_learning": "#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps",
"new_terms": "#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps",
"query": "#/components/schemas/Security_Detections_API_QueryRuleUpdateProps",
"saved_query": "#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps",
"threat_match": "#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps",
"threshold": "#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps"
}
}
},
"Security_Detections_API_RuleVersion": {
"minimum": 1,
"type": "integer",
"description": "The rule's version number.\n\n- For prebuilt rules it represents the version of the rule's content in the source [detection-rules](https://github.com/elastic/detection-rules) repository (and the corresponding `security_detection_engine` Fleet package that is used for distributing prebuilt rules). \n- For custom rules it is set to `1` when the rule is created. \n> info\n> It is not incremented on each update. Compare this to the `revision` field.\n"
},
"Security_Detections_API_RunScriptOsConfigValues": {
"minProperties": 1,
"type": "object",
"properties": {
"scriptId": {
"maxLength": 256,
"type": "string",
"description": "The ID of the script to run (from the Kibana Script library)"
},
"scriptInput": {
"maxLength": 8192,
"type": "string",
"description": "The arguments to pass to the script (if any)"
},
"timeout": {
"type": "integer",
"description": "Specify the timeout in seconds for the script execution",
"example": 60
}
}
},
"Security_Detections_API_RunscriptParams": {
"required": [
"command"
],
"type": "object",
"properties": {
"command": {
"enum": [
"runscript"
],
"type": "string"
},
"comment": {
"maxLength": 30000,
"type": "string",
"description": "Add a note that explains or describes the action. You can find your comment in the response actions history log"
},
"config": {
"type": "object",
"properties": {
"linux": {
"$ref": "#/components/schemas/Security_Detections_API_RunScriptOsConfigValues"
},
"macos": {
"$ref": "#/components/schemas/Security_Detections_API_RunScriptOsConfigValues"
},
"windows": {
"$ref": "#/components/schemas/Security_Detections_API_RunScriptOsConfigValues"
}
}
}
},
"description": "Run a script on the Elastic Defend host that triggered the alert."
},
"Security_Detections_API_RuntimeFieldMapping": {
"required": [
"type"
],
"type": "object",
"properties": {
"format": {
"maxLength": 100,
"type": "string",
"description": "Format string for date runtime fields, for example `strict_date_optional_time`."
},
"script": {
"required": [
"source"
],
"type": "object",
"properties": {
"source": {
"maxLength": 10000,
"type": "string",
"description": "Painless script source to execute."
}
},
"additionalProperties": false,
"description": "Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics."
},
"type": {
"$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldType"
}
},
"description": "A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time."
},
"Security_Detections_API_RuntimeFieldType": {
"enum": [
"keyword",
"long",
"double",
"date",
"ip",
"boolean",
"geo_point"
],
"type": "string",
"description": "The data type for the runtime field type. Determines how the field value is indexed and queried."
},
"Security_Detections_API_SavedObjectResolveAliasPurpose": {
"enum": [
"savedObjectConversion",
"savedObjectImport"
],
"type": "string"
},
"Security_Detections_API_SavedObjectResolveAliasTargetId": {
"type": "string"
},
"Security_Detections_API_SavedObjectResolveOutcome": {
"enum": [
"exactMatch",
"aliasMatch",
"conflict"
],
"type": "string"
},
"Security_Detections_API_SavedQueryId": {
"type": "string",
"description": "Kibana [saved search](https://www.elastic.co/docs/explore-analyze/discover/search-sessions) used by the rule to create alerts."
},
"Security_Detections_API_SavedQueryRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleResponseFields"
}
]
},
"Security_Detections_API_SavedQueryRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields"
}
]
},
"Security_Detections_API_SavedQueryRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields"
}
]
},
"Security_Detections_API_SavedQueryRuleDefaultableFields": {
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
},
"Security_Detections_API_SavedQueryRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
},
"data_view_id": {
"$ref": "#/components/schemas/Security_Detections_API_DataViewId"
},
"filters": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray"
},
"index": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
},
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
}
}
},
"Security_Detections_API_SavedQueryRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"saved_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryId"
},
"type": {
"enum": [
"saved_query"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields"
}
]
},
"Security_Detections_API_SavedQueryRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRulePatchFields"
}
]
},
"Security_Detections_API_SavedQueryRuleRequiredFields": {
"required": [
"type",
"saved_id"
],
"type": "object",
"properties": {
"saved_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryId"
},
"type": {
"enum": [
"saved_query"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_SavedQueryRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields"
},
{
"required": [
"language"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
}
]
},
"Security_Detections_API_SavedQueryRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields"
}
]
},
"Security_Detections_API_SetAlertAssigneesBody": {
"required": [
"assignees",
"ids"
],
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Security_Detections_API_AlertAssignees"
},
"ids": {
"$ref": "#/components/schemas/Security_Detections_API_AlertIds"
}
}
},
"Security_Detections_API_SetAlertsStatusByIds": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_CloseAlertsByIds"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SetAlertsStatusByIdsBase"
}
],
"discriminator": {
"propertyName": "status",
"mapping": {
"closed": "#/components/schemas/Security_Detections_API_CloseAlertsByIds"
}
}
},
"Security_Detections_API_SetAlertsStatusByIdsBase": {
"required": [
"signal_ids",
"status"
],
"type": "object",
"properties": {
"signal_ids": {
"minItems": 1,
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"format": "nonempty"
},
"description": "List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts."
},
"status": {
"$ref": "#/components/schemas/Security_Detections_API_AlertStatusExceptClosed"
}
}
},
"Security_Detections_API_SetAlertsStatusByQuery": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_CloseAlertsByQuery"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SetAlertsStatusByQueryBase"
}
],
"discriminator": {
"propertyName": "status",
"mapping": {
"closed": "#/components/schemas/Security_Detections_API_CloseAlertsByQuery"
}
}
},
"Security_Detections_API_SetAlertsStatusByQueryBase": {
"required": [
"query",
"status"
],
"type": "object",
"properties": {
"conflicts": {
"enum": [
"abort",
"proceed"
],
"type": "string",
"default": "abort"
},
"query": {
"type": "object"
},
"runtime_fields": {
"maxProperties": 100,
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldType"
},
"description": "Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created."
},
"runtime_mappings": {
"maxProperties": 100,
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldMapping"
},
"description": "Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected."
},
"status": {
"$ref": "#/components/schemas/Security_Detections_API_AlertStatusExceptClosed"
}
}
},
"Security_Detections_API_SetAlertTags": {
"required": [
"tags_to_add",
"tags_to_remove"
],
"type": "object",
"properties": {
"tags_to_add": {
"$ref": "#/components/schemas/Security_Detections_API_AlertTags"
},
"tags_to_remove": {
"$ref": "#/components/schemas/Security_Detections_API_AlertTags"
}
},
"description": "Object with list of tags to add and remove."
},
"Security_Detections_API_SetAlertTagsBody": {
"required": [
"ids",
"tags"
],
"type": "object",
"properties": {
"ids": {
"$ref": "#/components/schemas/Security_Detections_API_AlertIds"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_SetAlertTags"
}
}
},
"Security_Detections_API_SetAttacksAssigneesByIds": {
"required": [
"ids",
"assignees"
],
"type": "object",
"properties": {
"assignees": {
"$ref": "#/components/schemas/Security_Detections_API_AlertAssignees"
},
"ids": {
"$ref": "#/components/schemas/Security_Detections_API_AlertIds"
},
"update_related_alerts": {
"$ref": "#/components/schemas/Security_Detections_API_UpdateRelatedAlerts"
}
}
},
"Security_Detections_API_SetAttacksStatusByIds": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_CloseAttacksByIds"
},
{
"$ref": "#/components/schemas/Security_Detections_API_SetAttacksStatusByIdsBase"
}
],
"discriminator": {
"propertyName": "status",
"mapping": {
"closed": "#/components/schemas/Security_Detections_API_CloseAttacksByIds"
}
}
},
"Security_Detections_API_SetAttacksStatusByIdsBase": {
"required": [
"ids",
"status"
],
"type": "object",
"properties": {
"ids": {
"$ref": "#/components/schemas/Security_Detections_API_AlertIds"
},
"status": {
"$ref": "#/components/schemas/Security_Detections_API_AlertStatusExceptClosed"
},
"update_related_alerts": {
"$ref": "#/components/schemas/Security_Detections_API_UpdateRelatedAlerts"
}
}
},
"Security_Detections_API_SetAttacksTagsByIds": {
"required": [
"ids",
"tags"
],
"type": "object",
"properties": {
"ids": {
"$ref": "#/components/schemas/Security_Detections_API_AlertIds"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_SetAlertTags"
},
"update_related_alerts": {
"$ref": "#/components/schemas/Security_Detections_API_UpdateRelatedAlerts"
}
}
},
"Security_Detections_API_SetupGuide": {
"type": "string",
"description": "Populates the rule’s setup guide with instructions on rule prerequisites such as required integrations, configuration steps, and anything else needed for the rule to work correctly."
},
"Security_Detections_API_Severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string",
"description": "Severity level of alerts produced by the rule, which must be one of the following:\n* `low`: Alerts that are of interest but generally not considered to be security incidents\n* `medium`: Alerts that require investigation\n* `high`: Alerts that require immediate investigation\n* `critical`: Alerts that indicate it is highly likely a security incident has occurred\n"
},
"Security_Detections_API_SeverityMapping": {
"type": "array",
"items": {
"required": [
"field",
"operator",
"severity",
"value"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "Source event field used to override the default `severity`."
},
"operator": {
"enum": [
"equals"
],
"type": "string"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"value": {
"type": "string"
}
}
},
"description": "Overrides generated alerts' severity with values from the source event"
},
"Security_Detections_API_SiemErrorResponse": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"Security_Detections_API_SkippedAlertsIndexMigration": {
"required": [
"index"
],
"type": "object",
"properties": {
"index": {
"type": "string"
}
}
},
"Security_Detections_API_SortOrder": {
"enum": [
"asc",
"desc"
],
"type": "string"
},
"Security_Detections_API_SuspendProcessParams": {
"required": [
"command",
"config"
],
"type": "object",
"properties": {
"command": {
"enum": [
"suspend-process"
],
"type": "string",
"description": "To run an endpoint response action, specify a value for the command field. Example: \"command\": \"suspend-process\""
},
"comment": {
"maxLength": 30000,
"type": "string",
"description": "Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: \"comment\": \"Check processes\""
},
"config": {
"required": [
"field"
],
"type": "object",
"properties": {
"field": {
"maxLength": 2000,
"type": "string",
"description": "Field to use instead of process.pid"
},
"overwrite": {
"type": "boolean",
"description": "Whether to overwrite field with process.pid",
"default": true
}
}
}
}
},
"Security_Detections_API_Threat": {
"required": [
"framework",
"tactic"
],
"type": "object",
"properties": {
"framework": {
"type": "string",
"description": "Relevant attack framework"
},
"tactic": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatTactic"
},
"technique": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatTechnique"
},
"description": "Array containing information on the attack techniques (optional)"
}
},
"description": "> info\n> Currently, only threats described using the MITRE ATT&CK™ framework are supported.\n"
},
"Security_Detections_API_ThreatArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_Threat"
}
},
"Security_Detections_API_ThreatFilters": {
"type": "array",
"items": {
"description": "Query and filter context array used to filter documents from the Elasticsearch index containing the threat values"
}
},
"Security_Detections_API_ThreatIndex": {
"type": "array",
"items": {
"type": "string"
},
"description": "Elasticsearch indices used to check which field values generate alerts."
},
"Security_Detections_API_ThreatIndicatorPath": {
"type": "string",
"description": "Defines the path to the threat indicator in the indicator documents (optional)"
},
"Security_Detections_API_ThreatMapping": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"entries"
],
"type": "object",
"properties": {
"entries": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatMappingEntry"
}
}
}
},
"description": "Array of entries objects that define mappings between the source event fields and the values in the Elasticsearch threat index. Each entries object must contain these fields:\n\n- field: field from the event indices on which the rule runs\n- type: must be mapping\n- value: field from the Elasticsearch threat index\n \nYou can use Boolean and and or logic to define the conditions for when matching fields and values generate alerts. Sibling entries objects are evaluated using or logic, whereas multiple entries in a single entries object use and logic. See Example of Threat Match rule which uses both `and` and `or` logic.\n"
},
"Security_Detections_API_ThreatMappingEntry": {
"required": [
"field",
"type",
"value"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
},
"negate": {
"type": "boolean"
},
"type": {
"enum": [
"mapping"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_NonEmptyString"
}
}
},
"Security_Detections_API_ThreatMatchRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleResponseFields"
}
]
},
"Security_Detections_API_ThreatMatchRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields"
}
]
},
"Security_Detections_API_ThreatMatchRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields"
}
]
},
"Security_Detections_API_ThreatMatchRuleDefaultableFields": {
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
},
"Security_Detections_API_ThreatMatchRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppression"
},
"concurrent_searches": {
"$ref": "#/components/schemas/Security_Detections_API_ConcurrentSearches"
},
"data_view_id": {
"$ref": "#/components/schemas/Security_Detections_API_DataViewId"
},
"filters": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray"
},
"index": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
},
"items_per_search": {
"$ref": "#/components/schemas/Security_Detections_API_ItemsPerSearch"
},
"saved_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryId"
},
"threat_filters": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatFilters"
},
"threat_indicator_path": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatIndicatorPath"
},
"threat_language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
},
"Security_Detections_API_ThreatMatchRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"threat_index": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatIndex"
},
"threat_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatMapping"
},
"threat_query": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatQuery"
},
"type": {
"enum": [
"threat_match"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields"
}
]
},
"Security_Detections_API_ThreatMatchRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRulePatchFields"
}
]
},
"Security_Detections_API_ThreatMatchRuleRequiredFields": {
"required": [
"type",
"query",
"threat_query",
"threat_mapping",
"threat_index"
],
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"threat_index": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatIndex"
},
"threat_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatMapping"
},
"threat_query": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatQuery"
},
"type": {
"enum": [
"threat_match"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_ThreatMatchRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields"
},
{
"required": [
"language"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
}
]
},
"Security_Detections_API_ThreatMatchRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields"
}
]
},
"Security_Detections_API_ThreatQuery": {
"type": "string",
"description": "Query used to determine which fields in the Elasticsearch index are used for generating alerts."
},
"Security_Detections_API_ThreatSubtechnique": {
"required": [
"id",
"name",
"reference"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Subtechnique ID"
},
"name": {
"type": "string",
"description": "Subtechnique name"
},
"reference": {
"type": "string",
"description": "Subtechnique reference"
}
}
},
"Security_Detections_API_ThreatTactic": {
"required": [
"id",
"name",
"reference"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Tactic ID"
},
"name": {
"type": "string",
"description": "Tactic name"
},
"reference": {
"type": "string",
"description": "Tactic reference"
}
},
"description": "Object containing information on the attack type\n"
},
"Security_Detections_API_ThreatTechnique": {
"required": [
"id",
"name",
"reference"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Technique ID"
},
"name": {
"type": "string",
"description": "Technique name"
},
"reference": {
"type": "string",
"description": "Technique reference"
},
"subtechnique": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatSubtechnique"
},
"description": "Array containing more specific information on the attack technique.\n"
}
}
},
"Security_Detections_API_Threshold": {
"required": [
"field",
"value"
],
"type": "object",
"properties": {
"cardinality": {
"$ref": "#/components/schemas/Security_Detections_API_ThresholdCardinality"
},
"field": {
"$ref": "#/components/schemas/Security_Detections_API_ThresholdField"
},
"value": {
"$ref": "#/components/schemas/Security_Detections_API_ThresholdValue"
}
}
},
"Security_Detections_API_ThresholdAlertSuppression": {
"required": [
"duration"
],
"type": "object",
"properties": {
"duration": {
"$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionDuration"
}
},
"description": "Defines alert suppression configuration."
},
"Security_Detections_API_ThresholdCardinality": {
"type": "array",
"items": {
"required": [
"field",
"value"
],
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The field on which to calculate and compare the cardinality."
},
"value": {
"minimum": 0,
"type": "integer",
"description": "The threshold value from which an alert is generated based on unique number of values of cardinality.field."
}
}
},
"description": "The field on which the cardinality is applied."
},
"Security_Detections_API_ThresholdField": {
"oneOf": [
{
"type": "string"
},
{
"maxItems": 5,
"minItems": 0,
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "The field on which the threshold is applied. If you specify an empty array ([]), alerts are generated when the query returns at least the number of results specified in the value field."
},
"Security_Detections_API_ThresholdRule": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity",
"version",
"tags",
"enabled",
"risk_score_mapping",
"severity_mapping",
"interval",
"from",
"to",
"actions",
"exceptions_list",
"author",
"false_positives",
"references",
"max_signals",
"threat",
"setup",
"related_integrations",
"required_fields"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ResponseFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleResponseFields"
}
]
},
"Security_Detections_API_ThresholdRuleCreateFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields"
}
]
},
"Security_Detections_API_ThresholdRuleCreateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields"
}
]
},
"Security_Detections_API_ThresholdRuleDefaultableFields": {
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
},
"Security_Detections_API_ThresholdRuleOptionalFields": {
"type": "object",
"properties": {
"alert_suppression": {
"$ref": "#/components/schemas/Security_Detections_API_ThresholdAlertSuppression"
},
"data_view_id": {
"$ref": "#/components/schemas/Security_Detections_API_DataViewId"
},
"filters": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray"
},
"index": {
"$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray"
},
"saved_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedQueryId"
}
}
},
"Security_Detections_API_ThresholdRulePatchFields": {
"allOf": [
{
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"threshold": {
"$ref": "#/components/schemas/Security_Detections_API_Threshold"
},
"type": {
"enum": [
"threshold"
],
"type": "string",
"description": "Rule type"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields"
}
]
},
"Security_Detections_API_ThresholdRulePatchProps": {
"allOf": [
{
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRulePatchFields"
}
]
},
"Security_Detections_API_ThresholdRuleRequiredFields": {
"required": [
"type",
"query",
"threshold"
],
"type": "object",
"properties": {
"query": {
"$ref": "#/components/schemas/Security_Detections_API_RuleQuery"
},
"threshold": {
"$ref": "#/components/schemas/Security_Detections_API_Threshold"
},
"type": {
"enum": [
"threshold"
],
"type": "string",
"description": "Rule type"
}
}
},
"Security_Detections_API_ThresholdRuleResponseFields": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields"
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields"
},
{
"required": [
"language"
],
"type": "object",
"properties": {
"language": {
"$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage"
}
}
}
]
},
"Security_Detections_API_ThresholdRuleUpdateProps": {
"allOf": [
{
"required": [
"name",
"description",
"risk_score",
"severity"
],
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAction"
},
"description": "Array defining the automated actions (notifications) taken when alerts are generated."
},
"alias_purpose": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId"
},
"author": {
"$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray"
},
"building_block_type": {
"$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType"
},
"description": {
"$ref": "#/components/schemas/Security_Detections_API_RuleDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled"
},
"exceptions_list": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList"
}
},
"false_positives": {
"$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray"
},
"from": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom"
},
"id": {
"$ref": "#/components/schemas/Security_Detections_API_UUID"
},
"interval": {
"$ref": "#/components/schemas/Security_Detections_API_RuleInterval"
},
"investigation_fields": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationFields"
},
"license": {
"$ref": "#/components/schemas/Security_Detections_API_RuleLicense"
},
"max_signals": {
"$ref": "#/components/schemas/Security_Detections_API_MaxSignals"
},
"meta": {
"$ref": "#/components/schemas/Security_Detections_API_RuleMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Detections_API_RuleName"
},
"namespace": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace"
},
"note": {
"$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide"
},
"outcome": {
"$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome"
},
"output_index": {
"$ref": "#/components/schemas/Security_Detections_API_AlertsIndex"
},
"references": {
"$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray"
},
"related_integrations": {
"$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray"
},
"required_fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput"
},
"description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
},
"response_actions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Detections_API_ResponseAction"
}
},
"risk_score": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScore"
},
"risk_score_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping"
},
"rule_id": {
"$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId"
},
"rule_name_override": {
"$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride"
},
"setup": {
"$ref": "#/components/schemas/Security_Detections_API_SetupGuide"
},
"severity": {
"$ref": "#/components/schemas/Security_Detections_API_Severity"
},
"severity_mapping": {
"$ref": "#/components/schemas/Security_Detections_API_SeverityMapping"
},
"tags": {
"$ref": "#/components/schemas/Security_Detections_API_RuleTagArray"
},
"threat": {
"$ref": "#/components/schemas/Security_Detections_API_ThreatArray"
},
"throttle": {
"$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle"
},
"timeline_id": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId"
},
"timeline_title": {
"$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle"
},
"timestamp_override": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverride"
},
"timestamp_override_fallback_disabled": {
"$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled"
},
"to": {
"$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo"
},
"version": {
"$ref": "#/components/schemas/Security_Detections_API_RuleVersion"
}
}
},
{
"$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields"
}
]
},
"Security_Detections_API_ThresholdValue": {
"minimum": 1,
"type": "integer",
"description": "The threshold value from which an alert is generated."
},
"Security_Detections_API_ThrottleForBulkActions": {
"enum": [
"rule",
"1h",
"1d",
"7d"
],
"type": "string",
"description": "Defines the maximum interval in which a rule’s actions are executed.\n> info\n> The rule level `throttle` field is deprecated in Elastic Security 8.8 and will remain active for at least the next 12 months.\n> In Elastic Security 8.8 and later, you can use the `frequency` field to define frequencies for individual actions. Actions without frequencies will acquire a converted version of the rule’s `throttle` field. In the response, the converted `throttle` setting appears in the individual actions' `frequency` field.\n"
},
"Security_Detections_API_TiebreakerField": {
"type": "string",
"description": "Sets a secondary field for sorting events"
},
"Security_Detections_API_TimelineTemplateId": {
"type": "string",
"description": "Timeline template ID"
},
"Security_Detections_API_TimelineTemplateTitle": {
"type": "string",
"description": "Timeline template title"
},
"Security_Detections_API_TimestampField": {
"type": "string",
"description": "Specifies the name of the event timestamp field used for sorting a sequence of events. Not to be confused with `timestamp_override`, which specifies the more general field used for querying events within a range. Defaults to the @timestamp ECS field."
},
"Security_Detections_API_TimestampOverride": {
"type": "string",
"description": "Sets the time field used to query indices. When unspecified, rules query the `@timestamp` field. The source field must be an Elasticsearch date data type."
},
"Security_Detections_API_TimestampOverrideFallbackDisabled": {
"type": "boolean",
"description": "Disables the fallback to the event's @timestamp field"
},
"Security_Detections_API_UpdateRelatedAlerts": {
"type": "boolean",
"description": "When `true`, the change is also applied to detection alerts related to the attacks via `kibana.alert.attack_discovery.alert_ids`.",
"default": false
},
"Security_Detections_API_UUID": {
"type": "string",
"description": "A universally unique identifier",
"format": "uuid"
},
"Security_Detections_API_WarningSchema": {
"required": [
"type",
"message",
"actionPath"
],
"type": "object",
"properties": {
"actionPath": {
"type": "string"
},
"buttonLabel": {
"type": "string"
},
"message": {
"type": "string"
},
"type": {
"type": "string"
}
}
},
"Security_Endpoint_Exceptions_API_EndpointList": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionList"
},
{
"type": "object",
"additionalProperties": false
}
]
},
"Security_Endpoint_Exceptions_API_EndpointListItem": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem"
},
"Security_Endpoint_Exceptions_API_ExceptionList": {
"required": [
"id",
"list_id",
"type",
"name",
"description",
"immutable",
"namespace_type",
"version",
"tie_breaker_id",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"_version": {
"type": "string",
"description": "The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version."
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time"
},
"created_by": {
"type": "string",
"description": "Autogenerated value - user that created object."
},
"description": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListDescription"
},
"id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListId"
},
"immutable": {
"type": "boolean"
},
"list_id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType"
},
"os_types": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListTags"
},
"tie_breaker_id": {
"type": "string",
"description": "Field used in search to ensure all containers are sorted and returned correctly."
},
"type": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListType"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time"
},
"updated_by": {
"type": "string",
"description": "Autogenerated value - user that last updated object."
},
"version": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListVersion"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListDescription": {
"type": "string",
"description": "Describes the exception list.",
"example": "This list tracks allowlisted values."
},
"Security_Endpoint_Exceptions_API_ExceptionListHumanId": {
"minLength": 1,
"type": "string",
"description": "The exception list's human-readable string identifier.\n\nFor endpoint artifacts, use one of the following values:\n\n* `endpoint_list`: Elastic Endpoint exceptions list\n* `endpoint_trusted_apps`: Trusted applications list\n* `endpoint_trusted_devices`: Trusted devices list\n* `endpoint_event_filters`: Event filters list\n* `endpoint_host_isolation_exceptions`: Host isolation exceptions list\n* `endpoint_blocklists`: Blocklist\n",
"format": "nonempty",
"example": "simple_list"
},
"Security_Endpoint_Exceptions_API_ExceptionListId": {
"minLength": 1,
"type": "string",
"description": "Exception list's identifier.",
"format": "nonempty",
"example": "9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85"
},
"Security_Endpoint_Exceptions_API_ExceptionListItem": {
"required": [
"id",
"item_id",
"list_id",
"type",
"name",
"description",
"entries",
"namespace_type",
"comments",
"tie_breaker_id",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"_version": {
"type": "string",
"description": "The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version."
},
"comments": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray"
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time"
},
"created_by": {
"type": "string",
"description": "Autogenerated value - user that created object."
},
"description": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription"
},
"entries": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray"
},
"expire_time": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemExpireTime"
},
"id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId"
},
"item_id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId"
},
"list_id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType"
},
"os_types": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags"
},
"tie_breaker_id": {
"type": "string",
"description": "Field used in search to ensure all containers are sorted and returned correctly."
},
"type": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time"
},
"updated_by": {
"type": "string",
"description": "Autogenerated value - user that last updated object."
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemComment": {
"required": [
"id",
"comment",
"created_at",
"created_by"
],
"type": "object",
"properties": {
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time"
},
"created_by": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time"
},
"updated_by": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemComment"
},
"description": "Array of comment fields:\n\n- comment (string): Comments about the exception item.\n"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemDescription": {
"type": "string",
"description": "Describes the exception list."
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntry": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryList"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard"
}
],
"discriminator": {
"propertyName": "type"
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntry"
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists": {
"required": [
"type",
"field",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"exists"
],
"type": "string"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryList": {
"required": [
"type",
"field",
"list",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"list": {
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ListId"
},
"type": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ListType"
}
}
},
"operator": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"list"
],
"type": "string"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch": {
"required": [
"type",
"field",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"match"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny": {
"required": [
"type",
"field",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"match_any"
],
"type": "string"
},
"value": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
}
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard": {
"required": [
"type",
"field",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"wildcard"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested": {
"required": [
"type",
"field",
"entries"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem"
}
},
"field": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"type": {
"enum": [
"nested"
],
"type": "string"
}
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists"
}
]
},
"Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator": {
"enum": [
"excluded",
"included"
],
"type": "string"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemExpireTime": {
"type": "string",
"description": "The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.",
"format": "date-time"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemHumanId": {
"minLength": 1,
"type": "string",
"description": "Human readable string identifier, e.g. `trusted-linux-processes`",
"format": "nonempty",
"example": "simple_list_item"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemId": {
"minLength": 1,
"type": "string",
"description": "Exception's identifier.",
"format": "nonempty",
"example": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemMeta": {
"type": "object"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemName": {
"minLength": 1,
"type": "string",
"description": "Exception list name.",
"format": "nonempty"
},
"Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType"
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemTags": {
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "String array containing words and phrases to help categorize exception items.",
"format": "nonempty"
}
},
"Security_Endpoint_Exceptions_API_ExceptionListItemType": {
"enum": [
"simple"
],
"type": "string"
},
"Security_Endpoint_Exceptions_API_ExceptionListMeta": {
"type": "object",
"description": "Placeholder for metadata about the list container."
},
"Security_Endpoint_Exceptions_API_ExceptionListName": {
"type": "string",
"description": "The name of the exception list.",
"example": "My exception list"
},
"Security_Endpoint_Exceptions_API_ExceptionListOsType": {
"enum": [
"linux",
"macos",
"windows"
],
"type": "string",
"description": "Use this field to specify the operating system."
},
"Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType"
},
"description": "Use this field to specify the operating system. Only enter one value."
},
"Security_Endpoint_Exceptions_API_ExceptionListTags": {
"type": "array",
"items": {
"type": "string"
},
"description": "String array containing words and phrases to help categorize exception containers."
},
"Security_Endpoint_Exceptions_API_ExceptionListType": {
"enum": [
"detection",
"rule_default",
"endpoint",
"endpoint_trusted_apps",
"endpoint_trusted_devices",
"endpoint_events",
"endpoint_host_isolation_exceptions",
"endpoint_blocklists",
"endpoint_custom_yara_signatures"
],
"type": "string",
"description": "The type of exception list to be created. Different list types may denote where they can be utilized."
},
"Security_Endpoint_Exceptions_API_ExceptionListVersion": {
"minimum": 1,
"type": "integer",
"description": "The document version, automatically increasd on updates."
},
"Security_Endpoint_Exceptions_API_ExceptionNamespaceType": {
"enum": [
"agnostic",
"single"
],
"type": "string",
"description": "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n\nFor endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.\n"
},
"Security_Endpoint_Exceptions_API_FindEndpointListItemsFilter": {
"$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString"
},
"Security_Endpoint_Exceptions_API_ListId": {
"minLength": 1,
"type": "string",
"description": "Value list's identifier.",
"format": "nonempty",
"example": "21b01cfb-058d-44b9-838c-282be16c91cd"
},
"Security_Endpoint_Exceptions_API_ListType": {
"enum": [
"binary",
"boolean",
"byte",
"date",
"date_nanos",
"date_range",
"double",
"double_range",
"float",
"float_range",
"geo_point",
"geo_shape",
"half_float",
"integer",
"integer_range",
"ip",
"ip_range",
"keyword",
"long",
"long_range",
"shape",
"short",
"text"
],
"type": "string",
"description": "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:\n\n- `keyword`: Many ECS fields are Elasticsearch keywords\n- `ip`: IP addresses\n- `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)\n"
},
"Security_Endpoint_Exceptions_API_NonEmptyString": {
"minLength": 1,
"type": "string",
"description": "A string that does not contain only whitespace characters",
"format": "nonempty"
},
"Security_Endpoint_Exceptions_API_PlatformErrorResponse": {
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer"
}
}
},
"Security_Endpoint_Exceptions_API_SiemErrorResponse": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"Security_Endpoint_Management_API_ActionDetailsResponse": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_KillProcess"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_GetFile"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Execute"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Runscript"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Upload"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Scan"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Cancel"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Isolate"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Unisolate"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_SuspendProcess"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RunningProcesses"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_MemoryDump"
}
],
"discriminator": {
"propertyName": "command",
"mapping": {
"cancel": "#/components/schemas/Security_Endpoint_Management_API_Cancel",
"execute": "#/components/schemas/Security_Endpoint_Management_API_Execute",
"get-file": "#/components/schemas/Security_Endpoint_Management_API_GetFile",
"isolate": "#/components/schemas/Security_Endpoint_Management_API_Isolate",
"kill-process": "#/components/schemas/Security_Endpoint_Management_API_KillProcess",
"memory-dump": "#/components/schemas/Security_Endpoint_Management_API_MemoryDump",
"running-processes": "#/components/schemas/Security_Endpoint_Management_API_RunningProcesses",
"runscript": "#/components/schemas/Security_Endpoint_Management_API_Runscript",
"scan": "#/components/schemas/Security_Endpoint_Management_API_Scan",
"suspend-process": "#/components/schemas/Security_Endpoint_Management_API_SuspendProcess",
"unisolate": "#/components/schemas/Security_Endpoint_Management_API_Unisolate",
"upload": "#/components/schemas/Security_Endpoint_Management_API_Upload"
}
}
},
"Security_Endpoint_Management_API_ActionStateSuccessResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"canEncrypt": {
"type": "boolean",
"description": "Whether the Kibana instance has encryption enabled for response actions."
}
}
}
}
},
"Security_Endpoint_Management_API_ActionStatusSuccessResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"required": [
"agent_id",
"pending_actions"
],
"type": "object",
"properties": {
"agent_id": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentId"
},
"pending_actions": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionsSchema"
}
}
},
"description": "One pending-actions summary entry per requested agent."
}
}
},
"Security_Endpoint_Management_API_AgentId": {
"maxLength": 256,
"type": "string",
"description": "Agent ID"
},
"Security_Endpoint_Management_API_AgentIds": {
"minLength": 1,
"oneOf": [
{
"maxItems": 250,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"maxLength": 256,
"minLength": 1,
"type": "string"
}
],
"description": "A list of agent IDs. Max of 250.",
"example": [
"agent-id-1",
"agent-id-2"
]
},
"Security_Endpoint_Management_API_AgentTypes": {
"enum": [
"endpoint",
"sentinel_one",
"crowdstrike",
"microsoft_defender_endpoint"
],
"type": "string",
"description": "List of agent types to retrieve. Defaults to `endpoint`.",
"example": "endpoint"
},
"Security_Endpoint_Management_API_ApiPageSize": {
"maximum": 1000,
"minimum": 1,
"type": "integer",
"description": "Number of items per page",
"default": 10,
"example": 10
},
"Security_Endpoint_Management_API_ApiSortField": {
"enum": [
"name",
"createdAt",
"createdBy",
"updatedAt",
"updatedBy",
"fileSize"
],
"type": "string",
"description": "Determines which field is used to sort the results.",
"example": "updatedAt"
},
"Security_Endpoint_Management_API_ArchivePathToExecutableSchema": {
"maxLength": 4096,
"type": "string",
"description": "Used only for when the uploaded script is an archive (.zip file for example). This property defines the relative path to the file included in the archive that should be executed once its contents are extracted. The path should be relative to the root of the archive.",
"example": "./bin/script.sh"
},
"Security_Endpoint_Management_API_Cancel": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"type": "object",
"properties": {
"code": {
"type": "string"
}
}
}
}
}
},
"parameters": {
"type": "object",
"properties": {
"id": {
"type": "string",
"format": "uuid"
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_CancelRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ElasticDefendCancelParameters"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_MDECancelParameters"
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_CloudFileScriptParameters": {
"required": [
"cloudFile"
],
"type": "object",
"properties": {
"cloudFile": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "Script name in cloud storage."
},
"commandLine": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "Command line arguments."
},
"timeout": {
"minimum": 1,
"type": "integer",
"description": "Timeout in seconds."
}
}
},
"Security_Endpoint_Management_API_Command": {
"minLength": 1,
"enum": [
"isolate",
"unisolate",
"kill-process",
"suspend-process",
"running-processes",
"get-file",
"execute",
"upload",
"scan",
"runscript",
"cancel",
"memory-dump"
],
"type": "string",
"description": "The command for the response action"
},
"Security_Endpoint_Management_API_Commands": {
"maxItems": 50,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Command"
},
"description": "A list of response action command names.",
"example": [
"isolate",
"unisolate"
]
},
"Security_Endpoint_Management_API_Comment": {
"maxLength": 30000,
"type": "string",
"description": "Optional comment",
"example": "This is a comment"
},
"Security_Endpoint_Management_API_CreateScriptRouteRequestBody": {
"required": [
"name",
"platform",
"file",
"fileType"
],
"type": "object",
"properties": {
"description": {
"maxLength": 10000,
"type": "string",
"description": "Description of the script and its purpose/functionality"
},
"example": {
"maxLength": 10000,
"type": "string",
"description": "Example usage of the script"
},
"file": {
"type": "object",
"description": "The script file upload",
"format": "binary"
},
"fileType": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptFileType"
},
"instructions": {
"maxLength": 10000,
"type": "string",
"description": "Instructions for using the script, including details around its supported input arguments"
},
"name": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ScriptNameSchema"
},
"pathToExecutable": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ArchivePathToExecutableSchema"
},
"platform": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform"
},
"description": "Platforms supported by the the script"
},
"requiresInput": {
"type": "boolean",
"description": "Whether the script requires input arguments"
},
"tags": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags"
},
"description": "Tags to categorize the script"
}
}
},
"Security_Endpoint_Management_API_DownloadUri": {
"type": "object",
"properties": {
"downloadUri": {
"type": "string",
"description": "The server relative URI to download the file associated with the output of the response action.\nURI does **not** include the space prefix\n",
"format": "uri-reference",
"example": "/api/endpoint/action/497f6eca-6276/file/35645-6276-4993/download"
}
}
},
"Security_Endpoint_Management_API_ElasticDefendCancelParameters": {
"title": "ElasticDefendCancelParameters",
"required": [
"id"
],
"type": "object",
"properties": {
"force": {
"type": "boolean",
"description": "Forcefully cancel the response action even when it is already running",
"example": true
},
"id": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "ID of the response action to cancel",
"example": "7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d"
}
},
"description": "Elastic Defend agent type"
},
"Security_Endpoint_Management_API_EndDate": {
"maxLength": 64,
"type": "string",
"description": "An end date in ISO format or Date Math format.",
"example": "2023-10-31T23:59:59.999Z"
},
"Security_Endpoint_Management_API_EndpointIds": {
"maxItems": 250,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "List of endpoint IDs (cannot contain empty strings). Max of 250.",
"example": [
"endpoint-id-1",
"endpoint-id-2"
]
},
"Security_Endpoint_Management_API_EndpointMetadataResponse": {
"type": "object",
"example": {
"host_status": "healthy",
"last_checkin": "2023-07-04T15:48:57.360Z",
"metadata": {
"@timestamp": "2023-07-04T15:48:57.3609346Z",
"agent": {
"build": {
"original": "version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab"
},
"id": "abb8a826-6812-448c-a571-6d8269b51449",
"type": "endpoint",
"version": "7.16.0"
},
"data_stream": {
"dataset": "endpoint.metadata",
"namespace": "default",
"type": "metrics"
},
"ecs": {
"version": "1.11.0"
},
"elastic": {
"agent": {
"id": "abb8a826-6812-448c-a571-6d8269b51449"
}
},
"Endpoint": {
"capabilities": [
"isolation"
],
"configuration": {
"isolation": false
},
"policy": {
"applied": {
"endpoint_policy_version": "2",
"id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
"name": "test",
"status": "success",
"version": "3"
}
},
"state": {
"isolation": false
},
"status": "enrolled"
},
"event": {
"action": "endpoint_metadata",
"agent_id_status": "verified",
"category": [
"host"
],
"created": "2023-07-04T15:48:57.3609346Z",
"dataset": "endpoint.metadata",
"id": "MNtRc++KoKHXXwlj+++++OhZ",
"ingested": "2023-07-04T15:48:58Z",
"kind": "metric",
"module": "endpoint",
"sequence": 43757,
"type": [
"info"
]
},
"host": {
"architecture": "x86_64",
"hostname": "WinDev2104Eval",
"id": "17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5",
"ip": [
"10.0.2.15",
"fe80::21a6:63d3:d70e:e3ad",
"127.0.0.1",
"::1"
],
"mac": [
"08:00:27:b1:1d:5a"
],
"name": "WinDev2104Eval",
"os": {
"Ext": {
"variant": "Windows 10 Enterprise Evaluation"
},
"family": "windows",
"full": "Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)",
"kernel": "20H2 (10.0.19042.906)",
"name": "Windows",
"platform": "windows",
"type": "windows",
"version": "20H2 (10.0.19042.906)"
}
},
"message": "Endpoint metadata",
"policy_info": {
"agent": {
"applied": {
"id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753",
"revision": 3
},
"configured": {
"id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753",
"revision": 3
}
},
"endpoint": {
"id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
"revision": 2
}
}
}
}
},
"Security_Endpoint_Management_API_EndpointRunScriptParameters": {
"title": "Elastic Defend Run Script Parameters",
"required": [
"scriptId"
],
"type": "object",
"properties": {
"scriptId": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The script ID from the scripts library that will be executed."
},
"scriptInput": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "The input parameter arguments (if any) for the script that will be executed."
}
},
"description": "Parameters for Run Script response action against Elastic Defend agent type.",
"example": {
"agent_type": "endpoint",
"endpoint_ids": [
"endpoint-id-1"
],
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888",
"scriptInput": "--some-parameter some-value"
}
}
},
"Security_Endpoint_Management_API_EndpointScript": {
"type": "object",
"properties": {
"createdAt": {
"type": "string",
"format": "date-time"
},
"createdBy": {
"type": "string",
"example": "elastic"
},
"description": {
"type": "string",
"description": "Description of the script and its purpose/functionality",
"example": "Collects host data for investigation"
},
"downloadUri": {
"type": "string",
"description": "URI to download the script file. Note that this is the relative path and does not include the space (if applicable)",
"example": "/api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download"
},
"example": {
"type": "string"
},
"fileHash": {
"type": "string",
"description": "SHA256 hash of the script file that was uploaded",
"example": "abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8"
},
"fileName": {
"type": "string",
"description": "Name of the script file that was uploaded",
"example": "collect_host_data.sh"
},
"fileSize": {
"type": "integer",
"description": "Size of the script file that was uploaded in bytes",
"example": 12345
},
"id": {
"type": "string",
"format": "uuid",
"example": "123e4567-e89b-12d3-a456-426655440000"
},
"instructions": {
"type": "string",
"description": "Instructions for using the script, including details around its supported input arguments"
},
"name": {
"type": "string",
"example": "Collect host data"
},
"pathToExecutable": {
"type": "string",
"description": "The relative path to the file included in the archive that should be executed once its contents are extracted. Applicable only for scripts uploaded as an archive (.zip file for example).\n"
},
"platform": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform"
}
},
"requiresInput": {
"type": "boolean"
},
"tags": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags"
},
"description": "Tags that categorize the script"
},
"updatedAt": {
"type": "string",
"format": "date-time"
},
"updatedBy": {
"type": "string",
"example": "admin"
},
"version": {
"type": "string"
}
}
},
"Security_Endpoint_Management_API_EndpointScriptFileType": {
"enum": [
"script",
"archive"
],
"type": "string",
"description": "The type of the uploaded file, which determines the expected value of `pathToExecutable`. If `fileType` is \"script\", then `pathToExecutable` should not be included. If `fileType` is \"archive\", then `pathToExecutable` is required and should specify the path to the executable file within the archive."
},
"Security_Endpoint_Management_API_EndpointScriptPlatform": {
"enum": [
"linux",
"macos",
"windows"
],
"type": "string"
},
"Security_Endpoint_Management_API_EndpointScriptTags": {
"enum": [
"remediationAction",
"dataCollection",
"networkDiagnostics",
"networkAction",
"systemInventory",
"forensicCollection",
"threatHunting",
"discovery",
"systemManagement",
"userManagement",
"troubleshooting"
],
"type": "string"
},
"Security_Endpoint_Management_API_Execute": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_DownloadUri"
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"cwd": {
"type": "string"
},
"output_file_id": {
"type": "string"
},
"output_file_stderr_truncated": {
"type": "boolean"
},
"output_file_stdout_truncated": {
"type": "boolean"
},
"shell_code": {
"type": "number"
},
"stderr": {
"type": "string"
},
"stderr_truncated": {
"type": "boolean"
},
"stdout": {
"type": "string"
},
"stdout_truncated": {
"type": "boolean"
}
}
}
]
}
}
}
},
"parameters": {
"type": "object",
"properties": {
"command": {
"type": "string"
},
"timeout": {
"type": "number"
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_ExecuteRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"required": [
"command"
],
"type": "object",
"properties": {
"command": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "The shell command to execute on the endpoint."
},
"timeout": {
"minimum": 1,
"type": "integer",
"description": "The maximum timeout value in seconds before the command is terminated."
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_GetEndpointActionListResponse": {
"type": "object",
"properties": {
"agentTypes": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of agent types the query was filtered by."
},
"commands": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of commands the query was filtered by."
},
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
"description": "The list of response actions."
},
"elasticAgentIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of elastic agent IDs the query was filtered by."
},
"endDate": {
"type": "string",
"description": "The end date filter applied to the query."
},
"page": {
"type": "integer",
"description": "The current page number."
},
"pageSize": {
"type": "integer",
"description": "The number of items per page."
},
"startDate": {
"type": "string",
"description": "The start date filter applied to the query."
},
"statuses": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of statuses the query was filtered by."
},
"total": {
"type": "integer",
"description": "The total number of response actions matching the query."
},
"userIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of user IDs the query was filtered by."
}
},
"example": {
"data": [
{
"agents": [
"afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
],
"agentType": "endpoint",
"command": "running-processes",
"completedAt": "2022-08-08T09:50:47.672Z",
"createdBy": "elastic",
"id": "b3d6de74-36b0-4fa8-be46-c375bf1771bf",
"isCompleted": true,
"isExpired": false,
"startedAt": "2022-08-08T15:24:57.402Z",
"wasSuccessful": true
},
{
"agents": [
"afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
],
"agentType": "endpoint",
"command": "isolate",
"completedAt": "2022-08-08T10:41:57.352Z",
"createdBy": "elastic",
"id": "43b4098b-8752-4fbb-a7a7-6df7c74d0ee3",
"isCompleted": true,
"isExpired": false,
"startedAt": "2022-08-08T15:23:37.359Z",
"wasSuccessful": true
},
{
"agents": [
"afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
],
"agentType": "endpoint",
"command": "kill-process",
"comment": "bad process - taking up too much cpu",
"completedAt": "2022-08-08T09:44:50.952Z",
"createdBy": "elastic",
"id": "5bc92c86-b8e6-42dd-837f-12ad29e09caa",
"isCompleted": true,
"isExpired": false,
"startedAt": "2022-08-08T14:38:44.125Z",
"wasSuccessful": true
},
{
"agents": [
"afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
],
"agentType": "endpoint",
"command": "unisolate",
"comment": "Not a threat to the network",
"completedAt": "2022-08-08T09:40:47.398Z",
"createdBy": "elastic",
"id": "790d54e0-3aa3-4e5b-8255-3ce9d851246a",
"isCompleted": true,
"isExpired": false,
"startedAt": "2022-08-08T14:38:15.391Z",
"wasSuccessful": true
}
],
"elasticAgentIds": [
"afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
],
"endDate": "now",
"page": 1,
"pageSize": 10,
"startDate": "now-24h/h",
"total": 4
}
},
"Security_Endpoint_Management_API_GetFile": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_DownloadUri"
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"contents": {
"type": "array",
"items": {
"type": "object",
"properties": {
"file_name": {
"type": "string"
},
"path": {
"type": "string"
},
"sha256": {
"type": "string"
},
"size": {
"type": "number"
},
"type": {
"type": "string"
}
}
}
},
"zip_size": {
"type": "number"
}
}
}
]
}
}
}
},
"parameters": {
"type": "object",
"properties": {
"path": {
"type": "string"
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_GetFileRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"required": [
"path"
],
"type": "object",
"properties": {
"path": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "The full file path to retrieve from the endpoint."
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_GetProcessesRouteRequestBody": {
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
"Security_Endpoint_Management_API_HostPathScriptParameters": {
"required": [
"hostPath"
],
"type": "object",
"properties": {
"commandLine": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "Command line arguments."
},
"hostPath": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "Absolute or relative path of script on host machine."
},
"timeout": {
"minimum": 1,
"type": "integer",
"description": "Timeout in seconds."
}
}
},
"Security_Endpoint_Management_API_HostStatuses": {
"maxItems": 20,
"type": "array",
"items": {
"enum": [
"healthy",
"offline",
"updating",
"inactive",
"unenrolled"
],
"type": "string"
},
"description": "A set of agent health statuses to filter by.",
"example": [
"healthy",
"updating"
]
},
"Security_Endpoint_Management_API_Isolate": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"description": "Details of an isolate action response."
}
]
},
"Security_Endpoint_Management_API_IsolateRouteResponse": {
"type": "object",
"properties": {
"action": {
"type": "string",
"description": "The action ID (legacy field, same as `data.id`)."
},
"data": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
}
}
},
"Security_Endpoint_Management_API_KillProcess": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"oneOf": [
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"command": {
"type": "string"
},
"pid": {
"type": "number"
}
}
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"command": {
"type": "string"
},
"entity_id": {
"type": "string"
}
}
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"command": {
"type": "string"
},
"process_name": {
"type": "string"
}
}
}
]
}
}
}
},
"parameters": {
"oneOf": [
{
"type": "object",
"properties": {
"pid": {
"minimum": 1,
"type": "number",
"description": "The process ID (PID) of the process to terminate."
}
}
},
{
"type": "object",
"properties": {
"entity_id": {
"minLength": 1,
"type": "string",
"description": "The entity ID of the process to terminate."
}
}
},
{
"type": "object",
"properties": {
"process_name": {
"type": "string",
"description": "The name of the process to terminate. Valid for SentinelOne agent type only."
}
}
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_KillProcessRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"oneOf": [
{
"type": "object",
"properties": {
"pid": {
"minimum": 1,
"type": "integer",
"description": "The process ID (PID) of the process to terminate.",
"example": 123
}
}
},
{
"type": "object",
"properties": {
"entity_id": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The entity ID of the process to terminate.",
"example": "abc123"
}
}
},
{
"type": "object",
"properties": {
"process_name": {
"maxLength": 1024,
"minLength": 1,
"type": "string",
"description": "The name of the process to terminate. Valid for SentinelOne agent type only.",
"example": "Elastic"
}
}
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_Kuery": {
"maxLength": 30000,
"type": "string",
"description": "A KQL string.",
"example": "united.endpoint.host.os.name : 'Windows'"
},
"Security_Endpoint_Management_API_MDECancelParameters": {
"title": "MDECancelParameters",
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"maxLength": 50,
"minLength": 1,
"type": "string",
"description": "ID of the response action to cancel",
"example": "7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d"
}
},
"description": "Microsoft Defender for Endpoint agent type"
},
"Security_Endpoint_Management_API_MDERunScriptParameters": {
"title": "Microsoft Defender Endpoint Run Script Parameters",
"required": [
"scriptName"
],
"type": "object",
"properties": {
"args": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "Optional command line arguments for the script."
},
"scriptName": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The name of the script to execute from the cloud storage."
}
},
"description": "Parameters for Run Script response action against Microsoft Defender Endpoint agent type.",
"example": {
"agent_type": "microsoft_defender_endpoint",
"endpoint_ids": [
"endpoint-id-1"
],
"parameters": {
"args": "-param1 value1 -param2 value2",
"scriptName": "my-script.ps1"
}
}
},
"Security_Endpoint_Management_API_MemoryDump": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"title": "Memory dump output",
"type": "object",
"properties": {
"code": {
"type": "string"
},
"disk_free_space": {
"type": "number",
"description": "The free space on the host machine in bytes after the memory dump is written to disk"
},
"file_size": {
"type": "string",
"description": "The size of the memory dump compressed file in bytes"
},
"path": {
"type": "string",
"description": "The path to the memory dump compressed file on the host machine"
}
}
}
}
}
},
"parameters": {
"oneOf": [
{
"title": "Kernel memory dump",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"kernel"
],
"type": "string",
"description": "Kernel-level memory dump"
}
}
},
{
"title": "Process memory dump with PID",
"required": [
"type",
"pid"
],
"type": "object",
"properties": {
"pid": {
"type": "number",
"description": "The process ID (PID)"
},
"type": {
"enum": [
"process"
],
"type": "string",
"description": "Process-level memory dump using a process ID"
}
}
},
{
"title": "Process memory dump with entity ID",
"required": [
"type",
"entity_id"
],
"type": "object",
"properties": {
"entity_id": {
"type": "string",
"description": "The process entity ID"
},
"type": {
"enum": [
"process"
],
"type": "string",
"description": "Process-level memory dump using an entity ID"
}
}
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_MemoryDumpRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"oneOf": [
{
"title": "kernel",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"kernel"
],
"type": "string"
}
},
"description": "Dump the entire kernel memory."
