Run a connector
https://{kibana_url}
- POST /api/actions/connector/{id}/_execute
- POST /s/{space_id}/api/actions/connector/{id}/_execute
Refer to Spaces for more information.
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
Path Parameters
-
idstringrequired -
An identifier for the connector.
Request
-
paramsoneOfrequired -
dedupKeystring · max: 255required -
The deduplication key for the PagerDuty alert.
-
documentsobjectrequired -
The documents in JSON format for index connectors.
-
bccstring -
A list of "blind carbon copy" email addresses. Addresses can be specified in
user@host-nameformat or in name<user@host-name>format -
ccstring -
A list of "carbon copy" email addresses. Addresses can be specified in
user@host-nameformat or in name<user@host-name>format -
messagestringrequired -
The email message text. Markdown format is supported.
-
subjectstringrequired -
The subject line of the email.
-
tostring -
A list of email addresses. Addresses can be specified in
user@host-nameformat or in name<user@host-name>format. -
messagestringrequired -
The Slack message text, which cannot contain Markdown, images, or other advanced formatting.
-
classstring -
The class or type of the event.
-
componentstring -
The component of the source machine that is responsible for the event.
-
customDetailsobject -
Additional details to add to the event.
-
dedupKeystring · max: 255 -
All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.
-
groupstring -
The logical grouping of components of a service.
-
linksobject -
A list of links to add to the event.
-
severity· default: info -
The severity of the event on the affected system.
-
Values:
criticalerrorinfowarning -
sourcestring -
The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.
-
summarystring · max: 1024 -
A summery of the event.
-
timestampstring -
An ISO-8601 timestamp that indicates when the event was detected or generated.
-
subActionParamsobject -
The set of configuration properties for the action.
-
additional_infostring -
Additional information about the event.
-
descriptionstring -
The details about the event.
-
event_classstring -
A specific instance of the source.
-
message_keystring -
All actions sharing this key are associated with the same ServiceNow alert. The default value is
<rule ID>:<alert instance ID>. -
metric_namestring -
The name of the metric.
-
nodestring -
The host that the event was triggered for.
-
resourcestring -
The name of the resource.
-
severitystring -
The severity of the event.
-
sourcestring -
The name of the event source type.
-
time_of_eventstring -
The time of the event.
-
typestring -
The type of event.
-
subActionParamsobjectrequired -
aliasstringrequired -
The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
-
notestring -
Additional information for the alert.
-
sourcestring -
The display name for the source of the alert.
-
userstring -
The display name for the owner.
-
subActionParamsobjectrequired -
incidentobjectrequired -
correlation_idstring · max: 100 · default: {{rule.id}}:{{alert.id}}nullable -
An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
-
externalIdstringnullable -
The unique identifier (
incidentId) for the incident in ServiceNow. -
subActionParamsobjectrequired -
actionsstring -
The custom actions available to the alert in Opsgenie connectors.
-
aliasstring -
The unique identifier used for alert deduplication in Opsgenie.
-
descriptionstring -
A description that provides detailed information about the alert.
-
detailsobject -
The custom properties of the alert in Opsgenie connectors.
-
entitystring -
The domain of the alert in Opsgenie connectors. For example, the application or server name.
-
messagestring -
The alert message in Opsgenie connectors.
-
notestring -
Additional information for the alert in Opsgenie connectors.
-
respondersobject -
The entities to receive notifications about the alert in Opsgenie connectors. If
typeisuser, eitheridorusernameis required. Iftypeisteam, eitheridornameis required. -
severityinteger · min: 1 · max: 4 -
The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
-
sourcestring -
The display name for the source of the alert in Opsgenie and TheHive connectors.
-
sourceRefstring -
A source reference for the alert in TheHive connectors.
-
The tags for the alert in Opsgenie and TheHive connectors.
-
titlestring -
A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.
-
tlpinteger · min: 0 · max: 4 · default: 2 -
The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
-
typestring -
The type of alert in TheHive connectors.
-
userstring -
The display name for the owner.
-
visibleToobject -
The teams and users that the alert will be visible to without sending a notification. Only one of
id,name, orusernameis required. -
subActionParamsobjectrequired -
idstringrequired -
The Jira issue type identifier.
-
subActionParamsobjectrequired -
The set of configuration properties for the action.
-
idsstringrequired -
An array of CrowdStrike agent identifiers.
