{ "openapi": "3.1.2", "info": { "title": "Kibana APIs", "description": "The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.\nThe API calls are stateless.\nEach request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the\nrequest.\nAPI requests return JSON output, which is a format that is machine-readable and works well for automation.\n\nTo interact with Kibana APIs, use the following operations:\n\n- GET: Fetches the information.\n- PATCH: Applies partial modifications to the existing information.\n- POST: Adds new information.\n- PUT: Updates the existing information.\n- DELETE: Removes the information.\n\nYou can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.\nFor example:\n\n```\nGET kbn:/api/data_views\n```\n\nFor more information about the console, refer to [Run API requests](https://www.elastic.co/guide/en/kibana/current/console-kibana.html).\n\nNOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.\n\n## Documentation source and versions\n\nThis documentation is derived from the `8.19` branch of the [kibana](https://github.com/elastic/kibana) repository.\nIt is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).\n\nThis documentation contains work-in-progress information for future Elastic Stack releases.\n", "contact": { "name": "Kibana Team" }, "version": "", "x-doc-license": { "name": "Attribution-NonCommercial-NoDerivatives 4.0 International", "url": "https://creativecommons.org/licenses/by-nc-nd/4.0/" }, "x-feedbackLink": { "label": "Feedback", "url": "https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+" } }, "servers": [ { "url": "https://{kibana_url}", "variables": { "kibana_url": { "default": "localhost:5601" } } } ], "paths": { "/api/actions": { "get": { "tags": [ "connectors" ], "summary": "Get all connectors", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/actions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-actions", "responses": { "200": { "description": "OK: A successful request." } }, "deprecated": true } }, "/api/actions/action": { "post": { "tags": [ "connectors" ], "summary": "Create a connector", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/actions/action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-actions-action", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "actionTypeId" ], "type": "object", "properties": { "actionTypeId": { "type": "string", "description": "The connector type identifier." }, "config": { "type": "object", "additionalProperties": { } }, "name": { "type": "string", "description": "The display name for the connector." }, "secrets": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false } } } } }, "deprecated": true } }, "/api/actions/action/{id}": { "delete": { "tags": [ "connectors" ], "summary": "Delete a connector", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/actions/action/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: When you delete a connector, it cannot be recovered.", "operationId": "delete-actions-action-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." } }, "deprecated": true }, "get": { "tags": [ "connectors" ], "summary": "Get connector information", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/actions/action/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-actions-action-id", "parameters": [ { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false } } } } }, "deprecated": true }, "put": { "tags": [ "connectors" ], "summary": "Update a connector", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/actions/action/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "put-actions-action-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "name": { "type": "string" }, "secrets": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false } } } } }, "deprecated": true } }, "/api/actions/action/{id}/_execute": { "post": { "tags": [ "connectors" ], "summary": "Run a connector", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/actions/action/{id}/_execute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-actions-action-id-execute", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "params" ], "type": "object", "properties": { "params": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false } } } } }, "deprecated": true } }, "/api/actions/connector_types": { "get": { "tags": [ "connectors" ], "summary": "Get connector types", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/actions/connector_types
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou do not need any Kibana feature privileges to run this API.", "operationId": "get-actions-connector-types", "parameters": [ { "name": "feature_id", "in": "query", "description": "A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).", "schema": { "maxLength": 100, "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getConnectorTypesServerlessResponse": { "$ref": "#/components/examples/get_connector_types_generativeai_response" } } } } } } } }, "/api/actions/connector/{id}": { "delete": { "tags": [ "connectors" ], "summary": "Delete a connector", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/actions/connector/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: When you delete a connector, it cannot be recovered.", "operationId": "delete-actions-connector-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." } } }, "get": { "tags": [ "connectors" ], "summary": "Get connector information", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/actions/connector/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-actions-connector-id", "parameters": [ { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false }, "examples": { "getConnectorResponse": { "$ref": "#/components/examples/get_connector_response" } } } } } } }, "post": { "tags": [ "connectors" ], "summary": "Create a connector", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/actions/connector/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-actions-connector-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "connector_type_id" ], "type": "object", "properties": { "connector_type_id": { "type": "string", "description": "The type of connector." }, "name": { "type": "string", "description": "The display name for the connector." }, "config": { "oneOf": [ { "$ref": "#/components/schemas/bedrock_config" }, { "$ref": "#/components/schemas/crowdstrike_config" }, { "$ref": "#/components/schemas/d3security_config" }, { "$ref": "#/components/schemas/email_config" }, { "$ref": "#/components/schemas/gemini_config" }, { "$ref": "#/components/schemas/resilient_config" }, { "$ref": "#/components/schemas/index_config" }, { "$ref": "#/components/schemas/jira_config" }, { "$ref": "#/components/schemas/genai_azure_config" }, { "$ref": "#/components/schemas/genai_openai_config" }, { "$ref": "#/components/schemas/genai_openai_other_config" }, { "$ref": "#/components/schemas/opsgenie_config" }, { "$ref": "#/components/schemas/pagerduty_config" }, { "$ref": "#/components/schemas/sentinelone_config" }, { "$ref": "#/components/schemas/servicenow_config" }, { "$ref": "#/components/schemas/servicenow_itom_config" }, { "$ref": "#/components/schemas/slack_api_config" }, { "$ref": "#/components/schemas/swimlane_config" }, { "$ref": "#/components/schemas/thehive_config" }, { "$ref": "#/components/schemas/tines_config" }, { "$ref": "#/components/schemas/torq_config" }, { "$ref": "#/components/schemas/webhook_config" }, { "$ref": "#/components/schemas/cases_webhook_config" }, { "$ref": "#/components/schemas/xmatters_config" } ], "additionalProperties": { }, "description": "The