},
{
"title": "raw",
"required": [
"type"
],
"type": "object",
"properties": {
"type": {
"enum": [
"raw"
],
"type": "string"
}
},
"description": "Dump the entire raw memory."
},
{
"title": "Process PID",
"required": [
"type",
"pid"
],
"type": "object",
"properties": {
"pid": {
"type": "number"
},
"type": {
"enum": [
"process"
],
"type": "string"
}
},
"description": "Dump the entire memory of a process using the PID."
},
{
"title": "Process Entity ID",
"required": [
"type",
"entity_id"
],
"type": "object",
"properties": {
"entity_id": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"type": {
"enum": [
"process"
],
"type": "string"
}
},
"description": "Dump the entire memory of a process using the entity ID."
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_MetadataListResponse": {
"type": "object",
"example": {
"data": [
{
"host_status": "healthy",
"last_checkin": "2023-07-04T15:47:57.432Z",
"metadata": {
"@timestamp": "2023-07-04T15:47:57.432173535Z",
"agent": {
"build": {
"original": "version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab"
},
"id": "285297c6-3bff-4b83-9a07-f3e749801123",
"type": "endpoint",
"version": "7.16.0"
},
"data_stream": {
"dataset": "endpoint.metadata",
"namespace": "default",
"type": "metrics"
},
"ecs": {
"version": "1.11.0"
},
"elastic": {
"agent": {
"id": "285297c6-3bff-4b83-9a07-f3e749801123"
}
},
"Endpoint": {
"capabilities": [
"isolation"
],
"configuration": {
"isolation": false
},
"policy": {
"applied": {
"endpoint_policy_version": "2",
"id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
"name": "test",
"status": "success",
"version": "3"
}
},
"state": {
"isolation": false
},
"status": "enrolled"
},
"event": {
"action": "endpoint_metadata",
"agent_id_status": "verified",
"category": [
"host"
],
"created": "2023-07-04T15:47:57.432173535Z",
"dataset": "endpoint.metadata",
"id": "MNtSXK/SkhEBnmgt++++++7S",
"ingested": "2023-07-04T15:47:58Z",
"kind": "metric",
"module": "endpoint",
"sequence": 400,
"type": [
"info"
]
},
"host": {
"architecture": "x86_64",
"hostname": "david-Xubuntu",
"id": "0cfead88e2024bd8a27476352b5ab264",
"ip": [
"127.0.0.1",
"::1",
"10.0.2.15",
"fe80::2ac7:8e15:b957:2fa1"
],
"mac": [
"08:00:27:e6:78:8b"
],
"name": "david-Xubuntu",
"os": {
"Ext": {
"variant": "Ubuntu"
},
"family": "ubuntu",
"full": "Ubuntu 20.04.2",
"kernel": "5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021",
"name": "Linux",
"platform": "ubuntu",
"type": "linux",
"version": "20.04.2"
}
},
"message": "Endpoint metadata"
},
"policy_info": {
"agent": {
"applied": {
"id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753",
"revision": 0
},
"configured": {
"id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753",
"revision": 3
}
},
"endpoint": {
"id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
"revision": 2
}
}
},
{
"host_status": "healthy",
"last_checkin": "2023-07-04T15:44:31.491Z",
"metadata": {
"@timestamp": "2023-07-04T15:44:31.4917849Z",
"agent": {
"build": {
"original": "version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab"
},
"id": "abb8a826-6812-448c-a571-6d8269b51449",
"type": "endpoint",
"version": "7.16.0"
},
"data_stream": {
"dataset": "endpoint.metadata",
"namespace": "default",
"type": "metrics"
},
"ecs": {
"version": "1.11.0"
},
"elastic": {
"agent": {
"id": "abb8a826-6812-448c-a571-6d8269b51449"
}
},
"Endpoint": {
"capabilities": [
"isolation"
],
"configuration": {
"isolation": false
},
"policy": {
"applied": {
"endpoint_policy_version": "2",
"id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
"name": "test",
"status": "success",
"version": "3"
}
},
"state": {
"isolation": false
},
"status": "enrolled"
},
"event": {
"action": "endpoint_metadata",
"agent_id_status": "verified",
"category": [
"host"
],
"created": "2023-07-04T15:44:31.4917849Z",
"dataset": "endpoint.metadata",
"id": "MNtRc++KoKHXXwlj+++++/N9",
"ingested": "2023-07-04T15:44:33Z",
"kind": "metric",
"module": "endpoint",
"sequence": 5159,
"type": [
"info"
]
},
"host": {
"architecture": "x86_64",
"hostname": "WinDev2104Eval",
"id": "17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5",
"ip": [
"10.0.2.15",
"fe80::21a6:63d3:d70e:e3ad",
"127.0.0.1",
"::1"
],
"mac": [
"08:00:27:b1:1d:5a"
],
"name": "WinDev2104Eval",
"os": {
"Ext": {
"variant": "Windows 10 Enterprise Evaluation"
},
"family": "windows",
"full": "Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)",
"kernel": "20H2 (10.0.19042.906)",
"name": "Windows",
"platform": "windows",
"type": "windows",
"version": "20H2 (10.0.19042.906)"
}
},
"message": "Endpoint metadata"
},
"policy_info": {
"agent": {
"applied": {
"id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753",
"revision": 0
},
"configured": {
"id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753",
"revision": 3
}
},
"endpoint": {
"id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
"revision": 2
}
}
}
],
"page": 0,
"pageSize": 10,
"sortDirection": "desc",
"sortField": "enrolled_at",
"total": 2
}
},
"Security_Endpoint_Management_API_Page": {
"minimum": 1,
"type": "integer",
"description": "Page number",
"default": 1,
"example": 1
},
"Security_Endpoint_Management_API_PageSize": {
"maximum": 100,
"minimum": 1,
"type": "integer",
"description": "Number of items per page",
"default": 10,
"example": 10
},
"Security_Endpoint_Management_API_Parameters": {
"type": "object",
"description": "Parameters object"
},
"Security_Endpoint_Management_API_PatchUpdateScriptRouteRequestBody": {
"minProperties": 1,
"type": "object",
"properties": {
"description": {
"maxLength": 10000,
"type": "string",
"description": "Description of the script and its purpose/functionality"
},
"example": {
"maxLength": 10000,
"type": "string",
"description": "Example usage of the script"
},
"file": {
"type": "object",
"description": "The script file upload",
"format": "binary"
},
"fileType": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptFileType"
},
"instructions": {
"maxLength": 10000,
"type": "string",
"description": "Instructions for using the script, including details around its supported input arguments"
},
"name": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ScriptNameSchema"
},
"pathToExecutable": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ArchivePathToExecutableSchema"
},
"platform": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform"
},
"description": "Platforms supported by the the script"
},
"requiresInput": {
"type": "boolean",
"description": "Whether the script requires input arguments"
},
"tags": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags"
},
"description": "Tags to categorize the script"
},
"version": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Version of the script"
}
},
"description": "The script entry properties to be updated. At least one property must be provided."
},
"Security_Endpoint_Management_API_PendingActionDataType": {
"type": "integer",
"description": "Number of pending actions of this type."
},
"Security_Endpoint_Management_API_PendingActionsSchema": {
"oneOf": [
{
"type": "object",
"properties": {
"execute": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"get-file": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"isolate": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"kill-process": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"running-processes": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"scan": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"suspend-process": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"unisolate": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
},
"upload": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType"
}
}
},
{
"type": "object"
}
]
},
"Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse": {
"type": "object",
"properties": {
"note": {
"type": "string",
"description": "A note associated with the protection updates for the given package policy."
}
}
},
"Security_Endpoint_Management_API_RawScriptParameters": {
"required": [
"raw"
],
"type": "object",
"properties": {
"commandLine": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "Command line arguments."
},
"raw": {
"maxLength": 65536,
"minLength": 1,
"type": "string",
"description": "Raw script content."
},
"timeout": {
"minimum": 1,
"type": "integer",
"description": "Timeout in seconds."
}
}
},
"Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse": {
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
}
},
"example": {
"data": {
"agents": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"agentState": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"isCompleted": false,
"wasSuccessful": false
}
},
"agentType": "__agent__type__here_",
"command": "__command__name__here__",
"createdBy": "elastic",
"hosts": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"name": "gke-node-1235412"
}
},
"id": "233db9ea-6733-4849-9226-5a7039c7161d",
"isCompleted": false,
"isExpired": false,
"outputs": { },
"parameters": { },
"startedAt": "2022-07-29T19:08:49.126Z",
"status": "pending",
"wasSuccessful": false
}
}
},
"Security_Endpoint_Management_API_ResponseActionDetails": {
"required": [
"command"
],
"type": "object",
"properties": {
"agents": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"description": "The agent IDs for the hosts that the response action was sent to"
},
"agentState": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"completedAt": {
"type": "string",
"description": "The date and time the response action was completed for the agent ID"
},
"isCompleted": {
"type": "boolean",
"description": "Whether the response action is completed for the agent ID"
},
"wasCanceled": {
"type": "boolean",
"description": "Whether the response action was canceled for the agent ID"
},
"wasSuccessful": {
"type": "boolean",
"description": "Whether the response action was successful for the agent ID"
}
},
"format": "uuid"
},
"description": "The state of the response action for each agent ID that it was sent to"
},
"agentType": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"command": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Command"
},
"completedAt": {
"type": "string",
"description": "The response action completion time",
"format": "date-time"
},
"createdBy": {
"type": "string",
"description": "The user who created the response action"
},
"hosts": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The host name"
}
},
"format": "uuid"
},
"description": "An object containing the host names associated with the agent IDs the response action was sent to"
},
"id": {
"type": "string",
"description": "The response action ID",
"format": "uuid"
},
"isComplete": {
"type": "boolean",
"description": "Whether the response action is complete"
},
"isExpired": {
"type": "boolean",
"description": "Whether the response action is expired"
},
"outputs": {
"type": "object",
"additionalProperties": {
"title": "Agent ID",
"required": [
"type",
"content"
],
"type": "object",
"properties": {
"content": {
"type": [
"string",
"object"
],
"description": "The response action output content for the agent ID. Exact format depends on the response action command."
},
"type": {
"enum": [
"json",
"text"
],
"type": "string"
}
},
"description": "The agent id",
"format": "uuid"
},
"description": "The outputs of the response action for each agent ID that it was sent to. Content different depending on the\nresponse action command and will only be present for agents that have responded to the response action\n"
},
"parameters": {
"type": "object",
"description": "The parameters of the response action. Content different depending on the response action command"
},
"startedAt": {
"type": "string",
"description": "The response action start time",
"format": "date-time"
},
"status": {
"type": "string",
"description": "The response action status"
},
"wasCanceled": {
"type": "boolean",
"description": "Whether the response action was canceled"
},
"wasSuccessful": {
"type": "boolean",
"description": "Whether the response action was successful"
}
}
},
"Security_Endpoint_Management_API_RunningProcesses": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputEndpoint"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne"
}
]
}
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_RunningProcessesOutputEndpoint": {
"type": "object",
"properties": {
"code": {
"type": "string"
},
"entries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"command": {
"type": "string"
},
"entity_id": {
"type": "string"
},
"pid": {
"type": "number"
},
"user": {
"type": "string"
}
}
}
}
},
"description": "Processes output for `agentType` of `endpoint`"
},
"Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_DownloadUri"
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
}
},
"description": "Processes output for `agentType` of `sentinel_one`"
}
]
},
"Security_Endpoint_Management_API_Runscript": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_DownloadUri"
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"stderr": {
"type": "string"
},
"stdout": {
"type": "string"
}
}
}
]
}
}
}
},
"parameters": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsCrowdStrike"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsMicrosoft"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsSentinelOne"
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_RunscriptParamsCrowdStrike": {
"type": "object",
"properties": {
"cloudFile": {
"type": "string"
},
"commandLine": {
"type": "string"
},
"hostPath": {
"type": "string"
},
"raw": {
"type": "string"
},
"timeout": {
"type": "number"
}
}
},
"Security_Endpoint_Management_API_RunscriptParamsMicrosoft": {
"type": "object",
"properties": {
"args": {
"type": "string"
},
"scriptName": {
"type": "string"
}
}
},
"Security_Endpoint_Management_API_RunscriptParamsSentinelOne": {
"type": "object",
"properties": {
"scriptId": {
"type": "string"
},
"scriptInput": {
"type": "string"
}
}
},
"Security_Endpoint_Management_API_RunScriptRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointRunScriptParameters"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_RawScriptParameters"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_HostPathScriptParameters"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_CloudFileScriptParameters"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_SentinelOneRunScriptParameters"
},
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_MDERunScriptParameters"
}
],
"description": "One of the following set of parameters must be provided for the `agentType` that is specified.\n"
}
}
}
]
},
"Security_Endpoint_Management_API_Scan": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"type": "object",
"properties": {
"code": {
"type": "string"
}
}
}
}
}
},
"parameters": {
"type": "object",
"properties": {
"path": {
"type": "string"
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_ScanRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"required": [
"path"
],
"type": "object",
"properties": {
"path": {
"maxLength": 4096,
"minLength": 1,
"type": "string",
"description": "The folder or file's full path (including the file name).",
"example": "/usr/my-file.txt"
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_ScriptNameSchema": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Name of the script"
},
"Security_Endpoint_Management_API_ScriptsApiResponse": {
"type": "object",
"properties": {
"data": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointScript"
}
},
"example": {
"data": {
"description": "Collects host data for investigation",
"downloadUri": "/api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download",
"example": "./collect_host_data.sh --help",
"fileHash": "abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8",
"fileName": "collect_host_data.sh",
"fileSize": 12345,
"id": "123e4567-e89b-12d3-a456-426655440000",
"instructions": "Collects host data for investigation",
"name": "Collect host data",
"platform": [
"linux",
"macos"
],
"requiresInput": false
}
}
},
"Security_Endpoint_Management_API_SentinelOneRunScriptParameters": {
"title": "SentinelOne Run Script Parameters",
"required": [
"scriptId"
],
"type": "object",
"properties": {
"scriptId": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The script ID from SentinelOne scripts library that will be executed."
},
"scriptInput": {
"maxLength": 8192,
"minLength": 1,
"type": "string",
"description": "The input parameter arguments for the script that was selected."
}
},
"description": "Parameters for Run Script response action against SentinelOne agent type.",
"example": {
"agent_type": "sentinel_one",
"endpoint_ids": [
"endpoint-id-1"
],
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888",
"scriptInput": "--delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt"
}
}
},
"Security_Endpoint_Management_API_SortDirection": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "Determines the sort order.",
"example": "desc"
},
"Security_Endpoint_Management_API_SortField": {
"enum": [
"enrolled_at",
"metadata.host.hostname",
"host_status",
"metadata.Endpoint.policy.applied.name",
"metadata.Endpoint.policy.applied.status",
"metadata.host.os.name",
"metadata.host.ip",
"metadata.agent.version",
"last_checkin"
],
"type": "string",
"description": "Determines which field is used to sort the results.",
"example": "enrolled_at"
},
"Security_Endpoint_Management_API_StartDate": {
"maxLength": 64,
"type": "string",
"description": "A start date in ISO 8601 format or Date Math format.",
"example": "2023-10-31T00:00:00.000Z"
},
"Security_Endpoint_Management_API_SuccessResponse": {
"type": "object",
"description": "A generic successful response."
},
"Security_Endpoint_Management_API_SuspendProcess": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"oneOf": [
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"command": {
"type": "string"
},
"pid": {
"type": "number"
}
}
},
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"command": {
"type": "string"
},
"entity_id": {
"type": "string"
}
}
}
]
}
}
}
},
"parameters": {
"oneOf": [
{
"type": "object",
"properties": {
"pid": {
"minimum": 1,
"type": "number",
"description": "The process ID (PID) of the process to terminate."
}
}
},
{
"type": "object",
"properties": {
"entity_id": {
"minLength": 1,
"type": "string",
"description": "The entity ID of the process to terminate."
}
}
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_SuspendProcessRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters"
],
"type": "object",
"properties": {
"parameters": {
"oneOf": [
{
"type": "object",
"properties": {
"pid": {
"minimum": 1,
"type": "integer",
"description": "The process ID (PID) of the process to suspend.",
"example": 123
}
}
},
{
"type": "object",
"properties": {
"entity_id": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "The entity ID of the process to suspend.",
"example": "abc123"
}
}
}
]
}
}
}
]
},
"Security_Endpoint_Management_API_Type": {
"enum": [
"automated",
"manual"
],
"type": "string",
"description": "Type of response action"
},
"Security_Endpoint_Management_API_Types": {
"maxLength": 2,
"minLength": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Type"
},
"description": "List of types of response actions",
"example": [
"automated",
"manual"
]
},
"Security_Endpoint_Management_API_Unisolate": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"description": "Details of an unisolate action response."
}
]
},
"Security_Endpoint_Management_API_UnisolateRouteResponse": {
"type": "object",
"properties": {
"action": {
"type": "string",
"description": "The action ID (legacy field, same as `data.id`)."
},
"data": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
}
}
},
"Security_Endpoint_Management_API_Upload": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails"
},
{
"type": "object",
"properties": {
"outputs": {
"type": "object",
"additionalProperties": {
"type": "object",
"properties": {
"content": {
"type": "object",
"properties": {
"code": {
"type": "string"
},
"disk_free_space": {
"type": "number"
},
"path": {
"type": "string"
}
}
}
}
}
},
"parameters": {
"type": "object",
"properties": {
"file_id": {
"type": "string"
},
"file_name": {
"type": "string"
},
"file_sha256": {
"type": "string"
},
"file_size": {
"type": "number"
}
},
"description": "The parameters for upload returned on the details are derived via the API from the file that\nwas uploaded at the time that the response action was submitted\n"
}
}
}
]
},
"Security_Endpoint_Management_API_UploadRouteRequestBody": {
"allOf": [
{
"required": [
"endpoint_ids"
],
"type": "object",
"properties": {
"agent_type": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes"
},
"alert_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.",
"example": [
"alert-id-1",
"alert-id-2"
]
},
"case_ids": {
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
},
"description": "The IDs of cases where the action taken will be logged. Max of 50.",
"example": [
"case-id-1",
"case-id-2"
]
},
"comment": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment"
},
"endpoint_ids": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds"
},
"parameters": {
"$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters"
}
}
},
{
"required": [
"parameters",
"file"
],
"type": "object",
"properties": {
"file": {
"type": "string",
"description": "The binary content of the file.",
"format": "binary",
"example": "RWxhc3RpYw=="
},
"parameters": {
"type": "object",
"properties": {
"overwrite": {
"type": "boolean",
"description": "Overwrite the file on the host if it already exists.",
"default": false,
"example": false
}
}
}
}
}
]
},
"Security_Endpoint_Management_API_UserIds": {
"oneOf": [
{
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"maxLength": 256,
"minLength": 1,
"type": "string"
}
],
"description": "A list of user IDs. Max of 50.",
"example": [
"user-id-1",
"user-id-2"
]
},
"Security_Endpoint_Management_API_WithOutputs": {
"oneOf": [
{
"maxItems": 50,
"minItems": 1,
"type": "array",
"items": {
"maxLength": 256,
"minLength": 1,
"type": "string"
}
},
{
"maxLength": 256,
"minLength": 1,
"type": "string"
}
],
"description": "A list of action IDs that should include the complete output of the action. Max of 50.",
"example": [
"action-id-1",
"action-id-2"
]
},
"Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem": {
"required": [
"message",
"index"
],
"type": "object",
"properties": {
"index": {
"type": "integer"
},
"message": {
"type": "string"
}
}
},
"Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats": {
"required": [
"successful",
"failed",
"total"
],
"type": "object",
"properties": {
"failed": {
"type": "integer"
},
"successful": {
"type": "integer"
},
"total": {
"type": "integer"
}
}
},
"Security_Entity_Analytics_API_AssetCriticalityLevel": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact"
],
"type": "string",
"description": "The criticality level of the asset."
},
"Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload": {
"enum": [
"low_impact",
"medium_impact",
"high_impact",
"extreme_impact",
"unassigned"
],
"type": "string",
"description": "The criticality level of the asset for bulk upload. The value `unassigned` is used to indicate that the criticality level is not assigned and is only used for bulk upload."
},
"Security_Entity_Analytics_API_AssetCriticalityRecord": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord"
},
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts"
},
{
"required": [
"@timestamp"
],
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"description": "The time the record was created or updated.",
"format": "date-time",
"example": "2017-07-21T17:32:28Z"
}
}
}
],
"example": {
"@timestamp": "2024-08-02T11:15:34.290Z",
"asset": {
"criticality": "high_impact"
},
"criticality_level": "high_impact",
"host": {
"asset": {
"criticality": "high_impact"
},
"name": "my_host"
},
"id_field": "host.name",
"id_value": "my_host"
}
},
"Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts": {
"required": [
"asset"
],
"type": "object",
"properties": {
"asset": {
"required": [
"asset"
],
"type": "object",
"properties": {
"criticality": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
}
}
},
"entity": {
"required": [
"id"
],
"type": "object",
"properties": {
"asset": {
"required": [
"criticality"
],
"type": "object",
"properties": {
"criticality": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
}
}
},
"id": {
"type": "string"
}
}
},
"host": {
"required": [
"name"
],
"type": "object",
"properties": {
"asset": {
"required": [
"criticality"
],
"type": "object",
"properties": {
"criticality": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
}
}
},
"name": {
"type": "string"
}
}
},
"service": {
"required": [
"name"
],
"type": "object",
"properties": {
"asset": {
"required": [
"criticality"
],
"type": "object",
"properties": {
"criticality": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
}
}
},
"name": {
"type": "string"
}
}
},
"user": {
"required": [
"name"
],
"type": "object",
"properties": {
"asset": {
"required": [
"criticality"
],
"type": "object",
"properties": {
"criticality": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
}
}
},
"name": {
"type": "string"
}
}
}
}
},
"Security_Entity_Analytics_API_AssetCriticalityRecordIdParts": {
"required": [
"id_value",
"id_field"
],
"type": "object",
"properties": {
"id_field": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_IdField"
},
"id_value": {
"type": "string",
"description": "The ID value of the asset."
}
}
},
"Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse": {
"required": [
"cleanup_successful",
"errors"
],
"type": "object",
"properties": {
"cleanup_successful": {
"type": "boolean",
"example": false
},
"errors": {
"type": "array",
"items": {
"required": [
"seq",
"error"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"seq": {
"type": "integer"
}
}
}
}
}
},
"Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse": {
"required": [
"risk_engine_saved_object_configured",
"errors"
],
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"required": [
"seq",
"error"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"seq": {
"type": "integer"
}
}
}
},
"risk_engine_saved_object_configured": {
"type": "boolean",
"example": false
}
}
},
"Security_Entity_Analytics_API_CreateAssetCriticalityRecord": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts"
},
{
"required": [
"criticality_level"
],
"type": "object",
"properties": {
"criticality_level": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
}
}
}
]
},
"Security_Entity_Analytics_API_DateRange": {
"required": [
"start",
"end"
],
"type": "object",
"properties": {
"end": {
"maxLength": 256,
"type": "string",
"description": "End of the lookback period (date math or ISO string, e.g. \"now\")"
},
"start": {
"maxLength": 256,
"type": "string",
"description": "Start of the lookback period (date math or ISO string, e.g. \"now-10d\")"
}
},
"description": "Defines the lookback period for filtering source data by timestamp."
},
"Security_Entity_Analytics_API_EntityAnalyticsPrivileges": {
"required": [
"has_all_required",
"privileges"
],
"type": "object",
"properties": {
"has_all_required": {
"type": "boolean"
},
"has_install_permissions": {
"type": "boolean"
},
"has_read_permissions": {
"type": "boolean"
},
"has_write_permissions": {
"type": "boolean"
},
"install_privileges": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail"
},
"privileges": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail"
}
}
},
"Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail": {
"required": [
"elasticsearch"
],
"type": "object",
"properties": {
"elasticsearch": {
"type": "object",
"properties": {
"cluster": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
},
"index": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
}
}
}
},
"kibana": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
}
}
},
"Security_Entity_Analytics_API_EntityRiskLevels": {
"enum": [
"Unknown",
"Low",
"Moderate",
"High",
"Critical"
],
"type": "string"
},
"Security_Entity_Analytics_API_EntitySourceType": {
"enum": [
"index",
"entity_analytics_integration",
"store"
],
"type": "string"
},
"Security_Entity_Analytics_API_Filter": {
"type": "object",
"properties": {
"kuery": {
"oneOf": [
{
"maxLength": 4096,
"type": "string"
},
{
"type": "object",
"additionalProperties": false
}
]
}
}
},
"Security_Entity_Analytics_API_IdentifierType": {
"enum": [
"host",
"user",
"service",
"generic"
],
"type": "string"
},
"Security_Entity_Analytics_API_IdField": {
"enum": [
"host.name",
"user.name",
"service.name",
"entity.id"
],
"type": "string"
},
"Security_Entity_Analytics_API_Integrations": {
"type": "object",
"properties": {
"syncData": {
"type": "object",
"properties": {
"lastFullSync": {
"type": "string",
"description": "Timestamp of the last full sync from integrations",
"format": "date-time"
},
"lastUpdateProcessed": {
"type": "string",
"description": "Timestamp of the last update processed from integrations",
"format": "date-time"
}
},
"description": "integrations latest full sync and update syncData"
},
"syncMarkerIndex": {
"maxLength": 1000,
"type": "string",
"description": "Index to read latest sync markers from"
}
}
},
"Security_Entity_Analytics_API_Matcher": {
"required": [
"fields",
"values"
],
"type": "object",
"properties": {
"fields": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
},
"values": {
"oneOf": [
{
"maxItems": 1000,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
},
{
"maxItems": 1000,
"type": "array",
"items": {
"type": "boolean"
}
}
],
"description": "Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.\n"
}
}
},
"Security_Entity_Analytics_API_MonitoredUserDoc": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_MonitoredUserUpdateDoc"
},
{
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"format": "date-time"
},
"event": {
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"format": "date-time"
},
"ingested": {
"type": "string",
"format": "date-time"
}
}
},
"user": {
"type": "object",
"properties": {
"entity": {
"type": "object",
"properties": {
"attributes": {
"type": "object",
"properties": {
"Privileged": {
"type": "boolean",
"description": "Indicates if the user is privileged."
}
}
}
}
},
"is_privileged": {
"type": "boolean",
"description": "Indicates if the user is privileged."
},
"name": {
"type": "string"
}
}
}
}
}
]
},
"Security_Entity_Analytics_API_MonitoredUserUpdateDoc": {
"type": "object",
"properties": {
"entity_analytics_monitoring": {
"type": "object",
"properties": {
"labels": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_MonitoringLabel"
}
}
}
},
"id": {
"maxLength": 256,
"type": "string"
},
"labels": {
"type": "object",
"properties": {
"source_ids": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
},
"source_integrations": {
"maxItems": 100,
"type": "array",
"items": {
"maxLength": 256,
"type": "string"
}
},
"sources": {
"maxItems": 100,
"type": "array",
"items": {
"enum": [
"csv",
"index_sync",
"api"
]
}
}
}
},
"user": {
"type": "object",
"properties": {
"is_privileged": {
"type": "boolean",
"description": "Indicates if the user is privileged."
},
"name": {
"maxLength": 512,
"type": "string"
}
}
}
}
},
"Security_Entity_Analytics_API_MonitoringEngineDescriptor": {
"required": [
"status"
],
"type": "object",
"properties": {
"error": {
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "Error message typically only present if the engine is in error state"
}
}
},
"status": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus"
}
}
},
"Security_Entity_Analytics_API_MonitoringEntitySource": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_MonitoringEntitySourceProperties"
},
{
"required": [
"type",
"name",
"id",
"managed"
],
"type": "object",
"properties": {
"apiKeyId": {
"maxLength": 64,
"type": [
"null",
"string"
],
"description": "ID of the API key used for scoped reads from the source index. Only present for index-type sources."
},
"id": {
"type": "string"
}
}
}
]
},
"Security_Entity_Analytics_API_MonitoringEntitySourceProperties": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties"
},
{
"type": "object",
"properties": {
"managed": {
"type": "boolean"
}
}
}
]
},
"Security_Entity_Analytics_API_MonitoringLabel": {
"required": [
"field",
"value",
"source"
],
"type": "object",
"properties": {
"field": {
"maxLength": 256,
"type": "string"
},
"source": {
"type": "string"
},
"value": {
"maxLength": 256,
"type": "string"
}
}
},
"Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus": {
"enum": [
"started",
"error",
"disabled",
"not_installed"
],
"type": "string",
"description": "The status of the Privilege Monitoring Engine"
},
"Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem": {
"required": [
"message",
"index",
"username"
],
"type": "object",
"properties": {
"index": {
"type": [
"null",
"integer"
]
},
"message": {
"type": "string"
},
"username": {
"type": [
"null",
"string"
]
}
}
},
"Security_Entity_Analytics_API_PrivmonUserCsvUploadStats": {
"required": [
"successfulOperations",
"uploaded",
"failedOperations",
"totalOperations"
],
"type": "object",
"properties": {
"failedOperations": {
"type": "integer"
},
"successfulOperations": {
"type": "integer"
},
"totalOperations": {
"type": "integer"
},
"uploaded": {
"type": "integer"
}
}
},
"Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse": {
"required": [
"message",
"full_error"
],
"type": "object",
"properties": {
"full_error": {
"type": "string"
},
"message": {
"type": "string"
}
}
},
"Security_Entity_Analytics_API_RiskEngineScheduleNowResponse": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
}
}
},
"Security_Entity_Analytics_API_RiskScoreHistoryEntry": {
"required": [
"@timestamp",
"calculated_score_norm",
"calculated_level"
],
"type": "object",
"properties": {
"@timestamp": {
"maxLength": 33,
"type": "string",
"format": "date-time"
},
"calculated_level": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityRiskLevels"
},
"calculated_score": {
"type": "number",
"format": "double"
},
"calculated_score_norm": {
"maximum": 100,
"minimum": 0,
"type": "number",
"format": "double"
},
"category_1_count": {
"type": "integer"
},
"category_1_score": {
"type": "number",
"format": "double"
},
"category_2_count": {
"type": "integer"
},
"category_2_score": {
"type": "number",
"format": "double"
},
"criticality_level": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel"
},
"inputs": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_RiskScoreInput"
},
"description": "Present only when requested with `include_contributions=true`."
},
"modifiers": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_RiskScoreModifier"
},
"description": "Present only when requested with `include_contributions=true`."
},
"score_type": {
"enum": [
"base",
"propagated",
"resolution"
],
"type": "string"
}
}
},
"Security_Entity_Analytics_API_RiskScoreHistoryResponse": {
"required": [
"entity_id",
"entity_type",
"interval",
"entries"
],
"type": "object",
"properties": {
"entity_id": {
"maxLength": 1000,
"type": "string"
},
"entity_type": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_IdentifierType"
},
"entries": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_RiskScoreHistoryEntry"
}
},
"interval": {
"maxLength": 10,
"type": "string",
"description": "The effective Elasticsearch `date_histogram` interval expression the entries were aggregated into (for example `3h`, `1d`, `1w`), derived from the requested time range."
}
}
},
"Security_Entity_Analytics_API_RiskScoreInput": {
"required": [
"id",
"index",
"description",
"category"
],
"type": "object",
"properties": {
"category": {
"type": "string",
"description": "The risk category of the risk input document.",
"example": "category_1"
},
"contribution_score": {
"type": "number",
"format": "double"
},
"description": {
"type": "string",
"description": "A human-readable description of the risk input document.",
"example": "Generated from Detection Engine Rule: Malware Prevention Alert"
},
"entity_id": {
"type": "string",
"description": "The EUID of the entity within the graph that generated this alert."
},
"id": {
"type": "string",
"description": "The unique identifier (`_id`) of the original source document",
"example": "91a93376a507e86cfbf282166275b89f9dbdb1f0be6c8103c6ff2909ca8e1a1c"
},
"index": {
"type": "string",
"description": "The unique index (`_index`) of the original source document",
"example": ".internal.alerts-security.alerts-default-000001"
},
"risk_score": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "The weighted risk score of the risk input document.",
"format": "double"
},
"timestamp": {
"type": "string",
"description": "The @timestamp of the risk input document.",
"example": "2017-07-21T17:32:28Z"
}
},
"description": "A generic representation of a document contributing to a Risk Score."
},
"Security_Entity_Analytics_API_RiskScoreModifier": {
"required": [
"type",
"contribution"
],
"type": "object",
"properties": {
"contribution": {
"type": "number",
"format": "double"
},
"metadata": {
"type": "object"
},
"modifier_value": {
"type": "number",
"format": "double"
},
"subtype": {
"maxLength": 100,
"type": "string"
},
"type": {
"maxLength": 100,
"type": "string"
}
},
"description": "A modifier that was applied to the risk score calculation."
},
"Security_Entity_Analytics_API_TaskManagerUnavailableResponse": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"minimum": 400,
"type": "integer"
}
},
"description": "Task manager is unavailable"
},
"Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"filter": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_Filter"
},
"identifierField": {
"maxLength": 256,
"type": "string",
"description": "Field used to query the entity store for index-type sources"
},
"indexPattern": {
"maxLength": 1000,
"type": "string"
},
"integrationName": {
"maxLength": 256,
"type": "string"
},
"integrations": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_Integrations"
},
"matchers": {
"maxItems": 100,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_Matcher"
}
},
"name": {
"maxLength": 256,
"type": "string"
},
"queryRule": {
"maxLength": 4096,
"type": "string",
"description": "KQL query used to filter data from the provided index patterns"
},
"range": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_DateRange"
},
"type": {
"$ref": "#/components/schemas/Security_Entity_Analytics_API_EntitySourceType"
}
}
},
"Security_Entity_Analytics_API_UserName": {
"type": "object",
"properties": {
"entity_analytics_monitoring": {
"type": "object",
"properties": {
"labels": {
"maxItems": 100,
"type": "array",
"items": {
"type": "object",
"properties": {
"field": {
"maxLength": 256,
"type": "string",
"description": "The field name for the label"
},
"source": {
"enum": [
"api",
"csv",
"index_sync"
],
"type": "string",
"description": "The source where this label was created (api, csv, or index_sync)"
},
"value": {
"maxLength": 256,
"type": "string",
"description": "The value of the label"
}
}
},
"description": "Array of labels associated with the user"
}
},
"description": "Entity analytics monitoring configuration for the user"
},
"user": {
"type": "object",
"properties": {
"name": {
"maxLength": 512,
"type": "string",
"description": "The name of the user."
}
}
}
}
},
"Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem": {
"required": [
"status",
"matchedEntities"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error message if the row failed to process",
"example": "Invalid entity type"
},
"matchedEntities": {
"type": "integer",
"description": "Number of entities matched for this row",
"example": 1
},
"status": {
"enum": [
"success",
"failure",
"unmatched"
],
"type": "string",
"example": "success"
}
},
"example": {
"matchedEntities": 1,
"status": "success"
}
},
"Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem": {
"required": [
"euid",
"status"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error message if the entity failed to process",
"example": "Invalid entity type"
},
"euid": {
"type": "string",
"description": "The EUID of the entity",
"example": "user:john.doe"
},
"status": {
"enum": [
"success",
"failure",
"not_found"
],
"type": "string",
"example": "success"
}
},
"example": {
"euid": "user:john.doe",
"status": "success"
}
},
"Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem": {
"required": [
"euid",
"status"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "Error message if the entity failed to process",
"example": "Invalid entity type"
},
"euid": {
"type": "string",
"description": "The EUID of the entity",
"example": "user:john.doe"
},
"status": {
"enum": [
"success",
"failure",
"not_found"
],
"type": "string",
"example": "success"
}
},
"example": {
"euid": "user:john.doe",
"status": "success"
}
},
"Security_Entity_Analytics_API_WatchlistObject": {
"required": [
"name",
"riskModifier",
"managed"
],
"type": "object",
"properties": {
"createdAt": {
"type": "string",
"description": "Timestamp indicating when the watchlist was created",
"format": "date-time"
},
"description": {
"type": "string",
"description": "Description of the watchlist"
},
"entityCount": {
"type": "number",
"description": "Number of entities in the watchlist"
},
"entitySourceIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of entity source IDs associated with the watchlist"
},
"hasManualEntities": {
"type": "boolean",
"description": "Indicates whether the watchlist contains manually assigned entities"
},
"id": {
"type": "string",
"description": "The unique ID of the watchlist"
},
"managed": {
"type": "boolean",
"description": "Indicates if the watchlist is managed by the system"
},
"name": {
"type": "string",
"description": "The name of the watchlist"
},
"riskModifier": {
"type": "number",
"description": "Risk score modifier associated with the watchlist"
},
"updatedAt": {
"type": "string",
"description": "Timestamp indicating when the watchlist was last updated",
"format": "date-time"
}
},
"example": {
"createdAt": "2026-01-28T12:00:00.000Z",
"description": "High risk vendor watchlist",
"id": "watchlist-123",
"managed": false,
"name": "High Risk Vendors",
"riskModifier": 1.5,
"updatedAt": "2026-02-18T12:00:00.000Z"
}
},
"Security_Exceptions_API_BlocklistHashOrPathEntry": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"file.hash.md5",
"file.hash.sha1",
"file.hash.sha256",
"file.path",
"file.path.caseless"
],
"type": "string",
"description": "File hash or path field"
},
"operator": {
"enum": [
"included"
],
"type": "string",
"description": "Must be the value \"included\""
},
"type": {
"enum": [
"match_any"
],
"type": "string",
"description": "Must be match_any for blocklists"
},
"value": {
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of hash values or file paths"
}
}
},
"Security_Exceptions_API_BlocklistLinuxProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry"
},
"description": "**Validation rules:**\n* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)\n* Path entry: only 1 allowed\n"
},
"list_id": {
"enum": [
"endpoint_blocklists"
],
"type": "string",
"example": "endpoint_blocklists"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"linux"
],
"type": "string"
},
"description": "Linux-only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Blocklist list item properties (Linux, code signature not supported)."
},
"Security_Exceptions_API_BlocklistMacProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry"
},
"description": "**Validation rules:**\n* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)\n* Path entry: only 1 allowed\n"
},
"list_id": {
"enum": [
"endpoint_blocklists"
],
"type": "string",
"example": "endpoint_blocklists"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"macos"
],
"type": "string"
},
"description": "macOS-only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Blocklist list item properties (macOS, code signature not supported)."
},
"Security_Exceptions_API_BlocklistWindowsCodeSignatureEntry": {
"required": [
"field",
"type",
"entries"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"subject_name"
],
"type": "string",
"description": "Certificate subject name"
},
"operator": {
"enum": [
"included"
],
"type": "string",
"description": "Must be the value \"included\""
},
"type": {
"enum": [
"match",
"match_any"
],
"type": "string",
"description": "Match type for subject name"
},
"value": {
"oneOf": [
{
"type": "string",
"description": "Single subject name (used with match)"
},
{
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of subject names (used with match_any)"
}
]
}
}
},
"description": "Nested subject_name entries"
},
"field": {
"enum": [
"file.Ext.code_signature"
],
"type": "string",
"description": "Windows code signature field"
},
"type": {
"enum": [
"nested"
],
"type": "string",
"description": "Must be nested for Windows code signature"
}
}
},
"Security_Exceptions_API_BlocklistWindowsProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistWindowsCodeSignatureEntry"
}
]
},
"description": "**Validation rules:**\n* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)\n* Path entry: only 1 allowed\n* Code signature entry: only 1 allowed\n"
},
"list_id": {
"enum": [
"endpoint_blocklists"
],
"type": "string",
"example": "endpoint_blocklists"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"windows"
],
"type": "string"
},
"description": "Windows-only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Blocklist list item properties (Windows, supports code signature)."
},
"Security_Exceptions_API_CreateExceptionListItemBase": {
"required": [
"type",
"name",
"description"
],
"type": "object",
"properties": {
"comments": {
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemCommentArray"
},
"description": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription"
},
"expire_time": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime"
},
"item_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType"
},
"type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType"
}
}
},
"Security_Exceptions_API_CreateExceptionListItemBlocklistLinux": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistLinuxProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemBlocklistMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistMacProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemBlocklistWindows": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistWindowsProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemComment": {
"required": [
"comment"
],
"type": "object",
"properties": {
"comment": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
},
"Security_Exceptions_API_CreateExceptionListItemCommentArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemComment"
}
},
"Security_Exceptions_API_CreateExceptionListItemEndpointList": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointListProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemEventFilters": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_EventFiltersProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemGeneric": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"required": [
"list_id",
"entries"
],
"type": "object",
"properties": {
"entries": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray"
},
"list_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListHumanId"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags"
}
},
"example": {
"description": "This is a sample detection type exception item.",
"entries": [
{
"field": "actingProcess.file.signer",
"operator": "excluded",
"type": "exists"
},
{
"field": "host.name",
"operator": "included",
"type": "match_any",
"value": [
"saturn",
"jupiter"
]
}
],
"item_id": "simple_list_item",
"list_id": "simple_list",
"name": "Sample Exception List Item",
"namespace_type": "single",
"os_types": [
"linux"
],
"tags": [
"malware"
],
"type": "simple"
}
}
]
},
"Security_Exceptions_API_CreateExceptionListItemHostIsolation": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_HostIsolationProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemTrustedAppsLinux": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppsLinuxProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemTrustedAppsMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppsMacProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemTrustedAppsWindows": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppsWindowsProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemTrustedDevicesMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedDevicesMacProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindows": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsProperties"
}
]
},
"Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindowsMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsMacProperties"
}
]
},
"Security_Exceptions_API_CreateRuleExceptionListItemComment": {
"required": [
"comment"
],
"type": "object",
"properties": {
"comment": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
},
"Security_Exceptions_API_CreateRuleExceptionListItemCommentArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemComment"
}
},
"Security_Exceptions_API_CreateRuleExceptionListItemProps": {
"required": [
"type",
"name",
"description",
"entries"
],
"type": "object",
"properties": {
"comments": {
"$ref": "#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemCommentArray"
},
"description": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription"
},
"entries": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray"
},
"expire_time": {
"type": "string",
"format": "date-time"
},
"item_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags"
},
"type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType"
}
}
},
"Security_Exceptions_API_EndpointArtifactTags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags for categorization. Special tags for scope control:\n* `\"policy:all\"` - Global artifact (applies to all Elastic Defend policies)\n* `\"policy:\"` - Private artifact (applies to specific Elastic Defend policy only, where `` is the Elastic Defend integration policy ID)\n",
"default": [ ]
},
"Security_Exceptions_API_EndpointListProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray"
},
"list_id": {
"enum": [
"endpoint_list"
],
"type": "string",
"example": "endpoint_list"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Elastic Endpoint exception list item properties."
},
"Security_Exceptions_API_EventFiltersProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray"
},
"list_id": {
"enum": [
"endpoint_event_filters"
],
"type": "string",
"example": "endpoint_event_filters"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Event filters list item properties."
},
"Security_Exceptions_API_ExceptionList": {
"required": [
"id",
"list_id",
"type",
"name",
"description",
"immutable",
"namespace_type",
"version",
"tie_breaker_id",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"_version": {
"type": "string",
"description": "The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version."
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time"
},
"created_by": {
"type": "string",
"description": "Autogenerated value - user that created object."
},
"description": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListDescription"
},
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListId"
},
"immutable": {
"type": "boolean"
},
"list_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListTags"
},
"tie_breaker_id": {
"type": "string",
"description": "Field used in search to ensure all containers are sorted and returned correctly."
},
"type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListType"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time"
},
"updated_by": {
"type": "string",
"description": "Autogenerated value - user that last updated object."
},
"version": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListVersion"
}
}
},
"Security_Exceptions_API_ExceptionListDescription": {
"type": "string",
"description": "Describes the exception list.",
"example": "This list tracks allowlisted values."
},
"Security_Exceptions_API_ExceptionListHumanId": {
"minLength": 1,
"type": "string",
"description": "The exception list's human-readable string identifier.\n\nFor endpoint artifacts, use one of the following values:\n\n* `endpoint_list`: Elastic Endpoint exceptions list\n* `endpoint_trusted_apps`: Trusted applications list\n* `endpoint_trusted_devices`: Trusted devices list\n* `endpoint_event_filters`: Event filters list\n* `endpoint_host_isolation_exceptions`: Host isolation exceptions list\n* `endpoint_blocklists`: Blocklist\n",
"format": "nonempty",
"example": "simple_list"
},
"Security_Exceptions_API_ExceptionListId": {
"minLength": 1,
"type": "string",
"description": "Exception list's identifier.",
"format": "nonempty",
"example": "9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85"
},
"Security_Exceptions_API_ExceptionListItem": {
"required": [
"id",
"item_id",
"list_id",
"type",
"name",
"description",
"entries",
"namespace_type",
"comments",
"tie_breaker_id",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"_version": {
"type": "string",
"description": "The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version."
},
"comments": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemCommentArray"
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time"
},
"created_by": {
"type": "string",
"description": "Autogenerated value - user that created object."
},
"description": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription"
},
"entries": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray"
},
"expire_time": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime"
},
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemId"
},
"item_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId"
},
"list_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags"
},
"tie_breaker_id": {
"type": "string",
"description": "Field used in search to ensure all containers are sorted and returned correctly."
},
"type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time"
},
"updated_by": {
"type": "string",
"description": "Autogenerated value - user that last updated object."
}
}
},
"Security_Exceptions_API_ExceptionListItemComment": {
"required": [
"id",
"comment",
"created_at",
"created_by"
],
"type": "object",
"properties": {
"comment": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time"
},
"created_by": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time"
},
"updated_by": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
},
"Security_Exceptions_API_ExceptionListItemCommentArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemComment"
},
"description": "Array of comment fields:\n\n- comment (string): Comments about the exception item.\n"
},
"Security_Exceptions_API_ExceptionListItemDescription": {
"type": "string",
"description": "Describes the exception list."
},
"Security_Exceptions_API_ExceptionListItemEntry": {
"anyOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryList"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNested"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchWildcard"
}
],
"discriminator": {
"propertyName": "type"
}
},
"Security_Exceptions_API_ExceptionListItemEntryArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntry"
}
},
"Security_Exceptions_API_ExceptionListItemEntryExists": {
"required": [
"type",
"field",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"exists"
],
"type": "string"
}
}
},
"Security_Exceptions_API_ExceptionListItemEntryList": {
"required": [
"type",
"field",
"list",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"list": {
"required": [
"id",
"type"
],
"type": "object",
"properties": {
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ListId"
},
"type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ListType"
}
}
},
"operator": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"list"
],
"type": "string"
}
}
},
"Security_Exceptions_API_ExceptionListItemEntryMatch": {
"required": [
"type",
"field",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"match"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
},
"Security_Exceptions_API_ExceptionListItemEntryMatchAny": {
"required": [
"type",
"field",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"match_any"
],
"type": "string"
},
"value": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
}
},
"Security_Exceptions_API_ExceptionListItemEntryMatchWildcard": {
"required": [
"type",
"field",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"operator": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator"
},
"type": {
"enum": [
"wildcard"
],
"type": "string"
},
"value": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
},
"Security_Exceptions_API_ExceptionListItemEntryNested": {
"required": [
"type",
"field",
"entries"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem"
}
},
"field": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"type": {
"enum": [
"nested"
],
"type": "string"
}
}
},
"Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists"
}
]
},
"Security_Exceptions_API_ExceptionListItemEntryOperator": {
"enum": [
"excluded",
"included"
],
"type": "string"
},
"Security_Exceptions_API_ExceptionListItemExpireTime": {
"type": "string",
"description": "The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.",
"format": "date-time"
},
"Security_Exceptions_API_ExceptionListItemHumanId": {
"minLength": 1,
"type": "string",
"description": "Human readable string identifier, e.g. `trusted-linux-processes`",
"format": "nonempty",
"example": "simple_list_item"
},
"Security_Exceptions_API_ExceptionListItemId": {
"minLength": 1,
"type": "string",
"description": "Exception's identifier.",
"format": "nonempty",
"example": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2"
},
"Security_Exceptions_API_ExceptionListItemMeta": {
"type": "object"
},
"Security_Exceptions_API_ExceptionListItemName": {
"minLength": 1,
"type": "string",
"description": "Exception list name.",
"format": "nonempty"
},
"Security_Exceptions_API_ExceptionListItemOsTypeArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsType"
}
},
"Security_Exceptions_API_ExceptionListItemTags": {
"type": "array",
"items": {
"minLength": 1,
"type": "string",
"description": "String array containing words and phrases to help categorize exception items.",
"format": "nonempty"
}
},
"Security_Exceptions_API_ExceptionListItemType": {
"enum": [
"simple"
],
"type": "string"
},
"Security_Exceptions_API_ExceptionListMeta": {
"type": "object",
"description": "Placeholder for metadata about the list container."
},
"Security_Exceptions_API_ExceptionListName": {
"type": "string",
"description": "The name of the exception list.",
"example": "My exception list"
},
"Security_Exceptions_API_ExceptionListOsType": {
"enum": [
"linux",
"macos",
"windows"
],
"type": "string",
"description": "Use this field to specify the operating system."
},
"Security_Exceptions_API_ExceptionListOsTypeArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsType"
},
"description": "Use this field to specify the operating system. Only enter one value."
},
"Security_Exceptions_API_ExceptionListsImportBulkError": {
"required": [
"error"
],
"type": "object",
"properties": {
"error": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListId"
},
"item_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId"
},
"list_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListHumanId"
}
}
},
"Security_Exceptions_API_ExceptionListsImportBulkErrorArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkError"
}
},
"Security_Exceptions_API_ExceptionListTags": {
"type": "array",
"items": {
"type": "string"
},
"description": "String array containing words and phrases to help categorize exception containers."
},
"Security_Exceptions_API_ExceptionListType": {
"enum": [
"detection",
"rule_default",
"endpoint",
"endpoint_trusted_apps",
"endpoint_trusted_devices",
"endpoint_events",
"endpoint_host_isolation_exceptions",
"endpoint_blocklists",
"endpoint_custom_yara_signatures"
],
"type": "string",
"description": "The type of exception list to be created. Different list types may denote where they can be utilized."
},
"Security_Exceptions_API_ExceptionListVersion": {
"minimum": 1,
"type": "integer",
"description": "The document version, automatically increasd on updates."