-
subActionParamsobjectrequired -
The set of configuration properties for the action.
-
fieldsstringrequired -
An array of fields.
-
subActionParamsobjectrequired -
externalIdstringrequired -
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
-
subActionParamsobject -
idstringrequired -
The Jira issue identifier.
-
subActionParamsobjectrequired -
titlestringrequired -
The title of the Jira issue.
-
subActionParamsobjectrequired -
The set of configuration properties for the action.
-
channelIdsstring · max: 1 -
The Slack channel identifier, which must be one of the
allowedChannelsin the connector configuration. -
channelsstring · max: 1deprecated -
The name of a channel that your Slack app has access to.
-
textstring · min: 1 -
The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.
-
subActionParamsobjectrequired -
The set of configuration properties for the action.
-
commentsobject -
Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.
-
incidentobject -
Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.
-
additional_fieldsstring · max: 20nullable -
Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.
-
alertIdstring -
The alert identifier for Swimlane connectors.
-
caseIdstring -
The case identifier for the incident for Swimlane connectors.
-
caseNamestring -
The case name for the incident for Swimlane connectors.
-
categorystring -
The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
correlation_displaystring -
A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
-
correlation_idstring -
The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as
{{ruleID}}`:`{{alert ID}}to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of{{ruleID}}`:`{{alert ID}}ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. -
descriptionstring -
The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
-
dest_ipstring | string -
A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
-
externalIdstring -
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
-
idstring -
The external case identifier for Webhook - Case Management connectors.
-
impactstring -
The impact of the incident for ServiceNow ITSM connectors.
-
issueTypeinteger -
The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set
subActiontoissueTypes. -
labelsstring -
The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
-
malware_hashstring | string -
A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
-
malware_urlstring | string -
A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
-
otherFieldsobject -
Custom field identifiers and their values for Jira connectors.
-
parentstring -
The ID or key of the parent issue for Jira connectors. Applies only to
Sub-tasktypes of issues. -
prioritystring -
The priority of the incident in Jira and ServiceNow SecOps connectors.
-
ruleNamestring -
The rule name for Swimlane connectors.
-
severityinteger -
The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
-
short_descriptionstring -
A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
-
source_ipstring | string -
A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
-
statusstring -
The status of the incident for Webhook - Case Management connectors.
-
subcategorystring -
The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
summarystring -
A summary of the incident for Jira connectors.
-
A list of tags for TheHive and Webhook - Case Management connectors.
-
titlestring -
A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.
-
tlpinteger · min: 0 · max: 4 · default: 2 -
The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
-
urgencystring -
The urgency of the incident for ServiceNow ITSM connectors.
-
subActionParamsobjectrequired -
channelIdstringrequired -
The Slack channel identifier.
Test an action that acknowledges or resolves a PagerDuty alert.
Test an action that indexes a document into Elasticsearch.
Test an action that sends an email message. There must be at least one recipient in to, cc, or bcc.
Test an action that writes an entry to the Kibana server log.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack.
Test an action that triggers a PagerDuty alert.
The addEvent subaction for ServiceNow ITOM connectors.
The closeAlert subaction for Opsgenie connectors.
The closeIncident subaction for ServiceNow ITSM connectors.
The createAlert subaction for Opsgenie and TheHive connectors.
The fieldsByIssueType subaction for Jira connectors.
The getAgentDetails subaction for CrowdStrike connectors.
The getAgents subaction for SentinelOne connectors.
The getChoices subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
The getFields subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
The getIncident subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
The issue subaction for Jira connectors.
The issues subaction for Jira connectors.
The issueTypes subaction for Jira connectors.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack_api.
The pushToService subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is .slack_api.
Responses
Indicates a successful call.
-
configmap string to object -
connector_type_idstringrequired -
The connector type identifier.
-
idstringrequired -
The identifier for the connector.
-
is_connector_type_deprecatedbooleanrequired -
Indicates whether the connector type is deprecated.
-
is_deprecatedbooleanrequired -
Indicates whether the connector is deprecated.
-
is_missing_secretsboolean -
Indicates whether the connector is missing secrets.
-
is_preconfiguredbooleanrequired -
Indicates whether the connector is preconfigured. If true, the
configandis_missing_secretsproperties are omitted from the response. -
is_system_actionbooleanrequired -
Indicates whether the connector is used for system actions.
-
namestringrequired -
The name of the connector.
Indicates that this call is forbidden.