connector configuration details." }, "secrets": { "oneOf": [ { "$ref": "#/components/schemas/bedrock_secrets" }, { "$ref": "#/components/schemas/crowdstrike_secrets" }, { "$ref": "#/components/schemas/d3security_secrets" }, { "$ref": "#/components/schemas/email_secrets" }, { "$ref": "#/components/schemas/gemini_secrets" }, { "$ref": "#/components/schemas/resilient_secrets" }, { "$ref": "#/components/schemas/jira_secrets" }, { "$ref": "#/components/schemas/defender_secrets" }, { "$ref": "#/components/schemas/teams_secrets" }, { "$ref": "#/components/schemas/genai_secrets" }, { "$ref": "#/components/schemas/opsgenie_secrets" }, { "$ref": "#/components/schemas/pagerduty_secrets" }, { "$ref": "#/components/schemas/sentinelone_secrets" }, { "$ref": "#/components/schemas/servicenow_secrets" }, { "$ref": "#/components/schemas/slack_api_secrets" }, { "$ref": "#/components/schemas/swimlane_secrets" }, { "$ref": "#/components/schemas/thehive_secrets" }, { "$ref": "#/components/schemas/tines_secrets" }, { "$ref": "#/components/schemas/torq_secrets" }, { "$ref": "#/components/schemas/webhook_secrets" }, { "$ref": "#/components/schemas/cases_webhook_secrets" }, { "$ref": "#/components/schemas/xmatters_secrets" } ], "additionalProperties": { } } }, "additionalProperties": false }, "examples": { "createEmailConnectorRequest": { "$ref": "#/components/examples/create_email_connector_request" }, "createIndexConnectorRequest": { "$ref": "#/components/examples/create_index_connector_request" }, "createWebhookConnectorRequest": { "$ref": "#/components/examples/create_webhook_connector_request" }, "createXmattersConnectorRequest": { "$ref": "#/components/examples/create_xmatters_connector_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false }, "examples": { "createEmailConnectorResponse": { "$ref": "#/components/examples/create_email_connector_response" }, "createIndexConnectorResponse": { "$ref": "#/components/examples/create_index_connector_response" }, "createWebhookConnectorResponse": { "$ref": "#/components/examples/create_webhook_connector_response" }, "createXmattersConnectorResponse": { "$ref": "#/components/examples/get_connector_response" } } } } } } }, "put": { "tags": [ "connectors" ], "summary": "Update a connector", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/actions/connector/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "put-actions-connector-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name" ], "type": "object", "properties": { "name": { "type": "string", "description": "The display name for the connector." }, "config": { "oneOf": [ { "$ref": "#/components/schemas/bedrock_config" }, { "$ref": "#/components/schemas/crowdstrike_config" }, { "$ref": "#/components/schemas/d3security_config" }, { "$ref": "#/components/schemas/email_config" }, { "$ref": "#/components/schemas/gemini_config" }, { "$ref": "#/components/schemas/resilient_config" }, { "$ref": "#/components/schemas/index_config" }, { "$ref": "#/components/schemas/jira_config" }, { "$ref": "#/components/schemas/defender_config" }, { "$ref": "#/components/schemas/genai_azure_config" }, { "$ref": "#/components/schemas/genai_openai_config" }, { "$ref": "#/components/schemas/opsgenie_config" }, { "$ref": "#/components/schemas/pagerduty_config" }, { "$ref": "#/components/schemas/sentinelone_config" }, { "$ref": "#/components/schemas/servicenow_config" }, { "$ref": "#/components/schemas/servicenow_itom_config" }, { "$ref": "#/components/schemas/slack_api_config" }, { "$ref": "#/components/schemas/swimlane_config" }, { "$ref": "#/components/schemas/thehive_config" }, { "$ref": "#/components/schemas/tines_config" }, { "$ref": "#/components/schemas/torq_config" }, { "$ref": "#/components/schemas/webhook_config" }, { "$ref": "#/components/schemas/cases_webhook_config" }, { "$ref": "#/components/schemas/xmatters_config" } ], "additionalProperties": { }, "description": "The connector configuration details." }, "secrets": { "oneOf": [ { "$ref": "#/components/schemas/bedrock_secrets" }, { "$ref": "#/components/schemas/crowdstrike_secrets" }, { "$ref": "#/components/schemas/d3security_secrets" }, { "$ref": "#/components/schemas/email_secrets" }, { "$ref": "#/components/schemas/gemini_secrets" }, { "$ref": "#/components/schemas/resilient_secrets" }, { "$ref": "#/components/schemas/jira_secrets" }, { "$ref": "#/components/schemas/teams_secrets" }, { "$ref": "#/components/schemas/genai_secrets" }, { "$ref": "#/components/schemas/opsgenie_secrets" }, { "$ref": "#/components/schemas/pagerduty_secrets" }, { "$ref": "#/components/schemas/sentinelone_secrets" }, { "$ref": "#/components/schemas/servicenow_secrets" }, { "$ref": "#/components/schemas/slack_api_secrets" }, { "$ref": "#/components/schemas/swimlane_secrets" }, { "$ref": "#/components/schemas/thehive_secrets" }, { "$ref": "#/components/schemas/tines_secrets" }, { "$ref": "#/components/schemas/torq_secrets" }, { "$ref": "#/components/schemas/webhook_secrets" }, { "$ref": "#/components/schemas/cases_webhook_secrets" }, { "$ref": "#/components/schemas/xmatters_secrets" } ], "additionalProperties": { } } }, "additionalProperties": false }, "examples": { "updateIndexConnectorRequest": { "$ref": "#/components/examples/update_index_connector_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false } } } } } } }, "/api/actions/connector/{id}/_execute": { "post": { "tags": [ "connectors" ], "summary": "Run a connector", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/actions/connector/{id}/_execute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.", "operationId": "post-actions-connector-id-execute", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "An identifier for the connector.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "params" ], "type": "object", "properties": { "params": { "oneOf": [ { "$ref": "#/components/schemas/run_acknowledge_resolve_pagerduty" }, { "$ref": "#/components/schemas/run_documents" }, { "$ref": "#/components/schemas/run_message_email" }, { "$ref": "#/components/schemas/run_message_serverlog" }, { "$ref": "#/components/schemas/run_message_slack" }, { "$ref": "#/components/schemas/run_trigger_pagerduty" }, { "$ref": "#/components/schemas/run_addevent" }, { "$ref": "#/components/schemas/run_closealert" }, { "$ref": "#/components/schemas/run_closeincident" }, { "$ref": "#/components/schemas/run_createalert" }, { "$ref": "#/components/schemas/run_fieldsbyissuetype" }, { "$ref": "#/components/schemas/run_getagentdetails" }, { "$ref": "#/components/schemas/run_getagents" }, { "$ref": "#/components/schemas/run_getchoices" }, { "$ref": "#/components/schemas/run_getfields" }, { "$ref": "#/components/schemas/run_getincident" }, { "$ref": "#/components/schemas/run_issue" }, { "$ref": "#/components/schemas/run_issues" }, { "$ref": "#/components/schemas/run_issuetypes" }, { "$ref": "#/components/schemas/run_postmessage" }, { "$ref": "#/components/schemas/run_pushtoservice" }, { "$ref": "#/components/schemas/run_validchannelid" } ], "additionalProperties": { } } }, "additionalProperties": false }, "examples": { "runIndexConnectorRequest": { "$ref": "#/components/examples/run_index_connector_request" }, "runJiraConnectorRequest": { "$ref": "#/components/examples/run_jira_connector_request" }, "runServerLogConnectorRequest": { "$ref": "#/components/examples/run_servicenow_itom_connector_request" }, "runSlackConnectorRequest": { "$ref": "#/components/examples/run_slack_api_connector_request" }, "runSwimlaneConnectorRequest": { "$ref": "#/components/examples/run_swimlane_connector_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "name", "connector_type_id", "is_preconfigured", "is_deprecated", "is_system_action" ], "type": "object", "properties": { "config": { "type": "object", "additionalProperties": { } }, "connector_type_id": { "type": "string", "description": "The