},
"Security_Exceptions_API_ExceptionNamespaceType": {
"enum": [
"agnostic",
"single"
],
"type": "string",
"description": "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n\nFor endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.\n"
},
"Security_Exceptions_API_FindExceptionListItemsFilter": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"Security_Exceptions_API_FindExceptionListsFilter": {
"type": "string",
"example": "exception-list.attributes.name:%Detection%20List"
},
"Security_Exceptions_API_HostIsolationProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"destination.ip"
],
"type": "string",
"description": "Must be destination.ip"
},
"operator": {
"enum": [
"included"
],
"type": "string",
"description": "Must be the value \"included\""
},
"type": {
"enum": [
"match"
],
"type": "string",
"description": "Must be match"
},
"value": {
"type": "string",
"description": "Valid IPv4 address or CIDR notation (e.g., \"192.168.1.1\" or \"10.0.0.0/8\")"
}
}
},
"description": "Exactly one entry allowed for host isolation exceptions"
},
"list_id": {
"enum": [
"endpoint_host_isolation_exceptions"
],
"type": "string",
"example": "endpoint_host_isolation_exceptions"
},
"os_types": {
"maxItems": 3,
"minItems": 3,
"type": "array",
"items": {
"enum": [
"windows",
"linux",
"macos"
],
"type": "string"
},
"description": "Must include all three operating systems (windows, linux, macos)"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Host isolation exceptions list item properties."
},
"Security_Exceptions_API_ListId": {
"minLength": 1,
"type": "string",
"description": "Value list's identifier.",
"format": "nonempty",
"example": "21b01cfb-058d-44b9-838c-282be16c91cd"
},
"Security_Exceptions_API_ListType": {
"enum": [
"binary",
"boolean",
"byte",
"date",
"date_nanos",
"date_range",
"double",
"double_range",
"float",
"float_range",
"geo_point",
"geo_shape",
"half_float",
"integer",
"integer_range",
"ip",
"ip_range",
"keyword",
"long",
"long_range",
"shape",
"short",
"text"
],
"type": "string",
"description": "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:\n\n- `keyword`: Many ECS fields are Elasticsearch keywords\n- `ip`: IP addresses\n- `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)\n"
},
"Security_Exceptions_API_NonEmptyString": {
"minLength": 1,
"type": "string",
"description": "A string that does not contain only whitespace characters",
"format": "nonempty"
},
"Security_Exceptions_API_PlatformErrorResponse": {
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer"
}
}
},
"Security_Exceptions_API_RuleId": {
"$ref": "#/components/schemas/Security_Exceptions_API_UUID"
},
"Security_Exceptions_API_SiemErrorResponse": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"Security_Exceptions_API_TrustedAppHashEntry": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"process.hash.md5",
"process.hash.sha1",
"process.hash.sha256"
],
"type": "string",
"description": "Process hash field"
},
"operator": {
"enum": [
"included"
],
"type": "string"
},
"type": {
"enum": [
"match"
],
"type": "string",
"description": "Hash entries only support match type"
},
"value": {
"type": "string",
"description": "Hash value (MD5, SHA1, or SHA256)"
}
}
},
"Security_Exceptions_API_TrustedAppMacCodeSignatureEntry": {
"required": [
"field",
"type",
"entries"
],
"type": "object",
"properties": {
"entries": {
"maxItems": 2,
"minItems": 2,
"type": "array",
"items": {
"oneOf": [
{
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"subject_name"
],
"type": "string"
},
"operator": {
"enum": [
"included"
],
"type": "string"
},
"type": {
"enum": [
"match"
],
"type": "string"
},
"value": {
"type": "string",
"description": "Certificate subject name"
}
}
},
{
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"trusted"
],
"type": "string"
},
"operator": {
"enum": [
"included"
],
"type": "string"
},
"type": {
"enum": [
"match"
],
"type": "string"
},
"value": {
"enum": [
"true"
],
"type": "string",
"description": "Must be the string 'true'"
}
}
}
]
},
"description": "Must include exactly 2 entries - one for subject_name and one for trusted"
},
"field": {
"enum": [
"process.code_signature"
],
"type": "string",
"description": "macOS code signature field"
},
"type": {
"enum": [
"nested"
],
"type": "string"
}
}
},
"Security_Exceptions_API_TrustedAppPathEntry": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"process.executable.caseless"
],
"type": "string",
"description": "Process executable path field"
},
"operator": {
"enum": [
"included"
],
"type": "string"
},
"type": {
"enum": [
"match",
"wildcard"
],
"type": "string",
"description": "Path supports both match and wildcard types"
},
"value": {
"type": "string",
"description": "Executable path"
}
}
},
"Security_Exceptions_API_TrustedAppsLinuxProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry"
}
]
},
"description": "Process hash or executable path entries (code signature not supported on Linux)"
},
"list_id": {
"enum": [
"endpoint_trusted_apps"
],
"type": "string",
"example": "endpoint_trusted_apps"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"linux"
],
"type": "string"
},
"description": "Must be Linux only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Trusted applications list item properties (Linux)."
},
"Security_Exceptions_API_TrustedAppsMacProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppMacCodeSignatureEntry"
}
]
},
"description": "Process hash, executable path, or code signature entries"
},
"list_id": {
"enum": [
"endpoint_trusted_apps"
],
"type": "string",
"example": "endpoint_trusted_apps"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"macos"
],
"type": "string"
},
"description": "Must be macOS only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Trusted applications list item properties (macOS)."
},
"Security_Exceptions_API_TrustedAppsWindowsProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppWindowsCodeSignatureEntry"
}
]
},
"description": "Process hash, executable path, or code signature entries"
},
"list_id": {
"enum": [
"endpoint_trusted_apps"
],
"type": "string",
"example": "endpoint_trusted_apps"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"windows"
],
"type": "string"
},
"description": "Must be Windows only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Trusted applications list item properties (Windows)."
},
"Security_Exceptions_API_TrustedAppWindowsCodeSignatureEntry": {
"required": [
"field",
"type",
"entries"
],
"type": "object",
"properties": {
"entries": {
"maxItems": 2,
"minItems": 2,
"type": "array",
"items": {
"oneOf": [
{
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"subject_name"
],
"type": "string"
},
"operator": {
"enum": [
"included"
],
"type": "string"
},
"type": {
"enum": [
"match"
],
"type": "string"
},
"value": {
"type": "string",
"description": "Certificate subject name"
}
}
},
{
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"trusted"
],
"type": "string"
},
"operator": {
"enum": [
"included"
],
"type": "string"
},
"type": {
"enum": [
"match"
],
"type": "string"
},
"value": {
"enum": [
"true"
],
"type": "string",
"description": "Must be the string 'true'"
}
}
}
]
},
"description": "Must include exactly 2 entries - one for subject_name and one for trusted"
},
"field": {
"enum": [
"process.Ext.code_signature"
],
"type": "string",
"description": "Windows code signature field"
},
"type": {
"enum": [
"nested"
],
"type": "string"
}
}
},
"Security_Exceptions_API_TrustedDevicesMacProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"device.serial_number",
"device.type",
"host.name",
"device.vendor.name",
"device.vendor.id",
"device.product.id",
"device.product.name"
],
"type": "string",
"description": "Device field to match against"
},
"operator": {
"enum": [
"included"
],
"type": "string",
"description": "Must be the value \"included\""
},
"type": {
"enum": [
"match",
"wildcard",
"match_any"
],
"type": "string",
"description": "Entry match type"
},
"value": {
"oneOf": [
{
"type": "string",
"description": "Single value (used with match or wildcard)"
},
{
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of values (used with match_any)"
}
]
}
}
},
"description": "Exception entries for the trusted device (duplicate field entries are not allowed)"
},
"list_id": {
"enum": [
"endpoint_trusted_devices"
],
"type": "string",
"example": "endpoint_trusted_devices"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"macos"
],
"type": "string"
},
"description": "macOS-only"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Trusted devices list item properties (macOS-only, username not supported)."
},
"Security_Exceptions_API_TrustedDevicesWindowsMacProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"device.serial_number",
"device.type",
"host.name",
"device.vendor.name",
"device.vendor.id",
"device.product.id",
"device.product.name"
],
"type": "string",
"description": "Device field to match against (username not available for multi-OS)"
},
"operator": {
"enum": [
"included"
],
"type": "string",
"description": "Must be the value \"included\""
},
"type": {
"enum": [
"match",
"wildcard",
"match_any"
],
"type": "string",
"description": "Entry match type"
},
"value": {
"oneOf": [
{
"type": "string",
"description": "Single value (used with match or wildcard)"
},
{
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of values (used with match_any)"
}
]
}
}
},
"description": "Exception entries for the trusted device (duplicate field entries are not allowed, username not available when targeting both OS)"
},
"list_id": {
"enum": [
"endpoint_trusted_devices"
],
"type": "string",
"example": "endpoint_trusted_devices"
},
"os_types": {
"maxItems": 2,
"minItems": 2,
"type": "array",
"items": {
"enum": [
"windows",
"macos"
],
"type": "string"
},
"description": "Must include both Windows and macOS (username field not allowed)"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Trusted devices list item properties (Windows + macOS, username not supported)."
},
"Security_Exceptions_API_TrustedDevicesWindowsProperties": {
"required": [
"list_id"
],
"type": "object",
"properties": {
"entries": {
"minItems": 1,
"type": "array",
"items": {
"required": [
"field",
"type",
"value",
"operator"
],
"type": "object",
"properties": {
"field": {
"enum": [
"device.serial_number",
"device.type",
"host.name",
"device.vendor.name",
"device.vendor.id",
"device.product.id",
"device.product.name",
"user.name"
],
"type": "string",
"description": "Device field to match against (user.name is Windows-only)"
},
"operator": {
"enum": [
"included"
],
"type": "string",
"description": "Must be the value \"included\""
},
"type": {
"enum": [
"match",
"wildcard",
"match_any"
],
"type": "string",
"description": "Entry match type"
},
"value": {
"oneOf": [
{
"type": "string",
"description": "Single value (used with match or wildcard)"
},
{
"minItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "Array of values (used with match_any)"
}
]
}
}
},
"description": "Exception entries for the trusted device (duplicate field entries are not allowed)"
},
"list_id": {
"enum": [
"endpoint_trusted_devices"
],
"type": "string",
"example": "endpoint_trusted_devices"
},
"os_types": {
"maxItems": 1,
"minItems": 1,
"type": "array",
"items": {
"enum": [
"windows"
],
"type": "string"
},
"description": "Must be Windows-only to allow username field"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointArtifactTags"
}
},
"description": "Trusted devices list item properties (Windows-only, allows username field)."
},
"Security_Exceptions_API_UpdateExceptionListItemBase": {
"required": [
"type",
"name",
"description"
],
"type": "object",
"properties": {
"_version": {
"type": "string",
"description": "The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version."
},
"comments": {
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemCommentArray"
},
"description": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription"
},
"expire_time": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime"
},
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemId"
},
"item_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId"
},
"meta": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta"
},
"name": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemName"
},
"namespace_type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType"
},
"type": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType"
}
}
},
"Security_Exceptions_API_UpdateExceptionListItemBlocklistLinux": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistLinuxProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemBlocklistMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistMacProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemBlocklistWindows": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_BlocklistWindowsProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemComment": {
"required": [
"comment"
],
"type": "object",
"properties": {
"comment": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
},
"id": {
"$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString"
}
}
},
"Security_Exceptions_API_UpdateExceptionListItemCommentArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemComment"
}
},
"Security_Exceptions_API_UpdateExceptionListItemEndpointList": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_EndpointListProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemEventFilters": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_EventFiltersProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemGeneric": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"required": [
"entries"
],
"type": "object",
"properties": {
"entries": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray"
},
"list_id": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListHumanId"
},
"os_types": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray"
},
"tags": {
"$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags"
}
},
"example": {
"comments": [ ],
"description": "Updated description",
"entries": [
{
"field": "host.name",
"operator": "included",
"type": "match",
"value": "rock01"
}
],
"item_id": "simple_list_item",
"name": "Updated name",
"namespace_type": "single",
"tags": [ ],
"type": "simple"
}
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemHostIsolation": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_HostIsolationProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemTrustedAppsLinux": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppsLinuxProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemTrustedAppsMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppsMacProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemTrustedAppsWindows": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedAppsWindowsProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedDevicesMacProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindows": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsProperties"
}
]
},
"Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindowsMac": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase"
},
{
"$ref": "#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsMacProperties"
}
]
},
"Security_Exceptions_API_UUID": {
"type": "string",
"description": "A universally unique identifier",
"format": "uuid"
},
"Security_Lists_API_FindListItemsCursor": {
"minLength": 1,
"type": "string",
"description": "Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly.",
"format": "nonempty",
"example": "WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d"
},
"Security_Lists_API_FindListItemsFilter": {
"type": "string",
"example": "value:127.0.0.1"
},
"Security_Lists_API_FindListsCursor": {
"minLength": 1,
"type": "string",
"format": "nonempty",
"example": "WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d"
},
"Security_Lists_API_FindListsFilter": {
"type": "string",
"example": "value:127.0.0.1"
},
"Security_Lists_API_List": {
"required": [
"id",
"type",
"name",
"description",
"immutable",
"version",
"tie_breaker_id",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"_version": {
"$ref": "#/components/schemas/Security_Lists_API_ListVersionId"
},
"@timestamp": {
"type": "string",
"format": "date-time",
"example": "2025-01-08T04:47:34.273Z"
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time",
"example": "2025-01-08T04:47:34.273Z"
},
"created_by": {
"type": "string",
"description": "Autogenerated value - user that created object.",
"example": "elastic"
},
"description": {
"$ref": "#/components/schemas/Security_Lists_API_ListDescription"
},
"id": {
"$ref": "#/components/schemas/Security_Lists_API_ListId"
},
"immutable": {
"type": "boolean"
},
"meta": {
"$ref": "#/components/schemas/Security_Lists_API_ListMetadata"
},
"name": {
"$ref": "#/components/schemas/Security_Lists_API_ListName"
},
"tie_breaker_id": {
"type": "string",
"description": "Field used in search to ensure all containers are sorted and returned correctly.",
"example": "f5508188-b1e9-4e6e-9662-d039a7d89899"
},
"type": {
"$ref": "#/components/schemas/Security_Lists_API_ListType"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time",
"example": "2025-01-08T04:47:34.273Z"
},
"updated_by": {
"type": "string",
"description": "Autogenerated value - user that last updated object.",
"example": "elastic"
},
"version": {
"$ref": "#/components/schemas/Security_Lists_API_ListVersion"
}
}
},
"Security_Lists_API_ListDescription": {
"minLength": 1,
"type": "string",
"description": "Describes the value list.",
"format": "nonempty"
},
"Security_Lists_API_ListId": {
"minLength": 1,
"type": "string",
"description": "Value list's identifier.",
"format": "nonempty",
"example": "21b01cfb-058d-44b9-838c-282be16c91cd"
},
"Security_Lists_API_ListItem": {
"required": [
"id",
"type",
"list_id",
"value",
"tie_breaker_id",
"created_at",
"created_by",
"updated_at",
"updated_by"
],
"type": "object",
"properties": {
"_version": {
"$ref": "#/components/schemas/Security_Lists_API_ListVersionId"
},
"@timestamp": {
"type": "string",
"format": "date-time",
"example": "2025-01-08T04:47:34.273Z"
},
"created_at": {
"type": "string",
"description": "Autogenerated date of object creation.",
"format": "date-time",
"example": "2025-01-08T04:47:34.273Z"
},
"created_by": {
"type": "string",
"description": "Autogenerated value - user that created object.",
"example": "elastic"
},
"id": {
"$ref": "#/components/schemas/Security_Lists_API_ListItemId"
},
"list_id": {
"$ref": "#/components/schemas/Security_Lists_API_ListId"
},
"meta": {
"$ref": "#/components/schemas/Security_Lists_API_ListItemMetadata"
},
"tie_breaker_id": {
"type": "string",
"description": "Field used in search to ensure all containers are sorted and returned correctly.",
"example": "f5508188-b1e9-4e6e-9662-d039a7d89899"
},
"type": {
"$ref": "#/components/schemas/Security_Lists_API_ListType"
},
"updated_at": {
"type": "string",
"description": "Autogenerated date of last object update.",
"format": "date-time",
"example": "2025-01-08T04:47:34.273Z"
},
"updated_by": {
"type": "string",
"description": "Autogenerated value - user that last updated object.",
"example": "elastic"
},
"value": {
"$ref": "#/components/schemas/Security_Lists_API_ListItemValue"
}
}
},
"Security_Lists_API_ListItemId": {
"minLength": 1,
"type": "string",
"description": "Value list item's identifier.",
"format": "nonempty",
"example": "54b01cfb-058d-44b9-838c-282be16c91cd"
},
"Security_Lists_API_ListItemMetadata": {
"type": "object",
"description": "Placeholder for metadata about the value list item."
},
"Security_Lists_API_ListItemPrivileges": {
"required": [
"username",
"has_all_requested",
"cluster",
"index",
"application"
],
"type": "object",
"properties": {
"application": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
},
"cluster": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
},
"has_all_requested": {
"type": "boolean"
},
"index": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
}
},
"username": {
"type": "string"
}
}
},
"Security_Lists_API_ListItemValue": {
"minLength": 1,
"type": "string",
"description": "The value used to evaluate exceptions.",
"format": "nonempty"
},
"Security_Lists_API_ListMetadata": {
"type": "object",
"description": "Placeholder for metadata about the value list."
},
"Security_Lists_API_ListName": {
"minLength": 1,
"type": "string",
"description": "Value list's name.",
"format": "nonempty",
"example": "List of bad IPs"
},
"Security_Lists_API_ListPrivileges": {
"required": [
"username",
"has_all_requested",
"cluster",
"index",
"application"
],
"type": "object",
"properties": {
"application": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
},
"cluster": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
},
"has_all_requested": {
"type": "boolean"
},
"index": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "boolean"
}
}
},
"username": {
"type": "string"
}
}
},
"Security_Lists_API_ListType": {
"enum": [
"binary",
"boolean",
"byte",
"date",
"date_nanos",
"date_range",
"double",
"double_range",
"float",
"float_range",
"geo_point",
"geo_shape",
"half_float",
"integer",
"integer_range",
"ip",
"ip_range",
"keyword",
"long",
"long_range",
"shape",
"short",
"text"
],
"type": "string",
"description": "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:\n\n- `keyword`: Many ECS fields are Elasticsearch keywords\n- `ip`: IP addresses\n- `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)\n"
},
"Security_Lists_API_ListVersion": {
"minimum": 1,
"type": "integer",
"description": "The document version number.",
"example": 1
},
"Security_Lists_API_ListVersionId": {
"type": "string",
"description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.\n",
"example": "WzIsMV0="
},
"Security_Lists_API_PlatformErrorResponse": {
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string"
},
"message": {
"type": "string"
},
"statusCode": {
"type": "integer"
}
}
},
"Security_Lists_API_SiemErrorResponse": {
"required": [
"status_code",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string"
},
"status_code": {
"type": "integer"
}
}
},
"Security_Osquery_API_ArrayQueries": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Osquery_API_ArrayQueriesItem"
},
"description": "An array of queries to run."
},
"Security_Osquery_API_ArrayQueriesItem": {
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryEnabled"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryId"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"version": {
"$ref": "#/components/schemas/Security_Osquery_API_Version"
}
}
},
"Security_Osquery_API_CopyPacksResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"name"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersion"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMappingArray"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryEnabled"
},
"id": {
"type": "string"
},
"interval": {
"type": "integer"
},
"platform": {
"type": "string"
},
"query": {
"type": "string"
},
"removed": {
"type": "boolean"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"snapshot": {
"type": "boolean"
},
"timeout": {
"type": "integer"
},
"version": {
"type": "string"
}
}
},
"description": "Pack queries in saved-object storage format (array). Note: the read endpoint returns object format."
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_object_id": {
"type": "string",
"description": "The saved object ID of the copied pack."
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"shards": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "number"
}
}
},
"description": "Shard configuration as an array of key-value pairs."
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": "integer",
"description": "The pack version number."
}
}
}
},
"description": "The response for copying a pack.",
"example": {
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "My pack",
"enabled": false,
"name": "my_pack_copy",
"policy_ids": [ ],
"queries": [
{
"ecs_mapping": [
{
"key": "client.port",
"value": {
"field": "port"
}
}
],
"id": "ports",
"interval": 60,
"query": "SELECT * FROM listening_ports;",
"removed": false,
"snapshot": true,
"timeout": 120
}
],
"saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
"shards": [ ],
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic"
}
}
},
"Security_Osquery_API_CopySavedQueryResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"id"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"type": [
"integer",
"string"
]
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"saved_object_id": {
"type": "string"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"timeout": {
"type": "integer"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
}
}
}
},
"description": "The response for copying a saved query.",
"example": {
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "my_saved_query_copy",
"interval": "60",
"platform": "linux,darwin",
"query": "select * from uptime;",
"removed": false,
"saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
"snapshot": true,
"timeout": 120,
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic"
}
}
},
"Security_Osquery_API_CreateLiveQueryRequestBody": {
"type": "object",
"properties": {
"agent_all": {
"type": "boolean",
"description": "When `true`, the query runs on all agents."
},
"agent_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of agent IDs to run the query on."
},
"agent_platforms": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of agent platforms to run the query on."
},
"agent_policy_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of agent policy IDs to run the query on."
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of alert IDs associated with the live query."
},
"case_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of case IDs associated with the live query."
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"event_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of event IDs associated with the live query."
},
"metadata": {
"type": [
"null",
"object"
],
"description": "Custom metadata object associated with the live query."
},
"pack_id": {
"$ref": "#/components/schemas/Security_Osquery_API_PackId"
},
"queries": {
"$ref": "#/components/schemas/Security_Osquery_API_ArrayQueries"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"saved_query_id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
}
},
"example": {
"agent_all": true,
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"query": "select * from uptime;"
}
},
"Security_Osquery_API_CreateLiveQueryResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"action_id"
],
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"description": "The timestamp when the action was created.",
"format": "date-time"
},
"action_id": {
"type": "string",
"description": "The ID of the action."
},
"agent_all": {
"type": "boolean",
"description": "Whether the query targets all agents."
},
"agent_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "The agent IDs targeted by the action."
},
"agent_platforms": {
"type": "array",
"items": {
"type": "string"
},
"description": "The agent platforms targeted."
},
"agent_policy_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "The agent policy IDs targeted."
},
"agents": {
"type": "array",
"items": {
"type": "string"
},
"description": "The resolved list of agent IDs."
},
"expiration": {
"type": "string",
"description": "The expiration date of the action.",
"format": "date-time"
},
"input_type": {
"type": "string",
"description": "The input type."
},
"metadata": {
"type": "object",
"description": "Custom metadata associated with the action."
},
"pack_id": {
"type": "string",
"description": "The pack ID if the query was run from a pack."
},
"queries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_id": {
"type": "string"
},
"agents": {
"type": "array",
"items": {
"type": "string"
}
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"type": "string"
},
"platform": {
"type": "string"
},
"query": {
"type": "string"
},
"saved_query_id": {
"type": "string"
},
"timeout": {
"type": "integer"
},
"version": {
"type": "string"
}
}
},
"description": "The queries in this action."
},
"type": {
"type": "string",
"description": "The action type."
},
"user_id": {
"type": "string",
"description": "The user who created the action."
}
}
}
},
"description": "The response for creating a live query.",
"example": {
"data": {
"@timestamp": "2022-07-26T09:59:32.220Z",
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
"agent_all": true,
"agent_ids": [ ],
"agent_platforms": [ ],
"agent_policy_ids": [ ],
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"expiration": "2022-07-26T10:04:32.220Z",
"input_type": "osquery",
"metadata": {
"execution_context": {
"name": "osquery",
"url": "/app/osquery/new"
}
},
"queries": [
{
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
"query": "select * from uptime;",
"timeout": 120
}
],
"type": "INPUT_ACTION",
"user_id": "elastic"
}
}
},
"Security_Osquery_API_CreatePacksRequestBody": {
"type": "object",
"properties": {
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersionInput"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueriesInput"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"shards": {
"$ref": "#/components/schemas/Security_Osquery_API_Shards"
}
},
"example": {
"description": "My pack",
"enabled": true,
"name": "my_pack",
"policy_ids": [
"my_policy_id",
"fleet-server-policy"
],
"queries": {
"my_query": {
"ecs_mapping": {
"client.port": {
"field": "port"
},
"tags": {
"value": [
"tag1",
"tag2"
]
}
},
"interval": 60,
"query": "SELECT * FROM listening_ports;",
"timeout": 120
}
},
"shards": {
"fleet-server-policy": 58,
"my_policy_id": 35
}
}
},
"Security_Osquery_API_CreatePacksResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"name"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"description": "The date and time the pack was created.",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
],
"description": "The user who created the pack."
},
"created_by_profile_uid": {
"type": "string",
"description": "The profile UID of the user who created the pack."
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersion"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueries"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_object_id": {
"type": "string",
"description": "The saved object ID of the pack."
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"shards": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "number"
}
}
},
"description": "Shard configuration as an array of key-value pairs."
},
"updated_at": {
"type": "string",
"description": "The date and time the pack was last updated.",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
],
"description": "The user who last updated the pack."
},
"updated_by_profile_uid": {
"type": "string",
"description": "The profile UID of the user who last updated the pack."
},
"version": {
"type": "integer",
"description": "The pack version number."
}
}
}
},
"description": "The response for creating a pack.",
"example": {
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "My pack",
"enabled": true,
"name": "my_pack",
"policy_ids": [
"my_policy_id"
],
"queries": {
"ports": {
"ecs_mapping": {
"client.port": {
"field": "port"
}
},
"interval": 60,
"query": "SELECT * FROM listening_ports;",
"removed": false,
"snapshot": true,
"timeout": 120
}
},
"saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
"shards": {
"47638692-7c4c-4053-aa3e-7186f28df349": 35,
"5e267651-fe50-443e-8d3f-3bbc9171b618": 58
},
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic",
"version": 1
}
}
},
"Security_Osquery_API_CreateSavedQueryRequestBody": {
"type": "object",
"properties": {
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_Interval"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"version": {
"$ref": "#/components/schemas/Security_Osquery_API_Version"
}
},
"example": {
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "saved_query_id",
"interval": "60",
"platform": "linux,darwin",
"query": "select * from uptime;",
"timeout": 120,
"version": "2.8.0"
}
},
"Security_Osquery_API_CreateSavedQueryResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"id"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"type": [
"integer",
"string"
],
"description": "An interval, in seconds, on which to run the query. May be returned as number or string."
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"prebuilt": {
"type": "boolean",
"description": "Whether the saved query is prebuilt."
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"saved_object_id": {
"type": "string",
"description": "The saved object ID of the saved query."
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"timeout": {
"type": "integer",
"description": "The query timeout in seconds."
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": [
"integer",
"string"
],
"description": "The saved query version."
}
}
}
},
"description": "The response for creating a saved query.",
"example": {
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "saved_query_id",
"interval": "60",
"platform": "linux,darwin",
"prebuilt": false,
"query": "select * from uptime;",
"saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
"timeout": 120,
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic",
"version": "2.8.0"
}
}
},
"Security_Osquery_API_DefaultSuccessResponse": {
"type": "object"
},
"Security_Osquery_API_ECSMapping": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMappingItem"
},
"description": "Map osquery results columns or static values to Elastic Common Schema (ECS) fields",
"example": {
"host.uptime": {
"field": "total_seconds"
}
}
},
"Security_Osquery_API_ECSMappingArray": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMappingArrayItem"
},
"description": "ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping)."
},
"Security_Osquery_API_ECSMappingArrayItem": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The ECS field name."
},
"value": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMappingItem"
}
},
"description": "ECS mapping item in saved-object storage format (key-value pair)."
},
"Security_Osquery_API_ECSMappingArrayOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMappingArray"
},
"Security_Osquery_API_ECSMappingItem": {
"type": "object",
"properties": {
"field": {
"type": "string",
"description": "The ECS field to map to.",
"example": "host.uptime"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "The value to map to the ECS field.",
"example": "total_seconds"
}
}
},
"Security_Osquery_API_ECSMappingOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"Security_Osquery_API_Enabled": {
"type": "boolean",
"description": "Enables the pack.",
"example": true
},
"Security_Osquery_API_EnabledOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"Security_Osquery_API_ExportFormat": {
"enum": [
"ndjson",
"json",
"csv"
],
"type": "string",
"description": "The output format for the exported file. Use `ndjson` for streaming newline-delimited JSON (recommended for large exports), `json` for a single JSON array (held in memory; suitable for smaller result sets), or `csv` for a comma-separated values file with a header row derived from the ECS mapping.\n",
"example": "ndjson"
},
"Security_Osquery_API_ExportJsonResponse": {
"required": [
"_meta",
"results"
],
"type": "object",
"properties": {
"_meta": {
"$ref": "#/components/schemas/Security_Osquery_API_ExportMetadata"
},
"results": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Osquery_API_ExportResultRow"
}
}
},
"description": "JSON export response body. The `_meta` field contains export metadata; `results` contains all result rows. Prefer `ndjson` for large exports since rows are streamed individually rather than held in memory.\n"
},
"Security_Osquery_API_ExportMetadata": {
"required": [
"action_id",
"timestamp",
"exported_by",
"format"
],
"type": "object",
"properties": {
"action_id": {
"type": "string",
"description": "The action ID (live query) or schedule ID (scheduled query) that produced the results.",
"example": "e88d7652-fc3e-4544-b0e0-3d5df2be454c"
},
"csv_columns": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.\n"
},
"execution_count": {
"type": [
"null",
"integer"
],
"description": "For scheduled query exports only: the execution counter of the scheduled run that produced the results.\n",
"example": 17384
},
"exported_by": {
"type": "string",
"description": "Username of the Kibana user who triggered the export.",
"example": "elastic"
},
"format": {
"$ref": "#/components/schemas/Security_Osquery_API_ExportFormat"
},
"query": {
"type": [
"null",
"string"
],
"description": "The SQL query text, if it could be resolved from action details.",
"example": "SELECT * FROM users;"
},
"timestamp": {
"type": "string",
"description": "ISO 8601 timestamp of when the export was initiated.",
"format": "date-time",
"example": "2026-04-30T09:12:00.000Z"
},
"total_results": {
"type": [
"null",
"integer"
],
"description": "Total number of result rows included in this export.",
"example": 64
}
},
"description": "Metadata block produced for every export. Included as `_meta` in the JSON response body and as the first NDJSON line.\n"
},
"Security_Osquery_API_ExportRequestBody": {
"type": [
"null",
"object"
],
"properties": {
"agentIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.\n",
"example": [
"980a6b73-0b03-4d1e-8915-67c202e4a980",
"e40fde1c-5729-4885-b0b2-16a42e9332e3"
]
},
"esFilters": {
"type": [
"null",
"array"
],
"items": {
"type": "object"
},
"description": "An optional array of Elasticsearch / Kibana SearchBar filter objects (the same `esFilters` payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.\n",
"example": [
{
"meta": {
"key": "agent.name",
"params": {
"query": "prod-host-1"
},
"type": "phrase"
},
"query": {
"match_phrase": {
"agent.name": "prod-host-1"
}
}
}
]
},
"kuery": {
"type": [
"null",
"string"
],
"description": "An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.\n",
"example": "host.name: \"prod-host-1\""
}
},
"description": "Optional request body for export endpoints. All fields are optional. Omit the body or send `null` or `{}` to export all results without additional filtering.\n"
},
"Security_Osquery_API_ExportResultRow": {
"type": "object",
"description": "A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the `osquery.*` namespace.\n",
"example": {
"@timestamp": "2026-04-30T09:11:58.321Z",
"agent": {
"id": "980a6b73-0b03-4d1e-8915-67c202e4a980",
"name": "prod-host-1",
"type": "osquerybeat",
"version": "9.4.0"
},
"osquery": {
"directory": "/home/ubuntu",
"gid": "1000",
"shell": "/bin/bash",
"uid": "1000",
"username": "ubuntu"
},
"user": {
"group": {
"id": "1000"
},
"id": "1000",
"name": "ubuntu"
}
}
},
"Security_Osquery_API_FindLiveQueryDetailsResponse": {
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"format": "date-time"
},
"action_id": {
"type": "string"
},
"agents": {
"type": "array",
"items": {
"type": "string"
}
},
"expiration": {
"type": "string",
"format": "date-time"
},
"pack_id": {
"type": "string"
},
"pack_name": {
"type": "string"
},
"prebuilt_pack": {
"type": "boolean"
},
"queries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_id": {
"type": "string"
},
"agents": {
"type": "array",
"items": {
"type": "string"
}
},
"docs": {
"type": "integer",
"description": "Number of result documents."
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"failed": {
"type": "integer",
"description": "Number of failed queries."
},
"id": {
"type": "string"
},
"pending": {
"type": "integer",
"description": "Number of pending agents."
},
"query": {
"type": "string"
},
"responded": {
"type": "integer",
"description": "Total responded agents."
},
"saved_query_id": {
"type": "string"
},
"status": {
"enum": [
"completed",
"running"
],
"type": "string",
"description": "Status of this individual query."
},
"successful": {
"type": "integer",
"description": "Number of successful agents."
}
}
},
"description": "The queries with their execution status."
},
"status": {
"enum": [
"completed",
"running"
],
"type": "string",
"description": "Global status of the live query (completed, running)."
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"user_id": {
"type": "string"
},
"user_profile_uid": {
"type": "string"
}
}
}
},
"example": {
"data": {
"@timestamp": "2022-07-26T09:59:32.220Z",
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"expiration": "2022-07-26T10:04:32.220Z",
"queries": [
{
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"docs": 0,
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"failed": 1,
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
"pending": 0,
"query": "select * from uptime;",
"responded": 1,
"saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
"status": "completed",
"successful": 0
}
],
"status": "completed",
"user_id": "elastic"
}
}
},
"Security_Osquery_API_FindLiveQueryResponse": {
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"type": "object",
"properties": {
"_source": {
"type": "object",
"properties": {
"@timestamp": {
"type": "string",
"format": "date-time"
},
"action_id": {
"type": "string"
},
"agents": {
"type": "array",
"items": {
"type": "string"
}
},
"expiration": {
"type": "string",
"format": "date-time"
},
"pack_id": {
"type": "string"
},
"queries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action_id": {
"type": "string"
},
"agents": {
"type": "array",
"items": {
"type": "string"
}
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"type": "string"
},
"query": {
"type": "string"
},
"saved_query_id": {
"type": "string"
}
}
}
},
"result_counts": {
"type": "object",
"properties": {
"error_agents": {
"type": "integer"
},
"responded_agents": {
"type": "integer"
},
"successful_agents": {
"type": "integer"
},
"total_rows": {
"type": "integer"
}
},
"description": "Result count statistics (present when withResultCounts is true)."
},
"user_id": {
"type": "string"
}
}
}
}
},
"description": "An array of live query action items."
},
"total": {
"type": "integer",
"description": "The total number of live queries."
}
}
}
},
"example": {
"data": {
"items": [
{
"_source": {
"@timestamp": "2023-10-31T00:00:00Z",
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"expiration": "2023-10-31T00:00:00Z",
"queries": [
{
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agents": [
"16d7caf5-efd2-4212-9b62-73dafc91fa13"
],
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
"query": "select * from uptime;",
"saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d"
}
],
"result_counts": {
"error_agents": 0,
"responded_agents": 1,
"successful_agents": 1,
"total_rows": 42
},
"user_id": "elastic"
}
}
],
"total": 1
}
}
},
"Security_Osquery_API_FindPackResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"name"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersion"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"namespaces": {
"type": "array",
"items": {
"type": "string"
},
"description": "The namespaces the pack belongs to."
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueries"
},
"read_only": {
"type": "boolean",
"description": "Whether the pack is read-only (true for prebuilt packs)."
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_object_id": {
"type": "string",
"description": "The saved object ID of the pack."
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"shards": {
"$ref": "#/components/schemas/Security_Osquery_API_Shards"
},
"type": {
"type": "string",
"description": "The saved object type."
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": "integer",
"description": "The pack version number."
}
},
"description": "The pack details."
}
},
"description": "The details of a single query pack.",
"example": {
"data": {
"created_at": "2022-07-25T19:41:10.263Z",
"created_by": "elastic",
"description": "",
"enabled": true,
"name": "test_pack",
"namespaces": [
"default"
],
"policy_ids": [ ],
"queries": {
"uptime": {
"ecs_mapping": {
"message": {
"field": "days"
}
},
"interval": 3600,
"query": "select * from uptime"
}
},
"read_only": false,
"saved_object_id": "3c42c847-eb30-4452-80e0-728584042334",
"shards": { },
"type": "osquery-pack",
"updated_at": "2022-07-25T20:12:01.455Z",
"updated_by": "elastic",
"version": 1
}
}
},
"Security_Osquery_API_FindPacksResponse": {
"required": [
"page",
"per_page",
"total",
"data"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"required": [
"saved_object_id",
"name"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersion"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMappingArray"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryEnabled"
},
"id": {
"type": "string"
},
"interval": {
"type": "integer"
},
"platform": {
"type": "string"
},
"query": {
"type": "string"
},
"removed": {
"type": "boolean"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"snapshot": {
"type": "boolean"
},
"timeout": {
"type": "integer"
},
"version": {
"type": "string"
}
}
},
"description": "Pack queries in saved-object storage format (array). Note: the read endpoint returns object format."
},
"read_only": {
"type": "boolean",
"description": "Whether the pack is read-only (true for prebuilt packs)."
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_object_id": {
"type": "string",
"description": "The saved object ID of the pack."
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": "integer",
"description": "The pack version number."
}
}
},
"description": "An array of pack objects."
},
"page": {
"type": "integer",
"description": "The current page number."
},
"per_page": {
"type": "integer",
"description": "The number of results per page."
},
"total": {
"type": "integer",
"description": "The total number of packs."
}
},
"description": "A paginated list of query packs.",
"example": {
"data": [
{
"created_at": "2023-10-31T00:00:00Z",
"created_by": "elastic",
"created_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"description": "My pack description",
"enabled": true,
"name": "My Pack",
"policy_ids": [ ],
"queries": [
{
"ecs_mapping": [
{
"key": "host.uptime",
"value": {
"field": "total_seconds"
}
}
],
"id": "uptime",
"interval": 3600,
"query": "select * from uptime;"
}
],
"read_only": false,
"saved_object_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
"updated_at": "2023-10-31T00:00:00Z",
"updated_by": "elastic",
"updated_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
}
],
"page": 1,
"per_page": 10,
"total": 1
}
},
"Security_Osquery_API_FindSavedQueryDetailResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"id"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"type": [
"integer",
"string"
]
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"prebuilt": {
"type": "boolean"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"saved_object_id": {
"type": "string"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"timeout": {
"type": "integer"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": [
"integer",
"string"
]
}
}
}
},
"description": "The details of a single saved query.",
"example": {
"data": {
"created_at": "2022-07-26T09:28:08.597Z",
"created_by": "elastic",
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "saved_query_id",
"interval": "60",
"platform": "linux,darwin",
"prebuilt": false,
"query": "select * from uptime;",
"saved_object_id": "3c42c847-eb30-4452-80e0-728584042334",
"updated_at": "2022-07-26T09:28:08.597Z",
"updated_by": "elastic",
"version": "2.8.0"
}
}
},
"Security_Osquery_API_FindSavedQueryResponse": {
"required": [
"page",
"per_page",
"total",
"data"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"required": [
"saved_object_id",
"id"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"type": [
"integer",
"string"
]
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"prebuilt": {
"type": "boolean"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"saved_object_id": {
"type": "string"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"timeout": {
"type": "integer"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": [
"integer",
"string"
]
}
}
},
"description": "An array of saved query objects."
},
"page": {
"type": "integer",
"description": "The current page number."
},
"per_page": {
"type": "integer",
"description": "The number of results per page."
},
"total": {
"type": "integer",
"description": "The total number of saved queries."
}
},
"description": "A paginated list of saved queries.",
"example": {
"data": [
{
"created_at": "2022-07-26T09:28:08.597Z",
"created_by": "elastic",
"created_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "saved_query_id",
"interval": "60",
"platform": "linux,darwin",
"prebuilt": false,
"query": "select * from uptime;",
"saved_object_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
"updated_at": "2022-07-26T09:28:08.597Z",
"updated_by": "elastic",
"updated_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"version": "2.8.0"
}
],
"page": 1,
"per_page": 100,
"total": 11
}
},
"Security_Osquery_API_GetLiveQueryResultsResponse": {
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"edges": {
"type": "array",
"items": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"_source": {
"type": "object",
"description": "The Elasticsearch document source containing query results."
}
}
},
"description": "The result rows from the query execution."
},
"total": {
"type": "integer",
"description": "The total number of result rows."
}
}
}
},
"description": "The response for getting live query results.",
"example": {
"data": {
"edges": [
{
"_id": "doc1",
"_source": { }
},
{
"_id": "doc2",
"_source": { }
}
],
"total": 2
}
}
},
"Security_Osquery_API_GetScheduledActionResultsResponse": {
"type": "object",
"properties": {
"aggregations": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduledActionResultsAggregations"
},
"currentPage": {
"type": "integer",
"description": "The current page number (zero-based)."
},
"edges": {
"type": "array",
"items": {
"type": "object"
},
"description": "The paginated list of per-agent action results."
},
"inspect": {
"type": "object",
"description": "Debug/inspection data for the search query."
},
"metadata": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduledExecutionMetadata"
},
"pageSize": {
"type": "integer",
"description": "The number of results per page."
},
"total": {
"type": "integer",
"description": "The total number of action results."
},
"totalPages": {
"type": "integer",
"description": "The total number of pages."
}
},
"example": {
"aggregations": {
"failed": 1,
"pending": 0,
"successful": 9,
"totalResponded": 10,
"totalRowCount": 42
},
"currentPage": 0,
"edges": [
{
"_id": "result-001",
"fields": {
"agent_id": "16d7caf5-efd2-4212-9b62-73dafc91fa13",
"rows_count": 5,
"status": "success"
}
}
],
"metadata": {
"executionCount": 3,
"packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
"packName": "My Pack",
"queryName": "uptime",
"queryText": "select * from uptime;",
"scheduleId": "pack_my_pack_uptime",
"timestamp": "2024-07-26T09:00:00.000Z"
},
"pageSize": 20,
"total": 10,
"totalPages": 1
}
},
"Security_Osquery_API_GetScheduledQueryResultsResponse": {
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"edges": {
"type": "array",
"items": {
"type": "object"
},
"description": "The paginated list of query result rows."
},
"inspect": {
"type": "object",
"description": "Debug/inspection data for the search query."
},
"total": {
"type": "integer",
"description": "The total number of result rows."
}
},
"description": "The query results data wrapper."
}
},
"description": "The response for getting scheduled query results.",
"example": {
"data": {
"edges": [
{
"_id": "row-001",
"fields": {
"host.uptime": [
"12345"
]
}
},
{
"_id": "row-002",
"fields": {
"host.uptime": [
"67890"
]
}
}
],
"total": 2
}
}
},
"Security_Osquery_API_GetUnifiedHistoryResponse": {
"required": [
"data",
"hasMore"
],
"type": "object",
"properties": {
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Osquery_API_UnifiedHistoryRow"
},
"description": "The list of unified history rows for the current page."
},
"hasMore": {
"type": "boolean",
"description": "Whether there are more results beyond the current page."
},
"nextPage": {
"type": "string",
"description": "A base64-encoded cursor to fetch the next page. Absent when there are no more results."
}
},
"example": {
"data": [
{
"actionId": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agentCount": 5,
"errorCount": 0,
"id": "3c42c847-eb30-4452-80e0-728584042334",
"queryName": "uptime_query",
"queryText": "select * from uptime;",
"source": "Live",
"sourceType": "live",
"successCount": 5,
"timestamp": "2024-07-26T09:59:32.220Z",
"totalRows": 42,
"userId": "elastic"
},
{
"agentCount": 10,
"errorCount": 1,
"executionCount": 3,
"id": "pack_my_pack_uptime_3",
"packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
"packName": "My Pack",
"plannedTime": "2024-07-26T09:00:00.000Z",
"queryName": "uptime",
"queryText": "select * from uptime;",
"scheduleId": "pack_my_pack_uptime",
"source": "Scheduled",
"sourceType": "scheduled",
"successCount": 9,
"timestamp": "2024-07-26T09:00:00.000Z",
"totalRows": 100
}
],
"hasMore": true,
"nextPage": "eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3..."
}
},
"Security_Osquery_API_Interval": {
"type": "string",
"description": "An interval, in seconds, on which to run the query.",
"example": "60"
},
"Security_Osquery_API_IntervalOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Interval"
},
"Security_Osquery_API_KueryOrUndefined": {
"type": [
"null",
"string"
],
"description": "The kuery to filter the results by.",
"example": "agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13"
},
"Security_Osquery_API_LiveHistoryRow": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Osquery_API_UnifiedHistoryRowBase"
},
{
"required": [
"sourceType",
"source"
],
"type": "object",
"properties": {
"actionId": {
"type": "string",
"description": "The Fleet action ID for the live query."
},
"agentAll": {
"type": "boolean",
"description": "Whether the query targeted all agents."
},
"agentIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of targeted agent IDs."
},
"agentPlatforms": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of targeted agent platforms."
},
"agentPolicyIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of targeted agent policy IDs."
},
"ecsMapping": {
"type": "object",
"description": "ECS mapping configuration used for the query."
},
"queriesTotal": {
"type": "integer",
"description": "The total number of sub-queries in the live action."
},
"queriesWithResults": {
"type": "integer",
"description": "The number of sub-queries that returned results."
},
"savedQueryId": {
"type": "string",
"description": "The saved query ID, if the live query was based on a saved query."
},
"source": {
"enum": [
"Live",
"Rule"
],
"type": "string",
"description": "Whether this was a manually run live query or triggered by a rule."
},
"sourceType": {
"enum": [
"live"
],
"type": "string",
"description": "Identifies this as a live query history row."
},
"timeout": {
"type": "integer",
"description": "The query timeout in seconds."
},
"userId": {
"type": "string",
"description": "The ID of the user who ran the query."
},
"userProfileUid": {
"type": "string",
"description": "The user profile UID of the user who ran the query."
}
}
}
]
},
"Security_Osquery_API_MinOsqueryVersion": {
"maxLength": 64,
"minLength": 1,
"type": "string",
"description": "Minimum osquery version required to run this pack or query, e.g. `\"5.10.0\"`.",
"example": "5.10.0"
},
"Security_Osquery_API_MinOsqueryVersionInput": {
"maxLength": 64,
"minLength": 1,
"pattern": "^\\d+(\\.\\d+){0,2}$",
"type": "string",
"description": "Minimum osquery version required to run this pack or query. Formatted as a numeric version string, e.g. `\"5.10.0\"`. Non-numeric values (e.g. `\"latest\"`) are rejected.",
"example": "5.10.0"
},
"Security_Osquery_API_MinOsqueryVersionInputOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersionInput"
},
"Security_Osquery_API_ObjectQueries": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueriesItem"
},
"description": "An object of queries."
},
"Security_Osquery_API_ObjectQueriesInput": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueriesItemInput"
},
"description": "An object of queries."
},
"Security_Osquery_API_ObjectQueriesItem": {
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryEnabled"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryId"
},
"interval": {
"type": [
"null",
"integer"
],
"description": "Interval for this query, in seconds. Overrides the pack's `interval` when this query also has `schedule_type: interval`. If you send `interval` without `schedule_type: interval`, Kibana removes it when saving, and the query uses the pack's `interval` instead. Ignored when the pack's `schedule_type` is `rrule`.\n"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_query_id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"version": {
"$ref": "#/components/schemas/Security_Osquery_API_Version"
}
}
},
"Security_Osquery_API_ObjectQueriesItemInput": {
"type": "object",
"properties": {
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryEnabled"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_QueryId"
},
"interval": {
"type": [
"null",
"integer"
],
"description": "Interval for this query, in seconds. Overrides the pack's `interval` when this query also has `schedule_type: interval`. If you send `interval` without `schedule_type: interval`, Kibana removes it when saving, and the query uses the pack's `interval` instead. Ignored when the pack's `schedule_type` is `rrule`.\n"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_query_id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"version": {
"$ref": "#/components/schemas/Security_Osquery_API_PackQueryVersionInput"
}
}
},
"Security_Osquery_API_PackDescription": {
"type": "string",
"description": "The pack description.",
"example": "Pack description"
},
"Security_Osquery_API_PackDescriptionOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"Security_Osquery_API_PackId": {
"type": "string",
"description": "The ID of the pack.",
"example": "3c42c847-eb30-4452-80e0-728584042334"
},
"Security_Osquery_API_PackIdOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_PackId"
},
"Security_Osquery_API_PackInterval": {
"minimum": 1,
"type": "integer",
"description": "Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`.",
"example": 60
},
"Security_Osquery_API_PackIntervalOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"Security_Osquery_API_PackName": {
"type": "string",
"description": "The pack name.",
"example": "my_pack"
},
"Security_Osquery_API_PackPlatform": {
"maxLength": 256,
"minLength": 1,
"type": "string",
"description": "Pack-level platform restriction. To specify multiple platforms, use commas. For example, `linux,darwin`.",
"example": "linux,darwin"
},
"Security_Osquery_API_PackPlatformOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"Security_Osquery_API_PackQueryVersionInput": {
"maxLength": 64,
"pattern": "^(\\d+(\\.\\d+){0,2})?$",
"type": "string",
"description": "Uses the Osquery versions greater than or equal to the specified version string. Formatted as a numeric version string, e.g. `\"5.10.0\"`, or an empty string to inherit the pack's `min_osquery_version` (no constraint if the pack has none). Non-numeric values (e.g. `\"latest\"`) are rejected.",
"example": "5.10.0"
},
"Security_Osquery_API_PackQueryVersionInputOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_PackQueryVersionInput"
},
"Security_Osquery_API_PageOrUndefined": {
"type": [
"null",
"integer"
],
"description": "The page number to return. The default is 1.",
"example": 1
},
"Security_Osquery_API_PageSizeOrUndefined": {
"type": [
"null",
"integer"
],
"description": "The number of results to return per page. The default is 20.",
"example": 20
},
"Security_Osquery_API_Platform": {
"type": "string",
"description": "Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.",
"example": "linux,darwin"
},
"Security_Osquery_API_PlatformOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"Security_Osquery_API_PolicyIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of agents policy IDs.",
"example": [
"policyId1",
"policyId2"
]
},
"Security_Osquery_API_PolicyIdsOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"Security_Osquery_API_Query": {
"type": "string",
"description": "The SQL query you want to run.",
"example": "select * from uptime;"
},
"Security_Osquery_API_QueryEnabled": {
"type": "boolean",
"description": "Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.",
"example": true
},
"Security_Osquery_API_QueryId": {
"type": "string",
"description": "The ID of the query.",
"example": "3c42c847-eb30-4452-80e0-728584042334"
},
"Security_Osquery_API_QueryOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"Security_Osquery_API_Removed": {
"type": "boolean",
"description": "Indicates whether the query is removed.",
"example": false
},
"Security_Osquery_API_RemovedOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"Security_Osquery_API_ResultType": {
"enum": [
"snapshot",
"differential",
"differential_added_only"
],
"type": "string",
"description": "Controls the result document type emitted by osquerybeat for this pack or query.\n- `snapshot`: Full table snapshot on every scheduled run (default).\n- `differential`: Rows added or removed since the previous run.\n- `differential_added_only`: Only rows added since the previous run (no removals).\n"
},
"Security_Osquery_API_ResultTypeOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"Security_Osquery_API_RRuleScheduleConfig": {
"required": [
"rrule",
"start_date"
],
"type": "object",
"properties": {
"end_date": {
"maxLength": 64,
"type": "string",
"description": "Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.",
"format": "date-time",
"example": "2024-12-31T23:59:59Z"
},
"rrule": {
"maxLength": 2048,
"type": "string",
"description": "Fully serialized RFC 5545 RRULE string (e.g.\n`\"FREQ=WEEKLY;BYDAY=MO,WE,FR\"`). The Kibana UI writes only a\nsubset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`,\n`BYMONTH` — but the server accepts and round-trips any\nwell-formed parts (other recognized parts like `BYHOUR`,\n`BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved\nverbatim).\n",
"example": "FREQ=WEEKLY;BYDAY=MO,WE,FR"
},
"splay": {
"maxLength": 64,
"type": "string",
"description": "Optional Go duration string for splay (random execution delay),\ne.g. `\"30s\"`, `\"5m\"`, `\"1h\"`. The Kibana form writes single-unit\nvalues only; compound durations (`\"1h30m\"`) are tolerated on\nread for round-trip safety with osquerybeat's writer. Maximum\n12 hours (43200 seconds).\n",
"example": "5m"
},
"start_date": {
"maxLength": 64,
"type": "string",
"description": "RFC 3339 datetime string for the schedule's start.",
"format": "date-time",
"example": "2024-01-01T00:00:00Z"
},
"timeout": {
"type": "number",
"description": "Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.",
"example": 60
}
},
"description": "RRULE schedule configuration consumed by osquerybeat. Loose date\nforms like `\"2024-01-01\"` are rejected with 400. DTSTART is NOT\nembedded in `rrule`; the separate `start_date` field is the\nschedule anchor.\n"
},
"Security_Osquery_API_RRuleScheduleConfigOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"Security_Osquery_API_SavedQueryDescription": {
"type": "string",
"description": "The saved query description.",
"example": "Saved query description"
},
"Security_Osquery_API_SavedQueryDescriptionOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"Security_Osquery_API_SavedQueryId": {
"type": "string",
"description": "The ID of a saved query.",
"example": "3c42c847-eb30-4452-80e0-728584042334"
},
"Security_Osquery_API_SavedQueryIdOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"Security_Osquery_API_ScheduledActionResultsAggregations": {
"type": "object",
"properties": {
"failed": {
"type": "integer",
"description": "The number of agents that returned errors."
},
"pending": {
"type": "integer",
"description": "The number of agents with pending responses."
},
"successful": {
"type": "integer",
"description": "The number of agents that completed successfully."
},
"totalResponded": {
"type": "integer",
"description": "The total number of agents that responded."
},
"totalRowCount": {
"type": "integer",
"description": "The total number of result rows across all agents."
}
}
},
"Security_Osquery_API_ScheduledExecutionMetadata": {
"type": "object",
"properties": {
"executionCount": {
"type": "integer",
"description": "The execution count for this scheduled query run."
},
"packId": {
"type": "string",
"description": "The ID of the pack containing the query."
},
"packName": {
"type": "string",
"description": "The name of the pack containing the query."
},
"queryName": {
"type": "string",
"description": "The name of the query within the pack."
},
"queryText": {
"type": "string",
"description": "The SQL query that was executed."
},
"scheduleId": {
"type": "string",
"description": "The schedule ID for the scheduled query."
},
"timestamp": {
"type": "string",
"description": "The timestamp of the most recent response for this execution."
}
},
"description": "Execution metadata resolved from the pack saved object."
},
"Security_Osquery_API_ScheduledHistoryRow": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Osquery_API_UnifiedHistoryRowBase"
},
{
"required": [
"sourceType",
"source"
],
"type": "object",
"properties": {
"executionCount": {
"type": "integer",
"description": "The execution count for this scheduled query run."
},
"plannedTime": {
"type": "string",
"description": "The planned execution time for the scheduled query."
},
"scheduleId": {
"type": "string",
"description": "The schedule ID for the scheduled query."
},
"source": {
"enum": [
"Scheduled"
],
"type": "string",
"description": "Indicates this is a scheduled query execution."
},
"sourceType": {
"enum": [
"scheduled"
],
"type": "string",
"description": "Identifies this as a scheduled query history row."
}
}
}
]
},
"Security_Osquery_API_ScheduleType": {
"enum": [
"interval",
"rrule"
],
"type": "string",
"description": "Discriminator for the pack's schedule mode. `interval` uses native\nosqueryd interval scheduling (seconds). `rrule` uses osquerybeat's\nRRULE-based recurrence scheduling. Per-query overrides MUST use the\nsame mode as the pack — cross-mode overrides are rejected with 400.\n",
"example": "rrule"
},
"Security_Osquery_API_ScheduleTypeOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"Security_Osquery_API_Shards": {
"type": "object",
"additionalProperties": {
"type": "number"
},
"description": "An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.",
"example": {
"policy_id": 50
}
},
"Security_Osquery_API_Snapshot": {
"type": "boolean",
"description": "Indicates whether the query is a snapshot.",
"example": true
},
"Security_Osquery_API_SnapshotOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"Security_Osquery_API_SortOrderOrUndefined": {
"enum": [
"asc",
"desc"
],
"type": "string",
"description": "Specifies the sort order.",
"example": "desc"
},
"Security_Osquery_API_SortOrUndefined": {
"type": [
"null",
"string"
],
"description": "The field that is used to sort the results.",
"default": "createdAt",
"example": "createdAt"
},
"Security_Osquery_API_UnifiedHistoryRow": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Osquery_API_LiveHistoryRow"
},
{
"$ref": "#/components/schemas/Security_Osquery_API_ScheduledHistoryRow"
}
],
"discriminator": {
"propertyName": "sourceType",
"mapping": {
"live": "#/components/schemas/Security_Osquery_API_LiveHistoryRow",
"scheduled": "#/components/schemas/Security_Osquery_API_ScheduledHistoryRow"
}
}
},
"Security_Osquery_API_UnifiedHistoryRowBase": {
"required": [
"id",
"timestamp",
"queryText",
"agentCount"
],
"type": "object",
"properties": {
"agentCount": {
"type": "integer",
"description": "For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded."
},
"errorCount": {
"type": [
"null",
"integer"
],
"description": "The number of agent responses with errors."
},
"id": {
"type": "string",
"description": "Unique identifier for the history row."
},
"packId": {
"type": "string",
"description": "The ID of the pack containing the query."
},
"packName": {
"type": "string",
"description": "The name of the pack containing the query."
},
"queryName": {
"type": "string",
"description": "The name of the query, if available."
},
"queryText": {
"type": "string",
"description": "The SQL query that was executed."
},
"spaceId": {
"type": "string",
"description": "The Kibana space ID where the query was executed."
},
"successCount": {
"type": [
"null",
"integer"
],
"description": "The number of successful agent responses."
},
"timestamp": {
"type": "string",
"description": "The timestamp of the query execution."
},
"totalRows": {
"type": [
"null",
"integer"
],
"description": "The total number of result rows returned across all agents."
}
}
},
"Security_Osquery_API_UpdatePacksRequestBody": {
"type": "object",
"properties": {
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersionInput"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueriesInput"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"shards": {
"$ref": "#/components/schemas/Security_Osquery_API_Shards"
}
},
"example": {
"name": "updated_my_pack_name"
}
},
"Security_Osquery_API_UpdatePacksResponse": {
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_PackDescription"
},
"enabled": {
"$ref": "#/components/schemas/Security_Osquery_API_Enabled"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_PackInterval"
},
"min_osquery_version": {
"$ref": "#/components/schemas/Security_Osquery_API_MinOsqueryVersion"
},
"name": {
"$ref": "#/components/schemas/Security_Osquery_API_PackName"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_PackPlatform"
},
"policy_ids": {
"$ref": "#/components/schemas/Security_Osquery_API_PolicyIds"
},
"queries": {
"$ref": "#/components/schemas/Security_Osquery_API_ObjectQueries"
},
"result_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ResultType"
},
"rrule_schedule": {
"$ref": "#/components/schemas/Security_Osquery_API_RRuleScheduleConfig"
},
"saved_object_id": {
"type": "string",
"description": "The saved object ID of the pack."
},
"schedule_type": {
"$ref": "#/components/schemas/Security_Osquery_API_ScheduleType"
},
"shards": {
"$ref": "#/components/schemas/Security_Osquery_API_Shards"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": "integer",
"description": "The pack version number."
}
}
}
},
"description": "The response for updating a pack.",
"example": {
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "My pack",
"enabled": true,
"name": "updated_my_pack_name",
"policy_ids": [
"my_policy_id"
],
"queries": {
"ports": {
"ecs_mapping": {
"client.port": {
"field": "port"
}
},
"interval": 60,
"query": "SELECT * FROM listening_ports;",
"removed": false,
"snapshot": true,
"timeout": 120
}
},
"saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
"shards": {
"47638692-7c4c-4053-aa3e-7186f28df349": 35,
"5e267651-fe50-443e-8d3f-3bbc9171b618": 58
},
"updated_at": "2025-02-26T13:40:16.297Z",
"updated_by": "elastic",
"version": 1
}
}
},
"Security_Osquery_API_UpdateSavedQueryRequestBody": {
"type": "object",
"properties": {
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"$ref": "#/components/schemas/Security_Osquery_API_Interval"
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"version": {
"$ref": "#/components/schemas/Security_Osquery_API_Version"
}
},
"example": {
"id": "updated_my_saved_query_name"
}
},
"Security_Osquery_API_UpdateSavedQueryResponse": {
"required": [
"data"
],
"type": "object",
"properties": {
"data": {
"required": [
"saved_object_id",
"id"
],
"type": "object",
"properties": {
"created_at": {
"type": "string",
"format": "date-time"
},
"created_by": {
"type": [
"null",
"string"
]
},
"created_by_profile_uid": {
"type": "string"
},
"description": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription"
},
"ecs_mapping": {
"$ref": "#/components/schemas/Security_Osquery_API_ECSMapping"
},
"id": {
"$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId"
},
"interval": {
"type": [
"integer",
"string"
]
},
"platform": {
"$ref": "#/components/schemas/Security_Osquery_API_Platform"
},
"prebuilt": {
"type": "boolean"
},
"query": {
"$ref": "#/components/schemas/Security_Osquery_API_Query"
},
"removed": {
"$ref": "#/components/schemas/Security_Osquery_API_Removed"
},
"saved_object_id": {
"type": "string"
},
"snapshot": {
"$ref": "#/components/schemas/Security_Osquery_API_Snapshot"
},
"timeout": {
"type": "integer"
},
"updated_at": {
"type": "string",
"format": "date-time"
},
"updated_by": {
"type": [
"null",
"string"
]
},
"updated_by_profile_uid": {
"type": "string"
},
"version": {
"type": "string",
"description": "The saved query version."
}
}
}
},
"description": "The response for updating a saved query.",
"example": {
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "Saved query description",
"id": "updated_my_saved_query_name",
"interval": "60",
"query": "select * from uptime;",
"saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
"updated_at": "2025-02-26T13:40:16.297Z",
"updated_by": "elastic",
"version": "WzQzMTcsMV0="
}
}
},
"Security_Osquery_API_Version": {
"type": "string",
"description": "Uses the Osquery versions greater than or equal to the specified version string.",
"example": "1.0.0"
},
"Security_Osquery_API_VersionOrUndefined": {
"$ref": "#/components/schemas/Security_Osquery_API_Version"
},
"Security_Solution_Initialization_API_CreateListIndicesReadyResult": {
"required": [
"status"
],
"type": "object",
"properties": {
"status": {
"enum": [
"ready"
],
"type": "string"
}
}
},
"Security_Solution_Initialization_API_DataViewPayload": {
"required": [
"id",
"title",
"patternList"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"patternList": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
}
}
},
"Security_Solution_Initialization_API_InitializationFlowErrorResult": {
"required": [
"status",
"error"
],
"type": "object",
"properties": {
"error": {
"type": [
"null",
"string"
]
},
"status": {
"enum": [
"error"
],
"type": "string"
}
}
},
"Security_Solution_Initialization_API_InitializationFlowId": {
"enum": [
"create-list-indices",
"security-data-views",
"init-prebuilt-rules",
"init-endpoint-protection",
"init-ai-prompts",
"init-detection-rule-monitoring"
],
"type": "string",
"description": "Identifier for an initialization flow."
},
"Security_Solution_Initialization_API_InitializationFlowsResult": {
"type": "object",
"properties": {
"create-list-indices": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_CreateListIndicesReadyResult"
},
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult"
}
]
},
"init-ai-prompts": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_PackageInstallReadyResult"
},
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult"
}
]
},
"init-detection-rule-monitoring": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InstallDetectionEngineRuleMonitoringAssetsReadyResult"
},
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult"
}
]
},
"init-endpoint-protection": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_PackageInstallReadyResult"
},
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult"
}
]
},
"init-prebuilt-rules": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_PackageInstallReadyResult"
},
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult"
}
]
},
"security-data-views": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_SecurityDataViewsReadyResult"
},
{
"$ref": "#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult"
}
]
}
},
"description": "Per-flow results. Only requested flows appear in the response, so all properties are optional. Each flow is either a typed ready result or an error result."
},
"Security_Solution_Initialization_API_InstallDetectionEngineRuleMonitoringAssetsReadyResult": {
"required": [
"status"
],
"type": "object",
"properties": {
"status": {
"enum": [
"ready"
],
"type": "string"
}
}
},
"Security_Solution_Initialization_API_PackageInstallReadyResult": {
"required": [
"status",
"payload"
],
"type": "object",
"properties": {
"payload": {
"required": [
"name",
"version",
"install_status"
],
"type": "object",
"properties": {
"install_status": {
"type": "string",
"description": "Fleet package installation status (e.g., installed, already_installed)."
},
"name": {
"type": "string"
},
"version": {
"type": "string"
}
}
},
"status": {
"enum": [
"ready"
],
"type": "string"
}
}
},
"Security_Solution_Initialization_API_SecurityDataViewsReadyResult": {
"required": [
"status",
"payload"
],
"type": "object",
"properties": {
"payload": {
"required": [
"defaultDataView",
"alertDataView",
"kibanaDataViews",
"signalIndexName"
],
"type": "object",
"properties": {
"alertDataView": {
"$ref": "#/components/schemas/Security_Solution_Initialization_API_DataViewPayload"
},
"attackDataView": {
"$ref": "#/components/schemas/Security_Solution_Initialization_API_DataViewPayload"
},
"defaultDataView": {
"$ref": "#/components/schemas/Security_Solution_Initialization_API_DataViewPayload"
},
"kibanaDataViews": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Solution_Initialization_API_DataViewPayload"
}
},
"signalIndexName": {
"type": "string"
}
}
},
"status": {
"enum": [
"ready"
],
"type": "string"
}
}
},
"Security_Timeline_API_AssociatedFilterType": {
"enum": [
"all",
"document_only",
"saved_object_only",
"document_and_saved_object",
"orphan"
],
"type": "string",
"description": "How the note is associated with a Timeline saved object and/or an event (`eventId`). `all`: no association-based restriction from this parameter. `document_only`: document-linked notes (non-empty `eventId`) without timeline association in the API's internal sense; post-filtering drops notes without a usable `eventId`. `saved_object_only`: timeline notes with no linked event (`eventId` empty or absent); post-filtering keeps timeline-only notes. `document_and_saved_object`: notes on a timeline and linked to an event; post-filtering enforces a real `eventId`. `orphan`: not on a timeline and `eventId` is empty (stricter than missing `eventId` in some cases).\n"
},
"Security_Timeline_API_BareNote": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_NoteCreatedAndUpdatedMetadata"
},
{
"required": [
"timelineId"
],
"type": "object",
"properties": {
"eventId": {
"type": [
"null",
"string"
],
"description": "Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.\n",
"example": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc"
},
"note": {
"type": [
"null",
"string"
],
"description": "The text of the note",
"example": "This is an example text"
},
"timelineId": {
"type": "string",
"description": "The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).",
"example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
}
]
},
"Security_Timeline_API_BarePinnedEvent": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata"
},
{
"required": [
"eventId",
"timelineId"
],
"type": "object",
"properties": {
"eventId": {
"type": "string",
"description": "The `_id` of the associated event for this pinned event.",
"example": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc"
},
"timelineId": {
"type": "string",
"description": "The `savedObjectId` of the timeline that this pinned event is associated with",
"example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
}
}
]
},
"Security_Timeline_API_ColumnHeaderResult": {
"type": "object",
"properties": {
"aggregatable": {
"type": [
"null",
"boolean"
]
},
"category": {
"type": [
"null",
"string"
]
},
"columnHeaderType": {
"type": [
"null",
"string"
]
},
"description": {
"type": [
"null",
"string"
]
},
"example": {
"type": [
"null",
"string"
]
},
"id": {
"type": [
"null",
"string"
]
},
"indexes": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"name": {
"type": [
"null",
"string"
]
},
"placeholder": {
"type": [
"null",
"string"
]
},
"searchable": {
"type": [
"null",
"boolean"
]
},
"type": {
"type": [
"null",
"string"
]
}
}
},
"Security_Timeline_API_DataProviderQueryMatch": {
"type": "object",
"properties": {
"enabled": {
"type": [
"null",
"boolean"
]
},
"excluded": {
"type": [
"null",
"boolean"
]
},
"id": {
"type": [
"null",
"string"
]
},
"kqlQuery": {
"type": [
"null",
"string"
]
},
"name": {
"type": [
"null",
"string"
]
},
"queryMatch": {
"$ref": "#/components/schemas/Security_Timeline_API_QueryMatchResult"
},
"type": {
"$ref": "#/components/schemas/Security_Timeline_API_DataProviderType"
}
}
},
"Security_Timeline_API_DataProviderResult": {
"type": "object",
"properties": {
"and": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_DataProviderQueryMatch"
}
},
"enabled": {
"type": [
"null",
"boolean"
]
},
"excluded": {
"type": [
"null",
"boolean"
]
},
"id": {
"type": [
"null",
"string"
]
},
"kqlQuery": {
"type": [
"null",
"string"
]
},
"name": {
"type": [
"null",
"string"
]
},
"queryMatch": {
"$ref": "#/components/schemas/Security_Timeline_API_QueryMatchResult"
},
"type": {
"$ref": "#/components/schemas/Security_Timeline_API_DataProviderType"
}
}
},
"Security_Timeline_API_DataProviderType": {
"enum": [
"default",
"template"
],
"type": "string",
"description": "The type of data provider."
},
"Security_Timeline_API_DocumentIds": {
"oneOf": [
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "string"
}
],
"description": "One document ID or an array of IDs (Elasticsearch `_id` of the event)."
},
"Security_Timeline_API_FavoriteTimelineResponse": {
"required": [
"savedObjectId",
"version"
],
"type": "object",
"properties": {
"favorite": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_FavoriteTimelineResult"
}
},
"savedObjectId": {
"type": "string"
},
"templateTimelineId": {
"type": [
"null",
"string"
]
},
"templateTimelineVersion": {
"type": [
"null",
"number"
]
},
"timelineType": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
},
"version": {
"type": "string"
}
}
},
"Security_Timeline_API_FavoriteTimelineResult": {
"type": "object",
"properties": {
"favoriteDate": {
"type": [
"null",
"number"
]
},
"fullName": {
"type": [
"null",
"string"
]
},
"userName": {
"type": [
"null",
"string"
]
}
},
"description": "Indicates when and who marked a Timeline as a favorite.",
"example": {
"favoriteDate": 1741337636741,
"userName": "elastic"
}
},
"Security_Timeline_API_FilterTimelineResult": {
"type": "object",
"properties": {
"exists": {
"type": [
"null",
"string"
]
},
"match_all": {
"type": [
"null",
"string"
]
},
"meta": {
"type": [
"null",
"object"
],
"properties": {
"alias": {
"type": [
"null",
"string"
]
},
"controlledBy": {
"type": [
"null",
"string"
]
},
"disabled": {
"type": [
"null",
"boolean"
]
},
"field": {
"type": [
"null",
"string"
]
},
"formattedValue": {
"type": [
"null",
"string"
]
},
"index": {
"type": [
"null",
"string"
]
},
"key": {
"type": [
"null",
"string"
]
},
"negate": {
"type": [
"null",
"boolean"
]
},
"params": {
"type": [
"null",
"string"
]
},
"type": {
"type": [
"null",
"string"
]
},
"value": {
"type": [
"null",
"string"
]
}
}
},
"missing": {
"type": [
"null",
"string"
]
},
"query": {
"type": [
"null",
"string"
]
},
"range": {
"type": [
"null",
"string"
]
},
"script": {
"type": [
"null",
"string"
]
}
},
"example": {
"meta": {
"alias": "Custom filter name",
"disabled": false,
"index": ".alerts-security.alerts-default,logs-*",
"key": "@timestamp",
"negate": "false,",
"type": "exists",
"value": "exists"
},
"query": "{\"exists\":{\"field\":\"@timestamp\"}}"
}
},
"Security_Timeline_API_GetNotesResult": {
"required": [
"totalCount",
"notes"
],
"type": "object",
"properties": {
"notes": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_Note"
}
},
"totalCount": {
"type": "number",
"description": "Number of notes returned (may be adjusted after the query when `associatedFilter` applies post-filtering)."
}
}
},
"Security_Timeline_API_ImportTimelineResult": {
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"type": "object",
"properties": {
"error": {
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "The reason why the timeline could not be imported",
"example": "Malformed JSON"
},
"status_code": {
"type": "number",
"description": "The HTTP status code of the error",
"example": 400
}
},
"description": "The error containing the reason why the timeline could not be imported"
},
"id": {
"type": "string",
"description": "The ID of the timeline that failed to import",
"example": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
}
}
},
"description": "The list of failed Timeline imports"
},
"success": {
"type": "boolean",
"description": "Indicates whether any of the Timelines were successfully imports"
},
"success_count": {
"type": "number",
"description": "The amount of successfully imported/updated Timelines",
"example": 99
},
"timelines_installed": {
"type": "number",
"description": "The amount of successfully installed Timelines",
"example": 80
},
"timelines_updated": {
"type": "number",
"description": "The amount of successfully updated Timelines",
"example": 19
}
}
},
"Security_Timeline_API_ImportTimelines": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
{
"required": [
"savedObjectId",
"version",
"pinnedEventIds",
"eventNotes",
"globalNotes"
],
"type": "object",
"properties": {
"eventNotes": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_BareNote"
}
},
"globalNotes": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_BareNote"
}
},
"pinnedEventIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"savedObjectId": {
"type": [
"null",
"string"
]
},
"version": {
"type": [
"null",
"string"
]
}
}
}
]
},
"Security_Timeline_API_Note": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_BareNote"
},
{
"required": [
"noteId",
"version"
],
"type": "object",
"properties": {
"noteId": {
"type": "string",
"description": "The `savedObjectId` of the note",
"example": "709f99c6-89b6-4953-9160-35945c8e174e"
},
"version": {
"type": "string",
"description": "The version of the note",
"example": "WzQ2LDFd"
}
}
}
]
},
"Security_Timeline_API_NoteCreatedAndUpdatedMetadata": {
"type": "object",
"properties": {
"created": {
"type": [
"null",
"number"
],
"description": "The time the note was created, using a 13-digit Epoch timestamp.",
"example": 1587468588922
},
"createdBy": {
"type": [
"null",
"string"
],
"description": "The user who created the note.",
"example": "casetester"
},
"updated": {
"type": [
"null",
"number"
],
"description": "The last time the note was updated, using a 13-digit Epoch timestamp",
"example": 1741344876825
},
"updatedBy": {
"type": [
"null",
"string"
],
"description": "The user who last updated the note",
"example": "casetester"
}
}
},
"Security_Timeline_API_PersistPinnedEventResponse": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_PinnedEvent"
},
{
"required": [
"unpinned"
],
"type": "object",
"properties": {
"unpinned": {
"type": "boolean",
"description": "Indicates whether the event was successfully unpinned"
}
}
}
]
},
"Security_Timeline_API_PersistTimelineResponse": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse"
},
"Security_Timeline_API_PinnedEvent": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_BarePinnedEvent"
},
{
"required": [
"pinnedEventId",
"version"
],
"type": "object",
"properties": {
"pinnedEventId": {
"type": "string",
"description": "The `savedObjectId` of this pinned event",
"example": "10r1929b-0af7-42bd-85a8-56e234f98h2f3"
},
"version": {
"type": "string",
"description": "The version of this pinned event",
"example": "WzQ2LDFe"
}
}
}
]
},
"Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata": {
"type": "object",
"properties": {
"created": {
"type": [
"null",
"number"
],
"description": "The time the pinned event was created, using a 13-digit Epoch timestamp.",
"example": 1587468588922
},
"createdBy": {
"type": [
"null",
"string"
],
"description": "The user who created the pinned event.",
"example": "casetester"
},
"updated": {
"type": [
"null",
"number"
],
"description": "The last time the pinned event was updated, using a 13-digit Epoch timestamp",
"example": 1741344876825
},
"updatedBy": {
"type": [
"null",
"string"
],
"description": "The user who last updated the pinned event",
"example": "casetester"
}
}
},
"Security_Timeline_API_QueryMatchResult": {
"type": "object",
"properties": {
"displayField": {
"type": [
"null",
"string"
]
},
"displayValue": {
"type": [
"null",
"string"
]
},
"field": {
"type": [
"null",
"string"
]
},
"operator": {
"type": [
"null",
"string"
]
},
"value": {
"oneOf": [
{
"type": [
"null",
"string"
]
},
{
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
}
]
}
}
},
"Security_Timeline_API_ResolvedTimeline": {
"required": [
"timeline",
"outcome"
],
"type": "object",
"properties": {
"alias_purpose": {
"$ref": "#/components/schemas/Security_Timeline_API_SavedObjectResolveAliasPurpose"
},
"alias_target_id": {
"type": "string"
},
"outcome": {
"$ref": "#/components/schemas/Security_Timeline_API_SavedObjectResolveOutcome"
},
"timeline": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject"
}
}
},
"Security_Timeline_API_ResponseNote": {
"required": [
"note"
],
"type": "object",
"properties": {
"note": {
"$ref": "#/components/schemas/Security_Timeline_API_Note"
}
}
},
"Security_Timeline_API_RowRendererId": {
"enum": [
"alert",
"alerts",
"auditd",
"auditd_file",
"library",
"netflow",
"plain",
"registry",
"suricata",
"system",
"system_dns",
"system_endgame_process",
"system_file",
"system_fim",
"system_security_event",
"system_socket",
"threat_match",
"zeek"
],
"type": "string",
"description": "Identifies the available row renderers"
},
"Security_Timeline_API_SavedObjectIds": {
"oneOf": [
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "string"
}
],
"description": "One Timeline saved object ID or an array of IDs."
},
"Security_Timeline_API_SavedObjectResolveAliasPurpose": {
"enum": [
"savedObjectConversion",
"savedObjectImport"
],
"type": "string"
},
"Security_Timeline_API_SavedObjectResolveOutcome": {
"enum": [
"exactMatch",
"aliasMatch",
"conflict"
],
"type": "string"
},
"Security_Timeline_API_SavedTimeline": {
"type": "object",
"properties": {
"columns": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_ColumnHeaderResult"
},
"description": "The Timeline's columns",
"example": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
}
]
},
"created": {
"type": [
"null",
"number"
],
"description": "The time the Timeline was created, using a 13-digit Epoch timestamp.",
"example": 1587468588922
},
"createdBy": {
"type": [
"null",
"string"
],
"description": "The user who created the Timeline.",
"example": "casetester"
},
"dataProviders": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_DataProviderResult"
},
"description": "Object containing query clauses",
"example": [
{
"enabled": true,
"excluded": false,
"id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"queryMatch": {
"field": "_id,",
"operator": ":",
"value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
}
}
]
},
"dataViewId": {
"type": [
"null",
"string"
],
"description": "ID of the Timeline's Data View",
"example": "security-solution-default"
},
"dateRange": {
"type": [
"null",
"object"
],
"properties": {
"end": {
"oneOf": [
{
"type": [
"null",
"string"
]
},
{
"type": [
"null",
"number"
]
}
]
},
"start": {
"oneOf": [
{
"type": [
"null",
"string"
]
},
{
"type": [
"null",
"number"
]
}
]
}
},
"description": "The Timeline's search period.",
"example": {
"end": 1587456479201,
"start": 1587370079200
}
},
"description": {
"type": [
"null",
"string"
],
"description": "The Timeline's description",
"example": "Investigating exposure of CVE XYZ"
},
"eqlOptions": {
"type": [
"null",
"object"
],
"properties": {
"eventCategoryField": {
"type": [
"null",
"string"
]
},
"query": {
"type": [
"null",
"string"
]
},
"size": {
"oneOf": [
{
"type": [
"null",
"string"
]
},
{
"type": [
"null",
"number"
]
}
]
},
"tiebreakerField": {
"type": [
"null",
"string"
]
},
"timestampField": {
"type": [
"null",
"string"
]
}
},
"description": "EQL query that is used in the correlation tab",
"example": {
"eventCategoryField": "event.category",
"query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
"size": 100,
"timestampField": "@timestamp"
}
},
"eventType": {
"type": [
"null",
"string"
],
"description": "Event types displayed in the Timeline",
"example": "all",
"deprecated": true
},
"excludedRowRendererIds": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_RowRendererId"
},
"description": "A list of row renderers that should not be used when in `Event renderers` mode"
},
"favorite": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_FavoriteTimelineResult"
}
},
"filters": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_FilterTimelineResult"
},
"description": "A list of filters that should be applied to the query"
},
"indexNames": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "A list of index names to use in the query (e.g. when the default data view has been modified)",
"example": [
".logs*"
]
},
"kqlMode": {
"type": [
"null",
"string"
],
"description": "Indicates whether the KQL bar filters the query results or searches for additional results, where:\n * `filter`: filters query results\n * `search`: displays additional search results",
"example": "search"
},
"kqlQuery": {
"$ref": "#/components/schemas/Security_Timeline_API_SerializedFilterQueryResult"
},
"savedQueryId": {
"type": [
"null",
"string"
],
"description": "The ID of the saved query that might be used in the Query tab",
"example": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e"
},
"savedSearchId": {
"type": [
"null",
"string"
],
"description": "The ID of the saved search that is used in the ES|QL tab",
"example": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
},
"sort": {
"$ref": "#/components/schemas/Security_Timeline_API_Sort"
},
"status": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineStatus"
},
"templateTimelineId": {
"type": [
"null",
"string"
],
"description": "A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.",
"example": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
},
"templateTimelineVersion": {
"type": [
"null",
"number"
],
"description": "Timeline template version number. For Timelines, the value is `null`.",
"example": 12
},
"timelineType": {
"$ref": "#/components/schemas/Security_Timeline_API_TimelineType"
},
"title": {
"type": [
"null",
"string"
],
"description": "The Timeline's title.",
"example": "CVE XYZ investigation"
},
"updated": {
"type": [
"null",
"number"
],
"description": "The last time the Timeline was updated, using a 13-digit Epoch timestamp",
"example": 1741344876825
},
"updatedBy": {
"type": [
"null",
"string"
],
"description": "The user who last updated the Timeline",
"example": "casetester"
}
}
},
"Security_Timeline_API_SavedTimelineWithSavedObjectId": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
{
"required": [
"savedObjectId",
"version"
],
"type": "object",
"properties": {
"savedObjectId": {
"type": "string",
"description": "The `savedObjectId` of the Timeline or Timeline template",
"example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
},
"version": {
"type": "string",
"description": "The version of the Timeline or Timeline template",
"example": "WzE0LDFd"
}
}
}
]
},
"Security_Timeline_API_SerializedFilterQueryResult": {
"type": "object",
"properties": {
"filterQuery": {
"type": [
"null",
"object"
],
"properties": {
"kuery": {
"type": [
"null",
"object"
],
"properties": {
"expression": {
"type": [
"null",
"string"
]
},
"kind": {
"type": [
"null",
"string"
]
}
}
},
"serializedQuery": {
"type": [
"null",
"string"
]
}
}
}
},
"description": "KQL bar query.",
"example": {
"filterQuery": "null",
"kuery": {
"expression": "_id : *",
"kind": "kuery"
},
"serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
}
},
"Security_Timeline_API_Sort": {
"oneOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_SortObject"
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_SortObject"
}
}
]
},
"Security_Timeline_API_SortFieldTimeline": {
"enum": [
"title",
"description",
"updated",
"created"
],
"type": "string",
"description": "The field to sort the timelines by."
},
"Security_Timeline_API_SortObject": {
"type": "object",
"properties": {
"columnId": {
"type": [
"null",
"string"
]
},
"columnType": {
"type": [
"null",
"string"
]
},
"sortDirection": {
"type": [
"null",
"string"
]
}
},
"description": "Object indicating how rows are sorted in the Timeline's grid",
"example": {
"columnId": "@timestamp",
"sortDirection": "desc"
}
},
"Security_Timeline_API_TimelineResponse": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
{
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimelineWithSavedObjectId"
},
{
"type": "object",
"properties": {
"eventIdToNoteIds": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_Note"
},
"description": "A list of all the notes that are associated to this Timeline."
},
"noteIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "A list of all the ids of notes that are associated to this Timeline.",
"example": [
"709f99c6-89b6-4953-9160-35945c8e174e"
]
},
"notes": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_Note"
},
"description": "A list of all the notes that are associated to this Timeline."
},
"pinnedEventIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "A list of all the ids of pinned events that are associated to this Timeline.",
"example": [
"983f99c6-89b6-4953-9160-35945c8a194f"
]
},
"pinnedEventsSaveObject": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_PinnedEvent"
},
"description": "A list of all the pinned events that are associated to this Timeline."
}
}
}
]
},
"Security_Timeline_API_TimelineSavedToReturnObject": {
"allOf": [
{
"$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline"
},
{
"required": [
"savedObjectId",
"version"
],
"type": "object",
"properties": {
"eventIdToNoteIds": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_Note"
}
},
"noteIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"notes": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_Note"
}
},
"pinnedEventIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"pinnedEventsSaveObject": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/components/schemas/Security_Timeline_API_PinnedEvent"
}
},
"savedObjectId": {
"type": "string"
},
"version": {
"type": "string"
}
}
}
]
},
"Security_Timeline_API_TimelineStatus": {
"enum": [
"active",
"draft",
"immutable"
],
"type": "string",
"description": "The status of the Timeline."
},
"Security_Timeline_API_TimelineType": {
"enum": [
"default",
"template"
],
"type": "string",
"description": "The type of Timeline."
},
"Short_URL_APIs_urlResponse": {
"type": "object",
"properties": {
"accessCount": {
"type": "integer",
"description": "Number of times the short URL has been resolved."
},
"accessDate": {
"type": "integer",
"description": "Unix epoch (milliseconds) of the last time the short URL was resolved. Set to the creation time when the URL has never been accessed.",
"format": "int64"
},
"createDate": {
"type": "integer",
"description": "Unix epoch (milliseconds) when the short URL was created.",
"format": "int64"
},
"id": {
"type": "string",
"description": "The identifier for the short URL."
},
"locator": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The identifier for the locator."
},
"state": {
"type": "object",
"description": "The locator parameters."
},
"version": {
"type": "string",
"description": "The version of Kibana when the short URL was created."
}
}
},
"slug": {
"type": "string",
"description": "A random human-readable slug is automatically generated if the `humanReadableSlug` parameter is set to `true`. If it is set to `false`, a random short string is generated.\n"
}
}
},
"SLOs_400_response": {
"title": "Bad request",
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Bad Request"
},
"message": {
"type": "string",
"example": "Invalid value 'foo' supplied to: [...]"
},
"statusCode": {
"type": "number",
"example": 400
}
}
},
"SLOs_401_response": {
"title": "Unauthorized",
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Unauthorized"
},
"message": {
"type": "string",
"example": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]"
},
"statusCode": {
"type": "number",
"example": 401
}
}
},
"SLOs_403_response": {
"title": "Forbidden",
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Forbidden"
},
"message": {
"type": "string",
"example": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: action [slo_write] is unauthorized for user [limited_user] for REST request [/api/observability/slos]]: action [slo_write] is unauthorized for user [limited_user]"
},
"statusCode": {
"type": "number",
"example": 403
}
}
},
"SLOs_404_response": {
"title": "Not found",
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Not Found"
},
"message": {
"type": "string",
"example": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found"
},
"statusCode": {
"type": "number",
"example": 404
}
}
},
"SLOs_409_response": {
"title": "Conflict",
"required": [
"statusCode",
"error",
"message"
],
"type": "object",
"properties": {
"error": {
"type": "string",
"example": "Conflict"
},
"message": {
"type": "string",
"example": "SLO [d077e940-1515-11ee-9c50-9d096392f520] already exists"
},
"statusCode": {
"type": "number",
"example": 409
}
}
},
"SLOs_artifacts": {
"title": "Artifacts",
"type": "object",
"properties": {
"dashboards": {
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Dashboard saved-object id"
}
}
},
"description": "Array of dashboard references"
}
},
"description": "Links to related assets for the SLO"
},
"SLOs_budgeting_method": {
"title": "Budgeting method",
"enum": [
"occurrences",
"timeslices"
],
"type": "string",
"description": "The budgeting method to use when computing the rollup data.",
"example": "occurrences"
},
"SLOs_bulk_delete_request": {
"title": "Bulk delete SLO request",
"required": [
"list"
],
"type": "object",
"properties": {
"list": {
"type": "array",
"items": {
"type": "string",
"description": "The SLO Definition id",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"description": "An array of SLO Definition id"
}
},
"description": "The bulk delete SLO request takes a list of SLOs Definition id to delete.\n"
},
"SLOs_bulk_delete_response": {
"title": "Bulk delete SLO response",
"type": "object",
"properties": {
"taskId": {
"type": "string",
"description": "The taskId of the bulk delete operation",
"example": "d08506b7-f0e8-4f8b-a06a-a83940f4db91"
}
},
"description": "The bulk delete SLO response returns a taskId that can be used to poll for its status\n"
},
"SLOs_bulk_delete_status_response": {
"title": "The status of the bulk deletion",
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The error message if the bulk deletion operation failed",
"example": "Task not found"
},
"isDone": {
"type": "boolean",
"description": "Indicates if the bulk deletion operation is completed",
"example": true
},
"results": {
"type": "array",
"items": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "The error message if the deletion operation failed for this SLO",
"example": "SLO [d08506b7-f0e8-4f8b-a06a-a83940f4db91] not found"
},
"id": {
"type": "string",
"description": "The ID of the SLO that was deleted",
"example": "d08506b7-f0e8-4f8b-a06a-a83940f4db91"
},
"success": {
"type": "boolean",
"description": "The result of the deletion operation for this SLO",
"example": true
}
}
},
"description": "The results of the bulk deletion operation, including the success status and any errors for each SLO"
}
},
"description": "Indicates if the bulk deletion is completed, with the detailed results of the operation."
},
"SLOs_bulk_purge_rollup_request": {
"title": "Bulk Purge Rollup data request",
"required": [
"list",
"purgePolicy"
],
"type": "object",
"properties": {
"list": {
"type": "array",
"items": {
"type": "string",
"description": "The SLO Definition id",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"description": "An array of slo ids"
},
"purgePolicy": {
"type": "object",
"oneOf": [
{
"type": "object",
"properties": {
"age": {
"type": "string",
"description": "The duration to determine which documents to purge, formatted as {duration}{unit}. This value should be greater than or equal to the time window of every SLO provided.",
"example": "7d"
},
"purgeType": {
"enum": [
"fixed-age"
],
"type": "string",
"description": "Specifies whether documents will be purged based on a specific age or on a timestamp"
}
}
},
{
"type": "object",
"properties": {
"purgeType": {
"enum": [
"fixed-time"
],
"type": "string",
"description": "Specifies whether documents will be purged based on a specific age or on a timestamp"
},
"timestamp": {
"type": "string",
"description": "The timestamp to determine which documents to purge, formatted in ISO. This value should be older than the applicable time window of every SLO provided.",
"example": "2024-12-31T00:00:00.000Z"
}
}
}
],
"description": "Policy that dictates which SLI documents to purge based on age"
}
},
"description": "The bulk purge rollup data request takes a list of SLO ids and a purge policy, then deletes the rollup data according to the purge policy. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n"
},
"SLOs_bulk_purge_rollup_response": {
"title": "Bulk Purge Rollup data response",
"type": "object",
"properties": {
"taskId": {
"type": "string",
"description": "The task id of the purge operation",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
},
"description": "The bulk purge rollup data response returns a task id from the elasticsearch deleteByQuery response.\n"
},
"SLOs_bulk_snapshot_request": {
"title": "Bulk snapshot SLO request",
"required": [
"at",
"requests"
],
"type": "object",
"properties": {
"at": {
"type": "string",
"description": "The point in time at which to compute the SLO instance summaries",
"format": "date-time",
"example": "2025-01-12T10:00:00.000Z"
},
"requests": {
"maxItems": 100,
"type": "array",
"items": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The SLO definition id",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"instanceId": {
"type": "string",
"description": "The SLO instance ID. Omit this parameter or set it to `'*'` to return all instances for the SLO (up to 1000). Set a specific value to return that instance only.\n",
"example": "*"
}
}
},
"description": "The list of SLO instances to compute. Limited to 100 entries."
}
},
"description": "The bulk snapshot SLO request takes a point in time and a list of SLO instances to compute summaries for. The list is limited to 100 entries.\n"
},
"SLOs_create_slo_request": {
"title": "Create SLO request",
"required": [
"name",
"description",
"indicator",
"timeWindow",
"budgetingMethod",
"objective"
],
"type": "object",
"properties": {
"artifacts": {
"$ref": "#/components/schemas/SLOs_artifacts"
},
"budgetingMethod": {
"$ref": "#/components/schemas/SLOs_budgeting_method"
},
"description": {
"type": "string",
"description": "A description for the SLO."
},
"groupBy": {
"$ref": "#/components/schemas/SLOs_group_by"
},
"id": {
"type": "string",
"description": "A optional and unique identifier for the SLO. Must be between 8 and 48 chars",
"example": "my-super-slo-id"
},
"indicator": {
"oneOf": [
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_histogram"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric"
}
]
},
"name": {
"type": "string",
"description": "A name for the SLO."
},
"objective": {
"$ref": "#/components/schemas/SLOs_objective"
},
"settings": {
"$ref": "#/components/schemas/SLOs_settings"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of tags"
},
"timeWindow": {
"$ref": "#/components/schemas/SLOs_time_window"
}
},
"description": "The create SLO API request body varies depending on the type of indicator, time window and budgeting method.\n"
},
"SLOs_create_slo_response": {
"title": "Create SLO response",
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
}
},
"SLOs_delete_slo_instances_request": {
"title": "Delete SLO instances request",
"required": [
"list"
],
"type": "object",
"properties": {
"list": {
"type": "array",
"items": {
"required": [
"sloId",
"instanceId"
],
"type": "object",
"properties": {
"instanceId": {
"type": "string",
"description": "The SLO instance identifier",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"sloId": {
"type": "string",
"description": "The SLO unique identifier",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
}
},
"description": "An array of slo id and instance id"
}
},
"description": "The delete SLO instances request takes a list of SLO id and instance id, then delete the rollup and summary data. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n"
},
"SLOs_error_budget": {
"title": "Error budget",
"required": [
"initial",
"consumed",
"remaining",
"isEstimated"
],
"type": "object",
"properties": {
"consumed": {
"type": "number",
"description": "The error budget consummed, as a percentage of the initial value.",
"example": 0.8
},
"initial": {
"type": "number",
"description": "The initial error budget, as 1 - objective",
"example": 0.02
},
"isEstimated": {
"type": "boolean",
"description": "Only for SLO defined with occurrences budgeting method and calendar aligned time window.",
"example": true
},
"remaining": {
"type": "number",
"description": "The error budget remaining, as a percentage of the initial value.",
"example": 0.2
}
}
},
"SLOs_filter": {
"title": "Filter",
"type": "object",
"properties": {
"meta": {
"$ref": "#/components/schemas/SLOs_filter_meta"
},
"query": {
"type": "object"
}
},
"description": "Defines properties for a filter"
},
"SLOs_filter_meta": {
"title": "FilterMeta",
"type": "object",
"properties": {
"alias": {
"type": [
"null",
"string"
]
},
"controlledBy": {
"type": "string"
},
"disabled": {
"type": "boolean"
},
"field": {
"type": "string"
},
"group": {
"type": "string"
},
"index": {
"type": "string"
},
"isMultiIndex": {
"type": "boolean"
},
"key": {
"type": "string"
},
"negate": {
"type": "boolean"
},
"params": {
"type": "object"
},
"type": {
"type": "string"
},
"value": {
"type": "string"
}
},
"description": "Defines properties for a filter"
},
"SLOs_find_slo_definitions_response": {
"title": "Find SLO definitions response",
"type": "object",
"oneOf": [
{
"type": "object",
"properties": {
"page": {
"type": "number",
"example": 1
},
"perPage": {
"type": "number",
"example": 25
},
"results": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_slo_with_summary_response"
}
},
"total": {
"type": "number",
"example": 34
}
}
},
{
"type": "object",
"properties": {
"page": {
"type": "number",
"description": "for backward compability",
"default": 1
},
"perPage": {
"type": "number",
"description": "for backward compability",
"example": 25
},
"results": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_slo_with_summary_response"
}
},
"searchAfter": {
"type": "array",
"items": {
"type": "string"
},
"description": "the cursor to provide to get the next paged results",
"example": [
"some-slo-id",
"other-cursor-id"
]
},
"size": {
"type": "number",
"example": 25
},
"total": {
"type": "number",
"example": 34
}
}
}
],
"description": "A paginated response of SLO definitions matching the query.\n"
},
"SLOs_find_slo_response": {
"title": "Find SLO response",
"type": "object",
"properties": {
"page": {
"type": "number",
"example": 1
},
"perPage": {
"type": "number",
"example": 25
},
"results": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_slo_with_summary_response"
}
},
"searchAfter": {
"type": "string"
},
"size": {
"type": "number",
"description": "Size provided for cursor based pagination",
"example": 25
},
"total": {
"type": "number",
"example": 34
}
},
"description": "A paginated response of SLOs matching the query.\n"
},
"SLOs_group_by": {
"title": "Group by",
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "optional group by field or fields to use to generate an SLO per distinct value",
"example": [
[
"service.name"
],
"service.name",
[
"service.name",
"service.environment"
]
]
},
"SLOs_indicator_properties_apm_availability": {
"title": "APM availability",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"service",
"environment",
"transactionType",
"transactionName",
"index"
],
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "The APM service environment or \"*\"",
"example": "production"
},
"filter": {
"type": "string",
"description": "KQL query used for filtering the data",
"example": "service.foo : \"bar\""
},
"index": {
"type": "string",
"description": "The index used by APM metrics",
"example": "metrics-apm*,apm*"
},
"service": {
"type": "string",
"description": "The APM service name",
"example": "o11y-app"
},
"transactionName": {
"type": "string",
"description": "The APM transaction name or \"*\"",
"example": "GET /my/api"
},
"transactionType": {
"type": "string",
"description": "The APM transaction type or \"*\"",
"example": "request"
}
},
"description": "An object containing the indicator parameters."
},
"type": {
"type": "string",
"description": "The type of indicator.",
"example": "sli.apm.transactionDuration"
}
},
"description": "Defines properties for the APM availability indicator type"
},
"SLOs_indicator_properties_apm_latency": {
"title": "APM latency",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"service",
"environment",
"transactionType",
"transactionName",
"index",
"threshold"
],
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "The APM service environment or \"*\"",
"example": "production"
},
"filter": {
"type": "string",
"description": "KQL query used for filtering the data",
"example": "service.foo : \"bar\""
},
"index": {
"type": "string",
"description": "The index used by APM metrics",
"example": "metrics-apm*,apm*"
},
"service": {
"type": "string",
"description": "The APM service name",
"example": "o11y-app"
},
"threshold": {
"type": "number",
"description": "The latency threshold in milliseconds",
"example": 250
},
"transactionName": {
"type": "string",
"description": "The APM transaction name or \"*\"",
"example": "GET /my/api"
},
"transactionType": {
"type": "string",
"description": "The APM transaction type or \"*\"",
"example": "request"
}
},
"description": "An object containing the indicator parameters."
},
"type": {
"type": "string",
"description": "The type of indicator.",
"example": "sli.apm.transactionDuration"
}
},
"description": "Defines properties for the APM latency indicator type"
},
"SLOs_indicator_properties_custom_kql": {
"title": "Custom Query",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"index",
"timestampField",
"good",
"total"
],
"type": "object",
"properties": {
"dataViewId": {
"type": "string",
"description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.",
"example": "03b80ab3-003d-498b-881c-3beedbaf1162"
},
"filter": {
"$ref": "#/components/schemas/SLOs_kql_with_filters"
},
"good": {
"$ref": "#/components/schemas/SLOs_kql_with_filters_good"
},
"index": {
"type": "string",
"description": "The index or index pattern to use",
"example": "my-service-*"
},
"timestampField": {
"type": "string",
"description": "The timestamp field used in the source indice.\n",
"example": "timestamp"
},
"total": {
"$ref": "#/components/schemas/SLOs_kql_with_filters_total"
}
},
"description": "An object containing the indicator parameters."
},
"type": {
"type": "string",
"description": "The type of indicator.",
"example": "sli.kql.custom"
}
},
"description": "Defines properties for a custom query indicator type"
},
"SLOs_indicator_properties_custom_metric": {
"title": "Custom metric",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"index",
"timestampField",
"good",
"total"
],
"type": "object",
"properties": {
"dataViewId": {
"type": "string",
"description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.",
"example": "03b80ab3-003d-498b-881c-3beedbaf1162"
},
"filter": {
"type": "string",
"description": "the KQL query to filter the documents with.",
"example": "field.environment : \"production\" and service.name : \"my-service\""
},
"good": {
"required": [
"metrics",
"equation"
],
"type": "object",
"properties": {
"equation": {
"type": "string",
"description": "The equation to calculate the \"good\" metric.",
"example": "A"
},
"metrics": {
"type": "array",
"items": {
"oneOf": [
{
"required": [
"name",
"aggregation",
"field"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"sum"
],
"type": "string",
"description": "The aggregation type of the metric.",
"example": "sum"
},
"field": {
"type": "string",
"description": "The field of the metric.",
"example": "processor.processed"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: *"
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
}
}
},
{
"required": [
"name",
"aggregation"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"doc_count"
],
"type": "string",
"description": "The aggregation type of the metric.",
"example": "doc_count"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: *"
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
}
}
}
]
},
"description": "List of metrics with their name, aggregation type, and field."
}
},
"description": "An object defining the \"good\" metrics and equation\n"
},
"index": {
"type": "string",
"description": "The index or index pattern to use",
"example": "my-service-*"
},
"timestampField": {
"type": "string",
"description": "The timestamp field used in the source indice.\n",
"example": "timestamp"
},
"total": {
"required": [
"metrics",
"equation"
],
"type": "object",
"properties": {
"equation": {
"type": "string",
"description": "The equation to calculate the \"total\" metric.",
"example": "A"
},
"metrics": {
"type": "array",
"items": {
"oneOf": [
{
"required": [
"name",
"aggregation",
"field"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"sum"
],
"type": "string",
"description": "The aggregation type of the metric.",
"example": "sum"
},
"field": {
"type": "string",
"description": "The field of the metric.",
"example": "processor.processed"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: *"
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
}
}
},
{
"required": [
"name",
"aggregation"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"doc_count"
],
"type": "string",
"description": "The aggregation type of the metric.",
"example": "doc_count"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: *"
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
}
}
}
]
},
"description": "List of metrics with their name, aggregation type, and field."