connector type identifier." }, "id": { "type": "string", "description": "The identifier for the connector." }, "is_deprecated": { "type": "boolean", "description": "Indicates whether the connector is deprecated." }, "is_missing_secrets": { "type": "boolean", "description": "Indicates whether the connector is missing secrets." }, "is_preconfigured": { "type": "boolean", "description": "Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. " }, "is_system_action": { "type": "boolean", "description": "Indicates whether the connector is used for system actions." }, "name": { "type": "string", "description": " The name of the rule." } }, "additionalProperties": false }, "examples": { "runIndexConnectorResponse": { "$ref": "#/components/examples/run_index_connector_response" }, "runJiraConnectorResponse": { "$ref": "#/components/examples/run_jira_connector_response" }, "runServerLogConnectorResponse": { "$ref": "#/components/examples/run_server_log_connector_response" }, "runServiceNowITOMConnectorResponse": { "$ref": "#/components/examples/run_servicenow_itom_connector_response" }, "runSlackConnectorResponse": { "$ref": "#/components/examples/run_slack_api_connector_response" }, "runSwimlaneConnectorResponse": { "$ref": "#/components/examples/run_swimlane_connector_response" } } } } } } } }, "/api/actions/connectors": { "get": { "tags": [ "connectors" ], "summary": "Get all connectors", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/actions/connectors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-actions-connectors", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getConnectorsResponse": { "$ref": "#/components/examples/get_connectors_response" } } } } } } } }, "/api/actions/list_action_types": { "get": { "tags": [ "connectors" ], "summary": "Get connector types", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/actions/list_action_types
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-actions-list-action-types", "responses": { "200": { "description": "OK: A successful request." } }, "deprecated": true } }, "/api/alerting/_health": { "get": { "tags": [ "alerting" ], "summary": "Get the alerting framework health", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerting/_health
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Management > Stack Rules** feature or for at least one of the **Analytics > Discover**, **Analytics > Machine Learning**, **Observability**, or **Security** features.\n", "operationId": "getAlertingHealth", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "alerting_framework_health": { "type": "object", "properties": { "decryption_health": { "type": "object", "properties": { "status": { "enum": [ "error", "ok", "warn" ], "type": "string", "example": "ok" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-01-13T01:28:00.280Z" } }, "description": "The timestamp and status of the rule decryption." }, "execution_health": { "type": "object", "properties": { "status": { "enum": [ "error", "ok", "warn" ], "type": "string", "example": "ok" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-01-13T01:28:00.280Z" } }, "description": "The timestamp and status of the rule run." }, "read_health": { "type": "object", "properties": { "status": { "enum": [ "error", "ok", "warn" ], "type": "string", "example": "ok" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-01-13T01:28:00.280Z" } }, "description": "The timestamp and status of the rule reading events." } }, "description": "Three substates identify the health of the alerting framework: `decryption_health`, `execution_health`, and `read_health`.\n" }, "has_permanent_encryption_key": { "type": "boolean", "description": "If `false`, the encrypted saved object plugin does not have a permanent encryption key.", "example": true }, "is_sufficiently_secure": { "type": "boolean", "description": "If `false`, security is enabled but TLS is not.", "example": true } } }, "examples": { "getAlertingHealthResponse": { "$ref": "#/components/examples/Alerting_get_health_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } } } }, "/api/alerting/rule_types": { "get": { "tags": [ "alerting" ], "summary": "Get the rule types", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerting/rule_types
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nIf you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the **Management > Stack Rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, and **Security** features. To get rule types associated with the **Stack Monitoring** feature, use the `monitoring_user` built-in role.\n", "operationId": "getRuleTypes", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "action_groups": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "description": "An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.\n" }, "action_variables": { "type": "object", "properties": { "context": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" }, "useWithTripleBracesInTemplates": { "type": "boolean" } } } }, "params": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" } } } }, "state": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" } } } } }, "description": "A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.\n" }, "alerts": { "type": "object", "properties": { "context": { "enum": [ "ml.anomaly-detection", "observability.apm", "observability.logs", "observability.metrics", "observability.slo", "observability.threshold", "observability.uptime", "security", "stack" ], "type": "string", "description": "The namespace for this rule type.\n" }, "dynamic": { "enum": [ "false", "runtime", "strict", "true" ], "type": "string", "description": "Indicates whether new fields are added dynamically." }, "isSpaceAware": { "type": "boolean", "description": "Indicates whether the alerts are space-aware. If true, space-specific alert indices are used.\n" }, "mappings": { "type": "object", "properties": { "fieldMap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Alerting_fieldmap_properties" }, "description": "Mapping information for each field supported in alerts as data documents for this rule type. For more information about mapping parameters, refer to the Elasticsearch documentation.\n" } } }, "secondaryAlias": { "type": "string", "description": "A secondary alias. It is typically used to support the signals alias for detection rules.\n" }, "shouldWrite": { "type": "boolean", "description": "Indicates whether the rule should write out alerts as data.\n" }, "useEcs": { "type": "boolean", "description": "Indicates whether to include the ECS component template for the alerts.\n" }, "useLegacyAlerts": { "type": "boolean", "description": "Indicates whether to include the legacy component template for the alerts.\n", "default": false } }, "description": "Details for writing alerts as data documents for this rule type.