}
},
"description": "An object defining the \"total\" metrics and equation\n"
}
},
"description": "An object containing the indicator parameters."
},
"type": {
"type": "string",
"description": "The type of indicator.",
"example": "sli.metric.custom"
}
},
"description": "Defines properties for a custom metric indicator type"
},
"SLOs_indicator_properties_histogram": {
"title": "Histogram indicator",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"index",
"timestampField",
"good",
"total"
],
"type": "object",
"properties": {
"dataViewId": {
"type": "string",
"description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.",
"example": "03b80ab3-003d-498b-881c-3beedbaf1162"
},
"filter": {
"type": "string",
"description": "the KQL query to filter the documents with.",
"example": "field.environment : \"production\" and service.name : \"my-service\""
},
"good": {
"required": [
"aggregation",
"field"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"value_count",
"range"
],
"type": "string",
"description": "The type of aggregation to use.",
"example": "value_count"
},
"field": {
"type": "string",
"description": "The field use to aggregate the good events.",
"example": "processor.latency"
},
"filter": {
"type": "string",
"description": "The filter for good events.",
"example": "processor.outcome: \"success\""
},
"from": {
"type": "number",
"description": "The starting value of the range. Only required for \"range\" aggregations.",
"example": 0
},
"to": {
"type": "number",
"description": "The ending value of the range. Only required for \"range\" aggregations.",
"example": 100
}
},
"description": "An object defining the \"good\" events\n"
},
"index": {
"type": "string",
"description": "The index or index pattern to use",
"example": "my-service-*"
},
"timestampField": {
"type": "string",
"description": "The timestamp field used in the source indice.\n",
"example": "timestamp"
},
"total": {
"required": [
"aggregation",
"field"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"value_count",
"range"
],
"type": "string",
"description": "The type of aggregation to use.",
"example": "value_count"
},
"field": {
"type": "string",
"description": "The field use to aggregate the good events.",
"example": "processor.latency"
},
"filter": {
"type": "string",
"description": "The filter for total events.",
"example": "processor.outcome : *"
},
"from": {
"type": "number",
"description": "The starting value of the range. Only required for \"range\" aggregations.",
"example": 0
},
"to": {
"type": "number",
"description": "The ending value of the range. Only required for \"range\" aggregations.",
"example": 100
}
},
"description": "An object defining the \"total\" events\n"
}
},
"description": "An object containing the indicator parameters."
},
"type": {
"type": "string",
"description": "The type of indicator.",
"example": "sli.histogram.custom"
}
},
"description": "Defines properties for a histogram indicator type"
},
"SLOs_indicator_properties_timeslice_metric": {
"title": "Timeslice metric",
"required": [
"type",
"params"
],
"type": "object",
"properties": {
"params": {
"required": [
"index",
"timestampField",
"metric"
],
"type": "object",
"properties": {
"dataViewId": {
"type": "string",
"description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.",
"example": "03b80ab3-003d-498b-881c-3beedbaf1162"
},
"filter": {
"type": "string",
"description": "the KQL query to filter the documents with.",
"example": "field.environment : \"production\" and service.name : \"my-service\""
},
"index": {
"type": "string",
"description": "The index or index pattern to use",
"example": "my-service-*"
},
"metric": {
"required": [
"metrics",
"equation",
"comparator",
"threshold"
],
"type": "object",
"properties": {
"comparator": {
"enum": [
"GT",
"GTE",
"LT",
"LTE"
],
"type": "string",
"description": "The comparator to use to compare the equation to the threshold.",
"example": "GT"
},
"equation": {
"type": "string",
"description": "The equation to calculate the metric.",
"example": "A"
},
"metrics": {
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field"
},
{
"$ref": "#/components/schemas/SLOs_timeslice_metric_percentile_metric"
},
{
"$ref": "#/components/schemas/SLOs_timeslice_metric_doc_count_metric"
}
],
"discriminator": {
"propertyName": "aggregation",
"mapping": {
"avg": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field",
"cardinality": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field",
"doc_count": "#/components/schemas/SLOs_timeslice_metric_doc_count_metric",
"last_value": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field",
"max": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field",
"min": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field",
"percentile": "#/components/schemas/SLOs_timeslice_metric_percentile_metric",
"std_deviation": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field",
"sum": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field"
}
}
},
"description": "List of metrics with their name, aggregation type, and field."
},
"threshold": {
"type": "number",
"description": "The threshold used to determine if the metric is a good slice or not.",
"example": 100
}
},
"description": "An object defining the metrics, equation, and threshold to determine if it's a good slice or not\n"
},
"timestampField": {
"type": "string",
"description": "The timestamp field used in the source indice.\n",
"example": "timestamp"
}
},
"description": "An object containing the indicator parameters."
},
"type": {
"type": "string",
"description": "The type of indicator.",
"example": "sli.metric.timeslice"
}
},
"description": "Defines properties for a timeslice metric indicator type"
},
"SLOs_kql_with_filters": {
"title": "KQL with filters",
"oneOf": [
{
"type": "string",
"description": "the KQL query to filter the documents with.",
"example": "field.environment : \"production\" and service.name : \"my-service\""
},
{
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_filter"
}
},
"kqlQuery": {
"type": "string"
}
}
}
],
"description": "Defines properties for a filter"
},
"SLOs_kql_with_filters_good": {
"title": "KQL query for good events",
"oneOf": [
{
"type": "string",
"description": "the KQL query to filter the documents with.",
"example": "request.latency <= 150 and request.status_code : \"2xx\""
},
{
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_filter"
}
},
"kqlQuery": {
"type": "string"
}
}
}
],
"description": "The KQL query used to define the good events."
},
"SLOs_kql_with_filters_total": {
"title": "KQL query for all events",
"oneOf": [
{
"type": "string",
"description": "the KQL query to filter the documents with.",
"example": "field.environment : \"production\" and service.name : \"my-service\""
},
{
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_filter"
}
},
"kqlQuery": {
"type": "string"
}
}
}
],
"description": "The KQL query used to define all events."
},
"SLOs_objective": {
"title": "Objective",
"required": [
"target"
],
"type": "object",
"properties": {
"target": {
"exclusiveMaximum": 100,
"exclusiveMinimum": 0,
"type": "number",
"description": "the target objective between 0 and 1 excluded",
"example": 0.99
},
"timesliceTarget": {
"maximum": 100,
"minimum": 0,
"type": "number",
"description": "the target objective for each slice when using a timeslices budgeting method",
"example": 0.995
},
"timesliceWindow": {
"type": "string",
"description": "the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}",
"example": "5m"
}
},
"description": "Defines properties for the SLO objective"
},
"SLOs_settings": {
"title": "Settings",
"type": "object",
"properties": {
"frequency": {
"type": "string",
"description": "The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.",
"default": "1m",
"example": "5m"
},
"preventCrossProjectSearch": {
"type": "boolean",
"description": "Pin the L1 rollup transform to the local/origin project only, preventing flat-world (cross-linked-project) reads. Only applies on serverless. Default is false, meaning rollup transforms target all linked projects.",
"default": false,
"example": true,
"deprecated": true
},
"preventInitialBackfill": {
"type": "boolean",
"description": "Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.",
"default": false,
"example": true
},
"projectRoutings": {
"maxLength": 8192,
"type": [
"null",
"string"
],
"description": "ES ProjectRouting expression controlling which linked projects the L1 rollup reads. When set (including null), overrides preventCrossProjectSearch. null and `_alias:_origin` mean origin only; `_alias:*` means all linked projects. Subset example `_id:p1 AND _id:p2`.",
"example": "_alias:_origin"
},
"syncDelay": {
"type": "string",
"description": "The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.",
"default": "1m",
"example": "5m"
},
"syncField": {
"type": "string",
"description": "The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.",
"example": "event.ingested"
}
},
"description": "Defines properties for SLO settings."
},
"SLOs_slo_definition_response": {
"title": "SLO definition response",
"required": [
"id",
"name",
"description",
"indicator",
"timeWindow",
"budgetingMethod",
"objective",
"settings",
"revision",
"enabled",
"groupBy",
"tags",
"createdAt",
"updatedAt",
"version"
],
"type": "object",
"properties": {
"artifacts": {
"$ref": "#/components/schemas/SLOs_artifacts"
},
"budgetingMethod": {
"$ref": "#/components/schemas/SLOs_budgeting_method"
},
"createdAt": {
"type": "string",
"description": "The creation date",
"example": "2023-01-12T10:03:19.000Z"
},
"description": {
"type": "string",
"description": "The description of the SLO.",
"example": "My SLO description"
},
"enabled": {
"type": "boolean",
"description": "Indicate if the SLO is enabled",
"example": true
},
"groupBy": {
"$ref": "#/components/schemas/SLOs_group_by"
},
"id": {
"type": "string",
"description": "The identifier of the SLO.",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"indicator": {
"oneOf": [
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_histogram"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"sli.apm.transactionDuration": "#/components/schemas/SLOs_indicator_properties_apm_latency",
"sli.apm.transactionErrorRate": "#/components/schemas/SLOs_indicator_properties_apm_availability",
"sli.histogram.custom": "#/components/schemas/SLOs_indicator_properties_histogram",
"sli.kql.custom": "#/components/schemas/SLOs_indicator_properties_custom_kql",
"sli.metric.custom": "#/components/schemas/SLOs_indicator_properties_custom_metric",
"sli.metric.timeslice": "#/components/schemas/SLOs_indicator_properties_timeslice_metric"
}
}
},
"name": {
"type": "string",
"description": "The name of the SLO.",
"example": "My Service SLO"
},
"objective": {
"$ref": "#/components/schemas/SLOs_objective"
},
"revision": {
"type": "number",
"description": "The SLO revision",
"example": 2
},
"settings": {
"$ref": "#/components/schemas/SLOs_settings"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of tags"
},
"timeWindow": {
"$ref": "#/components/schemas/SLOs_time_window"
},
"updatedAt": {
"type": "string",
"description": "The last update date",
"example": "2023-01-12T10:03:19.000Z"
},
"version": {
"type": "number",
"description": "The internal SLO version",
"example": 2
}
}
},
"SLOs_slo_with_summary_response": {
"title": "SLO response",
"required": [
"id",
"name",
"description",
"indicator",
"timeWindow",
"budgetingMethod",
"objective",
"settings",
"revision",
"summary",
"enabled",
"groupBy",
"instanceId",
"tags",
"createdAt",
"updatedAt",
"version"
],
"type": "object",
"properties": {
"budgetingMethod": {
"$ref": "#/components/schemas/SLOs_budgeting_method"
},
"createdAt": {
"type": "string",
"description": "The creation date",
"example": "2023-01-12T10:03:19.000Z"
},
"description": {
"type": "string",
"description": "The description of the SLO.",
"example": "My SLO description"
},
"enabled": {
"type": "boolean",
"description": "Indicate if the SLO is enabled",
"example": true
},
"groupBy": {
"$ref": "#/components/schemas/SLOs_group_by"
},
"id": {
"type": "string",
"description": "The identifier of the SLO.",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"indicator": {
"oneOf": [
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_histogram"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric"
}
],
"discriminator": {
"propertyName": "type",
"mapping": {
"sli.apm.transactionDuration": "#/components/schemas/SLOs_indicator_properties_apm_latency",
"sli.apm.transactionErrorRate": "#/components/schemas/SLOs_indicator_properties_apm_availability",
"sli.histogram.custom": "#/components/schemas/SLOs_indicator_properties_histogram",
"sli.kql.custom": "#/components/schemas/SLOs_indicator_properties_custom_kql",
"sli.metric.custom": "#/components/schemas/SLOs_indicator_properties_custom_metric",
"sli.metric.timeslice": "#/components/schemas/SLOs_indicator_properties_timeslice_metric"
}
}
},
"instanceId": {
"type": "string",
"description": "the value derived from the groupBy field, if present, otherwise '*'",
"example": "host-abcde"
},
"name": {
"type": "string",
"description": "The name of the SLO.",
"example": "My Service SLO"
},
"objective": {
"$ref": "#/components/schemas/SLOs_objective"
},
"revision": {
"type": "number",
"description": "The SLO revision",
"example": 2
},
"settings": {
"$ref": "#/components/schemas/SLOs_settings"
},
"summary": {
"$ref": "#/components/schemas/SLOs_summary"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of tags"
},
"timeWindow": {
"$ref": "#/components/schemas/SLOs_time_window"
},
"updatedAt": {
"type": "string",
"description": "The last update date",
"example": "2023-01-12T10:03:19.000Z"
},
"version": {
"type": "number",
"description": "The internal SLO version",
"example": 2
}
}
},
"SLOs_snapshot_response": {
"title": "Snapshot SLO response",
"required": [
"at",
"results"
],
"type": "object",
"properties": {
"at": {
"type": "string",
"description": "The point in time at which the summaries were computed",
"format": "date-time",
"example": "2025-01-12T10:00:00.000Z"
},
"results": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SLOs_snapshot_result"
},
"description": "The per-instance computation results"
}
},
"description": "The snapshot SLO response returns the point in time and the per-instance results. Each result contains either a summary (success) or an error (per-instance failure).\n"
},
"SLOs_snapshot_result": {
"title": "Snapshot result",
"required": [
"id",
"instanceId"
],
"type": "object",
"properties": {
"error": {
"required": [
"statusCode",
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "The error message",
"example": "SLO [8853df00-ae2e-11ed-90af-09bb6422b258] not found"
},
"statusCode": {
"type": "number",
"description": "The HTTP status code of the error",
"example": 404
}
},
"description": "Error information when the computation failed for this SLO instance. Present when the computation failed."
},
"id": {
"type": "string",
"description": "The SLO definition id",
"example": "8853df00-ae2e-11ed-90af-09bb6422b258"
},
"instanceId": {
"type": "string",
"description": "The SLO instance id. '*' represents the default (ungrouped) instance.",
"example": "*"
},
"summary": {
"required": [
"status",
"sliValue",
"errorBudget",
"good",
"total"
],
"type": "object",
"properties": {
"errorBudget": {
"required": [
"initial",
"consumed",
"remaining"
],
"type": "object",
"properties": {
"consumed": {
"type": [
"null",
"number"
],
"description": "The error budget consumed, or null when no data is available",
"example": 0.24
},
"initial": {
"type": "number",
"description": "The initial error budget, derived from the SLO objective",
"example": 0.01
},
"remaining": {
"type": [
"null",
"number"
],
"description": "The error budget remaining, or null when no data is available",
"example": 0.76
}
}
},
"good": {
"type": "number",
"description": "The number of good events",
"example": 9976
},
"sliValue": {
"type": [
"null",
"number"
],
"description": "The SLI value at the requested point in time, or null when no data is available",
"example": 0.9976
},
"status": {
"enum": [
"NO_DATA",
"HEALTHY",
"DEGRADING",
"VIOLATED"
],
"type": "string",
"description": "The SLO health status",
"example": "HEALTHY"
},
"total": {
"type": "number",
"description": "The total number of events",
"example": 10000
}
},
"description": "The SLO instance summary at the requested point in time. Present when the computation succeeded."
}
},
"description": "The result of computing an SLO instance summary at a point in time. Contains either a summary (on success) or an error (on failure).\n"
},
"SLOs_summary": {
"title": "Summary",
"required": [
"status",
"sliValue",
"errorBudget"
],
"type": "object",
"properties": {
"errorBudget": {
"$ref": "#/components/schemas/SLOs_error_budget"
},
"sliValue": {
"type": "number",
"example": 0.9836
},
"status": {
"$ref": "#/components/schemas/SLOs_summary_status"
}
},
"description": "The SLO computed data"
},
"SLOs_summary_status": {
"title": "summary status",
"enum": [
"NO_DATA",
"HEALTHY",
"DEGRADING",
"VIOLATED"
],
"type": "string",
"example": "HEALTHY"
},
"SLOs_time_window": {
"title": "Time window",
"required": [
"duration",
"type"
],
"type": "object",
"properties": {
"duration": {
"type": "string",
"description": "the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)",
"example": "30d"
},
"type": {
"enum": [
"rolling",
"calendarAligned"
],
"type": "string",
"description": "Indicates weither the time window is a rolling or a calendar aligned time window.",
"example": "rolling"
}
},
"description": "Defines properties for the SLO time window"
},
"SLOs_timeslice_metric_basic_metric_with_field": {
"title": "Timeslice Metric Basic Metric with Field",
"required": [
"name",
"aggregation",
"field"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"sum",
"avg",
"min",
"max",
"std_deviation",
"last_value",
"cardinality"
],
"type": "string",
"description": "The aggregation type of the metric.",
"example": "sum"
},
"field": {
"type": "string",
"description": "The field of the metric.",
"example": "processor.processed"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: \"success\""
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
}
}
},
"SLOs_timeslice_metric_doc_count_metric": {
"title": "Timeslice Metric Doc Count Metric",
"required": [
"name",
"aggregation"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"doc_count"
],
"type": "string",
"description": "The aggregation type of the metric. Only valid option is \"doc_count\"",
"example": "doc_count"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: \"success\""
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
}
}
},
"SLOs_timeslice_metric_percentile_metric": {
"title": "Timeslice Metric Percentile Metric",
"required": [
"name",
"aggregation",
"field",
"percentile"
],
"type": "object",
"properties": {
"aggregation": {
"enum": [
"percentile"
],
"type": "string",
"description": "The aggregation type of the metric. Only valid option is \"percentile\"",
"example": "percentile"
},
"field": {
"type": "string",
"description": "The field of the metric.",
"example": "processor.processed"
},
"filter": {
"type": "string",
"description": "The filter to apply to the metric.",
"example": "processor.outcome: \"success\""
},
"name": {
"pattern": "^[A-Z]$",
"type": "string",
"description": "The name of the metric. Only valid options are A-Z",
"example": "A"
},
"percentile": {
"type": "number",
"description": "The percentile value.",
"example": 95
}
}
},
"SLOs_update_slo_request": {
"title": "Update SLO request",
"type": "object",
"properties": {
"artifacts": {
"$ref": "#/components/schemas/SLOs_artifacts"
},
"budgetingMethod": {
"$ref": "#/components/schemas/SLOs_budgeting_method"
},
"description": {
"type": "string",
"description": "A description for the SLO."
},
"groupBy": {
"$ref": "#/components/schemas/SLOs_group_by"
},
"indicator": {
"oneOf": [
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_histogram"
},
{
"$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric"
}
]
},
"name": {
"type": "string",
"description": "A name for the SLO."
},
"objective": {
"$ref": "#/components/schemas/SLOs_objective"
},
"settings": {
"$ref": "#/components/schemas/SLOs_settings"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of tags"
},
"timeWindow": {
"$ref": "#/components/schemas/SLOs_time_window"
}
},
"description": "The update SLO API request body varies depending on the type of indicator, time window and budgeting method. Partial update is handled.\n"
},
"Synthetics_apiMonitorFields": {
"title": "API Journey monitor fields",
"allOf": [
{
"$ref": "#/components/schemas/Synthetics_commonMonitorFields"
},
{
"required": [
"inline_script",
"type"
],
"type": "object",
"properties": {
"certificate_error_spki_allowlist": {
"type": "array",
"items": {
"type": "string"
},
"description": "PEM certificates whose public keys (SPKI) are allowlisted so the API request context bypasses certificate errors for matching presented certificates. This does not add a CA to the trust store.",
"default": [ ]
},
"ignore_https_errors": {
"type": "boolean",
"description": "Ignore HTTPS errors.",
"default": false
},
"inline_script": {
"type": "string",
"description": "The inline API Journey script."
},
"playwright_options": {
"type": "object",
"description": "Playwright API request context options."
},
"synthetics_args": {
"type": "array",
"items": {
"type": "string"
},
"description": "Synthetics agent CLI arguments."
},
"type": {
"enum": [
"api"
],
"type": "string",
"description": "The monitor type."
}
}
}
]
},
"Synthetics_browserMonitorFields": {
"title": "Browser monitor fields",
"allOf": [
{
"$ref": "#/components/schemas/Synthetics_commonMonitorFields"
},
{
"required": [
"inline_script",
"type"
],
"type": "object",
"properties": {
"certificate_error_spki_allowlist": {
"type": "array",
"items": {
"type": "string"
},
"description": "PEM certificates whose public keys (SPKI) are allowlisted so Chromium bypasses certificate errors for matching presented certificates. This does not add a CA to Chromium's trust store.",
"default": [ ]
},
"ignore_https_errors": {
"type": "boolean",
"description": "Ignore HTTPS errors.",
"default": false
},
"inline_script": {
"type": "string",
"description": "The inline script."
},
"playwright_options": {
"type": "object",
"description": "Playwright options."
},
"screenshots": {
"enum": [
"on",
"off",
"only-on-failure"
],
"type": "string",
"description": "The screenshot option.",
"default": "on"
},
"synthetics_args": {
"type": "array",
"items": {
"type": "string"
},
"description": "Synthetics agent CLI arguments."
},
"type": {
"enum": [
"browser"
],
"type": "string",
"description": "The monitor type."
}
}
}
]
},
"Synthetics_commonMonitorFields": {
"title": "Common monitor fields",
"required": [
"name"
],
"type": "object",
"properties": {
"alert": {
"type": "object",
"description": "The alert configuration. The default is `{ status: { enabled: true }, tls: { enabled: true } }`.\n"
},
"enabled": {
"type": "boolean",
"description": "Specify whether the monitor is enabled.",
"default": true
},
"labels": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Key-value pairs of labels to associate with the monitor. Labels can be used for filtering and grouping monitors.\n"
},
"locations": {
"type": "array",
"items": {
"type": "string"
},
"description": "The location to deploy the monitor.\nMonitors can be deployed in multiple locations so that you can detect differences in availability and response times across those locations.\nTo list available locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Management* and click *Create monitor*. Locations will be listed in *Locations*.\n",
"externalDocs": {
"url": "https://github.com/elastic/synthetics/blob/main/src/locations/public-locations.ts"
}
},
"name": {
"type": "string",
"description": "The monitor name."
},
"namespace": {
"type": "string",
"description": "The namespace field should be lowercase and not contain spaces. The namespace must not include any of the following characters: `*`, `\\`, `/`, `?`, `\"`, `<`, `>`, `|`, whitespace, `,`, `#`, `:`, or `-`.\n",
"default": "default"
},
"params": {
"type": "string",
"description": "The monitor parameters."
},
"private_locations": {
"type": "array",
"items": {
"type": "string"
},
"description": "The private locations to which the monitors will be deployed.\nThese private locations refer to locations hosted and managed by you, whereas `locations` are hosted by Elastic.\nYou can specify a private location using the location's name.\nTo list available private locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Settings* and click *Private locationsr*. Private locations will be listed in the table.\n\n> info\n> You can provide `locations` or `private_locations` or both. At least one is required.\n"
},
"retest_on_failure": {
"type": "boolean",
"description": "Turn retesting for when a monitor fails on or off. By default, monitors are automatically retested if the monitor goes from \"up\" to \"down\". If the result of the retest is also \"down\", an error will be created and if configured, an alert sent. The monitor will then resume running according to the defined schedule. Using `retest_on_failure` can reduce noise related to transient problems.\n",
"default": true
},
"schedule": {
"type": "number",
"description": "The monitor's schedule in minutes. Supported values are `1`, `3`, `5`, `10`, `15`, `30`, `60`, `120`, and `240`. The default value is `3` minutes for HTTP, TCP, and ICMP monitors. The default value is `10` minutes for Browser monitors.\n"
},
"service.name": {
"type": "string",
"description": "The APM service name."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of tags."
},
"timeout": {
"type": "number",
"description": "The monitor timeout in seconds. The monitor will fail if it doesn't complete within this time.\n\nFor browser monitors, the minimum timeout is 30 seconds. Browser monitor timeouts are only applied when the monitor runs on private locations. If a browser monitor specifies a timeout but has no private locations configured, the timeout will have no effect and a warning will be returned in the response.\n",
"default": 16
}
}
},
"Synthetics_getParameterResponse": {
"title": "Get parameter response",
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "The description of the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
},
"id": {
"type": "string",
"description": "The unique identifier of the parameter."
},
"key": {
"type": "string",
"description": "The key of the parameter."
},
"namespaces": {
"type": "array",
"items": {
"type": "string"
},
"description": "The namespaces associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of tags associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
},
"value": {
"type": "string",
"description": "The value associated with the parameter. It will be included in the response if the user has write permissions. \n"
}
}
},
"Synthetics_getPrivateLocation": {
"title": "Post a private location",
"type": "object",
"properties": {
"agentPolicyId": {
"type": "string",
"description": "The ID of the agent policy associated with the private location."
},
"geo": {
"required": [
"lat",
"lon"
],
"type": "object",
"properties": {
"lat": {
"type": "number",
"description": "The latitude of the location."
},
"lon": {
"type": "number",
"description": "The longitude of the location."
}
},
"description": "Geographic coordinates (WGS84) for the location."
},
"id": {
"type": "string",
"description": "The unique identifier of the private location."
},
"isInvalid": {
"type": "boolean",
"description": "Indicates whether the location is invalid. If `true`, the location is invalid, which means the agent policy associated with the location is deleted.\n"
},
"label": {
"type": "string",
"description": "A label for the private location."
},
"namespace": {
"type": "string",
"description": "The namespace of the location, which is the same as the namespace of the agent policy associated with the location."
}
}
},
"Synthetics_httpMonitorFields": {
"title": "HTTP monitor fields",
"allOf": [
{
"$ref": "#/components/schemas/Synthetics_commonMonitorFields"
},
{
"required": [
"type",
"url"
],
"type": "object",
"properties": {
"check": {
"type": "object",
"properties": {
"request": {
"type": "object",
"properties": {
"body": {
"type": "string",
"description": "Optional request body content."
},
"headers": {
"type": "object",
"description": "A dictionary of additional HTTP headers to send. By default, Synthetics will set the User-Agent header to identify itself.\n"
},
"method": {
"enum": [
"HEAD",
"GET",
"POST",
"OPTIONS"
],
"type": "string",
"description": "The HTTP method to use."
}
},
"description": "An optional request to send to the remote host."
},
"response": {
"type": "object",
"properties": {
"body": {
"type": "object"
},
"headers": {
"type": "object",
"description": "A dictionary of expected HTTP headers. If the header is not found, the check fails."
}
},
"description": "The expected response."
}
},
"description": "The check request settings."
},
"ipv4": {
"type": "boolean",
"description": "If `true`, ping using the ipv4 protocol.",
"default": true
},
"ipv6": {
"type": "boolean",
"description": "If `true`, ping using the ipv6 protocol.",
"default": true
},
"max_redirects": {
"type": "number",
"description": "The maximum number of redirects to follow.",
"default": 0
},
"mode": {
"enum": [
"all",
"any"
],
"type": "string",
"description": "The mode of the monitor. If it is `all`, the monitor pings all resolvable IPs for a hostname. If it is `any`, the monitor pings only one IP address for a hostname. If you're using a DNS-load balancer and want to ping every IP address for the specified hostname, you should use `all`.\n",
"default": "any"
},
"password": {
"type": "string",
"description": "The password for authenticating with the server. The credentials are passed with the request.\n"
},
"proxy_headers": {
"type": "object",
"description": "Additional headers to send to proxies during CONNECT requests."
},
"proxy_url": {
"type": "string",
"description": "The URL of the proxy to use for this monitor."
},
"response": {
"type": "object",
"description": "Controls the indexing of the HTTP response body contents to the `http.response.body.contents field`."
},
"ssl": {
"type": "object",
"description": "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n"
},
"type": {
"enum": [
"http"
],
"type": "string",
"description": "The monitor type."
},
"url": {
"type": "string",
"description": "The URL to monitor."
},
"username": {
"type": "string",
"description": "The username for authenticating with the server. The credentials are passed with the request.\n"
}
}
}
]
},
"Synthetics_icmpMonitorFields": {
"title": "ICMP monitor fields",
"allOf": [
{
"$ref": "#/components/schemas/Synthetics_commonMonitorFields"
},
{
"required": [
"host",
"type"
],
"type": "object",
"properties": {
"host": {
"type": "string",
"description": "The host to ping."
},
"type": {
"enum": [
"icmp"
],
"type": "string",
"description": "The monitor type."
},
"wait": {
"type": "number",
"description": "The wait time in seconds.",
"default": 1
}
}
}
]
},
"Synthetics_monitorWarning": {
"title": "Monitor warning",
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "A human-readable warning message."
},
"monitorId": {
"type": "string",
"description": "The monitor ID associated with the warning."
},
"publicLocationIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The public location IDs associated with the warning."
}
}
},
"Synthetics_parameterRequest": {
"title": "Parameter request",
"required": [
"key",
"value"
],
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A description of the parameter."
},
"key": {
"type": "string",
"description": "The key of the parameter."
},
"share_across_spaces": {
"type": "boolean",
"description": "Specify whether the parameter should be shared across spaces."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of tags to categorize the parameter."
},
"value": {
"type": "string",
"description": "The value associated with the parameter."
}
}
},
"Synthetics_postParameterResponse": {
"title": "Post parameter response",
"type": "object",
"properties": {
"description": {
"type": "string",
"description": "A description of the parameter."
},
"id": {
"type": "string",
"description": "The unique identifier for the parameter."
},
"key": {
"type": "string",
"description": "The parameter key."
},
"share_across_spaces": {
"type": "boolean",
"description": "Indicates whether the parameter is shared across spaces."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of tags associated with the parameter."
},
"value": {
"type": "string",
"description": "The value associated with the parameter."
}
}
},
"Synthetics_tcpMonitorFields": {
"title": "TCP monitor fields",
"allOf": [
{
"$ref": "#/components/schemas/Synthetics_commonMonitorFields"
},
{
"required": [
"host",
"type"
],
"type": "object",
"properties": {
"host": {
"type": "string",
"description": "The host to monitor; it can be an IP address or a hostname. The host can include the port using a colon, for example \"example.com:9200\".\n"
},
"proxy_url": {
"type": "string",
"description": "The URL of the SOCKS5 proxy to use when connecting to the server. The value must be a URL with a scheme of `socks5://`. If the SOCKS5 proxy server requires client authentication, then a username and password can be embedded in the URL. When using a proxy, hostnames are resolved on the proxy server instead of on the client. You can change this behavior by setting the `proxy_use_local_resolver` option.\n"
},
"proxy_use_local_resolver": {
"type": "boolean",
"description": "Specify that hostnames are resolved locally instead of being resolved on the proxy server. If `false`, name resolution occurs on the proxy server.\n",
"default": false
},
"ssl": {
"type": "object",
"description": "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n"
},
"type": {
"enum": [
"tcp"
],
"type": "string",
"description": "The monitor type."
}
}
}
]
},
"Task_manager_health_APIs_configuration": {
"type": "object",
"description": "This object summarizes the current configuration of Task Manager. This includes dynamic configurations that change over time, such as `poll_interval` and `max_workers`, which can adjust in reaction to changing load on the system.\n"
},
"Task_manager_health_APIs_health_response": {
"title": "Task health response properties",
"type": "object",
"properties": {
"id": {
"type": "string"
},
"last_update": {
"type": "string"
},
"stats": {
"type": "object",
"properties": {
"capacity_estimation": {
"type": "object",
"description": "This object provides a rough estimate about the sufficiency of its capacity. These are estimates based on historical data and should not be used as predictions.\n"
},
"configuration": {
"$ref": "#/components/schemas/Task_manager_health_APIs_configuration"
},
"runtime": {
"type": "object",
"description": "This object tracks runtime performance of Task Manager, tracking task drift, worker load, and stats broken down by type, including duration and run results.\n"
},
"workload": {
"$ref": "#/components/schemas/Task_manager_health_APIs_workload"
}
}
},
"status": {
"type": "string"
},
"timestamp": {
"type": "string"
}
}
},
"Task_manager_health_APIs_workload": {
"type": "object",
"description": "This object summarizes the work load across the cluster, including the tasks in the system, their types, and current status.\n"
},
"bedrock_config": {
"title": "Connector request properties for an Amazon Bedrock connector",
"required": [
"apiUrl"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The Amazon Bedrock request URL."
},
"region": {
"type": "string",
"description": "Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, `us-west-1`).\n"
},
"defaultModel": {
"type": "string",
"description": "The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.\n",
"default": "us.anthropic.claude-sonnet-4-5-20250929-v1:0"
}
},
"description": "Defines properties for connectors when type is `.bedrock`."
},
"crowdstrike_config": {
"title": "Connector request config properties for a Crowdstrike connector",
"required": [
"url"
],
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The CrowdStrike tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
}
},
"description": "Defines config properties for connectors when type is `.crowdstrike`."
},
"d3security_config": {
"title": "Connector request properties for a D3 Security connector",
"required": [
"url"
],
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
}
},
"description": "Defines properties for connectors when type is `.d3security`."
},
"email_config": {
"title": "Connector request properties for an email connector",
"required": [
"from"
],
"type": "object",
"properties": {
"allowHtml": {
"type": "boolean",
"description": "When `true`, the connector can send emails with HTML-formatted content in the body. Defaults to `false`. This option is unavailable when `service` is `elastic_cloud`.\n",
"default": false
},
"clientId": {
"type": [
"null",
"string"
],
"description": "The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n"
},
"from": {
"type": "string",
"description": "The from address for all emails sent by the connector. It must be specified in `user@host-name` format.\n"
},
"hasAuth": {
"type": "boolean",
"description": "Specifies whether a user and password are required inside the secrets configuration.\n",
"default": true
},
"host": {
"type": "string",
"description": "The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n"
},
"oauthTokenUrl": {
"type": [
"null",
"string"
]
},
"port": {
"type": "integer",
"description": "The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n"
},
"secure": {
"type": "boolean",
"description": "Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.\n"
},
"service": {
"enum": [
"elastic_cloud",
"exchange_server",
"gmail",
"other",
"outlook365",
"ses"
],
"type": "string",
"description": "The name of the email service.\n"
},
"tenantId": {
"type": [
"null",
"string"
],
"description": "The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n"
}
},
"description": "Defines properties for connectors when type is `.email`."
},
"gemini_config": {
"title": "Connector request properties for an Google Gemini connector",
"required": [
"apiUrl",
"gcpRegion",
"gcpProjectID"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The Google Gemini request URL."
},
"defaultModel": {
"type": "string",
"description": "The generative artificial intelligence model for Google Gemini to use.",
"default": "gemini-2.5-pro"
},
"gcpRegion": {
"type": "string",
"description": "The GCP region where the Vertex AI endpoint enabled."
},
"gcpProjectID": {
"type": "string",
"description": "The Google ProjectID that has Vertex AI endpoint enabled."
}
},
"description": "Defines properties for connectors when type is `.gemini`."
},
"resilient_config": {
"title": "Connector request properties for a IBM Resilient connector",
"required": [
"apiUrl",
"orgId"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The IBM Resilient instance URL."
},
"orgId": {
"type": "string",
"description": "The IBM Resilient organization ID."
}
},
"description": "Defines properties for connectors when type is `.resilient`."
},
"index_config": {
"title": "Connector request properties for an index connector",
"required": [
"index"
],
"type": "object",
"properties": {
"executionTimeField": {
"type": [
"null",
"string"
],
"description": "A field that indicates when the document was indexed.",
"default": "null"
},
"index": {
"type": "string",
"description": "The Elasticsearch index to be written to."
},
"refresh": {
"type": "boolean",
"description": "The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.\n",
"default": false
}
},
"description": "Defines properties for connectors when type is `.index`."
},
"jira_config": {
"title": "Connector request properties for a Jira connector",
"required": [
"apiUrl",
"projectKey"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The Jira instance URL."
},
"projectKey": {
"type": "string",
"description": "The Jira project key."
}
},
"description": "Defines properties for connectors when type is `.jira`."
},
"defender_config": {
"title": "Connector request properties for a Microsoft Defender for Endpoint connector",
"required": [
"apiUrl",
"projectKey"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The URL of the Microsoft Defender for Endpoint API. If you are using the `xpack.actions.allowedHosts` setting, make sure the hostname is added to the allowed hosts.\n"
},
"clientId": {
"type": "string",
"description": "The application (client) identifier for your app in the Azure portal."
},
"oAuthScope": {
"type": "string",
"description": "The OAuth scopes or permission sets for the Microsoft Defender for Endpoint API."
},
"oAuthServerUrl": {
"type": "string",
"description": "The OAuth server URL where authentication is sent and received for the Microsoft Defender for Endpoint API."
},
"tenantId": {
"type": "string",
"description": "The tenant identifier for your app in the Azure portal."
}
},
"description": "Defines properties for connectors when type is `.microsoft_defender_endpoint`."
},
"genai_azure_config": {
"title": "Connector request properties for an OpenAI connector that uses Azure OpenAI",
"required": [
"apiProvider",
"apiUrl"
],
"type": "object",
"properties": {
"apiProvider": {
"enum": [
"Azure OpenAI"
],
"type": "string",
"description": "The OpenAI API provider."
},
"apiUrl": {
"type": "string",
"description": "The OpenAI API endpoint."
}
},
"description": "Defines properties for connectors when type is `.gen-ai` and the API provider is `Azure OpenAI`.\n"
},
"genai_openai_config": {
"title": "Connector request properties for an OpenAI connector",
"required": [
"apiProvider",
"apiUrl"
],
"type": "object",
"properties": {
"apiProvider": {
"enum": [
"OpenAI"
],
"type": "string",
"description": "The OpenAI API provider."
},
"apiUrl": {
"type": "string",
"description": "The OpenAI API endpoint."
},
"defaultModel": {
"type": "string",
"description": "The default model to use for requests."
}
},
"description": "Defines properties for connectors when type is `.gen-ai` and the API provider is `OpenAI`.\n"
},
"opsgenie_config": {
"title": "Connector request properties for an Opsgenie connector",
"required": [
"apiUrl"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
}
},
"description": "Defines properties for connectors when type is `.opsgenie`."
},
"pagerduty_config": {
"title": "Connector request properties for a PagerDuty connector",
"type": "object",
"properties": {
"apiUrl": {
"type": [
"null",
"string"
],
"description": "The PagerDuty event URL.",
"example": "https://events.pagerduty.com/v2/enqueue"
}
},
"description": "Defines properties for connectors when type is `.pagerduty`."
},
"sentinelone_config": {
"title": "Connector request properties for a SentinelOne connector",
"required": [
"url"
],
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The SentinelOne tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
}
},
"description": "Defines properties for connectors when type is `.sentinelone`."
},
"servicenow_config": {
"title": "Connector request properties for a ServiceNow ITSM connector",
"required": [
"apiUrl"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The ServiceNow instance URL."
},
"clientId": {
"type": "string",
"description": "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n"
},
"isOAuth": {
"type": "boolean",
"description": "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n",
"default": false
},
"jwtKeyId": {
"type": "string",
"description": "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n"
},
"userIdentifierValue": {
"type": "string",
"description": "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n"
},
"usesTableApi": {
"type": "boolean",
"description": "Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow.\n",
"default": true
}
},
"description": "Defines properties for connectors when type is `.servicenow`."
},
"servicenow_itom_config": {
"title": "Connector request properties for a ServiceNow ITOM connector",
"required": [
"apiUrl"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The ServiceNow instance URL."
},
"clientId": {
"type": "string",
"description": "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n"
},
"isOAuth": {
"type": "boolean",
"description": "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n",
"default": false
},
"jwtKeyId": {
"type": "string",
"description": "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n"
},
"userIdentifierValue": {
"type": "string",
"description": "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n"
}
},
"description": "Defines properties for connectors when type is `.servicenow-itom`."
},
"slack_api_config": {
"title": "Connector request properties for a Slack connector",
"type": "object",
"properties": {
"allowedChannels": {
"type": "array",
"items": {
"maxItems": 25,
"required": [
"id",
"name"
],
"type": "object",
"properties": {
"id": {
"minLength": 1,
"type": "string",
"description": "The Slack channel ID.",
"example": "C123ABC456"
},
"name": {
"minLength": 1,
"type": "string",
"description": "The Slack channel name."
}
}
},
"description": "A list of valid Slack channels."
}
},
"description": "Defines properties for connectors when type is `.slack_api`."
},
"swimlane_config": {
"title": "Connector request properties for a Swimlane connector",
"required": [
"apiUrl",
"appId",
"connectorType"
],
"type": "object",
"properties": {
"apiUrl": {
"type": "string",
"description": "The Swimlane instance URL."
},
"appId": {
"type": "string",
"description": "The Swimlane application ID."
},
"connectorType": {
"enum": [
"all",
"alerts",
"cases"
],
"type": "string",
"description": "The type of connector. Valid values are `all`, `alerts`, and `cases`."
},
"mappings": {
"title": "Connector mappings properties for a Swimlane connector",
"type": "object",
"properties": {
"alertIdConfig": {
"title": "Alert identifier mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the alert ID."
},
"caseIdConfig": {
"title": "Case identifier mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the case ID."
},
"caseNameConfig": {
"title": "Case name mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the case name."
},
"commentsConfig": {
"title": "Case comment mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the case comments."
},
"descriptionConfig": {
"title": "Case description mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the case description."
},
"ruleNameConfig": {
"title": "Rule name mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the name of the alert's rule."
},
"severityConfig": {
"title": "Severity mapping",
"required": [
"fieldType",
"id",
"key",
"name"
],
"type": "object",
"properties": {
"fieldType": {
"type": "string",
"description": "The type of field in Swimlane."
},
"id": {
"type": "string",
"description": "The identifier for the field in Swimlane."
},
"key": {
"type": "string",
"description": "The key for the field in Swimlane."
},
"name": {
"type": "string",
"description": "The name of the field in Swimlane."
}
},
"description": "Mapping for the severity."
}
},
"description": "The field mapping."
}
},
"description": "Defines properties for connectors when type is `.swimlane`."
},
"thehive_config": {
"title": "Connector request properties for a TheHive connector",
"required": [
"url"
],
"type": "object",
"properties": {
"organisation": {
"type": "string",
"description": "The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.\n"
},
"url": {
"type": "string",
"description": "The instance URL in TheHive. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
}
},
"description": "Defines configuration properties for connectors when type is `.thehive`."
},
"tines_config": {
"title": "Connector request properties for a Tines connector",
"required": [
"url"
],
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.\n"
}
},
"description": "Defines properties for connectors when type is `.tines`."
},
"torq_config": {
"title": "Connector request properties for a Torq connector",
"required": [
"webhookIntegrationUrl"
],
"type": "object",
"properties": {
"webhookIntegrationUrl": {
"type": "string",
"description": "The endpoint URL of the Elastic Security integration in Torq."
}
},
"description": "Defines properties for connectors when type is `.torq`."
},
"auth_type": {
"title": "Authentication type",
"enum": [
"webhook-authentication-basic",
"webhook-authentication-ssl",
"webhook-oauth2-client-credentials"
],
"type": [
"null",
"string"
],
"description": "The type of authentication to use: basic, SSL, OAuth2 client credentials, or none.\n"
},
"ca": {
"title": "Certificate authority",
"type": "string",
"description": "A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.\n"
},
"cert_type": {
"title": "Certificate type",
"enum": [
"ssl-crt-key",
"ssl-pfx"
],
"type": "string",
"description": "If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.\n"
},
"has_auth": {
"title": "Has authentication",
"type": "boolean",
"description": "If true, a username and password for login type authentication must be provided.",
"default": true
},
"verification_mode": {
"title": "Verification mode",
"enum": [
"certificate",
"full",
"none"
],
"type": "string",
"description": "Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.\n",
"default": "full"
},
"webhook_config": {
"title": "Connector request properties for a Webhook connector",
"type": "object",
"properties": {
"accessTokenUrl": {
"type": "string",
"description": "The URL used to request an OAuth2 access token. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required.\n"
},
"additionalFields": {
"type": [
"null",
"string"
],
"description": "Additional fields, encoded as a JSON object, sent as part of the OAuth2 access token request body.\n"
},
"authType": {
"$ref": "#/components/schemas/auth_type"
},
"ca": {
"$ref": "#/components/schemas/ca"
},
"certType": {
"$ref": "#/components/schemas/cert_type"
},
"clientId": {
"type": "string",
"description": "The client identifier for OAuth2 authentication. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required.\n"
},
"hasAuth": {
"$ref": "#/components/schemas/has_auth"
},
"headers": {
"type": [
"null",
"object"
],
"description": "A set of key-value pairs sent as headers with the request."
},
"method": {
"enum": [
"post",
"put",
"patch",
"get",
"delete"
],
"type": "string",
"description": "The HTTP request method: `post`, `put`, `patch`, `get`, or `delete`.\n",
"default": "post"
},
"scope": {
"type": "string",
"description": "The scope requested when acquiring the OAuth2 access token.\n"
},
"url": {
"type": "string",
"description": "The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
},
"verificationMode": {
"$ref": "#/components/schemas/verification_mode"
}
},
"description": "Defines properties for connectors when type is `.webhook`."
},
"cases_webhook_config": {
"title": "Connector request properties for Webhook - Case Management connector",
"required": [
"createIncidentJson",
"createIncidentResponseKey",
"createIncidentUrl",
"getIncidentResponseExternalTitleKey",
"getIncidentUrl",
"updateIncidentJson",
"updateIncidentUrl",
"viewIncidentUrl"
],
"type": "object",
"properties": {
"authType": {
"$ref": "#/components/schemas/auth_type"
},
"ca": {
"$ref": "#/components/schemas/ca"
},
"certType": {
"$ref": "#/components/schemas/cert_type"
},
"createCommentJson": {
"type": "string",
"description": "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n",
"example": "{\"body\": {{{case.comment}}}}"
},
"createCommentMethod": {
"enum": [
"patch",
"post",
"put"
],
"type": "string",
"description": "The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.\n",
"default": "put"
},
"createCommentUrl": {
"type": "string",
"description": "The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.\n",
"example": "https://example.com/issue/{{{external.system.id}}}/comment"
},
"createIncidentJson": {
"type": "string",
"description": "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
"example": "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}"
},
"createIncidentMethod": {
"enum": [
"patch",
"post",
"put"
],
"type": "string",
"description": "The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.\n",
"default": "post"
},
"createIncidentResponseKey": {
"type": "string",
"description": "The JSON key in the create external case response that contains the case ID."
},
"createIncidentUrl": {
"type": "string",
"description": "The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
},
"getIncidentResponseExternalTitleKey": {
"type": "string",
"description": "The JSON key in get external case response that contains the case title."
},
"getIncidentUrl": {
"type": "string",
"description": "The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n",
"example": "https://example.com/issue/{{{external.system.id}}}"
},
"hasAuth": {
"$ref": "#/components/schemas/has_auth"
},
"headers": {
"type": [
"null",
"object"
],
"additionalProperties": {
"type": "string"
},
"description": "A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.\n"
},
"updateIncidentJson": {
"type": "string",
"description": "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
"example": "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}"
},
"updateIncidentMethod": {
"enum": [
"patch",
"post",
"put"
],
"type": "string",
"description": "The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`.\n",
"default": "put"
},
"updateIncidentUrl": {
"type": "string",
"description": "The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n",
"example": "https://example.com/issue/{{{external.system.ID}}}"
},
"verificationMode": {
"$ref": "#/components/schemas/verification_mode"
},
"viewIncidentUrl": {
"type": "string",
"description": "The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.\n",
"example": "https://testing-jira.atlassian.net/browse/{{{external.system.title}}}"
}
},
"description": "Defines properties for connectors when type is `.cases-webhook`."
},
"xmatters_config": {
"title": "Connector request properties for an xMatters connector",
"type": "object",
"properties": {
"configUrl": {
"type": [
"null",
"string"
],
"description": "The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`.\n"
},
"usesBasic": {
"type": "boolean",
"description": "Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`).",
"default": true
}
},
"description": "Defines properties for connectors when type is `.xmatters`."
},
"bedrock_secrets": {
"title": "Connector secrets properties for an Amazon Bedrock connector",
"required": [
"accessKey",
"secret"
],
"type": "object",
"properties": {
"accessKey": {
"type": "string",
"description": "The AWS access key for authentication."
},
"secret": {
"type": "string",
"description": "The AWS secret for authentication."
}
},
"description": "Defines secrets for connectors when type is `.bedrock`."
},
"crowdstrike_secrets": {
"title": "Connector secrets properties for a Crowdstrike connector",
"required": [
"clientId",
"clientSecret"
],
"type": "object",
"properties": {
"clientId": {
"type": "string",
"description": "The CrowdStrike API client identifier."
},
"clientSecret": {
"type": "string",
"description": "The CrowdStrike API client secret to authenticate the `clientId`."
}
},
"description": "Defines secrets for connectors when type is `.crowdstrike`."
},
"d3security_secrets": {
"title": "Connector secrets properties for a D3 Security connector",
"required": [
"token"
],
"type": "object",
"properties": {
"token": {
"type": "string",
"description": "The D3 Security token."
}
},
"description": "Defines secrets for connectors when type is `.d3security`."
},
"email_secrets": {
"title": "Connector secrets properties for an email connector",
"type": "object",
"properties": {
"clientSecret": {
"type": "string",
"description": "The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required.\n"
},
"password": {
"type": "string",
"description": "The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
},
"user": {
"type": "string",
"description": "The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
}
},
"description": "Defines secrets for connectors when type is `.email`."
},
"gemini_secrets": {
"title": "Connector secrets properties for a Google Gemini connector",
"required": [
"credentialsJson"
],
"type": "object",
"properties": {
"credentialsJson": {
"type": "string",
"description": "The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it."
}
},
"description": "Defines secrets for connectors when type is `.gemini`."
},
"resilient_secrets": {
"title": "Connector secrets properties for IBM Resilient connector",
"required": [
"apiKeyId",
"apiKeySecret"
],
"type": "object",
"properties": {
"apiKeyId": {
"type": "string",
"description": "The authentication key ID for HTTP Basic authentication."
},
"apiKeySecret": {
"type": "string",
"description": "The authentication key secret for HTTP Basic authentication."
}
},
"description": "Defines secrets for connectors when type is `.resilient`."
},
"jira_secrets": {
"title": "Connector secrets properties for a Jira connector",
"required": [
"apiToken",
"email"
],
"type": "object",
"properties": {
"apiToken": {
"type": "string",
"description": "The Jira API authentication token for HTTP basic authentication."
},
"email": {
"type": "string",
"description": "The account email for HTTP Basic authentication."
}
},
"description": "Defines secrets for connectors when type is `.jira`."
},
"teams_secrets": {
"title": "Connector secrets properties for a Microsoft Teams connector",
"required": [
"webhookUrl"
],
"type": "object",
"properties": {
"webhookUrl": {
"type": "string",
"description": "The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
}
},
"description": "Defines secrets for connectors when type is `.teams`."
},
"genai_secrets": {
"title": "Connector secrets properties for an OpenAI connector",
"type": "object",
"properties": {
"apiKey": {
"type": "string",
"description": "The API key for authentication. For OpenAI and Azure OpenAI providers, it is required. For the `Other` provider, it is required if you do not use PKI authentication. With PKI, you can also optionally include an API key if the OpenAI-compatible service supports or requires one.\n"
},
"certificateData": {
"minLength": 1,
"type": "string",
"description": "Base64-encoded PEM certificate content for PKI authentication (Other provider only). Required for PKI.\n"
},
"privateKeyData": {
"minLength": 1,
"type": "string",
"description": "Base64-encoded PEM private key content for PKI authentication (Other provider only). Required for PKI.\n"
},
"caData": {
"minLength": 1,
"type": "string",
"description": "Base64-encoded PEM CA certificate content for PKI authentication (Other provider only). Optional.\n"
}
},
"description": "Defines secrets for connectors when type is `.gen-ai`. Supports both API key authentication (OpenAI, Azure OpenAI, and `Other`) and PKI authentication (`Other` provider only). PKI fields must be base64-encoded PEM content.\n"
},
"opsgenie_secrets": {
"title": "Connector secrets properties for an Opsgenie connector",
"required": [
"apiKey"
],
"type": "object",
"properties": {
"apiKey": {
"type": "string",
"description": "The Opsgenie API authentication key for HTTP Basic authentication."
}
},
"description": "Defines secrets for connectors when type is `.opsgenie`."
},
"pagerduty_secrets": {
"title": "Connector secrets properties for a PagerDuty connector",
"required": [
"routingKey"
],
"type": "object",
"properties": {
"routingKey": {
"type": "string",
"description": "A 32 character PagerDuty Integration Key for an integration on a service.\n"
}
},
"description": "Defines secrets for connectors when type is `.pagerduty`."
},
"sentinelone_secrets": {
"title": "Connector secrets properties for a SentinelOne connector",
"required": [
"token"
],
"type": "object",
"properties": {
"token": {
"type": "string",
"description": "The A SentinelOne API token."
}
},
"description": "Defines secrets for connectors when type is `.sentinelone`."
},
"servicenow_secrets": {
"title": "Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors",
"type": "object",
"properties": {
"clientSecret": {
"type": "string",
"description": "The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`."
},
"password": {
"type": "string",
"description": "The password for HTTP basic authentication. This property is required when `isOAuth` is `false`."
},
"privateKey": {
"type": "string",
"description": "The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`."
},
"privateKeyPassword": {
"type": "string",
"description": "The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key."
},
"username": {
"type": "string",
"description": "The username for HTTP basic authentication. This property is required when `isOAuth` is `false`."
}
},
"description": "Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`."
},
"slack_api_secrets": {
"title": "Connector secrets properties for a Web API Slack connector",
"required": [
"token"
],
"type": "object",
"properties": {
"token": {
"type": "string",
"description": "Slack bot user OAuth token."
}
},
"description": "Defines secrets for connectors when type is `.slack`."
},
"swimlane_secrets": {
"title": "Connector secrets properties for a Swimlane connector",
"type": "object",
"properties": {
"apiToken": {
"type": "string",
"description": "Swimlane API authentication token."
}
},
"description": "Defines secrets for connectors when type is `.swimlane`."
},
"thehive_secrets": {
"title": "Connector secrets properties for a TheHive connector",
"required": [
"apiKey"
],
"type": "object",
"properties": {
"apiKey": {
"type": "string",
"description": "The API key for authentication in TheHive."
}
},
"description": "Defines secrets for connectors when type is `.thehive`."
},
"tines_secrets": {
"title": "Connector secrets properties for a Tines connector",
"required": [
"email",
"token"
],
"type": "object",
"properties": {
"email": {
"type": "string",
"description": "The email used to sign in to Tines."
},
"token": {
"type": "string",
"description": "The Tines API token."
}
},
"description": "Defines secrets for connectors when type is `.tines`."
},
"torq_secrets": {
"title": "Connector secrets properties for a Torq connector",
"required": [
"token"
],
"type": "object",
"properties": {
"token": {
"type": "string",
"description": "The secret of the webhook authentication header."
}
},
"description": "Defines secrets for connectors when type is `.torq`."
},
"crt": {
"title": "Certificate",
"type": "string",
"description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file."
},
"key": {
"title": "Certificate key",
"type": "string",
"description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file."
},
"pfx": {
"title": "Personal information exchange",
"type": "string",
"description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file."
},
"webhook_secrets": {
"title": "Connector secrets properties for a Webhook connector",
"type": "object",
"properties": {
"clientSecret": {
"type": "string",
"description": "The client secret for OAuth2 authentication. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required.\n"
},
"crt": {
"$ref": "#/components/schemas/crt"
},
"key": {
"$ref": "#/components/schemas/key"
},
"pfx": {
"$ref": "#/components/schemas/pfx"
},
"password": {
"type": "string",
"description": "The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
},
"user": {
"type": "string",
"description": "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
}
},
"description": "Defines secrets for connectors when type is `.webhook`."
},
"cases_webhook_secrets": {
"title": "Connector secrets properties for Webhook - Case Management connector",
"type": "object",
"properties": {
"crt": {
"$ref": "#/components/schemas/crt"
},
"key": {
"$ref": "#/components/schemas/key"
},
"pfx": {
"$ref": "#/components/schemas/pfx"
},
"password": {
"type": "string",
"description": "The password for HTTP basic authentication. If `hasAuth` is set to `true` and and `authType` is `webhook-authentication-basic`, this property is required.\n"
},
"user": {
"type": "string",
"description": "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
}
}
},
"xmatters_secrets": {
"title": "Connector secrets properties for an xMatters connector",
"type": "object",
"properties": {
"password": {
"type": "string",
"description": "A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n"
},
"secretsUrl": {
"type": "string",
"description": "The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`.\n"
},
"user": {
"type": "string",
"description": "A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n"
}
},
"description": "Defines secrets for connectors when type is `.xmatters`."
},
"genai_openai_other_config": {
"title": "Connector request properties for an OpenAI connector with Other provider",
"required": [
"apiProvider",
"apiUrl",
"defaultModel"
],
"type": "object",
"properties": {
"apiProvider": {
"enum": [
"Other"
],
"type": "string",
"description": "The OpenAI API provider."
},
"apiUrl": {
"type": "string",
"description": "The OpenAI-compatible API endpoint."
},
"defaultModel": {
"type": "string",
"description": "The default model to use for requests."
},
"certificateData": {
"minLength": 1,
"type": "string",
"description": "PEM-encoded certificate content."
},
"privateKeyData": {
"minLength": 1,
"type": "string",
"description": "PEM-encoded private key content."
},
"caData": {
"minLength": 1,
"type": "string",
"description": "PEM-encoded CA certificate content."
},
"verificationMode": {
"enum": [
"full",
"certificate",
"none"
],
"type": "string",
"description": "SSL verification mode for PKI authentication.",
"default": "full"
},
"headers": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Custom headers to include in requests."
}
},
"description": "Defines properties for connectors when type is `.gen-ai` and the API provider is `Other` (OpenAI-compatible service), including optional PKI authentication.\n"
},
"defender_secrets": {
"title": "Connector secrets properties for a Microsoft Defender for Endpoint connector",
"required": [
"clientSecret"
],
"type": "object",
"properties": {
"clientSecret": {
"type": "string",
"description": "The client secret for your app in the Azure portal."
}
},
"description": "Defines secrets for connectors when type is `..microsoft_defender_endpoint`."
},
"run_acknowledge_resolve_pagerduty": {
"title": "PagerDuty connector parameters",
"required": [
"dedupKey",
"eventAction"
],
"type": "object",
"properties": {
"dedupKey": {
"maxLength": 255,
"type": "string",
"description": "The deduplication key for the PagerDuty alert."
},
"eventAction": {
"enum": [
"acknowledge",
"resolve"
],
"type": "string",
"description": "The type of event."
}
},
"description": "Test an action that acknowledges or resolves a PagerDuty alert."
},
"run_documents": {
"title": "Index connector parameters",
"required": [
"documents"
],
"type": "object",
"properties": {
"documents": {
"type": "array",
"items": {
"type": "object"
},
"description": "The documents in JSON format for index connectors."
}
},
"description": "Test an action that indexes a document into Elasticsearch."
},
"run_message_email": {
"title": "Email connector parameters",
"required": [
"message",
"subject"
],
"type": "object",
"properties": {
"bcc": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of \"blind carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `` format\n"
},
"cc": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of \"carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `` format \n"
},
"message": {
"type": "string",
"description": "The email message text. Markdown format is supported."
},
"subject": {
"type": "string",
"description": "The subject line of the email."
},
"to": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of email addresses. Addresses can be specified in `user@host-name` format or in name `` format.\n"
}
},
"description": "Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.\n"
},
"run_message_serverlog": {
"title": "Server log connector parameters",
"required": [
"message"
],
"type": "object",
"properties": {
"level": {
"enum": [
"debug",
"error",
"fatal",
"info",
"trace",
"warn"
],
"type": "string",
"description": "The log level of the message for server log connectors.",
"default": "info"
},
"message": {
"type": "string",
"description": "The message for server log connectors."
}
},
"description": "Test an action that writes an entry to the Kibana server log."
},
"run_message_slack": {
"title": "Slack connector parameters",
"required": [
"message"
],
"type": "object",
"properties": {
"message": {
"type": "string",
"description": "The Slack message text, which cannot contain Markdown, images, or other advanced formatting."
}
},
"description": "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack`.\n"
},
"run_trigger_pagerduty": {
"title": "PagerDuty connector parameters",
"required": [
"eventAction"
],
"type": "object",
"properties": {
"class": {
"type": "string",
"description": "The class or type of the event.",
"example": "cpu load"
},
"component": {
"type": "string",
"description": "The component of the source machine that is responsible for the event.",
"example": "eth0"
},
"customDetails": {
"type": "object",
"description": "Additional details to add to the event."
},
"dedupKey": {
"maxLength": 255,
"type": "string",
"description": "All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.\n"
},
"eventAction": {
"enum": [
"trigger"
],
"type": "string",
"description": "The type of event."
},
"group": {
"type": "string",
"description": "The logical grouping of components of a service.",
"example": "app-stack"
},
"links": {
"type": "array",
"items": {
"type": "object",
"properties": {
"href": {
"type": "string",
"description": "The URL for the link."
},
"text": {
"type": "string",
"description": "A plain text description of the purpose of the link."
}
}
},
"description": "A list of links to add to the event."
},
"severity": {
"enum": [
"critical",
"error",
"info",
"warning"
],
"type": "string",
"description": "The severity of the event on the affected system.",
"default": "info"
},
"source": {
"type": "string",
"description": "The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.\n"
},
"summary": {
"maxLength": 1024,
"type": "string",
"description": "A summery of the event."
},
"timestamp": {
"type": "string",
"description": "An ISO-8601 timestamp that indicates when the event was detected or generated.",
"format": "date-time"
}
},
"description": "Test an action that triggers a PagerDuty alert."
},
"run_addevent": {
"title": "The addEvent subaction",
"required": [
"subAction"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"addEvent"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"type": "object",
"properties": {
"additional_info": {
"type": "string",
"description": "Additional information about the event."
},
"description": {
"type": "string",
"description": "The details about the event."
},
"event_class": {
"type": "string",
"description": "A specific instance of the source."
},
"message_key": {
"type": "string",
"description": "All actions sharing this key are associated with the same ServiceNow alert. The default value is `:`."
},
"metric_name": {
"type": "string",
"description": "The name of the metric."
},
"node": {
"type": "string",
"description": "The host that the event was triggered for."
},
"resource": {
"type": "string",
"description": "The name of the resource."
},
"severity": {
"type": "string",
"description": "The severity of the event."
},
"source": {
"type": "string",
"description": "The name of the event source type."
},
"time_of_event": {
"type": "string",
"description": "The time of the event."
},
"type": {
"type": "string",
"description": "The type of event."
}
},
"description": "The set of configuration properties for the action."
}
},
"description": "The `addEvent` subaction for ServiceNow ITOM connectors."
},
"run_closealert": {
"title": "The closeAlert subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"closeAlert"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"alias"
],
"type": "object",
"properties": {
"alias": {
"type": "string",
"description": "The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert."
},
"note": {
"type": "string",
"description": "Additional information for the alert."
},
"source": {
"type": "string",
"description": "The display name for the source of the alert."
},
"user": {
"type": "string",
"description": "The display name for the owner."
}
}
}
},
"description": "The `closeAlert` subaction for Opsgenie connectors."
},
"run_closeincident": {
"title": "The closeIncident subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"closeIncident"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"incident"
],
"type": "object",
"properties": {
"incident": {
"type": "object",
"anyOf": [
{
"required": [
"correlation_id"
]
},
{
"required": [
"externalId"
]
}
],
"properties": {
"correlation_id": {
"maxLength": 100,
"type": [
"null",
"string"
],
"description": "An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.\n",
"default": "{{rule.id}}:{{alert.id}}"
},
"externalId": {
"type": [
"null",
"string"
],
"description": "The unique identifier (`incidentId`) for the incident in ServiceNow."
}
}
}
}
}
},
"description": "The `closeIncident` subaction for ServiceNow ITSM connectors."
},
"run_createalert": {
"title": "The createAlert subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"createAlert"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"type": "string"
},
"description": "The custom actions available to the alert in Opsgenie connectors."
},
"alias": {
"type": "string",
"description": "The unique identifier used for alert deduplication in Opsgenie."
},
"description": {
"type": "string",
"description": "A description that provides detailed information about the alert."
},
"details": {
"type": "object",
"description": "The custom properties of the alert in Opsgenie connectors.",
"example": {
"key1": "value1",
"key2": "value2"
}
},
"entity": {
"type": "string",
"description": "The domain of the alert in Opsgenie connectors. For example, the application or server name."
},
"message": {
"type": "string",
"description": "The alert message in Opsgenie connectors."
},
"note": {
"type": "string",
"description": "Additional information for the alert in Opsgenie connectors."
},
"priority": {
"enum": [
"P1",
"P2",
"P3",
"P4",
"P5"
],
"type": "string",
"description": "The priority level for the alert in Opsgenie connectors."
},
"responders": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The identifier for the entity."
},
"name": {
"type": "string",
"description": "The name of the entity."
},
"type": {
"enum": [
"escalation",
"schedule",
"team",
"user"
],
"type": "string",
"description": "The type of responders, in this case `escalation`."
},
"username": {
"type": "string",
"description": "A valid email address for the user."
}
}
},
"description": "The entities to receive notifications about the alert in Opsgenie connectors. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.\n"
},
"severity": {
"maximum": 4,
"minimum": 1,
"type": "integer",
"description": "The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n"
},
"source": {
"type": "string",
"description": "The display name for the source of the alert in Opsgenie and TheHive connectors."
},
"sourceRef": {
"type": "string",
"description": "A source reference for the alert in TheHive connectors."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tags for the alert in Opsgenie and TheHive connectors."
},
"title": {
"type": "string",
"description": "A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.\n"
},
"tlp": {
"maximum": 4,
"minimum": 0,
"type": "integer",
"description": "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n",
"default": 2
},
"type": {
"type": "string",
"description": "The type of alert in TheHive connectors."
},
"user": {
"type": "string",
"description": "The display name for the owner."
},
"visibleTo": {
"type": "array",
"items": {
"required": [
"type"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The identifier for the entity."
},
"name": {
"type": "string",
"description": "The name of the entity."
},
"type": {
"enum": [
"team",
"user"
],
"type": "string",
"description": "Valid values are `team` and `user`."
},
"username": {
"type": "string",
"description": "The user name. This property is required only when the `type` is `user`."
}
}
},
"description": "The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required."
}
}
}
},
"description": "The `createAlert` subaction for Opsgenie and TheHive connectors."
},
"run_fieldsbyissuetype": {
"title": "The fieldsByIssueType subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"fieldsByIssueType"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The Jira issue type identifier.",
"example": 10024
}
}
}
},
"description": "The `fieldsByIssueType` subaction for Jira connectors."
},
"run_getagentdetails": {
"title": "The getAgentDetails subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"getAgentDetails"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"ids"
],
"type": "object",
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of CrowdStrike agent identifiers."
}
},
"description": "The set of configuration properties for the action."
}
},
"description": "The `getAgentDetails` subaction for CrowdStrike connectors."
},
"run_getagents": {
"title": "The getAgents subaction",
"required": [
"subAction"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"getAgents"
],
"type": "string",
"description": "The action to test."
}
},
"description": "The `getAgents` subaction for SentinelOne connectors."
},
"run_getchoices": {
"title": "The getChoices subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"getChoices"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"fields"
],
"type": "object",
"properties": {
"fields": {
"type": "array",
"items": {
"type": "string"
},
"description": "An array of fields."
}
},
"description": "The set of configuration properties for the action."
}
},
"description": "The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors."
},
"run_getfields": {
"title": "The getFields subaction",
"required": [
"subAction"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"getFields"
],
"type": "string",
"description": "The action to test."
}
},
"description": "The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors."
},
"run_getincident": {
"title": "The getIncident subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"getIncident"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"externalId"
],
"type": "object",
"properties": {
"externalId": {
"type": "string",
"description": "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.",
"example": 71778
}
}
}
},
"description": "The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors."
},
"run_issue": {
"title": "The issue subaction",
"required": [
"subAction"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"issue"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"id"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The Jira issue identifier.",
"example": 71778
}
}
}
},
"description": "The `issue` subaction for Jira connectors."
},
"run_issues": {
"title": "The issues subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"issues"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"title"
],
"type": "object",
"properties": {
"title": {
"type": "string",
"description": "The title of the Jira issue."
}
}
}
},
"description": "The `issues` subaction for Jira connectors."
},
"run_issuetypes": {
"title": "The issueTypes subaction",
"required": [
"subAction"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"issueTypes"
],
"type": "string",
"description": "The action to test."
}
},
"description": "The `issueTypes` subaction for Jira connectors."
},
"run_postmessage": {
"title": "The postMessage subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"postMessage"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"type": "object",
"properties": {
"channelIds": {
"maxItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "The Slack channel identifier, which must be one of the `allowedChannels` in the connector configuration.\n"
},
"channels": {
"maxItems": 1,
"type": "array",
"items": {
"type": "string"
},
"description": "The name of a channel that your Slack app has access to.\n",
"deprecated": true
},
"text": {
"minLength": 1,
"type": "string",
"description": "The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.\n"
}
},
"description": "The set of configuration properties for the action."
}
},
"description": "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack_api`.\n"
},
"run_pushtoservice": {
"title": "The pushToService subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"pushToService"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"type": "object",
"properties": {
"comments": {
"type": "array",
"items": {
"type": "object",
"properties": {
"comment": {
"type": "string",
"description": "A comment related to the incident. For example, describe how to troubleshoot the issue."
},
"commentId": {
"type": "integer",
"description": "A unique identifier for the comment."
}
}
},
"description": "Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive."
},
"incident": {
"type": "object",
"properties": {
"additional_fields": {
"maxLength": 20,
"type": [
"null",
"string"
],
"description": "Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.\n"
},
"alertId": {
"type": "string",
"description": "The alert identifier for Swimlane connectors."
},
"caseId": {
"type": "string",
"description": "The case identifier for the incident for Swimlane connectors."
},
"caseName": {
"type": "string",
"description": "The case name for the incident for Swimlane connectors."
},
"category": {
"type": "string",
"description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors."
},
"correlation_display": {
"type": "string",
"description": "A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors."
},
"correlation_id": {
"type": "string",
"description": "The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.\n"
},
"description": {
"type": "string",
"description": "The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors."
},
"dest_ip": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.\n"
},
"externalId": {
"type": "string",
"description": "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.\n"
},
"id": {
"type": "string",
"description": "The external case identifier for Webhook - Case Management connectors."
},
"impact": {
"type": "string",
"description": "The impact of the incident for ServiceNow ITSM connectors."
},
"issueType": {
"type": "integer",
"description": "The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`."
},
"labels": {
"type": "array",
"items": {
"type": "string"
},
"description": "The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.\n"
},
"malware_hash": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident."
},
"malware_url": {
"type": "string",
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident."
},
"otherFields": {
"maxProperties": 20,
"type": "object",
"description": "Custom field identifiers and their values for Jira connectors.\n"
},
"parent": {
"type": "string",
"description": "The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues."
},
"priority": {
"type": "string",
"description": "The priority of the incident in Jira and ServiceNow SecOps connectors."
},
"ruleName": {
"type": "string",
"description": "The rule name for Swimlane connectors."
},
"severity": {
"type": "integer",
"description": "The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n"
},
"short_description": {
"type": "string",
"description": "A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.\n"
},
"source_ip": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident."
},
"status": {
"type": "string",
"description": "The status of the incident for Webhook - Case Management connectors."
},
"subcategory": {
"type": "string",
"description": "The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors."
},
"summary": {
"type": "string",
"description": "A summary of the incident for Jira connectors."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of tags for TheHive and Webhook - Case Management connectors."
},
"title": {
"type": "string",
"description": "A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.\n"
},
"tlp": {
"maximum": 4,
"minimum": 0,
"type": "integer",
"description": "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n",
"default": 2
},
"urgency": {
"type": "string",
"description": "The urgency of the incident for ServiceNow ITSM connectors."
}
},
"description": "Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident."
}
},
"description": "The set of configuration properties for the action."
}
},
"description": "The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors."
},
"run_validchannelid": {
"title": "The validChannelId subaction",
"required": [
"subAction",
"subActionParams"
],
"type": "object",
"properties": {
"subAction": {
"enum": [
"validChannelId"
],
"type": "string",
"description": "The action to test."
},
"subActionParams": {
"required": [
"channelId"
],
"type": "object",
"properties": {
"channelId": {
"type": "string",
"description": "The Slack channel identifier.",
"example": "C123ABC456"
}
}
}
},
"description": "Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is `.slack_api`.\n"
}
},
"parameters": {
"APM_UI_elastic_api_version": {
"name": "elastic-api-version",
"in": "header",
"description": "The version of the API to use",
"required": true,
"schema": {
"enum": [
"2023-10-31"
],
"type": "string",
"default": "2023-10-31"
}
},
"APM_UI_kbn_xsrf": {
"name": "kbn-xsrf",
"in": "header",
"description": "A required header to protect against CSRF attacks",
"required": true,
"schema": {
"type": "string",
"example": "true"
}
},
"Cases_alert_id": {
"name": "alertId",
"in": "path",
"description": "An identifier for the alert.",
"required": true,
"schema": {
"type": "string",
"example": "09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540"
}
},
"Cases_assignees_filter": {
"name": "assignees",
"in": "query",
"description": "Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.\n",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_string"
},
{
"$ref": "#/components/schemas/Cases_string_array"
}
]
}
},
"Cases_case_id": {
"name": "caseId",
"in": "path",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.",
"required": true,
"schema": {
"type": "string",
"example": "9c235210-6834-11ea-a78c-6ffb38a34414"
}
},
"Cases_category": {
"name": "category",
"in": "query",
"description": "Filters the returned cases by category.",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_case_category"
},
{
"$ref": "#/components/schemas/Cases_case_categories"
}
]
}
},
"Cases_comment_id": {
"name": "commentId",
"in": "path",
"description": "The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs.\n",
"required": true,
"schema": {
"type": "string",
"example": "71ec1870-725b-11ea-a0b2-c51ea50a58e2"
}
},
"Cases_configuration_id": {
"name": "configurationId",
"in": "path",
"description": "An identifier for the configuration.",
"required": true,
"schema": {
"type": "string",
"example": "3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9"
}
},
"Cases_connector_id": {
"name": "connectorId",
"in": "path",
"description": "An identifier for the connector. To retrieve connector IDs, use the find connectors API.",
"required": true,
"schema": {
"type": "string",
"example": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2"
}
},
"Cases_defaultSearchOperator": {
"name": "defaultSearchOperator",
"in": "query",
"description": "he default operator to use for the simple_query_string.",
"schema": {
"type": "string",
"default": "OR"
},
"example": "OR"
},
"Cases_field_definition_id": {
"name": "field_definition_id",
"in": "path",
"description": "The identifier for the field definition.",
"required": true,
"schema": {
"maxLength": 36,
"type": "string"
}
},
"Cases_from": {
"name": "from",
"in": "query",
"description": "Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.\n",
"schema": {
"type": "string",
"example": "now-1d"
}
},
"Cases_ids": {
"name": "ids",
"in": "query",
"description": "The cases that you want to removed. To get the case identifiers, use the search cases (`_find`) API. In the Dev Console, you can specify the array of cases in the following format: `ids=[\"e58e77e3-ef8e-4251-926f-efb115f3c4ec\"]`. In `curl`, all non-ASCII characters must be URL encoded. For example: `ids=%5B%22e58e77e3-ef8e-4251-926f-efb115f3c4ec%22%5D`\n",
"required": true,
"schema": {
"type": "array",
"items": {
"maxItems": 100,
"minItems": 1,
"type": "string",
"example": "d4e7abb0-b462-11ec-9a8d-698504725a43"
}
}
},
"Cases_kbn_xsrf": {
"name": "kbn-xsrf",
"in": "header",
"description": "Cross-site request forgery protection",
"required": true,
"schema": {
"type": "string"
}
},
"Cases_owner_filter": {
"name": "owner",
"in": "query",
"description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.\n",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_owner"
},
{
"$ref": "#/components/schemas/Cases_owners"
}
]
},
"example": "cases"
},
"Cases_page_index": {
"name": "page",
"in": "query",
"description": "The page number to return.",
"schema": {
"type": "integer",
"default": 1
},
"example": 1
},
"Cases_page_size": {
"name": "perPage",
"in": "query",
"description": "The number of items to return. Limited to 100 items.",
"schema": {
"maximum": 100,
"type": "integer",
"default": 20
},
"example": 20
},
"Cases_reporters": {
"name": "reporters",
"in": "query",
"description": "Filters the returned cases by the user name of the reporter.",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_string"
},
{
"$ref": "#/components/schemas/Cases_string_array"
}
]
},
"example": "elastic"
},
"Cases_search": {
"name": "search",
"in": "query",
"description": "An Elasticsearch simple_query_string query that filters the objects in the response.",
"schema": {
"type": "string"
},
"example": "Case title 1"
},
"Cases_searchFields": {
"name": "searchFields",
"in": "query",
"description": "The fields to perform the simple_query_string parsed query against.",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_searchFieldsType"
},
{
"$ref": "#/components/schemas/Cases_searchFieldsTypeArray"
}
]
}
},
"Cases_severity": {
"name": "severity",
"in": "query",
"description": "The severity of the case.",
"schema": {
"enum": [
"critical",
"high",
"low",
"medium"
],
"type": "string"
},
"example": "low"
},
"Cases_sort_order": {
"name": "sortOrder",
"in": "query",
"description": "Determines the sort order.",
"schema": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc"
},
"example": "desc"
},
"Cases_sortField": {
"name": "sortField",
"in": "query",
"description": "Determines which field is used to sort the results.",
"schema": {
"enum": [
"createdAt",
"updatedAt",
"closedAt",
"title",
"category",
"status",
"severity"
],
"type": "string",
"default": "createdAt"
},
"example": "updatedAt"
},
"Cases_status": {
"name": "status",
"in": "query",
"description": "Filters the returned cases by state.",
"schema": {
"enum": [
"closed",
"in-progress",
"open"
],
"type": "string"
},
"example": "open"
},
"Cases_tags": {
"name": "tags",
"in": "query",
"description": "Filters the returned cases by tags.",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_string"
},
{
"$ref": "#/components/schemas/Cases_string_array"
}
]
},
"example": "tag-1"
},
"Cases_template_author": {
"name": "author",
"in": "query",
"description": "Filters the returned templates by author username.",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_string"
},
{
"$ref": "#/components/schemas/Cases_string_array"
}
]
},
"example": "elastic"
},
"Cases_template_id": {
"name": "template_id",
"in": "path",
"description": "The identifier for the template.",
"required": true,
"schema": {
"maxLength": 36,
"type": "string"
},
"example": "9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42"
},
"Cases_template_is_enabled": {
"name": "isEnabled",
"in": "query",
"description": "Filters the returned templates by their enabled state.",
"schema": {
"type": "boolean"
},
"example": true
},
"Cases_template_sort_field": {
"name": "sortField",
"in": "query",
"description": "Determines which field is used to sort the results.",
"schema": {
"enum": [
"templateId",
"name",
"templateVersion",
"owner",
"deletedAt",
"author",
"usageCount",
"fieldCount",
"lastUsedAt",
"isDefault",
"isLatest"
],
"type": "string",
"default": "name"
},
"example": "name"
},
"Cases_template_tags": {
"name": "tags",
"in": "query",
"description": "Filters the returned templates by tags.",
"schema": {
"oneOf": [
{
"$ref": "#/components/schemas/Cases_string"
},
{
"$ref": "#/components/schemas/Cases_string_array"
}
]
},
"example": "tag-1"
},
"Cases_template_version": {
"name": "version",
"in": "query",
"description": "The version number of the template to retrieve. If omitted, the latest version is returned.",
"schema": {
"minimum": 1,
"type": "integer"
},
"example": 1
},
"Cases_to": {
"name": "to",
"in": "query",
"description": "Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.\n",
"schema": {
"type": "string"
},
"example": "now+1d"
},
"Cases_user_action_types": {
"name": "types",
"in": "query",
"description": "Determines the types of user actions to return.",
"schema": {
"type": "array",
"items": {
"enum": [
"action",
"alert",
"assignees",
"attachment",
"comment",
"connector",
"create_case",
"description",
"pushed",
"settings",
"severity",
"status",
"tags",
"title",
"user",
"workflow"
],
"type": "string",
"example": "create_case"
}
}
},
"Data_views_field_name": {
"name": "fieldName",
"in": "path",
"description": "The name of the runtime field.",
"required": true,
"schema": {
"type": "string",
"example": "hour_of_day"
}
},
"Data_views_kbn_xsrf": {
"name": "kbn-xsrf",
"in": "header",
"description": "Cross-site request forgery protection",
"required": true,
"schema": {
"type": "string"
}
},
"Data_views_view_id": {
"name": "viewId",
"in": "path",
"description": "An identifier for the data view.",
"required": true,
"schema": {
"type": "string",
"example": "ff959d40-b880-11e8-a6d9-e546fe2bba5f"
}
},
"Machine_learning_APIs_simulateParam": {
"name": "simulate",
"in": "query",
"description": "When true, simulates the synchronization by returning only the list of actions that would be performed.",
"schema": {
"type": "boolean"
},
"example": "true"
},
"Short_URL_APIs_idParam": {
"name": "id",
"in": "path",
"description": "The identifier for the short URL.",
"required": true,
"schema": {
"type": "string"
}
},
"SLOs_kbn_xsrf": {
"name": "kbn-xsrf",
"in": "header",
"description": "Cross-site request forgery protection",
"required": true,
"schema": {
"type": "string"
}
},
"SLOs_slo_id": {
"name": "sloId",
"in": "path",
"description": "An identifier for the slo.",
"required": true,
"schema": {
"type": "string",
"example": "9c235211-6834-11ea-a78c-6feb38a34414"
}
},
"SLOs_space_id": {
"name": "spaceId",
"in": "path",
"description": "An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.",
"required": true,
"schema": {
"type": "string",
"example": "default"
}
}
},
"examples": {
"Alerting_401_health_response": {
"summary": "Unauthorized response for the get alerting health API.",
"value": {
"error": "Unauthorized",
"message": "[security_exception] missing authentication credentials for REST request",
"statusCode": 401
}
},
"Alerting_401_rule_types_response": {
"summary": "Unauthorized response for the get rule types API.",
"value": {
"error": "Unauthorized",
"message": "[security_exception] missing authentication credentials for REST request",
"statusCode": 401
}
},
"Alerting_get_health_response": {
"summary": "Retrieve information about the health of the alerting framework.",
"value": {
"alerting_framework_health": {
"decryption_health": {
"status": "ok",
"timestamp": "2023-01-13T01:28:00.280Z"
},
"execution_health": {
"status": "ok",
"timestamp": "2023-01-13T01:28:00.280Z"
},
"read_health": {
"status": "ok",
"timestamp": "2023-01-13T01:28:00.280Z"
}
},
"has_permanent_encryption_key": true,
"is_sufficiently_secure": true
}
},
"Alerting_get_rule_types_response": {
"summary": "Retrieve rule types associated with Kibana machine learning features",
"value": [
{
"action_groups": [
{
"id": "anomaly_score_match",
"name": "Anomaly score matched the condition"
},
{
"id": "recovered",
"name": "Recovered"
}
],
"action_variables": {
"context": [
{
"description": "The bucket timestamp of the anomaly",
"name": "timestamp"
},
{
"description": "The bucket time of the anomaly in ISO8601 format",
"name": "timestampIso8601"
},
{
"description": "List of job IDs that triggered the alert",
"name": "jobIds"
},
{
"description": "Alert info message",
"name": "message"
},
{
"description": "Indicate if top hits contain interim results",
"name": "isInterim"
},
{
"description": "Anomaly score at the time of the notification action",
"name": "score"
},
{
"description": "Top records",
"name": "topRecords"
},
{
"description": "Top influencers",
"name": "topInfluencers"
},
{
"description": "URL to open in the Anomaly Explorer",
"name": "anomalyExplorerUrl",
"useWithTripleBracesInTemplates": true
}
],
"params": [ ],
"state": [ ]
},
"alerts": {
"context": "ml.anomaly-detection",
"mappings": {
"fieldMap": {
"kibana.alert.anomaly_score": {
"array": false,
"type": "double",
"required": false
},
"kibana.alert.anomaly_timestamp": {
"array": false,
"type": "date",
"required": false
},
"kibana.alert.is_interim": {
"array": false,
"type": "boolean",
"required": false
},
"kibana.alert.job_id": {
"array": false,
"type": "keyword",
"required": true
},
"kibana.alert.top_influencers": {
"array": true,
"dynamic": false,
"type": "object",
"properties": {
"influencer_field_name": {
"type": "keyword"
},
"influencer_field_value": {
"type": "keyword"
},
"influencer_score": {
"type": "double"
},
"initial_influencer_score": {
"type": "double"
},
"is_interim": {
"type": "boolean"
},
"job_id": {
"type": "keyword"
},
"timestamp": {
"type": "date"
}
},
"required": false
},
"kibana.alert.top_records": {
"array": true,
"dynamic": false,
"type": "object",
"properties": {
"actual": {
"type": "double"
},
"by_field_name": {
"type": "keyword"
},
"by_field_value": {
"type": "keyword"
},
"detector_index": {
"type": "integer"
},
"field_name": {
"type": "keyword"
},
"function": {
"type": "keyword"
},
"initial_record_score": {
"type": "double"
},
"is_interim": {
"type": "boolean"
},
"job_id": {
"type": "keyword"
},
"over_field_name": {
"type": "keyword"
},
"over_field_value": {
"type": "keyword"
},
"partition_field_name": {
"type": "keyword"
},
"partition_field_value": {
"type": "keyword"
},
"record_score": {
"type": "double"
},
"timestamp": {
"type": "date"
},
"typical": {
"type": "double"
}
},
"required": false
}
}
},
"shouldWrite": true
},
"authorized_consumers": {
"alerts": {
"all": true,
"read": true
},
"apm": {
"all": true,
"read": true
},
"discover": {
"all": true,
"read": true
},
"infrastructure": {
"all": true,
"read": true
},
"logs": {
"all": true,
"read": true
},
"ml": {
"all": true,
"read": true
},
"monitoring": {
"all": true,
"read": true
},
"siem": {
"all": true,
"read": true
},
"slo": {
"all": true,
"read": true
},
"stackAlerts": {
"all": true,
"read": true
},
"uptime": {
"all": true,
"read": true
}
},
"category": "management",
"default_action_group_id": "anomaly_score_match",
"does_set_recovery_context": true,
"enabled_in_license": true,
"has_alerts_mappings": true,
"has_fields_for_a_a_d": true,
"id": "xpack.ml.anomaly_detection_alert",
"is_exportable": true,
"minimum_license_required": "platinum",
"name": "Anomaly detection alert",
"producer": "ml",
"recovery_action_group": {
"id": "recovered",
"name": "Recovered"
},
"rule_task_timeout": "5m"
},
{
"action_groups": [
{
"id": "anomaly_detection_realtime_issue",
"name": "Issue detected"
},
{
"id": "recovered",
"name": "Recovered"
}
],
"action_variables": {
"context": [
{
"description": "Results of the rule execution",
"name": "results"
},
{
"description": "Alert info message",
"name": "message"
}
],
"params": [ ],
"state": [ ]
},
"authorized_consumers": {
"alerts": {
"all": true,
"read": true
},
"apm": {
"all": true,
"read": true
},
"discover": {
"all": true,
"read": true
},
"infrastructure": {
"all": true,
"read": true
},
"logs": {
"all": true,
"read": true
},
"ml": {
"all": true,
"read": true
},
"monitoring": {
"all": true,
"read": true
},
"siem": {
"all": true,
"read": true
},
"slo": {
"all": true,
"read": true
},
"stackAlerts": {
"all": true,
"read": true
},
"uptime": {
"all": true,
"read": true
}
},
"category": "management",
"default_action_group_id": "anomaly_detection_realtime_issue",
"does_set_recovery_context": true,
"enabled_in_license": true,
"has_alerts_mappings": false,
"has_fields_for_a_a_d": false,
"id": "xpack.ml.anomaly_detection_jobs_health",
"is_exportable": true,
"minimum_license_required": "platinum",
"name": "Anomaly detection jobs health",
"producer": "ml",
"recovery_action_group": {
"id": "recovered",
"name": "Recovered"
},
"rule_task_timeout": "5m"
}
]
},
"APM_UI_agent_configuration_environments_200_response1": {
"description": "An example of a successful response from `GET /api/apm/settings/agent-configuration/environments`.",
"value": {
"environments": [
{
"alreadyConfigured": true,
"name": "production"
},
{
"alreadyConfigured": false,
"name": "development"
},
{
"alreadyConfigured": false,
"name": "ALL_OPTION_VALUE"
}
]
}
},
"APM_UI_agent_configuration_intake_object_delete_200_response1": {
"description": "An example of a successful response from `DELETE /api/apm/settings/agent-configuration`.",
"value": {
"result": "deleted"
}
},
"APM_UI_agent_configuration_intake_object_delete_request1": {
"description": "Run `DELETE /api/apm/settings/agent-configuration` to delete a configuration.",
"value": {
"service": {
"environment": "production",
"name": "frontend"
}
}
},
"APM_UI_agent_configuration_intake_object_get_200_response1": {
"description": "An example of a successful response from `GET /api/apm/settings/agent-configuration`.",
"value": [
{
"@timestamp": 1581934104843,
"agent_name": "go",
"applied_by_agent": false,
"etag": "1e58c178efeebae15c25c539da740d21dee422fc",
"service": {
"environment": "production",
"name": "opbeans-go"
},
"settings": {
"capture_body": "off",
"transaction_max_spans": "200",
"transaction_sample_rate": "1"
}
},
{
"@timestamp": 1581934111727,
"agent_name": "go",
"applied_by_agent": false,
"etag": "3eed916d3db434d9fb7f039daa681c7a04539a64",
"service": {
"name": "opbeans-go"
},
"settings": {
"capture_body": "off",
"transaction_max_spans": "300",
"transaction_sample_rate": "1"
}
},
{
"@timestamp": 1582031336265,
"agent_name": "nodejs",
"applied_by_agent": false,
"etag": "5080ed25785b7b19f32713681e79f46996801a5b",
"service": {
"name": "frontend"
},
"settings": {
"transaction_sample_rate": "1"
}
}
]
},
"APM_UI_agent_configuration_intake_object_put_200_response1": {
"description": "An example of a successful response from `PUT /api/apm/settings/agent-configuration`. The response body is intentionally empty.",
"value": { }
},
"APM_UI_agent_configuration_intake_object_put_request1": {
"description": "Run `PUT /api/apm/settings/agent-configuration` to create or update configuration details.",
"value": {
"agent_name": "nodejs",
"service": {
"environment": "production",
"name": "frontend"
},
"settings": {
"capture_body": "off",
"transaction_max_spans": "500",
"transaction_sample_rate": "0.4"
}
}
},
"APM_UI_agent_configuration_intake_object_search_200_response1": {
"description": "An example of a successful response from `POST /api/apm/settings/agent-configuration/search`.",
"value": {
"_id": "CIaqXXABmQCdPphWj8EJ",
"_index": ".apm-agent-configuration",
"_score": 2,
"_source": {
"@timestamp": 1582031336265,
"agent_name": "nodejs",
"applied_by_agent": false,
"etag": "5080ed25785b7b19f32713681e79f46996801a5b",
"service": {
"name": "frontend"
},
"settings": {
"transaction_sample_rate": "1"
}
}
}
},
"APM_UI_agent_configuration_intake_object_search_request1": {
"description": "Run `POST /api/apm/settings/agent-configuration/search` to search configuration details.",
"value": {
"etag": "1e58c178efeebae15c25c539da740d21dee422fc",
"service": {
"environment": "production",
"name": "frontend"
}
}
},
"APM_UI_agent_configuration_intake_object_view_200_response1": {
"description": "An example of a successful response from `GET /api/apm/settings/agent-configuration/view`.",
"value": {
"@timestamp": 1582031336265,
"agent_name": "nodejs",
"applied_by_agent": true,
"etag": "5080ed25785b7b19f32713681e79f46996801a5b",
"id": "CIaqXXABmQCdPphWj8EJ",
"service": {
"environment": "production",
"name": "frontend"
},
"settings": {
"capture_body": "off",
"transaction_max_spans": "500",
"transaction_sample_rate": "0.4"
}
}
},
"APM_UI_agent_keys_object_post_200_response1": {
"description": "An example of a successful response from `POST /api/apm/agent_keys`, which creates an APM agent API key.",
"value": {
"agentKey": {
"api_key": "PjGloCGOTzaZr8ilUPvkjA",
"encoded": "M0RDTG1uMEIzWk1oTFVhN1dCRzk6UGpHbG9DR09UemFacjhpbFVQdmtqQQ==",
"id": "3DCLmn0B3ZMhLUa7WBG9",
"name": "apm-key"
}
}
},
"APM_UI_agent_keys_object_post_request1": {
"description": "Run `POST /api/apm/agent_keys` to create an APM agent API key with the specified privileges.",
"value": {
"name": "apm-key",
"privileges": [
"event:write",
"config_agent:read"
]
}
},
"APM_UI_annotation_object_post_200_response1": {
"description": "An example of a successful response from `POST /api/apm/services/opbeans-java/annotation`, which creates an annotation for a service named `opbeans-java`.",
"value": {
"_id": "Lc9I93EBh6DbmkeV7nFX",
"_index": "observability-annotations",
"_primary_term": 1,
"_seq_no": 12,
"_source": {
"@timestamp": "2020-05-08T10:31:30.452Z",
"annotation": {
"type": "deployment"
},
"event": {
"created": "2020-05-09T02:34:43.937Z"
},
"message": "Deployment 1.2",
"service": {
"name": "opbeans-java",
"version": "1.2"
},
"tags": [
"apm",
"elastic.co",
"customer"
]
},
"_version": 1,
"found": true
}
},
"APM_UI_annotation_object_post_request1": {
"description": "Run `POST /api/apm/services/{serviceName}/annotation` to create a deployment annotation for a service.",
"value": {
"@timestamp": "2024-01-15T12:00:00.000Z",
"message": "Deployment 1.2.0",
"service": {
"environment": "production",
"version": "1.2.0"
},
"tags": [
"apm",
"deployment"
]
}
},
"APM_UI_annotation_search_get_200_response1": {
"description": "An example of a successful response from `GET /api/apm/services/{serviceName}/annotation/search`, which returns the annotations associated with a service over the given time range.",
"value": {
"annotations": [
{
"@timestamp": 1735689600000,
"id": "opbeans-node@2.0.0",
"text": "opbeans-node@2.0.0",
"type": "version"
},
{
"@timestamp": 1736294400000,
"id": "opbeans-node@2.1.0",
"text": "opbeans-node@2.1.0",
"type": "version"
}
]
}
},
"APM_UI_error_400_response": {
"description": "An example of a 400 Bad Request response, returned when the request payload or query parameters fail validation.",
"value": {
"error": "Bad Request",
"message": "[request body]: expected value of type [string] but got [undefined]",
"statusCode": 400
}
},
"APM_UI_error_401_response": {
"description": "An example of a 401 Unauthorized response, returned when the request is missing valid authentication credentials.",
"value": {
"error": "Unauthorized",
"message": "[security_exception]: missing authentication credentials for REST request",
"statusCode": 401
}
},
"APM_UI_error_403_response": {
"description": "An example of a 403 Forbidden response, returned when the authenticated user lacks the required APM and User Experience privileges.",
"value": {
"error": "Forbidden",
"message": "Insufficient privileges to perform this action. The APM and User Experience feature requires `all` privileges.",
"statusCode": 403
}
},
"APM_UI_error_404_response": {
"description": "An example of a 404 Not Found response, returned when the requested resource does not exist or the feature is not available on the current deployment.",
"value": {
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}
},
"APM_UI_error_500_response": {
"description": "An example of a 500 Internal Server Error response, returned when an unexpected error occurs while processing the request.",
"value": {
"error": "Internal Server Error",
"message": "An internal server error occurred. Check the Kibana server logs for details.",
"statusCode": 500
}
},
"APM_UI_error_501_response": {
"description": "An example of a 501 Not Implemented response, returned when the source map feature is not available on the current deployment.",
"value": {
"error": "Not Implemented",
"message": "Not Implemented",
"statusCode": 501
}
},
"APM_UI_fleet_apm_server_schema_200_response1": {
"description": "An example of a successful response from `POST /api/apm/fleet/apm_server_schema`. The response body is intentionally empty.",
"value": { }
},
"APM_UI_service_agent_name_get_200_response1": {
"description": "An example of a successful response from `GET /api/apm/settings/agent-configuration/agent_name`, which returns the detected APM agent name for a service.",
"value": {
"agentName": "nodejs"
}
},
"APM_UI_source_maps_delete_200_response1": {
"description": "An example of a successful response from `DELETE /api/apm/sourcemaps/{id}`. The response body is intentionally empty.",
"value": { }
},
"APM_UI_source_maps_get_200_response1": {
"description": "A successful response from `GET /api/apm/sourcemaps`.",
"value": {
"artifacts": [
{
"body": {
"bundleFilepath": "/test/e2e/general-usecase/bundle.js",
"serviceName": "foo",
"serviceVersion": "1.0.0",
"sourceMap": {
"file": "static/js/main.chunk.js",
"mappings": "mapping",
"sourceRoot": "",
"sources": [
"fleet-source-map-client/src/index.css",
"fleet-source-map-client/src/App.js",
"webpack:///./src/index.css?bb0a",
"fleet-source-map-client/src/index.js",
"fleet-source-map-client/src/reportWebVitals.js"
],
"sourcesContent": [
"content"
],
"version": 3
}
},
"compressionAlgorithm": "zlib",
"created": "2021-07-09T20:47:44.812Z",
"decodedSha256": "644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"decodedSize": 441,
"encodedSha256": "024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24",
"encodedSize": 237,
"encryptionAlgorithm": "none",
"id": "apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"identifier": "foo-1.0.0",
"packageName": "apm",
"relative_url": "/api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"type": "sourcemap"
}
]
}
},
"APM_UI_source_maps_upload_200_response1": {
"description": "A successful response from `POST /api/apm/sourcemaps`.",
"value": {
"body": "eJyFkL1OwzAUhd/Fc+MbYMuCEBIbHRjKgBgc96R16tiWr1OQqr47NwqJxEK3q/PzWccXxchnZ7E1A1SjuhjVZtF2yOxiEPlO17oWox3D3uPFeSRTjmJQARfCPeiAgGx8NTKsYdAc1T3rwaSJGcds8Sp3c1HnhfywUZ3QhMTFFGepZxqMC9oex3CS9tpk1XyozgOlmoVKuJX1DqEQZ0su7PGtLU+V/3JPKc3cL7TJ2FNDRPov4bFta3MDM4f7W69lpJjLO9qdK8bzVPhcJz3HUCQ4LbO/p5hCSC4cZPByrp/wFqOklbpefwAhzpqI",
"compressionAlgorithm": "zlib",
"created": "2021-07-09T20:47:44.812Z",
"decodedSha256": "644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"decodedSize": 441,
"encodedSha256": "024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24",
"encodedSize": 237,
"encryptionAlgorithm": "none",
"id": "apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"identifier": "foo-1.0.0",
"packageName": "apm",
"relative_url": "/api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"type": "sourcemap"
}
},
"APM_UI_source_maps_upload_request1": {
"description": "An example of a multipart/form-data request body for `POST /api/apm/sourcemaps`.\nEach field is a separate form part; `sourcemap` is the source map file content (typically uploaded as a file).\n",
"value": {
"bundle_filepath": "/test/e2e/general-usecase/bundle.js.map",
"service_name": "opbeans-node",
"service_version": "1.0.0",
"sourcemap": "{\"version\":3,\"sources\":[\"bundle.js\"],\"names\":[],\"mappings\":\"AAAA\",\"file\":\"bundle.js\",\"sourcesContent\":[\"console.log('hello');\"]}"
}
},
"Cases_add_comment_request": {
"summary": "Adds a comment to a case.",
"value": {
"comment": "A new comment.",
"owner": "cases",
"type": "user"
}
},
"Cases_add_comment_response": {
"summary": "The add comment to case API returns a JSON object that contains details about the case and its comments.",
"value": {
"assignees": [ ],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"comments": [
{
"comment": "A new comment.",
"created_at": "2022-10-02T00:49:47.716Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
"owner": "cases",
"pushed_at": "null",
"pushed_by": "null",
"type": "user",
"updated_at": "null",
"updated_by": "null",
"version": "WzIwNDMxLDFd"
}
],
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"created_at": "2022-03-24T00:37:03.906Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "Field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": true
}
],
"description": "A case description.",
"duration": "null",
"external_service": "null",
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
"observables": [ ],
"owner": "cases",
"settings": {
"syncAlerts": false
},
"severity": "low",
"status": "open",
"tags": [
"tag 1"
],
"title": "Case title 1",
"total_observables": 0,
"totalAlerts": 0,
"totalComment": 1,
"totalEvents": 0,
"updated_at": "2022-06-03T00:49:47.716Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzIzMzgsMV0="
}
},
"Cases_create_case_request": {
"summary": "Create a security case that uses a Jira connector.",
"value": {
"connector": {
"fields": {
"issueType": "10006",
"parent": "null",
"priority": "High"
},
"id": "131d4448-abe0-4789-939d-8ef60680b498",
"name": "My connector",
"type": ".jira"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My field value"
}
],
"description": "A case description.",
"owner": "cases",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"tags": [
"tag-1"
],
"title": "Case title 1"
}
},
"Cases_create_case_response": {
"summary": "The create case API returns a JSON object that contains details about the case.",
"value": {
"assignees": [ ],
"closed_at": "null",
"closed_by": "null",
"comments": [ ],
"connector": {
"fields": {
"issueType": "10006",
"parent": "null",
"priority": "High"
},
"id": "131d4448-abe0-4789-939d-8ef60680b498",
"name": "My connector",
"type": ".jira"
},
"created_at": "2022-10-13T15:33:50.604Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": "null"
}
],
"description": "A case description.",
"duration": "null",
"external_service": "null",
"id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
"observables": [ ],
"owner": "cases",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"severity": "low",
"status": "open",
"tags": [
"tag 1"
],
"title": "Case title 1",
"total_observables": 0,
"totalAlerts": 0,
"totalComment": 0,
"totalEvents": 0,
"updated_at": "null",
"updated_by": "null",
"version": "WzUzMiwxXQ=="
}
},
"Cases_field_definition_write_request": {
"summary": "Create or update a reusable field definition.",
"value": {
"definition": "name: priority\nlabel: Priority\ntype: keyword\ncontrol: SELECT_BASIC\nmetadata:\n options: [low, medium, high]\n default: medium\n",
"description": "Ticket priority level.",
"isGlobal": false,
"name": "priority",
"owner": "cases"
}
},
"Cases_find_case_activity_response": {
"summary": "Retrieves all activity for a case",
"value": {
"page": 1,
"perPage": 20,
"total": 3,
"userActions": [
{
"action": "create",
"comment_id": "null",
"created_at": "2023-10-20T01:17:22.150Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "b4cd0770-07c9-11ed-a5fd-47154cb8767e",
"owner": "cases",
"payload": {
"assignees": [ ],
"category": "null",
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": "null"
}
],
"description": "A case description.",
"owner": "cases",
"settings": {
"syncAlerts": false
},
"severity": "low",
"status": "open",
"tags": [
"tag 1"
],
"title": "Case title 1"
},
"type": "create_case",
"version": "WzM1ODg4LDFd"
},
{
"action": "create",
"comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
"created_at": "2023-10-14T20:12:53.354Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "57af14a0-03b1-11ed-920c-974bfa104448",
"owner": "cases",
"payload": {
"comment": {
"comment": "A new comment",
"owner": "cases",
"type": "user"
}
},
"type": "comment",
"version": "WzM1ODg4LDFa"
},
{
"action": "add",
"comment_id": "null",
"created_at": "2023-10-20T01:10:28.238Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "573c6980-6123-11ed-aa41-81a0a61fe447",
"owner": "cases",
"payload": {
"assignees": [
{
"uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
}
]
},
"type": "assignees",
"version": "WzM1ODg4LDFb"
}
]
}
},
"Cases_find_case_comments_response": {
"summary": "Paginated list of user comments for a case",
"value": {
"comments": [
{
"comment": "A new comment",
"created_at": "2023-10-07T19:32:13.104Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "8048b460-fe2b-11ec-b15d-779a7c8bbcc3",
"owner": "cases",
"pushed_at": "null",
"pushed_by": "null",
"type": "user",
"updated_at": "null",
"updated_by": "null",
"version": "WzIzLDFd"
}
],
"page": 1,
"per_page": 20,
"total": 1
}
},
"Cases_find_case_response": {
"summary": "Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.",
"value": {
"cases": [
{
"assignees": [ ],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"comments": [ ],
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"created_at": "2023-10-12T00:16:36.371Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": "null"
}
],
"description": "Case description",
"duration": "null",
"external_service": "null",
"id": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2",
"incremental_id": 1,
"observables": [ ],
"owner": "cases",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"severity": "low",
"status": "open",
"tags": [
"tag-1"
],
"title": "Case title",
"total_observables": 0,
"totalAlerts": 0,
"totalComment": 1,
"totalEvents": 0,
"updated_at": "2023-10-12T00:27:58.162Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzExMCwxXQ=="
}
],
"count_closed_cases": 0,
"count_in_progress_cases": 0,
"count_open_cases": 1,
"page": 1,
"per_page": 5,
"total": 1
}
},
"Cases_find_connector_response": {
"summary": "Retrieve information about the connectors and their settings.",
"value": [
{
"actionTypeId": ".jira",
"config": {
"apiUrl": "https://elastic.atlassian.net/",
"projectKey": "ES"
},
"id": "61787f53-4eee-4741-8df6-8fe84fa616f7",
"isDeprecated": false,
"isMissingSecrets": false,
"isPreconfigured": false,
"name": "my-Jira",
"referencedByCount": 0
}
]
},
"Cases_get_case_alerts_response": {
"summary": "Retrieves all alerts attached to a case",
"value": [
{
"attached_at": "2022-07-25T20:09:40.963Z",
"id": "f6a7d0c3-d52d-432c-b2e6-447cd7fce04d",
"index": ".alerts-observability.logs.alerts-default"
}
]
},
"Cases_get_case_applicable_fields_response": {
"summary": "Fields applicable to a case",
"value": {
"fields": [
{
"control": "SELECT_BASIC",
"defaultValue": "medium",
"displayOnly": false,
"isGlobal": true,
"key": "priority_as_keyword",
"label": "Priority",
"name": "priority",
"options": [
"low",
"medium",
"high"
],
"type": "keyword",
"required": true,
"requiredOnClose": false,
"source": "global"
},
{
"control": "TEXTAREA",
"displayOnly": false,
"isGlobal": false,
"key": "rollout_notes_as_keyword",
"label": "Rollout notes",
"name": "rollout_notes",
"type": "keyword",
"required": false,
"requiredOnClose": true,
"source": "template"
},
{
"control": "MARKDOWN",
"displayOnly": true,
"isGlobal": false,
"key": "instructions_as_keyword",
"label": "Instructions",
"name": "instructions",
"type": "keyword",
"required": false,
"requiredOnClose": false,
"source": "template"
}
]
}
},
"Cases_get_case_configuration_response": {
"summary": "Get the case configuration.",
"value": [
{
"closure_type": "close-by-user",
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"created_at": "2024-07-01T17:07:17.767Z",
"created_by": {
"email": "null",
"full_name": "null",
"username": "elastic"
},
"customFields": [
{
"defaultValue": "Custom text field value.",
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"label": "my-text-field",
"type": "text",
"required": false
}
],
"error": "null",
"extractObservables": true,
"id": "856ee650-6c82-11ee-a20a-6164169afa58",
"mappings": [ ],
"observableTypes": [ ],
"owner": "cases",
"templates": [
{
"caseFields": {
"assignees": [
{
"uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
}
],
"category": "Default-category",
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "Default text field value."
}
],
"description": "A default description for cases.",
"settings": {
"syncAlerts": false
},
"tags": [
"Default case tag"
],
"title": "Default case title"
},
"description": "A description of the template.",
"key": "505932fe-ee3a-4960-a661-c781b5acdb05",
"name": "template-1",
"tags": [
"Template tag 1"
]
}
],
"updated_at": "null",
"updated_by": "null",
"version": "WzEyLDNd",
"workflowTags": [
"soc-triage"
]
}
]
},
"Cases_get_case_field_definition_response": {
"summary": "A reusable field definition.",
"value": {
"definition": "name: priority\nlabel: Priority\ntype: keyword\ncontrol: SELECT_BASIC\nmetadata:\n options: [low, medium, high]\n default: medium\n",
"description": "Ticket priority level.",
"fieldDefinitionId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"isGlobal": false,
"name": "priority",
"owner": "cases"
}
},
"Cases_get_case_field_definitions_response": {
"summary": "A paginated list of reusable field definitions.",
"value": {
"fieldDefinitions": [
{
"definition": "name: priority\nlabel: Priority\ntype: keyword\ncontrol: SELECT_BASIC\nmetadata:\n options: [low, medium, high]\n default: medium\n",
"description": "Ticket priority level.",
"fieldDefinitionId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"isGlobal": false,
"name": "priority",
"owner": "cases"
}
],
"page": 1,
"perPage": 20,
"total": 1
}
},
"Cases_get_case_observability_response": {
"summary": "Get case response (Observability). Comments are not included; use the find case comments API. totalComment reflects the actual count.",
"value": {
"assignees": [
{
"uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
}
],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"created_at": "2023-11-06T19:29:04.086Z",
"created_by": {
"email": "null",
"full_name": "null",
"username": "elastic"
},
"customFields": [ ],
"description": "An Observability case description.",
"duration": "null",
"external_service": "null",
"id": "c3ff7550-def1-4e90-b6bc-c9969a4a09b1",
"observables": [ ],
"owner": "observability",
"settings": {
"extractObservables": false,
"syncAlerts": false
},
"severity": "low",
"status": "in-progress",
"tags": [
"observability",
"tag 1"
],
"title": "Observability case title 1",
"total_observables": 0,
"totalAlerts": 1,
"totalComment": 1,
"totalEvents": 0,
"updated_at": "2023-11-06T19:47:55.662Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzI0NywyXQ=="
}
},
"Cases_get_case_response": {
"summary": "Get case response. Comments are not included; use the find case comments API. totalComment reflects the actual count.",
"value": {
"assignees": [
{
"uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
}
],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"created_at": "2023-10-13T15:33:50.604Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": "null"
}
],
"description": "A case description",
"duration": "null",
"external_service": "null",
"id": "31cdada0-02c1-11ed-85f2-4f7c222ca2fa",
"incremental_id": 1,
"observables": [ ],
"owner": "cases",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"severity": "low",
"status": "open",
"tags": [
"tag 1"
],
"title": "Case title 1",
"total_observables": 0,
"totalAlerts": 1,
"totalComment": 1,
"totalEvents": 0,
"updated_at": "2023-10-13T15:40:32.335Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzM2LDFd"
}
},
"Cases_get_case_template_response": {
"summary": "A case template.",
"value": {
"definition": { },
"definitionString": "fields: []",
"deletedAt": "null",
"isLatest": true,
"latestVersion": 1,
"name": "My Template",
"owner": "cases",
"templateId": "9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42",
"templateVersion": 1
}
},
"Cases_get_case_templates_response": {
"summary": "A paginated list of case templates.",
"value": {
"page": 1,
"perPage": 20,
"templates": [
{
"definition": { },
"definitionString": "fields: []",
"deletedAt": "null",
"fieldSearchMatches": false,
"isLatest": true,
"latestVersion": 1,
"name": "My Template",
"owner": "cases",
"templateId": "9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42",
"templateVersion": 1
}
],
"total": 1
}
},
"Cases_get_comment_response": {
"summary": "A single user comment retrieved from a case",
"value": {
"comment": "A new comment",
"created_at": "2023-10-07T19:32:13.104Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "8048b460-fe2b-11ec-b15d-779a7c8bbcc3",
"owner": "cases",
"pushed_at": "null",
"pushed_by": "null",
"type": "user",
"updated_at": "null",
"updated_by": "null",
"version": "WzIzLDFd"
}
},
"Cases_get_reporters_response": {
"summary": "A list of two users that opened cases",
"value": [
{
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
{
"email": "jdoe@example.com",
"full_name": "Jane Doe",
"profile_uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0",
"username": "jdoe"
}
]
},
"Cases_get_tags_response": {
"summary": "A list of tags that are used in cases",
"value": [
"observability",
"security",
"tag 1",
"tag 2"
]
},
"Cases_push_case_response": {
"summary": "The push case API returns a JSON object with details about the case and the external service.",
"value": {
"assignees": [ ],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"comments": [ ],
"connector": {
"fields": {
"issueType": "10006",
"parent": "null",
"priority": "Low"
},
"id": "09f8c0b0-0eda-11ed-bd18-65557fe66949",
"name": "My connector",
"type": ".jira"
},
"created_at": "2022-07-29T00:59:39.444Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [ ],
"description": "A case description.",
"duration": "null",
"external_service": {
"connector_id": "09f8c0b0-0eda-11ed-bd18-65557fe66949",
"connector_name": "My connector",
"external_id": "71926",
"external_title": "ES-554",
"external_url": "https://cases.jira.com",
"pushed_at": "2022-07-29T01:20:58.436Z",
"pushed_by": {
"email": "null",
"full_name": "null",
"username": "elastic"
}
},
"id": "b917f300-0ed9-11ed-bd18-65557fe66949",
"observables": [ ],
"owner": "cases",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"severity": "low",
"status": "open",
"tags": [
"tag 1"
],
"title": "Case title 1",
"total_observables": 0,
"totalAlerts": 0,
"totalComment": 0,
"totalEvents": 0,
"updated_at": "2022-07-29T01:20:58.436Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzE3NjgsM10="
}
},
"Cases_response_400_invalid_template": {
"summary": "The request is invalid.",
"value": {
"error": "Bad Request",
"message": "Template [invalid-template-id] not found for owner [cases]",
"statusCode": 400
}
},
"Cases_response_400_template_limit": {
"summary": "A template resource limit was exceeded.",
"value": {
"error": "Bad Request",
"message": "A template cannot define more than 200 fields.",
"statusCode": 400
}
},
"Cases_response_401": {
"summary": "Authorization information is missing or invalid.",
"value": {
"error": "Unauthorized",
"message": "Unable to authenticate with the provided credentials.",
"statusCode": 401
}
},
"Cases_response_403": {
"summary": "The user does not have access to the requested resource.",
"value": {
"error": "Forbidden",
"message": "Unauthorized to access cases",
"statusCode": 403
}
},
"Cases_response_404": {
"summary": "The requested resource was not found.",
"value": {
"error": "Not Found",
"message": "Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found",
"statusCode": 404
}
},
"Cases_response_409": {
"summary": "A resource conflict occurred.",
"value": {
"error": "Conflict",
"message": "Template name \"Security incident\" already exists for owner \"cases\"",
"statusCode": 409
}
},
"Cases_set_case_configuration_request": {
"summary": "Set the closure type, custom fields, and default connector for Stack Management cases.",
"value": {
"closure_type": "close-by-user",
"connector": {
"fields": "null",
"id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
"name": "my-jira-connector",
"type": ".jira"
},
"customFields": [
{
"defaultValue": "My custom field default value.",
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"label": "my-text-field",
"type": "text",
"required": false
}
],
"owner": "cases",
"templates": [
{
"caseFields": {
"assignees": [
{
"uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
}
],
"category": "Default-category",
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "A text field value for the template."
}
],
"description": "A default description for cases.",
"tags": [
"Default case tag"
],
"title": "Default case title"
},
"description": "A description of the template.",
"key": "505932fe-ee3a-4960-a661-c781b5acdb05",
"name": "template-1",
"tags": [
"Template tag 1"
]
}
],
"workflowTags": [
"soc-triage"
]
}
},
"Cases_set_case_configuration_response": {
"summary": "This is an example response for case settings.",
"value": {
"closure_type": "close-by-user",
"connector": {
"fields": "null",
"id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
"name": "my-jira-connector",
"type": ".jira"
},
"created_at": "2024-07-01T17:07:17.767Z",
"created_by": {
"email": "null,",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"defaultValue": "My custom field default value.",
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"label": "my-text-field",
"type": "text",
"required": false
}
],
"error": "null",
"extractObservables": true,
"id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
"mappings": [
{
"action_type": "overwrite",
"source": "title",
"target": "summary"
},
{
"action_type": "overwrite",
"source": "description",
"target": "description"
},
{
"action_type": "append",
"source": "comments",
"target": "comments"
},
{
"action_type": "overwrite",
"source": "tags",
"target": "labels"
}
],
"owner": "cases",
"templates": [
{
"caseFields": {
"assignees": [
{
"uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
}
],
"category": "Default-category",
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "A text field value for the template."
}
],
"description": "A default description for cases.",
"tags": [
"Default case tag"
],
"title": "Default case title"
},
"description": "A description of the template.",
"key": "505932fe-ee3a-4960-a661-c781b5acdb05",
"name": "template-1",
"tags": [
"Template tag 1"
]
}
],
"updated_at": "null",
"updated_by": "null",
"version": "WzIwNzMsMV0=",
"workflowTags": [
"soc-triage"
]
}
},
"Cases_template_dry_run_response": {
"summary": "Dry-run validation succeeded without writing.",
"value": {
"valid": true
}
},
"Cases_template_write_request": {
"summary": "Create or fully replace a case template.",
"value": {
"definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n - name: priority\n label: Priority\n type: keyword\n control: SELECT_BASIC\n metadata:\n options: [low, medium, high]\n default: medium\n",
"description": "Default template for security incidents.",
"isEnabled": true,
"name": "Security incident",
"owner": "cases",
"tags": [
"security"
]
}
},
"Cases_update_case_configuration_request": {
"summary": "Update the case settings.",
"value": {
"closure_type": "close-by-user",
"connector": {
"fields": "null",
"id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
"name": "my-jira-connector",
"type": ".jira"
},
"customFields": [
{
"defaultValue": "A new default value.",
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"label": "my-text-field",
"type": "text",
"required": true
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"label": "my-toggle",
"type": "toggle",
"required": false
}
],
"version": "WzExOSw0XQ==",
"workflowTags": [
"soc-triage",
"enrichment"
]
}
},
"Cases_update_case_configuration_response": {
"summary": "This is an example response when the case configuration was updated.",
"value": {
"closure_type": "close-by-user",
"connector": {
"fields": "null",
"id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
"name": "my-jira-connector",
"type": ".jira"
},
"created_at": "2024-07-01T17:07:17.767Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"defaultValue": "A new default value.",
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"label": "my-text-field",
"type": "text",
"required": true
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"label": "my-toggle",
"type": "toggle",
"required": false
}
],
"error": "null",
"extractObservables": true,
"id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
"mappings": [
{
"action_type": "overwrite",
"source": "title",
"target": "summary"
},
{
"action_type": "overwrite",
"source": "description",
"target": "description"
},
{
"action_type": "overwrite",
"source": "tags",
"target": "labels"
},
{
"action_type": "append",
"source": "comments",
"target": "comments"
}
],
"owner": "cases",
"templates": [ ],
"updated_at": "2024-07-19T00:52:42.401Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzI2LDNd",
"workflowTags": [
"soc-triage",
"enrichment"
]
}
},
"Cases_update_case_request": {
"summary": "Update the case description, tags, and connector.",
"value": {
"cases": [
{
"connector": {
"fields": {
"issueType": "10006",
"parent": "null",
"priority": "null"
},
"id": "131d4448-abe0-4789-939d-8ef60680b498",
"name": "My connector",
"type": ".jira"
},
"customFields": [
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": false
},
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My new field value"
}
],
"description": "A case description.",
"id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"tags": [
"tag-1"
],
"version": "WzIzLDFd"
}
]
}
},
"Cases_update_case_response": {
"summary": "This is an example response when the case description, tags, and connector were updated.",
"value": [
{
"assignees": [ ],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"comments": [ ],
"connector": {
"fields": {
"issueType": "10006",
"parent": "null",
"priority": "null"
},
"id": "131d4448-abe0-4789-939d-8ef60680b498",
"name": "My connector",
"type": ".jira"
},
"created_at": "2023-10-13T09:16:17.416Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My new field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": false
}
],
"description": "A case description.",
"duration": "null",
"external_service": {
"connector_id": "05da469f-1fde-4058-99a3-91e4807e2de8",
"connector_name": "Jira",
"external_id": "10003",
"external_title": "IS-4",
"external_url": "https://hms.atlassian.net/browse/IS-4",
"pushed_at": "2023-10-13T09:20:40.672Z",
"pushed_by": {
"email": "null",
"full_name": "null",
"username": "elastic"
}
},
"id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
"observables": [ ],
"owner": "cases",
"settings": {
"extractObservables": false,
"syncAlerts": true
},
"severity": "low",
"status": "open",
"tags": [
"tag-1"
],
"title": "Case title 1",
"total_observables": 0,
"totalAlerts": 0,
"totalComment": 0,
"totalEvents": 0,
"updated_at": "2023-10-13T09:48:33.043Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzU0OCwxXQ=="
}
]
},
"Cases_update_comment_request": {
"summary": "Updates a comment of a case.",
"value": {
"comment": "An updated comment.",
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
"owner": "cases",
"type": "user",
"version": "Wzk1LDFd"
}
},
"Cases_update_comment_response": {
"summary": "The add comment to case API returns a JSON object that contains details about the case and its comments.",
"value": {
"assignees": [ ],
"category": "null",
"closed_at": "null",
"closed_by": "null",
"comments": [
{
"comment": "An updated comment.",
"created_at": "2023-10-24T00:37:10.832Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
"owner": "cases",
"pushed_at": "null",
"pushed_by": "null",
"type": "user",
"updated_at": "2023-10-24T01:27:06.210Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzIwNjM3LDFd"
}
],
"connector": {
"fields": "null",
"id": "none",
"name": "none",
"type": ".none"
},
"created_at": "2023-10-24T00:37:03.906Z",
"created_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My new field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": false
}
],
"description": "A case description.",
"duration": "null",
"external_service": "null",
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
"owner": "cases",
"settings": {
"syncAlerts": false
},
"severity": "low",
"status": "open",
"tags": [
"tag 1"
],
"title": "Case title 1",
"totalAlerts": 0,
"totalComment": 1,
"totalEvents": 0,
"updated_at": "2023-10-24T01:27:06.210Z",
"updated_by": {
"email": "null",
"full_name": "null",
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"username": "elastic"
},
"version": "WzIwNjM2LDFd"
}
},
"Data_views_create_data_view_request": {
"summary": "Create a data view with runtime fields.",
"description": "Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.",
"value": {
"data_view": {
"name": "My Logstash data view",
"runtimeFieldMap": {
"runtime_shape_name": {
"script": {
"source": "emit(doc['shape_name'].value)"
},
"type": "keyword"
}
},
"title": "logstash-*"
}
}
},
"Data_views_create_data_view_response": {
"summary": "The create data view API returns a JSON object that contains details about the new data view.",
"description": "The response includes the full data view specification, including auto-generated fields such as the unique identifier and version.",
"value": {
"data_view": {
"allowNoIndex": false,
"fieldAttrs": { },
"fieldFormats": { },
"fields": {
"runtime_shape_name": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"name": "runtime_shape_name",
"readFromDocValues": false,
"runtimeField": {
"script": {
"source": "emit(doc['shape_name'].value)"
},
"type": "keyword"
},
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
}
},
"id": "b561acfb-0181-455e-84a3-ce8980b2272f",
"name": "My Logstash data view",
"namespaces": [
"default"
],
"runtimeFieldMap": {
"runtime_shape_name": {
"script": {
"source": "emit(doc['shape_name'].value)"
},
"type": "keyword"
}
},
"sourceFilters": [ ],
"title": "logstash-*",
"typeMeta": { },
"version": "WzQ5LDJd"
}
}
},
"Data_views_create_runtime_field_request": {
"summary": "Create a runtime field.",
"description": "Create a long-type runtime field that emits a value derived from the foo source field.",
"value": {
"name": "runtimeFoo",
"runtimeField": {
"script": {
"source": "emit(doc[\"foo\"].value)"
},
"type": "long"
}
}
},
"Data_views_create_runtime_field_response": {
"summary": "The API returns created runtime field object array and updated data view object.",
"description": "The response includes the newly created runtime field as an array and the full updated data view object.",
"value": {
"data_view": {
"...": "null"
},
"fields": [
"..."
]
}
},
"Data_views_error_400_response": {
"summary": "A bad request response.",
"description": "The request was rejected because the payload or query parameters are missing required fields or contain invalid values.",
"value": {
"error": "Bad Request",
"message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
"statusCode": 400
}
},
"Data_views_error_404_response": {
"summary": "A not found response.",
"description": "The requested data view or runtime field was not found in the current Kibana space.",
"value": {
"error": "Not Found",
"message": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found",
"statusCode": 404
}
},
"Data_views_get_data_view_response": {
"summary": "The get data view API returns a JSON object that contains information about the data view.",
"description": "A complete data view object including all fields, runtime fields, and metadata.",
"value": {
"data_view": {
"allowNoIndex": false,
"fieldAttrs": {
"products.manufacturer": {
"count": 1
},
"products.price": {
"count": 1
},
"products.product_name": {
"count": 1
},
"total_quantity": {
"count": 1
}
},
"fieldFormats": {
"products.base_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.base_unit_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.min_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.taxful_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.taxless_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"taxful_total_price": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"taxless_total_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
}
},
"fields": {
"_id": {
"aggregatable": false,
"count": 0,
"esTypes": [
"_id"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "_id",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"_index": {
"aggregatable": true,
"count": 0,
"esTypes": [
"_index"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "_index",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"_score": {
"aggregatable": false,
"count": 0,
"format": {
"id": "number"
},
"isMapped": true,
"name": "_score",
"readFromDocValues": false,
"scripted": false,
"searchable": false,
"shortDotsEnable": false,
"type": "number"
},
"_source": {
"aggregatable": false,
"count": 0,
"esTypes": [
"_source"
],
"format": {
"id": "_source"
},
"isMapped": true,
"name": "_source",
"readFromDocValues": false,
"scripted": false,
"searchable": false,
"shortDotsEnable": false,
"type": "_source"
},
"category": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "category",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"category.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "category.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "category"
}
},
"type": "string"
},
"currency": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "currency",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"customer_birth_date": {
"aggregatable": true,
"count": 0,
"esTypes": [
"date"
],
"format": {
"id": "date"
},
"isMapped": true,
"name": "customer_birth_date",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "date"
},
"customer_first_name": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_first_name",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"customer_first_name.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_first_name.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "customer_first_name"
}
},
"type": "string"
},
"customer_full_name": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_full_name",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"customer_full_name.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_full_name.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "customer_full_name"
}
},
"type": "string"
},
"customer_gender": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_gender",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"customer_id": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_id",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"customer_last_name": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_last_name",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"customer_last_name.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_last_name.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "customer_last_name"
}
},
"type": "string"
},
"customer_phone": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "customer_phone",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"day_of_week": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "day_of_week",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"day_of_week_i": {
"aggregatable": true,
"count": 0,
"esTypes": [
"integer"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "day_of_week_i",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"email": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "email",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"event.dataset": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "event.dataset",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"geoip.city_name": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "geoip.city_name",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"geoip.continent_name": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "geoip.continent_name",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"geoip.country_iso_code": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "geoip.country_iso_code",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"geoip.location": {
"aggregatable": true,
"count": 0,
"esTypes": [
"geo_point"
],
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"isMapped": true,
"name": "geoip.location",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "geo_point"
},
"geoip.region_name": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "geoip.region_name",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"manufacturer": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "manufacturer",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"manufacturer.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "manufacturer.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "manufacturer"
}
},
"type": "string"
},
"order_date": {
"aggregatable": true,
"count": 0,
"esTypes": [
"date"
],
"format": {
"id": "date"
},
"isMapped": true,
"name": "order_date",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "date"
},
"order_id": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "order_id",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"products._id": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products._id",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"products._id.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products._id.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "products._id"
}
},
"type": "string"
},
"products.base_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "products.base_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.base_unit_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "products.base_unit_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.category": {
"aggregatable": false,
"count": 0,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.category",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"products.category.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.category.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "products.category"
}
},
"type": "string"
},
"products.created_on": {
"aggregatable": true,
"count": 0,
"esTypes": [
"date"
],
"format": {
"id": "date"
},
"isMapped": true,
"name": "products.created_on",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "date"
},
"products.discount_amount": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "products.discount_amount",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.discount_percentage": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "products.discount_percentage",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.manufacturer": {
"aggregatable": false,
"count": 1,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.manufacturer",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"products.manufacturer.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.manufacturer.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "products.manufacturer"
}
},
"type": "string"
},
"products.min_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "products.min_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.price": {
"aggregatable": true,
"count": 1,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "products.price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.product_id": {
"aggregatable": true,
"count": 0,
"esTypes": [
"long"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "products.product_id",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.product_name": {
"aggregatable": false,
"count": 1,
"esTypes": [
"text"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.product_name",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"products.product_name.keyword": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.product_name.keyword",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"subType": {
"multi": {
"parent": "products.product_name"
}
},
"type": "string"
},
"products.quantity": {
"aggregatable": true,
"count": 0,
"esTypes": [
"integer"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "products.quantity",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.sku": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "products.sku",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"products.tax_amount": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "products.tax_amount",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.taxful_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "products.taxful_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.taxless_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "products.taxless_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"products.unit_discount_amount": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "products.unit_discount_amount",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"sku": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "sku",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"taxful_total_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"isMapped": true,
"name": "taxful_total_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"taxless_total_price": {
"aggregatable": true,
"count": 0,
"esTypes": [
"half_float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"isMapped": true,
"name": "taxless_total_price",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"total_quantity": {
"aggregatable": true,
"count": 1,
"esTypes": [
"integer"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "total_quantity",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"total_unique_products": {
"aggregatable": true,
"count": 0,
"esTypes": [
"integer"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "total_unique_products",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"type": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "type",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"user": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "user",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
}
},
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "Kibana Sample Data eCommerce",
"namespaces": [
"default"
],
"runtimeFieldMap": { },
"sourceFilters": [ ],
"timeFieldName": "order_date",
"title": "kibana_sample_data_ecommerce",
"typeMeta": { },
"version": "WzUsMV0="
}
}
},
"Data_views_get_data_views_response": {
"summary": "The get all data views API returns a list of data views.",
"description": "A list of available data views including their identifiers, names, and index patterns.",
"value": {
"data_view": [
{
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "Kibana Sample Data eCommerce",
"namespaces": [
"default"
],
"title": "kibana_sample_data_ecommerce",
"typeMeta": { }
},
{
"id": "d3d7af60-4c81-11e8-b3d7-01146121b73d",
"name": "Kibana Sample Data Flights",
"namespaces": [
"default"
],
"title": "kibana_sample_data_flights"
},
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "Kibana Sample Data Logs",
"namespaces": [
"default"
],
"title": "kibana_sample_data_logs"
}
]
}
},
"Data_views_get_default_data_view_response": {
"summary": "The get default data view API returns the default data view identifier.",
"description": "The identifier of the default data view for the current Kibana space.",
"value": {
"data_view_id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f"
}
},
"Data_views_get_runtime_field_response": {
"summary": "The get runtime field API returns a JSON object that contains information about the runtime field (`hour_of_day`) and the data view (`d3d7af60-4c81-11e8-b3d7-01146121b73d`).",
"description": "The runtime field definition along with the parent data view.",
"value": {
"data_view": {
"allowNoIndex": false,
"fieldAttrs": { },
"fieldFormats": {
"AvgTicketPrice": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"hour_of_day": {
"id": "number",
"params": {
"pattern": "00"
}
}
},
"fields": {
"_id": {
"aggregatable": false,
"count": 0,
"esTypes": [
"_id"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "_id",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"_index": {
"aggregatable": true,
"count": 0,
"esTypes": [
"_index"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "_index",
"readFromDocValues": false,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"_score": {
"aggregatable": false,
"count": 0,
"format": {
"id": "number"
},
"isMapped": true,
"name": "_score",
"readFromDocValues": false,
"scripted": false,
"searchable": false,
"shortDotsEnable": false,
"type": "number"
},
"_source": {
"aggregatable": false,
"count": 0,
"esTypes": [
"_source"
],
"format": {
"id": "_source"
},
"isMapped": true,
"name": "_source",
"readFromDocValues": false,
"scripted": false,
"searchable": false,
"shortDotsEnable": false,
"type": "_source"
},
"AvgTicketPrice": {
"aggregatable": true,
"count": 0,
"esTypes": [
"float"
],
"format": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"isMapped": true,
"name": "AvgTicketPrice",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"Cancelled": {
"aggregatable": true,
"count": 0,
"esTypes": [
"boolean"
],
"format": {
"id": "boolean"
},
"isMapped": true,
"name": "Cancelled",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "boolean"
},
"Carrier": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "Carrier",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"dayOfWeek": {
"aggregatable": true,
"count": 0,
"esTypes": [
"integer"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "dayOfWeek",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"Dest": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "Dest",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"DestAirportID": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "DestAirportID",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"DestCityName": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "DestCityName",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"DestCountry": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "DestCountry",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"DestLocation": {
"aggregatable": true,
"count": 0,
"esTypes": [
"geo_point"
],
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"isMapped": true,
"name": "DestLocation",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "geo_point"
},
"DestRegion": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "DestRegion",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"DestWeather": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "DestWeather",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"DistanceKilometers": {
"aggregatable": true,
"count": 0,
"esTypes": [
"float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "DistanceKilometers",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"DistanceMiles": {
"aggregatable": true,
"count": 0,
"esTypes": [
"float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "DistanceMiles",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"FlightDelay": {
"aggregatable": true,
"count": 0,
"esTypes": [
"boolean"
],
"format": {
"id": "boolean"
},
"isMapped": true,
"name": "FlightDelay",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "boolean"
},
"FlightDelayMin": {
"aggregatable": true,
"count": 0,
"esTypes": [
"integer"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "FlightDelayMin",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"FlightDelayType": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "FlightDelayType",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"FlightNum": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "FlightNum",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"FlightTimeHour": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "FlightTimeHour",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"FlightTimeMin": {
"aggregatable": true,
"count": 0,
"esTypes": [
"float"
],
"format": {
"id": "number"
},
"isMapped": true,
"name": "FlightTimeMin",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"hour_of_day": {
"aggregatable": true,
"count": 0,
"esTypes": [
"long"
],
"format": {
"id": "number",
"params": {
"pattern": "00"
}
},
"name": "hour_of_day",
"readFromDocValues": false,
"runtimeField": {
"script": {
"source": "emit(doc['timestamp'].value.getHour());"
},
"type": "long"
},
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
},
"Origin": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "Origin",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"OriginAirportID": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "OriginAirportID",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"OriginCityName": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "OriginCityName",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"OriginCountry": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "OriginCountry",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"OriginLocation": {
"aggregatable": true,
"count": 0,
"esTypes": [
"geo_point"
],
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"isMapped": true,
"name": "OriginLocation",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "geo_point"
},
"OriginRegion": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "OriginRegion",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"OriginWeather": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"isMapped": true,
"name": "OriginWeather",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
},
"timestamp": {
"aggregatable": true,
"count": 0,
"esTypes": [
"date"
],
"format": {
"id": "date"
},
"isMapped": true,
"name": "timestamp",
"readFromDocValues": true,
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "date"
}
},
"id": "d3d7af60-4c81-11e8-b3d7-01146121b73d",
"name": "Kibana Sample Data Flights",
"runtimeFieldMap": {
"hour_of_day": {
"script": {
"source": "emit(doc['timestamp'].value.getHour());"
},
"type": "long"
}
},
"sourceFilters": [ ],
"timeFieldName": "timestamp",
"title": "kibana_sample_data_flights",
"version": "WzM2LDJd"
},
"fields": [
{
"aggregatable": true,
"count": 0,
"esTypes": [
"long"
],
"name": "hour_of_day",
"readFromDocValues": false,
"runtimeField": {
"script": {
"source": "emit(doc['timestamp'].value.getHour());"
},
"type": "long"
},
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "number"
}
]
}
},
"Data_views_preview_swap_data_view_request": {
"summary": "Preview swapping references from data view ID \"abcd-efg\" to \"xyz-123\".",
"description": "Preview the saved objects that would be affected by swapping references from one data view to another.",
"value": {
"fromId": "abcd-efg",
"toId": "xyz-123"
}
},
"Data_views_preview_swap_data_view_response": {
"summary": "A preview of saved objects that would be affected by a data view swap.",
"description": "The result array lists every saved object that references the source data view. No saved objects are modified by the preview endpoint.",
"value": {
"result": [
{
"id": "8963ca30-bca7-11e8-aa00-0123456789ab",
"type": "visualization"
},
{
"id": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b",
"type": "dashboard"
}
]
}
},
"Data_views_set_default_data_view_request": {
"summary": "Set the default data view identifier.",
"description": "Set the default data view, using the force flag to overwrite an existing default.",
"value": {
"data_view_id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"force": true
}
},
"Data_views_set_default_data_view_response": {
"summary": "The default data view was set successfully.",
"description": "The acknowledged flag confirms that the default data view for the current Kibana space was updated.",
"value": {
"acknowledged": true
}
},
"Data_views_swap_data_view_request": {
"summary": "Swap references from data view ID \"abcd-efg\" to \"xyz-123\" and remove the data view that is no longer referenced.",
"description": "Swap all saved object references from one data view to another and delete the source data view afterward.",
"value": {
"delete": true,
"fromId": "abcd-efg",
"toId": "xyz-123"
}
},
"Data_views_swap_data_view_response": {
"summary": "The swap references API returns a list of the affected saved objects.",
"description": "The list of saved objects whose references were updated, along with the delete status of the source.",
"value": {
"deleteStatus": {
"deletePerformed": true,
"remainingRefs": 0
},
"result": [
{
"id": "123",
"type": "visualization"
}
]
}
},
"Data_views_update_data_view_request": {
"summary": "Update some properties for a data view.",
"description": "Update the title, time field, and other properties of an existing data view.",
"value": {
"data_view": {
"allowNoIndex": false,
"name": "Kibana Sample Data eCommerce",
"timeFieldName": "order_date",
"title": "kibana_sample_data_ecommerce"
},
"refresh_fields": true
}
},
"Data_views_update_field_metadata_request": {
"summary": "Update metadata for multiple fields.",
"description": "Update the popularity count, custom label, and custom description for specific fields in a data view.",
"value": {
"fields": {
"field1": {
"count": 123,
"customLabel": "Field 1 label"
},
"field2": {
"customDescription": "Field 2 description",
"customLabel": "Field 2 label"
}
}
}
},
"Data_views_update_field_metadata_response": {
"summary": "Field metadata was updated successfully.",
"description": "The acknowledged flag confirms that the field metadata changes were applied to the data view.",
"value": {
"acknowledged": true
}
},
"Data_views_update_runtime_field_request": {
"summary": "Update an existing runtime field on a data view.",
"description": "Update the script of an existing runtime field.",
"value": {
"runtimeField": {
"script": {
"source": "emit(doc[\"bar\"].value)"
}
}
}
},
"Machine_learning_APIs_mlSync401Example": {
"summary": "Two anomaly detection jobs required synchronization in this example.",
"value": {
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [ml_viewer] for REST request [/_security/_authenticate]]: unable to authenticate user [ml_viewer] for REST request [/_security/_authenticate]",
"statusCode": 401
}
},
"Machine_learning_APIs_mlSyncExample": {
"summary": "Two anomaly detection jobs required synchronization in this example.",
"value": {
"datafeedsAdded": { },
"datafeedsRemoved": { },
"savedObjectsCreated": {
"anomaly-detector": {
"myjob1": {
"success": true
},
"myjob2": {
"success": true
}
}
},
"savedObjectsDeleted": { }
}
},
"Observability_AI_Assistant_API_ChatCompleteRequestExample": {
"summary": "Example of completing a chat interaction",
"value": "{\n \"connectorId\": \"\",\n \"disableFunctions\": false,\n \"messages\": [\n {\n \"@timestamp\": \"2025-06-25T23:45:00.000Z\",\n \"message\": {\n \"role\": \"user\",\n \"content\": \"Is my Elasticsearch cluster healthy right now?\"\n }\n }\n ],\n \"persist\": false,\n \"actions\": [\n {\n \"name\": \"get_cluster_health\",\n \"description\": \"Fetch the current Elasticsearch cluster-health status and key metrics.\",\n \"parameters\": {\n \"type\": \"object\",\n \"properties\": {\n \"includeShardStats\": {\n \"type\": \"boolean\",\n \"default\": false\n }\n }\n }\n }\n ],\n \"instructions\": [\"When the user asks about Elasticsearch cluster health, use the get_cluster_health tool to retrieve cluster health, then summarize the response in plain English.\"]\n}\n"
},
"Observability_AI_Assistant_API_ChatCompleteResponseExample": {
"summary": "Get a chat completion from the Observability AI Assistant",
"value": "data: {\"model\":\"unknown\",\"choices\":[{\"delta\":{\"content\":\"\",\"function_call\":{\"name\":\"get_cluster_health\",\"arguments\":\"{\\\"includeShardStats\\\":true}\"}},\"finish_reason\":null,\"index\":0}],\"created\":1750936626911,\"id\":\"9c8eff9b-4fd4-4203-a4ab-2e364688deff\",\"object\":\"chat.completion.chunk\"}\n\ndata: [DONE]\n"
},
"Saved_objects_key_rotation_response": {
"summary": "Encryption key rotation using default parameters.",
"value": {
"failed": 0,
"successful": 300,
"total": 1000
}
},
"Security_Detections_API_SetAlertAssigneesBodyAdd": {
"value": {
"assignees": {
"add": [
"u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
],
"remove": [ ]
},
"ids": [
"681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
]
}
},
"Security_Detections_API_SetAlertAssigneesBodyRemove": {
"value": {
"assignees": {
"add": [ ],
"remove": [
"u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
]
},
"ids": [
"681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
]
}
},
"Security_Detections_API_SetAlertTagsBodyAdd": {
"value": {
"ids": [
"549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e"
],
"tags": {
"tags_to_add": [
"Duplicate"
],
"tags_to_remove": [ ]
}
}
},
"Security_Detections_API_SetAlertTagsBodyRemove": {
"value": {
"ids": [
"549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e"
],
"tags": {
"tags_to_add": [ ],
"tags_to_remove": [
"Duplicate"
]
}
}
},
"Task_manager_health_APIs_health_200response": {
"description": "A successful response from `GET api/task_manager/_health`.",
"value": "{\n \"id\": \"330bbc6a-56cd-44d5-88e3-e3229f14d619\",\n \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n \"status\": \"OK\",\n \"last_update\": \"2025-03-21T21:30:04.455Z\",\n \"stats\": {\n \"configuration\": {\n \"timestamp\": \"2025-03-21T21:26:10.002Z\",\n \"value\": {\n \"request_capacity\": 1000,\n \"monitored_aggregated_stats_refresh_rate\": 60000,\n \"monitored_stats_running_average_window\": 50,\n \"monitored_task_execution_thresholds\": {\n \"custom\": {},\n \"default\": {\n \"error_threshold\": 90,\n \"warn_threshold\": 80\n }\n },\n \"claim_strategy\": \"mget\",\n \"poll_interval\": 500,\n \"capacity\": {\n \"config\": 10,\n \"as_workers\": 10,\n \"as_cost\": 20\n }\n },\n \"status\": \"OK\"\n },\n \"runtime\": {\n \"timestamp\": \"2025-03-21T21:30:04.455Z\",\n \"value\": {\n \"polling\": {\n \"last_successful_poll\": \"2025-03-21T21:30:04.455Z\",\n \"last_polling_delay\": \"2025-03-21T21:26:10.001Z\",\n \"claim_duration\": {\n \"p50\": 17,\n \"p90\": 22,\n \"p95\": 25,\n \"p99\": 27\n },\n \"duration\": {\n \"p50\": 19,\n \"p90\": 25.5,\n \"p95\": 28,\n \"p99\": 28\n },\n \"claim_conflicts\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"claim_mismatches\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"claim_stale_tasks\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"result_frequency_percent_as_number\": {\n \"Failed\": 0,\n \"NoAvailableWorkers\": 0,\n \"NoTasksClaimed\": 100,\n \"RanOutOfCapacity\": 0,\n \"RunningAtCapacity\": 0,\n \"PoolFilled\": 0\n },\n \"persistence\": {\n \"recurring\": 88,\n \"non_recurring\": 12\n }\n },\n \"drift\": {\n \"p50\": 2089,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"drift_by_type\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"p50\": 2082,\n \"p90\": 2082,\n \"p95\": 2082,\n \"p99\": 2082\n },\n \"fleet:check-deleted-files-task\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"osquery:telemetry-saved-queries\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"p50\": 2089,\n \"p90\": 2089,\n \"p95\": 2089,\n \"p99\": 2089\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"p50\": 336.5,\n \"p90\": 2089,\n \"p95\": 2089,\n \"p99\": 2089\n },\n \"alerts_invalidate_api_keys\": {\n \"p50\": 2086,\n \"p90\": 2086,\n \"p95\": 2086,\n \"p99\": 2086\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"alerting_health_check\": {\n \"p50\": 2086,\n \"p90\": 2086,\n \"p95\": 2086,\n \"p99\": 2086\n },\n \"Fleet-Usage-Sender\": {\n \"p50\": 2079,\n \"p90\": 2079,\n \"p95\": 2079,\n \"p99\": 2079\n },\n \"security:endpoint-diagnostics\": {\n \"p50\": 2525,\n \"p90\": 2525,\n \"p95\": 2525,\n \"p99\": 2525\n },\n \"security:telemetry-lists\": {\n \"p50\": 2525,\n \"p90\": 2525,\n \"p95\": 2525,\n \"p99\": 2525\n },\n \"security:telemetry-timelines\": {\n \"p50\": 2526,\n \"p90\": 2526,\n \"p95\": 2526,\n \"p99\": 2526\n },\n \"cases-telemetry-task\": {\n \"p50\": 2083,\n \"p90\": 2083,\n \"p95\": 2083,\n \"p99\": 2083\n },\n \"osquery:telemetry-packs\": {\n \"p50\": 2530,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"Fleet-Metrics-Task\": {\n \"p50\": 133.5,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"p50\": 2530,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"osquery:telemetry-configs\": {\n \"p50\": 2529,\n \"p90\": 2529,\n \"p95\": 2529,\n \"p99\": 2529\n },\n \"endpoint:complete-external-response-actions\": {\n \"p50\": 519,\n \"p90\": 2526,\n \"p95\": 2526,\n \"p99\": 2526\n },\n \"security:telemetry-detection-rules\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:endpoint-meta-telemetry\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-filterlist-artifact\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-configuration\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:indices-metadata-telemetry\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"Fleet-Usage-Logger\": {\n \"p50\": 2190,\n \"p90\": 2190,\n \"p95\": 2190,\n \"p99\": 2190\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"p50\": 2189,\n \"p90\": 2189,\n \"p95\": 2189,\n \"p99\": 2189\n },\n \"dashboard_telemetry\": {\n \"p50\": 2452,\n \"p90\": 2452,\n \"p95\": 2452,\n \"p99\": 2452\n },\n \"session_cleanup\": {\n \"p50\": 2569,\n \"p90\": 2569,\n \"p95\": 2569,\n \"p99\": 2569\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"p50\": 2452,\n \"p90\": 2452,\n \"p95\": 2452,\n \"p99\": 2452\n },\n \"apm-telemetry-task\": {\n \"p50\": 2591,\n \"p90\": 2591,\n \"p95\": 2591,\n \"p99\": 2591\n },\n \"ML:saved-objects-sync\": {\n \"p50\": 2475,\n \"p90\": 2475,\n \"p95\": 2475,\n \"p99\": 2475\n },\n \"apm-source-map-migration-task\": {\n \"p50\": 1603.5,\n \"p90\": 2987,\n \"p95\": 2987,\n \"p99\": 2987\n },\n \"actions_telemetry\": {\n \"p50\": 771,\n \"p90\": 771,\n \"p95\": 771,\n \"p99\": 771\n },\n \"alerting_telemetry\": {\n \"p50\": 768,\n \"p90\": 768,\n \"p95\": 768,\n \"p99\": 768\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"p50\": 834,\n \"p90\": 834,\n \"p95\": 834,\n \"p99\": 834\n },\n \"endpoint:user-artifact-packager\": {\n \"p50\": 529.5,\n \"p90\": 835,\n \"p95\": 835,\n \"p99\": 835\n },\n \"fleet:bump_agent_policies\": {\n \"p50\": 361,\n \"p90\": 361,\n \"p95\": 361,\n \"p99\": 361\n }\n },\n \"load\": {\n \"p50\": 10,\n \"p90\": 100,\n \"p95\": 100,\n \"p99\": 100\n },\n \"execution\": {\n \"duration\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"p50\": 24,\n \"p90\": 24,\n \"p95\": 24,\n \"p99\": 24\n },\n \"fleet:check-deleted-files-task\": {\n \"p50\": 24,\n \"p90\": 24,\n \"p95\": 24,\n \"p99\": 24\n },\n \"osquery:telemetry-saved-queries\": {\n \"p50\": 25,\n \"p90\": 25,\n \"p95\": 25,\n \"p99\": 25\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"p50\": 28,\n \"p90\": 28,\n \"p95\": 28,\n \"p99\": 28\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"p50\": 7.5,\n \"p90\": 29,\n \"p95\": 29,\n \"p99\": 29\n },\n \"alerts_invalidate_api_keys\": {\n \"p50\": 34,\n \"p90\": 34,\n \"p95\": 34,\n \"p99\": 34\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"p50\": 39,\n \"p90\": 39,\n \"p95\": 39,\n \"p99\": 39\n },\n \"alerting_health_check\": {\n \"p50\": 42,\n \"p90\": 42,\n \"p95\": 42,\n \"p99\": 42\n },\n \"Fleet-Usage-Sender\": {\n \"p50\": 78,\n \"p90\": 78,\n \"p95\": 78,\n \"p99\": 78\n },\n \"security:endpoint-diagnostics\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-lists\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-timelines\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"cases-telemetry-task\": {\n \"p50\": 458,\n \"p90\": 458,\n \"p95\": 458,\n \"p99\": 458\n },\n \"osquery:telemetry-packs\": {\n \"p50\": 10,\n \"p90\": 10,\n \"p95\": 10,\n \"p99\": 10\n },\n \"Fleet-Metrics-Task\": {\n \"p50\": 5,\n \"p90\": 10,\n \"p95\": 10,\n \"p99\": 10\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"p50\": 11,\n \"p90\": 11,\n \"p95\": 11,\n \"p99\": 11\n },\n \"osquery:telemetry-configs\": {\n \"p50\": 12,\n \"p90\": 12,\n \"p95\": 12,\n \"p99\": 12\n },\n \"endpoint:complete-external-response-actions\": {\n \"p50\": 7,\n \"p90\": 11,\n \"p95\": 11,\n \"p99\": 11\n },\n \"security:telemetry-detection-rules\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:endpoint-meta-telemetry\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-filterlist-artifact\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:telemetry-configuration\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:indices-metadata-telemetry\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"Fleet-Usage-Logger\": {\n \"p50\": 18,\n \"p90\": 18,\n \"p95\": 18,\n \"p99\": 18\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"p50\": 8,\n \"p90\": 8,\n \"p95\": 8,\n \"p99\": 8\n },\n \"dashboard_telemetry\": {\n \"p50\": 12,\n \"p90\": 12,\n \"p95\": 12,\n \"p99\": 12\n },\n \"session_cleanup\": {\n \"p50\": 58,\n \"p90\": 58,\n \"p95\": 58,\n \"p99\": 58\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"p50\": 147,\n \"p90\": 147,\n \"p95\": 147,\n \"p99\": 147\n },\n \"apm-telemetry-task\": {\n \"p50\": 543,\n \"p90\": 543,\n \"p95\": 543,\n \"p99\": 543\n },\n \"ML:saved-objects-sync\": {\n \"p50\": 544,\n \"p90\": 544,\n \"p95\": 544,\n \"p99\": 544\n },\n \"apm-source-map-migration-task\": {\n \"p50\": 1649,\n \"p90\": 3282,\n \"p95\": 3282,\n \"p99\": 3282\n },\n \"actions_telemetry\": {\n \"p50\": 19,\n \"p90\": 19,\n \"p95\": 19,\n \"p99\": 19\n },\n \"alerting_telemetry\": {\n \"p50\": 64,\n \"p90\": 64,\n \"p95\": 64,\n \"p99\": 64\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"endpoint:user-artifact-packager\": {\n \"p50\": 10,\n \"p90\": 13,\n \"p95\": 13,\n \"p99\": 13\n },\n \"fleet:bump_agent_policies\": {\n \"p50\": 9,\n \"p90\": 9,\n \"p95\": 9,\n \"p99\": 9\n }\n },\n \"duration_by_persistence\": {\n \"recurring\": {\n \"p50\": 9,\n \"p90\": 63.39999999999999,\n \"p95\": 474.99999999999966,\n \"p99\": 544\n },\n \"non_recurring\": {\n \"p50\": 14,\n \"p90\": 2968.500000000001,\n \"p95\": 3282,\n \"p99\": 3282\n }\n },\n \"persistence\": {\n \"recurring\": 88,\n \"non_recurring\": 12\n },\n \"result_frequency_percent_as_number\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:check-deleted-files-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-saved-queries\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerts_invalidate_api_keys\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerting_health_check\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Usage-Sender\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:endpoint-diagnostics\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-lists\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-timelines\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"cases-telemetry-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-packs\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Metrics-Task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-configs\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:complete-external-response-actions\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-detection-rules\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:endpoint-meta-telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-filterlist-artifact\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-configuration\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:indices-metadata-telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Usage-Logger\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"dashboard_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"session_cleanup\": {\n \"Success\": 0,\n \"RetryScheduled\": 100,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"apm-telemetry-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"ML:saved-objects-sync\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"apm-source-map-migration-task\": {\n \"Success\": 50,\n \"RetryScheduled\": 50,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"actions_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerting_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:user-artifact-packager\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:bump_agent_policies\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n }\n }\n }\n },\n \"status\": \"OK\"\n },\n \"workload\": {\n \"timestamp\": \"2025-03-21T21:29:10.367Z\",\n \"value\": {\n \"count\": 35,\n \"cost\": 70,\n \"task_types\": {\n \"Fleet-Metrics-Task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"Fleet-Usage-Logger\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"Fleet-Usage-Sender\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"ML:saved-objects-sync\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"actions_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerting_health_check\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerting_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerts_invalidate_api_keys\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"apm-telemetry-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"cases-telemetry-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"dashboard_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:complete-external-response-actions\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:user-artifact-packager\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:check-deleted-files-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-configs\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-packs\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-saved-queries\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:endpoint-diagnostics\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:endpoint-meta-telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:indices-metadata-telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-configuration\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-detection-rules\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-filterlist-artifact\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-lists\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-timelines\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"session_cleanup\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n }\n },\n \"non_recurring\": 1,\n \"non_recurring_cost\": 2,\n \"schedule\": [\n [\n \"1m\",\n 2\n ],\n [\n \"60s\",\n 2\n ],\n [\n \"5m\",\n 2\n ],\n [\n \"10m\",\n 1\n ],\n [\n \"15m\",\n 1\n ],\n [\n \"45m\",\n 1\n ],\n [\n \"1h\",\n 9\n ],\n [\n \"3600s\",\n 1\n ],\n [\n \"60m\",\n 1\n ],\n [\n \"2h\",\n 1\n ],\n [\n \"720m\",\n 2\n ],\n [\n \"24h\",\n 7\n ],\n [\n \"1d\",\n 3\n ],\n [\n \"1440m\",\n 1\n ]\n ],\n \"overdue\": 0,\n \"overdue_cost\": 0,\n \"overdue_non_recurring\": 0,\n \"estimated_schedule_density\": [\n 0,\n 0,\n 0,\n 1,\n 1,\n 1,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 1,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0\n ],\n \"capacity_requirements\": {\n \"per_minute\": 4,\n \"per_hour\": 46,\n \"per_day\": 27\n }\n },\n \"status\": \"OK\"\n },\n \"capacity_estimation\": {\n \"status\": \"OK\",\n \"reason\": \"Task Manager is healthy, the assumedRequiredThroughputPerMinutePerKibana (148.78541666666666) < capacityPerMinutePerKibana (1200)\",\n \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n \"value\": {\n \"observed\": {\n \"observed_kibana_instances\": 1,\n \"max_throughput_per_minute_per_kibana\": 1200,\n \"max_throughput_per_minute\": 1200,\n \"minutes_to_drain_overdue\": 0,\n \"avg_recurring_required_throughput_per_minute\": 5,\n \"avg_recurring_required_throughput_per_minute_per_kibana\": 5,\n \"avg_required_throughput_per_minute\": 149,\n \"avg_required_throughput_per_minute_per_kibana\": 149\n },\n \"proposed\": {\n \"provisioned_kibana\": 2,\n \"min_required_kibana\": 1,\n \"avg_recurring_required_throughput_per_minute_per_kibana\": 3,\n \"avg_required_throughput_per_minute_per_kibana\": 75\n }\n }\n }\n }\n}"
},
"get_connector_types_generativeai_response": {
"summary": "A list of connector types for the `generativeAI` feature.",
"value": [
{
"id": ".gen-ai",
"name": "OpenAI",
"enabled": true,
"enabled_in_config": true,
"enabled_in_license": true,
"minimum_license_required": "enterprise",
"supported_feature_ids": [
"generativeAIForSecurity",
"generativeAIForObservability"
],
"is_system_action_type": false
},
{
"id": ".bedrock",
"name": "AWS Bedrock",
"enabled": true,
"enabled_in_config": true,
"enabled_in_license": true,
"minimum_license_required": "enterprise",
"supported_feature_ids": [
"generativeAIForSecurity",
"generativeAIForObservability"
],
"is_system_action_type": false
},
{
"id": ".gemini",
"name": "Google Gemini",
"enabled": true,
"enabled_in_config": true,
"enabled_in_license": true,
"minimum_license_required": "enterprise",
"supported_feature_ids": [
"generativeAIForSecurity"
],
"is_system_action_type": false
}
]
},
"get_connector_response": {
"summary": "Get connector details.",
"value": {
"id": "df770e30-8b8b-11ed-a780-3b746c987a81",
"name": "my_server_log_connector",
"config": { },
"connector_type_id": ".server-log",
"is_preconfigured": false,
"is_deprecated": false,
"is_missing_secrets": false,
"is_system_action": false
}
},
"update_index_connector_request": {
"summary": "Update an index connector.",
"value": {
"name": "updated-connector",
"config": {
"index": "updated-index"
}
}
},
"create_email_connector_request": {
"summary": "Create an email connector.",
"value": {
"name": "email-connector-1",
"connector_type_id": ".email",
"config": {
"from": "tester@example.com",
"hasAuth": true,
"host": "https://example.com",
"port": 1025,
"secure": false,
"service": "other"
},
"secrets": {
"user": "username",
"password": "password"
}
}
},
"create_index_connector_request": {
"summary": "Create an index connector.",
"value": {
"name": "my-connector",
"connector_type_id": ".index",
"config": {
"index": "test-index"
}
}
},
"create_webhook_connector_request": {
"summary": "Create a webhook connector with SSL authentication.",
"value": {
"name": "my-webhook-connector",
"connector_type_id": ".webhook",
"config": {
"method": "post",
"url": "https://example.com",
"authType": "webhook-authentication-ssl",
"certType": "ssl-crt-key"
},
"secrets": {
"crt": "QmFnIEF0dH...",
"key": "LS0tLS1CRUdJ...",
"password": "my-passphrase"
}
}
},
"create_xmatters_connector_request": {
"summary": "Create an xMatters connector with URL authentication.",
"value": {
"name": "my-xmatters-connector",
"connector_type_id": ".xmatters",
"config": {
"usesBasic": false
},
"secrets": {
"secretsUrl": "https://example.com?apiKey=xxxxx"
}
}
},
"create_email_connector_response": {
"summary": "A new email connector.",
"value": {
"id": "90a82c60-478f-11ee-a343-f98a117c727f",
"connector_type_id": ".email",
"name": "email-connector-1",
"config": {
"from": "tester@example.com",
"service": "other",
"host": "https://example.com",
"port": 1025,
"secure": false,
"hasAuth": true,
"tenantId": "null",
"clientId": "null",
"oauthTokenUrl": "null"
},
"is_preconfigured": false,
"is_deprecated": false,
"is_missing_secrets": false,
"is_system_action": false
}
},
"create_index_connector_response": {
"summary": "A new index connector.",
"value": {
"id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad",
"connector_type_id": ".index",
"name": "my-connector",
"config": {
"index": "test-index",
"refresh": false,
"executionTimeField": "null"
},
"is_preconfigured": false,
"is_deprecated": false,
"is_missing_secrets": false,
"is_system_action": false
}
},
"create_webhook_connector_response": {
"summary": "A new webhook connector.",
"value": {
"id": "900eb010-3b9d-11ee-a642-8ffbb94e38bd",
"name": "my-webhook-connector",
"config": {
"method": "post",
"url": "https://example.com",
"authType": "webhook-authentication-ssl",
"certType": "ssl-crt-key",
"verificationMode": "full",
"headers": "null",
"hasAuth": true
},
"connector_type_id": ".webhook",
"is_preconfigured": false,
"is_deprecated": false,
"is_missing_secrets": false,
"is_system_action": false
}
},
"run_index_connector_request": {
"summary": "Run an index connector.",
"value": {
"params": {
"documents": [
{
"id": "my_doc_id",
"name": "my_doc_name",
"message": "hello, world"
}
]
}
}
},
"run_jira_connector_request": {
"summary": "Run a Jira connector to retrieve the list of issue types.",
"value": {
"params": {
"subAction": "issueTypes"
}
}
},
"run_servicenow_itom_connector_request": {
"summary": "Run a ServiceNow ITOM connector to retrieve the list of choices.",
"value": {
"params": {
"subAction": "getChoices",
"subActionParams": {
"fields": [
"severity",
"urgency"
]
}
}
}
},
"run_slack_api_connector_request": {
"summary": "Run a Slack connector that uses the web API method to post a message on a channel.",
"value": {
"params": {
"subAction": "postMessage",
"subActionParams": {
"channelIds": [
"C123ABC456"
],
"text": "A test message."
}
}
}
},
"run_swimlane_connector_request": {
"summary": "Run a Swimlane connector to create an incident.",
"value": {
"params": {
"subAction": "pushToService",
"subActionParams": {
"comments": [
{
"commentId": 1,
"comment": "A comment about the incident."
}
],
"incident": {
"caseId": "1000",
"caseName": "Case name",
"description": "Description of the incident."
}
}
}
}
},
"run_index_connector_response": {
"summary": "Response from running an index connector.",
"value": {
"connector_id": "fd38c600-96a5-11ed-bb79-353b74189cba",
"data": {
"errors": false,
"items": [
{
"create": {
"_id": "4JtvwYUBrcyxt2NnfW3y",
"_index": "my-index",
"_primary_term": 1,
"_seq_no": 0,
"_shards": {
"failed": 0,
"successful": 1,
"total": 2
},
"_version": 1,
"result": "created",
"status": 201
}
}
],
"took": 135
},
"status": "ok"
}
},
"run_jira_connector_response": {
"summary": "Response from retrieving the list of issue types for a Jira connector.",
"value": {
"connector_id": "b3aad810-edbe-11ec-82d1-11348ecbf4a6",
"data": [
{
"id": 10024,
"name": "Improvement"
},
{
"id": 10006,
"name": "Task"
},
{
"id": 10007,
"name": "Sub-task"
},
{
"id": 10025,
"name": "New Feature"
},
{
"id": 10023,
"name": "Bug"
},
{
"id": 10000,
"name": "Epic"
}
],
"status": "ok"
}
},
"run_server_log_connector_response": {
"summary": "Response from running a server log connector.",
"value": {
"connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907",
"status": "ok"
}
},
"run_servicenow_itom_connector_response": {
"summary": "Response from retrieving the list of choices for a ServiceNow ITOM connector.",
"value": {
"connector_id": "9d9be270-2fd2-11ed-b0e0-87533c532698",
"data": [
{
"dependent_value": "",
"element": "severity",
"label": "Critical",
"value": 1
},
{
"dependent_value": "",
"element": "severity",
"label": "Major",
"value": 2
},
{
"dependent_value": "",
"element": "severity",
"label": "Minor",
"value": 3
},
{
"dependent_value": "",
"element": "severity",
"label": "Warning",
"value": 4
},
{
"dependent_value": "",
"element": "severity",
"label": "OK",
"value": 5
},
{
"dependent_value": "",
"element": "severity",
"label": "Clear",
"value": 0
},
{
"dependent_value": "",
"element": "urgency",
"label": "1 - High",
"value": 1
},
{
"dependent_value": "",
"element": "urgency",
"label": "2 - Medium",
"value": 2
},
{
"dependent_value": "",
"element": "urgency",
"label": "3 - Low",
"value": 3
}
],
"status": "ok"
}
},
"run_slack_api_connector_response": {
"summary": "Response from posting a message with a Slack connector.",
"value": {
"status": "ok",
"data": {
"ok": true,
"channel": "C123ABC456",
"ts": "1234567890.123456",
"message": {
"bot_id": "B12BCDEFGHI",
"type": "message",
"text": "A test message",
"user": "U12A345BC6D",
"ts": "1234567890.123456",
"app_id": "A01BC2D34EF",
"blocks": [
{
"type": "rich_text",
"block_id": "/NXe",
"elements": [
{
"type": "rich_text_section",
"elements": [
{
"type": "text",
"text": "A test message."
}
]
}
]
}
],
"team": "T01ABCDE2F",
"bot_profile": {
"id": "B12BCDEFGHI",
"app_id": "A01BC2D34EF",
"name": "test",
"icons": {
"image_36": "https://a.slack-edge.com/80588/img/plugins/app/bot_36.png"
},
"deleted": false,
"updated": 1672169705,
"team_id": "T01ABCDE2F"
}
}
},
"connector_id": ".slack_api"
}
},
"run_swimlane_connector_response": {
"summary": "Response from creating a Swimlane incident.",
"value": {
"connector_id": "a4746470-2f94-11ed-b0e0-87533c532698",
"data": {
"id": "aKPmBHWzmdRQtx6Mx",
"title": "TEST-457",
"url": "https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx",
"pushedDate": "2022-09-08T16:52:27.866Z",
"comments": [
{
"commentId": 1,
"pushedDate": "2022-09-08T16:52:27.865Z"
}
]
},
"status": "ok"
}
},
"get_connectors_response": {
"summary": "A list of connectors",
"value": [
{
"id": "preconfigured-email-connector",
"name": "my-preconfigured-email-notification",
"connector_type_id": ".email",
"is_preconfigured": true,
"is_deprecated": false,
"referenced_by_count": 0,
"is_system_action": false
},
{
"id": "e07d0c80-8b8b-11ed-a780-3b746c987a81",
"name": "my-index-connector",
"config": {
"index": "test-index",
"refresh": false,
"executionTimeField": "null"
},
"connector_type_id": ".index",
"is_preconfigured": false,
"is_deprecated": false,
"referenced_by_count": 2,
"is_missing_secrets": false,
"is_system_action": false
}
]
},
"get_roles_response1": {
"summary": "Get all role details",
"value": [
{
"name": "my_kibana_role",
"description": "My kibana role description",
"metadata": {
"version": 1
},
"transient_metadata": {
"enabled": true
},
"elasticsearch": {
"indices": [ ],
"cluster": [ ],
"run_as": [ ]
},
"kibana": [
{
"base": [
"all"
],
"feature": { },
"spaces": [
"*"
]
}
]
},
{
"name": "my_admin_role",
"description": "My admin role description",
"metadata": {
"version": 1
},
"transient_metadata": {
"enabled": true
},
"elasticsearch": {
"cluster": [
"all"
],
"indices": [
{
"names": [
"index1",
"index2"
],
"privileges": [
"all"
],
"field_security": {
"grant": [
"title",
"body"
]
},
"query": "{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}"
}
]
},
"kibana": [ ]
}
]
},
"get_role_response1": {
"summary": "Get role details",
"value": {
"name": "my_kibana_role",
"description": "Grants all cluster privileges and full access to index1 and index2. Grants full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grants all Kibana privileges in the default space.",
"metadata": {
"version": 1
},
"transient_metadata": {
"enabled": true
},
"elasticsearch": {
"cluster": [
"all"
],
"remote_cluster": [
{
"privileges": [
"monitor_enrich"
],
"clusters": [
"remote_cluster1"
]
}
],
"indices": [
{
"names": [
"index1",
"index2"
],
"privileges": [
"all"
],
"allow_restricted_indices": false
}
],
"remote_indices": [
{
"names": [
"remote_index1",
"remote_index2"
],
"privileges": [
"all"
],
"allow_restricted_indices": false,
"clusters": [
"remote_cluster1"
]
}
],
"run_as": [ ]
},
"kibana": [
{
"base": [
"all"
],
"feature": { },
"spaces": [
"default"
]
}
],
"_transform_error": [ ],
"_unrecognized_applications": [ ]
}
},
"create_role_request1": {
"summary": "Feature privileges in multiple spaces",
"description": "Grant access to various features in some spaces.",
"value": {
"description": "Grant full access to discover and dashboard features in the default space. Grant read access in the marketing, and sales spaces.",
"metadata": {
"version": 1
},
"elasticsearch": {
"cluster": [ ],
"indices": [ ]
},
"kibana": [
{
"base": [ ],
"feature": {
"discover": [
"all"
],
"dashboard": [
"all"
]
},
"spaces": [
"default"
]
},
{
"base": [
"read"
],
"spaces": [
"marketing",
"sales"
]
}
]
}
},
"create_role_request2": {
"summary": "Dashboard privileges in a space",
"description": "Grant access to dashboard features in a Marketing space.",
"value": {
"description": "Grant dashboard access in the Marketing space.",
"metadata": {
"version": 1
},
"elasticsearch": {
"cluster": [ ],
"indices": [ ]
},
"kibana": [
{
"base": [ ],
"feature": {
"dashboard": [
"read"
]
},
"spaces": [
"marketing"
]
}
]
}
},
"create_role_request3": {
"summary": "Feature privileges in a space",
"description": "Grant full access to all features in the default space.",
"value": {
"metadata": {
"version": 1
},
"elasticsearch": {
"cluster": [ ],
"indices": [ ]
},
"kibana": [
{
"base": [
"all"
],
"feature": { },
"spaces": [
"default"
]
}
]
}
},
"create_role_request4": {
"summary": "Elasticsearch and Kibana feature privileges",
"description": "Grant Elasticsearch and Kibana feature privileges.",
"value": {
"description": "Grant all cluster privileges and full access to index1 and index2. Grant full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grant all Kibana privileges in the default space.",
"metadata": {
"version": 1
},
"elasticsearch": {
"cluster": [
"all"
],
"indices": [
{
"names": [
"index1",
"index2"
],
"privileges": [
"all"
]
}
],
"remote_indices": [
{
"clusters": [
"remote_cluster1"
],
"names": [
"remote_index1",
"remote_index2"
],
"privileges": [
"all"
]
}
],
"remote_cluster": [
{
"clusters": [
"remote_cluster1"
],
"privileges": [
"monitor_enrich"
]
}
]
},
"kibana": [
{
"base": [
"all"
],
"feature": { },
"spaces": [
"default"
]
}
]
}
},
"copy_saved_objects_request1": {
"summary": "Copy with createNewCopies",
"description": "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n",
"value": {
"objects": [
{
"type": "dashboard",
"id": "my-dashboard"
}
],
"spaces": [
"marketing"
],
"includeReferences": true
}
},
"copy_saved_objects_request2": {
"summary": "Copy without createNewCopies",
"description": "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n",
"value": {
"objects": [
{
"type": "dashboard",
"id": "my-dashboard"
}
],
"spaces": [
"marketing"
],
"includeReferences": true,
"createNewCopies": false
}
},
"copy_saved_objects_response1": {
"summary": "Copy with createNewCopies",
"description": "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. The result indicates a successful copy and all three objects are created. Since these objects were created as new copies, each entry in the successResults array includes a destinationId attribute.\n",
"value": {
"marketing": {
"success": true,
"successCount": 3,
"successResults": [
{
"id": "my-dashboard",
"type": "dashboard",
"destinationId": "1e127098-5b80-417f-b0f1-c60c8395358f",
"meta": {
"icon": "dashboardApp",
"title": "Look at my dashboard"
}
},
{
"id": "my-vis",
"type": "visualization",
"destinationId": "a610ed80-1c73-4507-9e13-d3af736c8e04",
"meta": {
"icon": "visualizeApp",
"title": "Look at my visualization"
}
},
{
"id": "my-index-pattern",
"type": "index-pattern",
"destinationId": "bc3c9c70-bf6f-4bec-b4ce-f4189aa9e26b",
"meta": {
"icon": "indexPatternApp",
"title": "my-pattern-*"
}
}
]
}
}
},
"copy_saved_objects_response2": {
"summary": "Copy without createNewCopies",
"description": "The response for successfully copying a dashboard with the my-dashboard ID with createNewCopies turned off. The result indicates a successful copy and all three objects are created.\n",
"value": {
"marketing": {
"success": true,
"successCount": 3,
"successResults": [
{
"id": "my-dashboard",
"type": "dashboard",
"meta": {
"icon": "dashboardApp",
"title": "Look at my dashboard"
}
},
{
"id": "my-vis",
"type": "visualization",
"meta": {
"icon": "visualizeApp",
"title": "Look at my visualization"
}
},
{
"id": "my-index-pattern",
"type": "index-pattern",
"meta": {
"icon": "indexPatternApp",
"title": "my-pattern-*"
}
}
]
}
}
},
"copy_saved_objects_response3": {
"summary": "Failed copy response with conflict errors",
"description": "A response for a failed copy of a dashboard with the my-dashboard ID including all references from the default space to the marketing and sales spaces. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to an index pattern. The result indicates a successful copy for the marketing space and an unsuccessful copy for the sales space because the data view, visualization, and Canvas workpad each resulted in a conflict error. Objects are created when the error is resolved using the resolve copy conflicts API.\n",
"value": {
"marketing": {
"success": true,
"successCount": 4,
"successResults": [
{
"id": "my-dashboard",
"type": "dashboard",
"meta": {
"icon": "dashboardApp",
"title": "Look at my dashboard"
}
},
{
"id": "my-vis",
"type": "visualization",
"meta": {
"icon": "visualizeApp",
"title": "Look at my visualization"
}
},
{
"id": "my-canvas",
"type": "canvas-workpad",
"meta": {
"icon": "canvasApp",
"title": "Look at my canvas"
}
},
{
"id": "my-index-pattern",
"type": "index-pattern",
"meta": {
"icon": "indexPatternApp",
"title": "my-pattern-*"
}
}
]
},
"sales": {
"success": false,
"successCount": "1,",
"errors": [
{
"id": "my-pattern",
"type": "index-pattern",
"title": "my-pattern-*",
"error": {
"type": "conflict"
},
"meta": {
"icon": "indexPatternApp",
"title": "my-pattern-*"
}
},
{
"id": "my-visualization",
"type": "my-vis",
"title": "Look at my visualization",
"error": {
"type": "conflict",
"destinationId": "another-vis"
},
"meta": {
"icon": "visualizeApp",
"title": "Look at my visualization"
}
},
{
"id": "my-canvas",
"type": "canvas-workpad",
"title": "Look at my canvas",
"error": {
"type": "ambiguous_conflict",
"destinations": [
{
"id": "another-canvas",
"title": "Look at another canvas",
"updatedAt": "2020-07-08T16:36:32.377Z"
},
{
"id": "yet-another-canvas",
"title": "Look at yet another canvas",
"updatedAt": "2020-07-05T12:29:54.849Z"
}
]
},
"meta": {
"icon": "canvasApp",
"title": "Look at my canvas"
}
}
],
"successResults\"": [
{
"id": "my-dashboard",
"type": "dashboard",
"meta": {
"icon": "dashboardApp",
"title": "Look at my dashboard"
}
}
]
}
}
},
"copy_saved_objects_response4": {
"summary": "Failed copy with missing reference errors",
"description": "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to a data view. The result indicates an unsuccessful copy because the visualization resulted in a missing references error. Objects are created when the errors are resolved using the resolve copy conflicts API.\n",
"value": {
"marketing": {
"success": false,
"successCount": 2,
"errors": [
{
"id": "my-vis",
"type": "visualization",
"title": "Look at my visualization",
"error": {
"type": "missing_references",
"references": [
{
"type": "index-pattern",
"id": "my-pattern-*"
}
]
},
"meta": {
"icon": "visualizeApp",
"title": "Look at my visualization"
}
}
],
"successResults": [
{
"id": "my-dashboard",
"type": "dashboard",
"meta": {
"icon": "dashboardApp",
"title": "Look at my dashboard"
}
},
{
"id": "my-canvas",
"type": "canvas-workpad",
"meta": {
"icon": "canvasApp",
"title": "Look at my canvas"
}
}
]
}
}
},
"disable_legacy_url_request1": {
"summary": "Disable legacy URL aliases",
"description": "This request leaves the alias intact but the legacy URL for this alias (http://localhost:5601/s/bills-space/app/dashboards#/view/123) will no longer function. The dashboard still exists and you can access it with the new URL.\n",
"value": {
"aliases": [
{
"targetSpace": "bills-space",
"targetType": "dashboard",
"sourceId": 123
}
]
}
},
"get_shareable_references_request1": {
"summary": "Get shareable references",
"description": "Collect references and space contexts for a dashboard saved object.\n",
"value": {
"objects": [
{
"type": "dashboard",
"id": "my-dashboard-id"
}
]
}
},
"get_shareable_references_response1": {
"summary": "Get shareable references response",
"description": "A response that includes the collected references and the spaces where the objects exist.\n",
"value": {
"objects": [
{
"type": "dashboard",
"id": "my-dashboard-id",
"spaces": [
"default",
"marketing"
],
"inboundReferences": [ ]
}
]
}
},
"resolve_copy_saved_objects_request1": {
"summary": "Resolve conflict errors",
"description": "Resolve conflict errors for a data view, visualization, and Canvas workpad by overwriting the existing saved objects. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard accordingly.\n",
"value": {
"objects": [
{
"type": "dashboard",
"id": "my-dashboard"
}
],
"includeReferences": true,
"createNewCopies": false,
"retries": {
"sales": [
{
"type": "index-pattern",
"id": "my-pattern",
"overwrite": true
},
{
"type": "visualization",
"id": "my-vis",
"overwrite": "true,",
"destinationId": "another-vis"
},
{
"type": "canvas",
"id": "my-canvas",
"overwrite": true,
"destinationId": "yet-another-canvas"
},
{
"type": "dashboard",
"id": "my-dashboard"
}
]
}
}
},
"resolve_copy_saved_objects_request2": {
"summary": "Resolve missing reference errors",
"description": "Resolve missing reference errors for a visualization by ignoring the error. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard and canvas accordingly.\n",
"value": {
"objects": [
{
"type": "dashboard",
"id": "my-dashboard"
}
],
"includeReferences": true,
"createNewCopies": false,
"retries": {
"marketing": [
{
"type": "visualization",
"id": "my-vis",
"ignoreMissingReferences": true
},
{
"type": "canvas",
"id": "my-canvas"
},
{
"type": "dashboard",
"id": "my-dashboard"
}
]
}
}
},
"update_saved_objects_spaces_request1": {
"summary": "Update saved object spaces",
"description": "Update the spaces of each saved object and all its references.",
"value": {
"objects": [
{
"type": "index-pattern",
"id": "90943e30-9a47-11e8-b64d-95841ca0b247"
}
],
"spacesToAdd": [
"test"
],
"spacesToRemove": [ ]
}
},
"update_saved_objects_spaces_response1": {
"summary": "Update saved object spaces",
"description": "The response from updating the spaces of saved objects.\n",
"value": {
"objects": [
{
"type": "index-pattern",
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"spaces": [
"default",
"test"
]
}
]
}
},
"get_spaces_response1": {
"summary": "Get all spaces",
"description": "Get all spaces without specifying any options.",
"value": [
{
"id": "default",
"name": "Default",
"description": "This is the Default Space",
"disabledFeatures": [ ],
"imageUrl": "",
"_reserved": true
},
{
"id": "marketing",
"name": "Marketing",
"description": "This is the Marketing Space",
"color": "null",
"disabledFeatures": [
"apm"
],
"initials": "MK",
"imageUrl": "data:image/png;base64,iVBORw0KGgoAAAANSU"
},
{
"id": "sales",
"name": "Sales",
"initials": "MK",
"disabledFeatures": [
"discover"
],
"imageUr\"": "",
"solution": "oblt"
}
]
},
"get_spaces_response2": {
"summary": "Get all spaces with custom options",
"description": "The user has read-only access to the Sales space. Get all spaces with the following query parameters: \"purpose=shareSavedObjectsIntoSpace&include_authorized_purposes=true\"\n",
"value": [
{
"id": "default",
"name": "Default",
"description": "This is the Default Space",
"disabledFeatures": [ ],
"imageUrl": "",
"_reserved": true,
"authorizedPurposes": {
"any": true,
"copySavedObjectsIntoSpace": true,
"findSavedObjects": true,
"shareSavedObjectsIntoSpace": true
}
},
{
"id": "marketing",
"name": "Marketing",
"description": "This is the Marketing Space",
"color": "null",
"disabledFeatures": [
"apm"
],
"initials": "MK",
"imageUrl": "data:image/png;base64,iVBORw0KGgoAAAANSU",
"authorizedPurposes": {
"any": true,
"copySavedObjectsIntoSpace": true,
"findSavedObjects": true,
"shareSavedObjectsIntoSpace": true
}
},
{
"id": "sales",
"name": "Sales",
"initials": "MK",
"disabledFeatures": [
"discover"
],
"imageUrl": "",
"authorizedPurposes": {
"any": true,
"copySavedObjectsIntoSpace": false,
"findSavedObjects": true,
"shareSavedObjectsIntoSpace": false
}
}
]
},
"create_space_request": {
"summary": "Create a marketing space",
"value": {
"id": "marketing",
"name": "Marketing",
"description": "This is the Marketing Space",
"color": "null",
"initials": "MK",
"disabledFeatures": [ ],
"imageUrl": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAD4AAABACAYAAABC6cT1AAAGf0lEQVRoQ+3abYydRRUH8N882xYo0IqagEVjokQJKAiKBjXExC9G/aCkGowCIghCkRcrVSSKIu/FEiqgGL6gBIlAYrAqUTH6hZgQFVEMKlQFfItWoQWhZe8z5uzMLdvbfbkLxb13d+fbvfe588x/zpn/+Z9zJpmnI81T3BaAzzfLL1h8weLzZAcWXH2eGHo7zAWLL1h8nuzAjFw9G1N6Kzq8HnuM36MR8iibF3Fv4q+7cv8yDV6K13bYq2furSP8Ag8ncr/vnSnwRViJT2GfCV7yL1yHGxLb+l3EdM9lluNEnIC9xz+f2ZL4Er6Z2DrdXN3fZwp8CU7OfDHxggle8lTLbQ1nJ/7Z7yKmey5zYGZt4h2IzR8/trRc2PDlxJPTzfVcgJ+CC0wMPOa9F6cm7up3EVM9V9386MxliVdM8GwAv6hh/awCz/w7lY25OtF5ruBz4ZLP42NYNrDAFbC3YPWuILnMAfgq3oaRQQYea/stViV+sgssvjKzLvGySeaaNVfP4d7Btokgvxj/bblgpueuF1hmWcyTCmfE3J3M1lTcv0vMswM88zR+jpw4osu6me8kzkpsfLZWzxyRuabO22buxxOJ12FxnXfWgEe83pB5sOE47BsLymzscOoi7nw2JJfZreUjiUsTyzKPZm5NvBDvSuw268AzNzV8H5/Am+qCnsAXgpgSW2Zq9cyKlksbPlTd+te4quWNieMHBfiNDdciYnwsdI/MaOaWhnMTf54J8CqNj8x8JXFIZltYu+HqlmNT8YSBsHgAPw/vxvlVV4du/s0oaxbxg0TbL/jMni0nNcVjQq7+HZfgtpbzBg342TgQ63AkmsymxBW4IjE6A+D7Vzd/fyWxIM/VuCe+HzTgZ2Jpy/kNJ2FJLmLm24mPJ/42A+Bvrxt4SISwlhsaPodH26LZB8rVA3inwwebsrixJCZzX+KMxI/7AV61eVh3DV6Mx3EOvh4kN6jAg8nfUCXm4d1wE66OyxNPTQc+s3/o/MoXizL3JE5O3F3P/uBZPPF4Zr+Wi5uSO48ZPRdyCwn7YB/A35m5KhWNHox4fcNnIs0ddOCRSBxf8+cQG+Huf0l8NJVYP+nI7NXy2ar4QqIGm69JfKPOE2w/mBavCzwM11R2D+ChsUO7hyUfmwx55qDM1xJvqZ7y08TpifuGBfjeURVJnNIVGpkNiXNS0ds7jcySDitDCCWW56LJ10fRo8sNA+3qXUSZD2CtQlZh9T+1rB7h9oliembflnMbzqgSNZKbKGHdPm7OwXb1CvQ1metSETMpszmzvikCJNh/h5E5PHNl4qga/+/cxqrdeWDYgIe7X5L4cGJPJX2940lOX8pD41FnFnc4riluvQKbK0dcHJFi2IBHNTQSlguru4d2/wPOTNzRA3x5y+U1E1uqWDkETOT026XuUJzx6u7ReLhSYenQ7uHua0fKZmwfmcPqsQjxE5WVONcRxn7X89zgn/EKPMRMxOVQXmP18Mx3q3b/Y/0cQE/IhFtHESMsHFlZ1Ml3CH3DZPHImY+pxcKumNmYirtvqMBfhMuU6s3iqOQkTsMPe1tCQwO8Ajs0lxr7W+vnp1MJc9EgCNd/cy6x+9D4veXmprj5wxMw/3C4egW6zzgZOlYZzfwo3F2J7ael0pJamvlPKgWNKFft1AAcKotXoFEbD7kaoSoQPVKB35+5KHF0lai/rJo+up87jWEE/qqqwY+qrL21LWLm95lPJ16ppKw31XC3PXYPJauPEx7B6BHCgrSizRs18qiaRp8tlN3ueCTYPHH9RNaunjI8Z7wLYpT3jZSCYXQ8e9vTsRE/q+no3XMKeObgGtaintbb/AvXj4JDkNw/5hrwYPfIvlZFUbLn7G5q+eQIN09Vnho6cqvnM/Lt99RixH49wO8K0ZL41WTWHoQzvsNVkOheZqKhEGpsp3SzB+BBtZAYve7uOR9tuTaaB6l0XScdYfEQPpkTUyHEGP+XqyDBzu+NBCITUjNWHynkrbWKOuWFn1xKzqsyx0bdvS78odp0+N503Zao0uCsWuSIDku8/7EO60b41vN5+Ses9BKlTdvd8bhp9EBvJjWJAIn/vxwHe6b3tSk6JFPV4nq85oAOrx555v/x/rh3E6Lo+bnuNS4uB4Cuq0ZfvO8X1rM6q/+vnjLVqZq7v83onttc2oYF4HPJmv1gWbB4P7s0l55ZsPhcsmY/WBYs3s8uzaVn5q3F/wf70mRuBCtbjQAAAABJRU5ErkJggg=="
}
},
"get_space_response": {
"summary": "Get details about a marketing space",
"value": {
"id": "marketing",
"name": "Marketing",
"description": "This is the Marketing Space",
"color": "null",
"initials": "MK",
"disabledFeatures": [ ],
"imageUrl": "",
"solution": "es"
}
},
"update_space_request": {
"summary": "Update a marketing space",
"description": "Update the marketing space to remove the imageUrl.",
"value": {
"id": "marketing",
"name": "Marketing",
"description": "This is the Marketing Space",
"color": "null",
"initials": "MK",
"disabledFeatures": [ ],
"imageUrl": ""
}
}
},
"securitySchemes": {
"apiKeyAuth": {
"type": "apiKey",
"description": "These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`\n",
"name": "Authorization",
"in": "header"
},
"basicAuth": {
"type": "http",
"scheme": "basic"
}
}
},
"security": [
{
"apiKeyAuth": [ ]
},
{
"basicAuth": [ ]
}
],
"tags": [
{
"name": "agent builder",
"description": "Agent Builder is a set of AI-powered capabilities for developing and interacting with agents that work with your Elasticsearch data.\n\nMost users will probably want to integrate with Agent Builder using MCP or A2A, but you can also work programmatically with tools, agents, and conversations using these Kibana APIs. Follow the [Agent Builder API tutorial](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-api-tutorial) for a guided example.\n\n**Elastic Agent Builder requires an Enterprise subscription.**\n",
"externalDocs": {
"description": "Agent Builder docs",
"url": "https://www.elastic.co/docs/solutions/search/agent-builder/programmatic-access"
},
"x-displayName": "Agent Builder"
},
{
"name": "alerting",
"description": "Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.\n",
"externalDocs": {
"description": "Alerting documentation",
"url": "https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts"
},
"x-displayName": "Alerting"
},
{
"name": "alerting-v2",
"description": "Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.\n",
"x-displayName": "Alerting V2"
},
{
"name": "APM agent configuration",
"description": "Adjust APM agent configuration without need to redeploy your application.\n"
},
{
"name": "APM agent keys",
"description": "Configure APM agent keys to authorize requests from APM agents to the APM Server.\n"
},
{
"name": "APM annotations",
"description": "Annotate visualizations in the APM app with significant events. Annotations enable you to easily see how events are impacting the performance of your applications.\n"
},
{
"name": "APM server schema",
"description": "Create APM fleet server schema."
},
{
"name": "APM sourcemaps",
"description": "Configure APM source maps. A source map allows minified files to be mapped back to original source code--allowing you to maintain the speed advantage of minified code, without losing the ability to quickly and easily debug your application.\nFor best results, uploading source maps should become a part of your deployment procedure, and not something you only do when you see unhelpful errors. That's because uploading source maps after errors happen won't make old errors magically readable--errors must occur again for source mapping to occur.\n"
},
{
"name": "cases",
"description": "Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.\n",
"externalDocs": {
"description": "Cases documentation",
"url": "https://www.elastic.co/docs/explore-analyze/alerts-cases/cases"
},
"x-displayName": "Cases"
},
{
"name": "connectors",
"description": "Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.\n",
"externalDocs": {
"description": "Connector documentation",
"url": "https://www.elastic.co/docs/reference/kibana/connectors-kibana"
},
"x-displayName": "Connectors"
},
{
"name": "context engine",
"description": "Use the Context Engine APIs to manage AI Indices, query them with ES|QL, and describe them for an agent. An AI Index attaches a name, sources, traces, and automations to a single data stream or index.\n\nIn each space, these APIs return a 404 until the `contextEngine:enabled` advanced setting is turned on for that space.\n",
"externalDocs": {
"description": "Context Engine documentation",
"url": "https://www.elastic.co/docs/explore-analyze/ai-features/context-engine"
},
"x-displayName": "Context Engine"
},
{
"name": "Dashboards",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**\n",
"externalDocs": {
"description": "Dashboards documentation",
"url": "https://www.elastic.co/docs/explore-analyze/dashboards"
},
"x-displayName": "Dashboards"
},
{
"name": "Data streams",
"description": "Data stream APIs enable you to manage data streams, which are collections of indices that share the same index template and are managed as a single unit for time-series data.\n",
"x-displayName": "Data streams"
},
{
"name": "data views",
"description": "Data view APIs enable you to manage data views, formerly known as Kibana index patterns.",
"x-displayName": "Data views"
},
{
"name": "Elastic Agent actions",
"description": "Elastic Agent actions APIs enable you to manage actions performed on Elastic Agents, including agent reassignment, diagnostics collection, enrollment management, upgrades, and bulk operations for agent lifecycle management.\n",
"x-displayName": "Elastic Agent actions"
},
{
"name": "Elastic Agent binary download sources",
"description": "Elastic Agent binary download sources APIs enable you to manage download sources for Elastic Agent binaries, including creating, updating, and deleting custom download sources for agent binaries.\n",
"x-displayName": "Elastic Agent binary download sources"
},
{
"name": "Elastic Agent policies",
"description": "Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.\n",
"x-displayName": "Elastic Agent policies"
},
{
"name": "Elastic Agent status",
"description": "Enables you to retrieve status information about Elastic Agents, including health summaries and operational status.\n",
"x-displayName": "Elastic Agent status"
},
{
"name": "Elastic Agents",
"description": "Elastic Agents APIs enable you to manage Elastic Agents, including retrieving agent information, managing agent lifecycle, handling file uploads, and initiating agent setup.\n",
"x-displayName": "Elastic Agents"
},
{
"name": "Elastic Package Manager (EPM)",
"description": "Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.\n",
"x-displayName": "Elastic Package Manager (EPM)"
},
{
"name": "Fleet agentless policies"
},
{
"name": "Fleet cloud connectors",
"description": "Fleet cloud connectors APIs enable you to manage Fleet cloud connectors, including creating, updating, and deleting cloud connector configurations for Fleet integrations.\n",
"x-displayName": "Fleet cloud connectors"
},
{
"name": "Fleet cloud onboarding deployments"
},
{
"name": "Fleet enrollment API keys",
"description": "Fleet enrollment API keys APIs enable you to manage enrollment API keys for Fleet, including creating, retrieving, and revoking API keys used for agent enrollment.\n",
"x-displayName": "Fleet enrollment API keys"
},
{
"name": "Fleet internals",
"description": "Fleet internals APIs enable you to manage Fleet internal operations, including checking permissions, monitoring Fleet Server health, managing settings, and initiating Fleet setup.\n",
"x-displayName": "Fleet internals"
},
{
"name": "Fleet managed integrations"
},
{
"name": "Fleet outputs",
"description": "Fleet outputs APIs enable you to manage Fleet outputs, including creating, updating, and deleting output configurations, generating Logstash API keys, and monitoring output health.\n",
"x-displayName": "Fleet outputs"
},
{
"name": "Fleet package policies",
"description": "Fleet package policies APIs enable you to manage Fleet package policies, including creating, updating, and deleting policies, performing bulk operations, and managing policy upgrades.\n",
"x-displayName": "Fleet package policies"
},
{
"name": "Fleet proxies",
"description": "Fleet proxies APIs enable you to manage Fleet proxies, including creating, updating, and deleting proxy configurations for Fleet agent communication.\n",
"x-displayName": "Fleet proxies"
},
{
"name": "Fleet remote synced integrations",
"description": "Use the Fleet remote synced integrations API to check the status of the automatic integrations synchronization on a remote cluster:\n* Use the `/api/fleet/remote_synced_integrations/{outputId}/remote_status` endpoint on the management cluster to query the synchronization status of the integrations installed on the remote cluster by the ID of the configured remote Elasticsearch output.\n* Use the `/api/fleet/remote_synced_integrations/status` endpoint on the remote cluster to query the synchronization status of the installed integrations.\n",
"externalDocs": {
"description": "Automatic integrations synchronization documentation",
"url": "https://www.elastic.co/docs/reference/fleet/automatic-integrations-synchronization"
}
},
{
"name": "Fleet Server hosts",
"description": "Fleet Server hosts APIs enable you to manage Fleet Server hosts, including creating, updating, and deleting Fleet Server host configurations.\n",
"x-displayName": "Fleet Server hosts"
},
{
"name": "Fleet service tokens",
"description": "Enables you to create tokens for Fleet service authentication and authorization.\n",
"x-displayName": "Fleet service tokens"
},
{
"name": "Fleet uninstall tokens",
"description": "Fleet uninstall tokens APIs enable you to manage Fleet uninstall tokens, including retrieving metadata and decrypted tokens for agent uninstallation.\n",
"x-displayName": "Fleet uninstall tokens"
},
{
"name": "Links"
},
{
"name": "logstash",
"description": "Programmatically integrate with Logstash configuration management.\n> warn\n> Do not directly access the `.logstash` index. The structure of the `.logstash` index is subject to change, which could cause your integration to break. Instead, use the Logstash configuration management APIs.\n",
"externalDocs": {
"description": "Centralized pipeline management",
"url": "https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management"
},
"x-displayName": "Logstash configuration management"
},
{
"name": "maintenance-window",
"description": "You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.\n",
"externalDocs": {
"description": "Maintenance window documentation",
"url": "https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts/maintenance-windows"
},
"x-displayName": "Maintenance windows"
},
{
"name": "Markdowns"
},
{
"name": "Message Signing Service",
"description": "Enables you to rotate message signing key pairs for secure Fleet communication.\n",
"x-displayName": "Fleet Message Signing Service"
},
{
"name": "ml",
"description": "Enables you to synchronize machine learning saved objects.\n",
"x-displayName": "Machine learning"
},
{
"name": "observability_ai_assistant",
"description": "Interact with the Observability AI Assistant resources.",
"externalDocs": {
"description": "Observability AI Assistant",
"url": "https://www.elastic.co/docs/solutions/observability/observability-ai-assistant"
},
"x-displayName": "Observability AI Assistant"
},
{
"name": "roles",
"description": "Manage the roles that grant Elasticsearch and Kibana privileges.",
"externalDocs": {
"description": "Kibana role management",
"url": "https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles"
},
"x-displayName": "Roles"
},
{
"name": "saved objects",
"description": "Export sets of saved objects that you want to import into Kibana, resolve import errors, and rotate an encryption key for encrypted saved objects with the saved objects APIs.\n\nTo manage a specific type of saved object, use the corresponding APIs.\nFor example, use:\n\n* [Data views](../group/endpoint-data-views)\n* [Spaces](../group/endpoint-spaces)\n* [Short URLs](../group/endpoint-short-url)\n\nWarning: Do not write documents directly to the `.kibana` index. When you write directly to the `.kibana` index, the data becomes corrupted and permanently breaks future Kibana versions.\n",
"x-displayName": "Saved objects"
},
{
"name": "Security AI Assistant API",
"description": "Manage and interact with Security Assistant resources.",
"x-displayName": "Security AI assistant"
},
{
"name": "Security Attack discovery API",
"description": "Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each \"discovery\" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.",
"x-displayName": "Security Attack discovery"
},
{
"name": "Security Detections API",
"description": "Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.\n\nThis API supports both key-based authentication and basic authentication.\n\nTo use key-based authentication, create an API key, then specify the key in the header of your API calls.\n\nTo use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.\n\nIn both cases, the API key is subsequently used for authorization when the rule runs.\n> warn\n> If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.\n\n> If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.\n\nTo create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.\n",
"x-displayName": "Security detections"
},
{
"name": "Security Endpoint Exceptions API",
"description": "Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.",
"x-displayName": "Security Elastic Endpoint exceptions"
},
{
"name": "Security Endpoint Management API",
"description": "Interact with and manage endpoints running the Elastic Defend integration.",
"x-displayName": "Security endpoint management"
},
{
"name": "Security Entity Analytics API",
"description": "Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.\n",
"x-displayName": "Security entity analytics"
},
{
"name": "Security entity store"
},
{
"name": "Security Exceptions API",
"description": "Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts.\n\nExceptions are made up of:\n\n* **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.\n* **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert.\n\nFor detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated.\n> info\n> You cannot use lists with endpoint rule exceptions.\n\n> info\n> Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container.\n\n## Exceptions requirements\n\nBefore you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).\n",
"x-displayName": "Security exceptions"
},
{
"name": "Security Lists API",
"description": "Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.\n\nLists are made up of:\n\n* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used:\n * `boolean`\n * `byte`\n * `date`\n * `date_nanos`\n * `date_range`\n * `double`\n * `double_range`\n * `float`\n * `float_range`\n * `half_float`\n * `integer`\n * `integer_range`\n * `ip`\n * `ip_range`\n * `keyword`\n * `long`\n * `long_range`\n * `short`\n * `text`\n* **List items**: The values used to determine whether the exception prevents an alert from being generated.\n\nAll list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:\n1. `192.168.1.1`\n2. `192.168.1.3`\n3. `192.168.1.18`\n4. `192.168.1.12`\n5. `192.168.1.7`\n\nTo use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.\n> info\n> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.\n\n## Lists requirements\n\nBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.\n",
"x-displayName": "Security lists"
},
{
"name": "Security Osquery API",
"description": "Run live queries, manage packs and saved queries.",
"x-displayName": "Security Osquery"
},
{
"name": "Security Solution Initialization API",
"description": "Use the initialization API to set up the assets Elastic Security needs to operate in a Kibana space.\n\nA single request can run one or more initialization flows. Each flow provisions a specific set of assets (for example, list indices, security data views, prebuilt detection rules, endpoint protection, AI prompts, or detection rule monitoring assets). The response reports a per-flow result so you can tell which flows completed and which returned an error.\n",
"x-displayName": "Security solution initialization"
},
{
"name": "Security Timeline API",
"description": "You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.",
"x-displayName": "Security timeline"
},
{
"name": "short url",
"description": "Manage Kibana short URLs.",
"x-displayName": "Short URLs"
},
{
"name": "slo",
"description": "SLO APIs enable you to define, manage and track service-level objectives",
"x-displayName": "Service level objectives"
},
{
"name": "spaces",
"description": "Manage your Kibana spaces.",
"externalDocs": {
"description": "Space overview",
"url": "https://www.elastic.co/docs/deploy-manage/manage-spaces"
},
"x-displayName": "Spaces"
},
{
"name": "streams",
"description": "Streams provide a unified data management layer for ingestion, routing, and processing. There are three stream types:\n* **Wired** streams are managed by Kibana. They route documents to child streams based on\n field conditions and support custom field mappings and processing steps.\n\n* **Classic** streams map to existing Elasticsearch data streams. You can add processing\n steps to classic streams without changing their underlying index template.\n\n* **Query** streams are virtual aggregations backed by an ES|QL expression. They aggregate\n data from multiple streams into a single logical view without duplicating documents.\n",
"externalDocs": {
"description": "Streams documentation",
"url": "https://www.elastic.co/docs/solutions/observability/streams/streams"
},
"x-displayName": "Streams"
},
{
"name": "synthetics",
"description": "Synthetics APIs enable you to check the status of your services and applications.",
"externalDocs": {
"description": "Synthetic monitoring",
"url": "https://www.elastic.co/docs/solutions/observability/synthetics"
},
"x-displayName": "Synthetics"
},
{
"name": "system",
"description": "Get information about the system status, resource usage, features, and installed plugins.\n",
"x-displayName": "System"
},
{
"name": "Tags"
},
{
"name": "task manager",
"description": "Task manager APIs enable you to check the health of the Kibana task manager, which is used by features such as alerting, actions, and reporting to run mission critical work as persistent background tasks.",
"externalDocs": {
"description": "Task manager",
"url": "https://www.elastic.co/docs/deploy-manage/distributed-architecture/kibana-tasks-management"
},
"x-displayName": "Task manager"
},
{
"name": "Universal Profiling",
"description": "Universal Profiling provides whole-system, always-on, continuous profiling with zero instrumentation. Use these APIs to check whether the Elasticsearch resources Universal Profiling depends on are set up, and to set them up. Universal Profiling is available on Elastic Cloud Hosted and self-managed deployments.\n",
"externalDocs": {
"description": "Universal Profiling documentation",
"url": "https://www.elastic.co/docs/solutions/observability/infra-and-hosts/universal-profiling"
},
"x-displayName": "Universal Profiling"
},
{
"name": "upgrade",
"description": "The Kibana Upgrade Assistant API helps you prepare for the next major Elasticsearch release.\n> warn\n> This is a Kibana REST API (not an Elasticsearch API) and requests must target your Kibana URL:\n> * Self-managed URL pattern: `https://localhost:5601`\n> * Elastic Cloud URL pattern: `https://your-deployment.kb.us-east-1.aws.elastic.cloud:9243`\n",
"x-displayName": "Upgrade assistant"
},
{
"name": "uptime",
"description": "Uptime APIs enable you to view and update uptime monitoring settings.",
"externalDocs": {
"description": "Uptime monitoring",
"url": "https://www.elastic.co/docs/solutions/observability/uptime"
},
"x-displayName": "Uptime"
},
{
"name": "user session",
"description": "Enables you to invalidate user sessions for security and session management purposes.\n",
"x-displayName": "User session management"
},
{
"name": "Visualizations",
"description": "> This documentation is temporarily hosted at a separate location.\n>\n> **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**\n",
"externalDocs": {
"description": "Visualizations documentation",
"url": "https://www.elastic.co/docs/explore-analyze/visualize/lens"
},
"x-displayName": "Visualizations"
},
{
"name": "workflows",
"description": "Workflows enable you to automate multi-step processes directly in Kibana. Define sequences of steps in YAML to transform data insights into automated actions and outcomes, without needing external automation tools.\n\nUse the workflows APIs to create, manage, and run workflows programmatically. You can also search, export, import, and monitor workflow executions.\n",
"externalDocs": {
"description": "Workflows documentation",
"url": "https://www.elastic.co/docs/explore-analyze/workflows"
},
"x-displayName": "Workflows"
}
],
"x-topics": [
{
"title": "Kibana spaces",
"content": "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"
}
]
}