\n" }, "authorized_consumers": { "type": "object", "properties": { "alerts": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "apm": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "discover": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "infrastructure": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "logs": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "ml": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "monitoring": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "siem": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "slo": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "stackAlerts": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } }, "uptime": { "type": "object", "properties": { "all": { "type": "boolean" }, "read": { "type": "boolean" } } } }, "description": "The list of the plugins IDs that have access to the rule type." }, "category": { "enum": [ "management", "observability", "securitySolution" ], "type": "string", "description": "The rule category, which is used by features such as category-specific maintenance windows." }, "default_action_group_id": { "type": "string", "description": "The default identifier for the rule type group." }, "does_set_recovery_context": { "type": "boolean", "description": "Indicates whether the rule passes context variables to its recovery action." }, "enabled_in_license": { "type": "boolean", "description": "Indicates whether the rule type is enabled or disabled based on the subscription." }, "has_alerts_mappings": { "type": "boolean", "description": "Indicates whether the rule type has custom mappings for the alert data." }, "has_fields_for_a_a_d": { "type": "boolean" }, "id": { "type": "string", "description": "The unique identifier for the rule type." }, "is_exportable": { "type": "boolean", "description": "Indicates whether the rule type is exportable in **Stack Management > Saved Objects**." }, "minimum_license_required": { "type": "string", "description": "The subscriptions required to use the rule type.", "example": "basic" }, "name": { "type": "string", "description": "The descriptive name of the rule type." }, "producer": { "type": "string", "description": "An identifier for the application that produces this rule type.", "example": "stackAlerts" }, "recovery_action_group": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "description": "An action group to use when an alert goes from an active state to an inactive one." }, "rule_task_timeout": { "type": "string", "example": "5m" } } } }, "examples": { "getRuleTypesResponse": { "$ref": "#/components/examples/Alerting_get_rule_types_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } } } }, "/api/alerting/rule/{id}": { "delete": { "tags": [ "alerting" ], "summary": "Delete a rule", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/alerting/rule/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-alerting-rule-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." } } }, "get": { "tags": [ "alerting" ], "summary": "Get rule details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerting/rule/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-alerting-rule-id", "parameters": [ { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "enabled", "name", "tags", "rule_type_id", "consumer", "schedule", "actions", "params", "created_by", "updated_by", "created_at", "updated_at", "api_key_owner", "mute_all", "muted_alert_ids", "execution_status", "revision" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "id", "connector_type_id", "params" ], "type": "object", "properties": { "alerts_filter": { "type": "object", "properties": { "query": { "required": [ "kql", "filters" ], "type": "object", "properties": { "dsl": { "type": "string", "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)." }, "filters": { "type": "array", "items": { "required": [ "meta" ], "type": "object", "properties": { "$state": { "required": [ "store" ], "type": "object", "properties": { "store": { "enum": [ "appState", "globalState" ], "type": "string", "description": "A filter can be either specific to an application context or applied globally." } }, "additionalProperties": false }, "meta": { "type": "object", "additionalProperties": { } }, "query": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false }, "timeframe": { "required": [ "days", "hours", "timezone" ], "type": "object", "properties": { "days": { "type": "array", "items": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer" }, "description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week." }, "hours": { "required": [ "start", "end" ], "type": "object", "properties": { "end": { "type": "string", "description": "The end of the time frame in 24-hour notation (`hh:mm`)." }, "start": { "type": "string", "description": "The start of the time frame in 24-hour notation (`hh:mm`)." } }, "additionalProperties": false }, "timezone": { "type": "string", "description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Defines a period that limits whether the action runs." }, "connector_type_id": { "type": "string", "description": "The type of connector. This property appears in responses but cannot be set in requests." }, "frequency": { "required": [ "summary", "notify_when", "throttle" ], "type": "object", "properties": { "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "summary": { "type": "boolean", "description": "Indicates whether the action is a summary." }, "throttle": { "type": [ "null", "string" ], "description": "The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "additionalProperties": false } }, "active_snoozes": { "type": "array", "items": { "type": "string", "description": "List of active snoozes for the rule." } }, "alert_delay": { "required": [ "active" ], "type": "object", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "additionalProperties": false, "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions." }, "api_key_created_by_user": { "type": [ "null", "boolean" ], "description": "Indicates whether the API key that is associated with the rule was created by the user." }, "api_key_owner": { "type": [ "null", "string" ], "description": "The owner of the API key that is associated with the rule and used to run background tasks." }, "artifacts": { "type": "object", "properties": { "dashboards": { "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } }, "additionalProperties": false } }, "investigation_guide": { "required": [ "blob" ], "type": "object", "properties": { "blob": { "type": "string", "description": "User-created content that describes alert causes and remdiation." } }, "additionalProperties": false } }, "additionalProperties": false }, "consumer": { "type": "string", "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`." }, "created_at": { "type": "string", "description": "The date and time that the rule was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the rule." }, "enabled": { "type": "boolean", "description": "Indicates whether you want to run the rule on an interval basis after it is created." }, "execution_status": { "required": [ "status", "last_execution_date" ], "type": "object", "properties": { "error": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Error message." }, "reason": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate" ], "type": "string", "description": "Reason for error." } }, "additionalProperties": false }, "last_duration": { "type": "number", "description": "Duration of last execution of the rule." }, "last_execution_date": { "type": "string", "description": "The date and time when rule was executed last." }, "status": { "enum": [ "ok", "active", "error", "warning", "pending", "unknown" ], "type": "string", "description": "Status of rule execution." }, "warning": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Warning message." }, "reason": { "enum": [ "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": "string", "description": "Reason for warning." } }, "additionalProperties": false } }, "additionalProperties": false }, "flapping": { "required": [ "look_back_window", "status_change_threshold" ], "type": [ "null", "object" ], "properties": { "look_back_window": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "additionalProperties": false, "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced." }, "id": { "type": "string", "description": "The identifier for the rule." }, "is_snoozed_until": { "type": [ "null", "string" ], "description": "The date when the rule will no longer be snoozed." }, "last_run": { "required": [ "outcome", "alerts_count" ], "type": [ "null", "object" ], "properties": { "alerts_count": { "type": "object", "properties": { "active": { "type": [ "null", "number" ], "description": "Number of active alerts during last run." }, "ignored": { "type": [ "null", "number" ], "description": "Number of ignored alerts during last run." }, "new": { "type": [ "null", "number" ], "description": "Number of new alerts during last run." }, "recovered": { "type": [ "null", "number" ], "description": "Number of recovered alerts during last run." } }, "additionalProperties": false }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "outcome_msg": { "type": [ "null", "array" ], "items": { "type": "string", "description": "Outcome message generated during last rule run." } }, "outcome_order": { "type": "number", "description": "Order of the outcome." }, "warning": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate", "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": [ "null", "string" ], "description": "Warning of last rule execution." } }, "additionalProperties": false }, "mapped_params": { "type": "object", "additionalProperties": { } }, "monitoring": { "required": [ "run" ], "type": "object", "properties": { "run": { "required": [ "history", "calculated_metrics", "last_run" ], "type": "object", "properties": { "calculated_metrics": { "required": [ "success_ratio" ], "type": "object", "properties": { "p50": { "type": "number" }, "p95": { "type": "number" }, "p99": { "type": "number" }, "success_ratio": { "type": "number" } }, "additionalProperties": false, "description": "Calculation of different percentiles and success ratio." }, "history": { "type": "array", "items": { "required": [ "success", "timestamp" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule run." }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "success": { "type": "boolean", "description": "Indicates whether the rule run was successful." }, "timestamp": { "type": "number", "description": "Time of rule run." } }, "additionalProperties": false }, "description": "History of the rule run." }, "last_run": { "required": [ "timestamp", "metrics" ], "type": "object", "properties": { "metrics": { "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of most recent rule run." }, "gap_duration_s": { "type": [ "null", "number" ], "description": "Duration in seconds of rule run gap." }, "gap_range": { "required": [ "lte", "gte" ], "type": [ "null", "object" ], "properties": { "gte": { "type": "string", "description": "End of the gap range." }, "lte": { "type": "string", "description": "Start of the gap range." } }, "additionalProperties": false }, "total_alerts_created": { "type": [ "null", "number" ], "description": "Total number of alerts created during last rule run." }, "total_alerts_detected": { "type": [ "null", "number" ], "description": "Total number of alerts detected during last rule run." }, "total_indexing_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent indexing documents during last rule run in milliseconds." }, "total_search_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response." } }, "additionalProperties": false }, "timestamp": { "type": "string", "description": "Time of the most recent rule run." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Rule run details." } }, "additionalProperties": false, "description": "Monitoring details of the rule." }, "mute_all": { "type": "boolean", "description": "Indicates whether all alerts are muted." }, "muted_alert_ids": { "type": "array", "items": { "type": "string", "description": "List of identifiers of muted alerts. " } }, "name": { "type": "string", "description": " The name of the rule." }, "next_run": { "type": [ "null", "string" ], "description": "Date and time of the next run of the rule." }, "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": [ "null", "string" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the rule." }, "revision": { "type": "number", "description": "The rule revision number." }, "rule_type_id": { "type": "string", "description": "The rule type identifier." }, "running": { "type": [ "null", "boolean" ], "description": "Indicates whether the rule is running." }, "schedule": { "required": [ "interval" ], "type": "object", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "additionalProperties": false }, "scheduled_task_id": { "type": "string", "description": "Identifier of the scheduled task." }, "snooze_schedule": { "type": "array", "items": { "required": [ "duration", "rRule" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule snooze schedule." }, "id": { "type": "string", "description": "Identifier of the rule snooze schedule." }, "rRule": { "required": [ "dtstart", "tzid" ], "type": "object", "properties": { "byhour": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates hours of the day to recur." } }, "byminute": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates minutes of the hour to recur." } }, "bymonth": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates months of the year that this rule should recur." } }, "bymonthday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the month to recur." } }, "bysecond": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates seconds of the day to recur." } }, "bysetpos": { "type": [ "null", "array" ], "items": { "type": "number", "description": "A positive or negative integer affecting the nth day of the month. For example, -2 combined with `byweekday` of FR is 2nd to last Friday of the month. It is recommended to not set this manually and just use `byweekday`." } }, "byweekday": { "type": [ "null", "array" ], "items": { "type": [ "number", "string" ], "description": "Indicates the days of the week to recur or else nth-day-of-month strings. For example, \"+2TU\" second Tuesday of month, \"-1FR\" last Friday of the month, which are internally converted to a `byweekday/bysetpos` combination." } }, "byweekno": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates number of the week hours to recur." } }, "byyearday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the year that this rule should recur." } }, "count": { "type": "number", "description": "Number of times the rule should recur until it stops." }, "dtstart": { "type": "string", "description": "Rule start date in Coordinated Universal Time (UTC)." }, "freq": { "enum": [ 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "description": "Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY." }, "interval": { "type": "number", "description": "Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks." }, "tzid": { "type": "string", "description": "Indicates timezone abbreviation." }, "until": { "type": "string", "description": "Recur the rule until this date." }, "wkst": { "enum": [ "MO", "TU", "WE", "TH", "FR", "SA", "SU" ], "type": "string", "description": "Indicates the start of week, defaults to Monday." } }, "additionalProperties": false }, "skipRecurrences": { "type": "array", "items": { "type": "string", "description": "Skips recurrence of rule on this date." } } }, "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "string", "description": "The tags for the rule." } }, "throttle": { "type": [ "null", "string" ], "description": "Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.", "deprecated": true }, "updated_at": { "type": "string", "description": "The date and time that the rule was updated most recently." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that updated this rule most recently." }, "view_in_app_relative_url": { "type": [ "null", "string" ], "description": "Relative URL to view rule in the app." } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." } } }, "post": { "tags": [ "alerting" ], "summary": "Create a rule", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule. If it is omitted, an ID is randomly generated.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "rule_type_id", "consumer", "schedule" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "alerts_filter": { "type": "object", "properties": { "query": { "required": [ "kql", "filters" ], "type": "object", "properties": { "dsl": { "type": "string", "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)." }, "filters": { "type": "array", "items": { "required": [ "meta" ], "type": "object", "properties": { "$state": { "required": [ "store" ], "type": "object", "properties": { "store": { "enum": [ "appState", "globalState" ], "type": "string", "description": "A filter can be either specific to an application context or applied globally." } }, "additionalProperties": false }, "meta": { "type": "object", "additionalProperties": { } }, "query": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false }, "timeframe": { "required": [ "days", "hours", "timezone" ], "type": "object", "properties": { "days": { "type": "array", "items": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer" }, "description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week." }, "hours": { "required": [ "start", "end" ], "type": "object", "properties": { "end": { "type": "string", "description": "The end of the time frame in 24-hour notation (`hh:mm`)." }, "start": { "type": "string", "description": "The start of the time frame in 24-hour notation (`hh:mm`)." } }, "additionalProperties": false, "description": "Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day." }, "timezone": { "type": "string", "description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended." } }, "additionalProperties": false, "description": "Defines a period that limits whether the action runs." } }, "additionalProperties": false, "description": "Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs." }, "frequency": { "required": [ "summary", "notify_when", "throttle" ], "type": "object", "properties": { "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "summary": { "type": "boolean", "description": "Indicates whether the action is a summary." }, "throttle": { "type": [ "null", "string" ], "description": "The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if `notify_when` is set to `onThrottleInterval`. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "additionalProperties": false, "description": "An action that runs under defined conditions." }, "default": [ ] }, "alert_delay": { "required": [ "active" ], "type": "object", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "additionalProperties": false, "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions." }, "artifacts": { "type": "object", "properties": { "dashboards": { "maxItems": 10, "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } }, "additionalProperties": false } }, "investigation_guide": { "required": [ "blob" ], "type": "object", "properties": { "blob": { "maxLength": 10000, "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false }, "consumer": { "type": "string", "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`." }, "enabled": { "type": "boolean", "description": "Indicates whether you want to run the rule on an interval basis after it is created.", "default": true }, "flapping": { "required": [ "look_back_window", "status_change_threshold" ], "type": [ "null", "object" ], "properties": { "look_back_window": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "additionalProperties": false, "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced." }, "name": { "type": "string", "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule." }, "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": [ "null", "string" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "rule_type_id": { "type": "string", "description": "The rule type identifier." }, "schedule": { "required": [ "interval" ], "type": "object", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "additionalProperties": false, "description": "The check interval, which specifies how frequently the rule conditions are checked." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "The tags for the rule.", "default": [ ] }, "throttle": { "type": [ "null", "string" ], "description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "params": { "anyOf": [ { "$ref": "#/components/schemas/params_property_apm_anomaly" }, { "$ref": "#/components/schemas/params_property_apm_error_count" }, { "$ref": "#/components/schemas/params_property_apm_transaction_duration" }, { "$ref": "#/components/schemas/params_property_apm_transaction_error_rate" }, { "$ref": "#/components/schemas/params_es_query_dsl_rule" }, { "$ref": "#/components/schemas/params_es_query_esql_rule" }, { "$ref": "#/components/schemas/params_es_query_kql_rule" }, { "$ref": "#/components/schemas/params_index_threshold_rule" }, { "$ref": "#/components/schemas/params_property_infra_inventory" }, { "$ref": "#/components/schemas/params_property_log_threshold" }, { "$ref": "#/components/schemas/params_property_infra_metric_threshold" }, { "$ref": "#/components/schemas/params_property_slo_burn_rate" }, { "$ref": "#/components/schemas/params_property_synthetics_uptime_tls" }, { "$ref": "#/components/schemas/params_property_synthetics_monitor_status" } ], "additionalProperties": { }, "description": "The parameters for the rule." } }, "additionalProperties": false }, "examples": { "createEsQueryEsqlRuleRequest": { "$ref": "#/components/examples/create_es_query_esql_rule_request" }, "createEsQueryRuleRequest": { "$ref": "#/components/examples/create_es_query_rule_request" }, "createEsQueryKqlRuleRequest": { "$ref": "#/components/examples/create_es_query_kql_rule_request" }, "createIndexThresholdRuleRequest": { "$ref": "#/components/examples/create_index_threshold_rule_request" }, "createTrackingContainmentRuleRequest": { "$ref": "#/components/examples/create_tracking_containment_rule_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "enabled", "name", "tags", "rule_type_id", "consumer", "schedule", "actions", "params", "created_by", "updated_by", "created_at", "updated_at", "api_key_owner", "mute_all", "muted_alert_ids", "execution_status", "revision" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "id", "connector_type_id", "params" ], "type": "object", "properties": { "alerts_filter": { "type": "object", "properties": { "query": { "required": [ "kql", "filters" ], "type": "object", "properties": { "dsl": { "type": "string", "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)." }, "filters": { "type": "array", "items": { "required": [ "meta" ], "type": "object", "properties": { "$state": { "required": [ "store" ], "type": "object", "properties": { "store": { "enum": [ "appState", "globalState" ], "type": "string", "description": "A filter can be either specific to an application context or applied globally." } }, "additionalProperties": false }, "meta": { "type": "object", "additionalProperties": { } }, "query": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false }, "timeframe": { "required": [ "days", "hours", "timezone" ], "type": "object", "properties": { "days": { "type": "array", "items": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer" }, "description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week." }, "hours": { "required": [ "start", "end" ], "type": "object", "properties": { "end": { "type": "string", "description": "The end of the time frame in 24-hour notation (`hh:mm`)." }, "start": { "type": "string", "description": "The start of the time frame in 24-hour notation (`hh:mm`)." } }, "additionalProperties": false }, "timezone": { "type": "string", "description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Defines a period that limits whether the action runs." }, "connector_type_id": { "type": "string", "description": "The type of connector. This property appears in responses but cannot be set in requests." }, "frequency": { "required": [ "summary", "notify_when", "throttle" ], "type": "object", "properties": { "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "summary": { "type": "boolean", "description": "Indicates whether the action is a summary." }, "throttle": { "type": [ "null", "string" ], "description": "The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "additionalProperties": false } }, "active_snoozes": { "type": "array", "items": { "type": "string", "description": "List of active snoozes for the rule." } }, "alert_delay": { "required": [ "active" ], "type": "object", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "additionalProperties": false, "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions." }, "api_key_created_by_user": { "type": [ "null", "boolean" ], "description": "Indicates whether the API key that is associated with the rule was created by the user." }, "api_key_owner": { "type": [ "null", "string" ], "description": "The owner of the API key that is associated with the rule and used to run background tasks." }, "artifacts": { "type": "object", "properties": { "dashboards": { "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } }, "additionalProperties": false } }, "investigation_guide": { "required": [ "blob" ], "type": "object", "properties": { "blob": { "type": "string", "description": "User-created content that describes alert causes and remdiation." } }, "additionalProperties": false } }, "additionalProperties": false }, "consumer": { "type": "string", "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`." }, "created_at": { "type": "string", "description": "The date and time that the rule was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the rule." }, "enabled": { "type": "boolean", "description": "Indicates whether you want to run the rule on an interval basis after it is created." }, "execution_status": { "required": [ "status", "last_execution_date" ], "type": "object", "properties": { "error": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Error message." }, "reason": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate" ], "type": "string", "description": "Reason for error." } }, "additionalProperties": false }, "last_duration": { "type": "number", "description": "Duration of last execution of the rule." }, "last_execution_date": { "type": "string", "description": "The date and time when rule was executed last." }, "status": { "enum": [ "ok", "active", "error", "warning", "pending", "unknown" ], "type": "string", "description": "Status of rule execution." }, "warning": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Warning message." }, "reason": { "enum": [ "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": "string", "description": "Reason for warning." } }, "additionalProperties": false } }, "additionalProperties": false }, "flapping": { "required": [ "look_back_window", "status_change_threshold" ], "type": [ "null", "object" ], "properties": { "look_back_window": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "additionalProperties": false, "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced." }, "id": { "type": "string", "description": "The identifier for the rule." }, "is_snoozed_until": { "type": [ "null", "string" ], "description": "The date when the rule will no longer be snoozed." }, "last_run": { "required": [ "outcome", "alerts_count" ], "type": [ "null", "object" ], "properties": { "alerts_count": { "type": "object", "properties": { "active": { "type": [ "null", "number" ], "description": "Number of active alerts during last run." }, "ignored": { "type": [ "null", "number" ], "description": "Number of ignored alerts during last run." }, "new": { "type": [ "null", "number" ], "description": "Number of new alerts during last run." }, "recovered": { "type": [ "null", "number" ], "description": "Number of recovered alerts during last run." } }, "additionalProperties": false }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "outcome_msg": { "type": [ "null", "array" ], "items": { "type": "string", "description": "Outcome message generated during last rule run." } }, "outcome_order": { "type": "number", "description": "Order of the outcome." }, "warning": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate", "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": [ "null", "string" ], "description": "Warning of last rule execution." } }, "additionalProperties": false }, "mapped_params": { "type": "object", "additionalProperties": { } }, "monitoring": { "required": [ "run" ], "type": "object", "properties": { "run": { "required": [ "history", "calculated_metrics", "last_run" ], "type": "object", "properties": { "calculated_metrics": { "required": [ "success_ratio" ], "type": "object", "properties": { "p50": { "type": "number" }, "p95": { "type": "number" }, "p99": { "type": "number" }, "success_ratio": { "type": "number" } }, "additionalProperties": false, "description": "Calculation of different percentiles and success ratio." }, "history": { "type": "array", "items": { "required": [ "success", "timestamp" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule run." }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "success": { "type": "boolean", "description": "Indicates whether the rule run was successful." }, "timestamp": { "type": "number", "description": "Time of rule run." } }, "additionalProperties": false }, "description": "History of the rule run." }, "last_run": { "required": [ "timestamp", "metrics" ], "type": "object", "properties": { "metrics": { "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of most recent rule run." }, "gap_duration_s": { "type": [ "null", "number" ], "description": "Duration in seconds of rule run gap." }, "gap_range": { "required": [ "lte", "gte" ], "type": [ "null", "object" ], "properties": { "gte": { "type": "string", "description": "End of the gap range." }, "lte": { "type": "string", "description": "Start of the gap range." } }, "additionalProperties": false }, "total_alerts_created": { "type": [ "null", "number" ], "description": "Total number of alerts created during last rule run." }, "total_alerts_detected": { "type": [ "null", "number" ], "description": "Total number of alerts detected during last rule run." }, "total_indexing_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent indexing documents during last rule run in milliseconds." }, "total_search_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response." } }, "additionalProperties": false }, "timestamp": { "type": "string", "description": "Time of the most recent rule run." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Rule run details." } }, "additionalProperties": false, "description": "Monitoring details of the rule." }, "mute_all": { "type": "boolean", "description": "Indicates whether all alerts are muted." }, "muted_alert_ids": { "type": "array", "items": { "type": "string", "description": "List of identifiers of muted alerts. " } }, "name": { "type": "string", "description": " The name of the rule." }, "next_run": { "type": [ "null", "string" ], "description": "Date and time of the next run of the rule." }, "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": [ "null", "string" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the rule." }, "revision": { "type": "number", "description": "The rule revision number." }, "rule_type_id": { "type": "string", "description": "The rule type identifier." }, "running": { "type": [ "null", "boolean" ], "description": "Indicates whether the rule is running." }, "schedule": { "required": [ "interval" ], "type": "object", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "additionalProperties": false }, "scheduled_task_id": { "type": "string", "description": "Identifier of the scheduled task." }, "snooze_schedule": { "type": "array", "items": { "required": [ "duration", "rRule" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule snooze schedule." }, "id": { "type": "string", "description": "Identifier of the rule snooze schedule." }, "rRule": { "required": [ "dtstart", "tzid" ], "type": "object", "properties": { "byhour": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates hours of the day to recur." } }, "byminute": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates minutes of the hour to recur." } }, "bymonth": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates months of the year that this rule should recur." } }, "bymonthday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the month to recur." } }, "bysecond": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates seconds of the day to recur." } }, "bysetpos": { "type": [ "null", "array" ], "items": { "type": "number", "description": "A positive or negative integer affecting the nth day of the month. For example, -2 combined with `byweekday` of FR is 2nd to last Friday of the month. It is recommended to not set this manually and just use `byweekday`." } }, "byweekday": { "type": [ "null", "array" ], "items": { "type": [ "number", "string" ], "description": "Indicates the days of the week to recur or else nth-day-of-month strings. For example, \"+2TU\" second Tuesday of month, \"-1FR\" last Friday of the month, which are internally converted to a `byweekday/bysetpos` combination." } }, "byweekno": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates number of the week hours to recur." } }, "byyearday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the year that this rule should recur." } }, "count": { "type": "number", "description": "Number of times the rule should recur until it stops." }, "dtstart": { "type": "string", "description": "Rule start date in Coordinated Universal Time (UTC)." }, "freq": { "enum": [ 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "description": "Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY." }, "interval": { "type": "number", "description": "Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks." }, "tzid": { "type": "string", "description": "Indicates timezone abbreviation." }, "until": { "type": "string", "description": "Recur the rule until this date." }, "wkst": { "enum": [ "MO", "TU", "WE", "TH", "FR", "SA", "SU" ], "type": "string", "description": "Indicates the start of week, defaults to Monday." } }, "additionalProperties": false }, "skipRecurrences": { "type": "array", "items": { "type": "string", "description": "Skips recurrence of rule on this date." } } }, "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "string", "description": "The tags for the rule." } }, "throttle": { "type": [ "null", "string" ], "description": "Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.", "deprecated": true }, "updated_at": { "type": "string", "description": "The date and time that the rule was updated most recently." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that updated this rule most recently." }, "view_in_app_relative_url": { "type": [ "null", "string" ], "description": "Relative URL to view rule in the app." } }, "additionalProperties": false }, "examples": { "createEsQueryEsqlRuleResponse": { "$ref": "#/components/examples/create_es_query_esql_rule_response" }, "createEsQueryRuleResponse": { "$ref": "#/components/examples/create_es_query_rule_response" }, "createEsQueryKqlRuleResponse": { "$ref": "#/components/examples/create_es_query_kql_rule_response" }, "createIndexThresholdRuleResponse": { "$ref": "#/components/examples/create_index_threshold_rule_response" }, "createTrackingContainmentRuleResponse": { "$ref": "#/components/examples/create_tracking_containment_rule_response" } } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "409": { "description": "Indicates that the rule id is already in use." } } }, "put": { "tags": [ "alerting" ], "summary": "Update a rule", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/alerting/rule/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "put-alerting-rule-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "schedule" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "alerts_filter": { "type": "object", "properties": { "query": { "required": [ "kql", "filters" ], "type": "object", "properties": { "dsl": { "type": "string", "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)." }, "filters": { "type": "array", "items": { "required": [ "meta" ], "type": "object", "properties": { "$state": { "required": [ "store" ], "type": "object", "properties": { "store": { "enum": [ "appState", "globalState" ], "type": "string", "description": "A filter can be either specific to an application context or applied globally." } }, "additionalProperties": false }, "meta": { "type": "object", "additionalProperties": { } }, "query": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false }, "timeframe": { "required": [ "days", "hours", "timezone" ], "type": "object", "properties": { "days": { "type": "array", "items": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer" }, "description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week." }, "hours": { "required": [ "start", "end" ], "type": "object", "properties": { "end": { "type": "string", "description": "The end of the time frame in 24-hour notation (`hh:mm`)." }, "start": { "type": "string", "description": "The start of the time frame in 24-hour notation (`hh:mm`)." } }, "additionalProperties": false, "description": "Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day." }, "timezone": { "type": "string", "description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended." } }, "additionalProperties": false, "description": "Defines a period that limits whether the action runs." } }, "additionalProperties": false }, "frequency": { "required": [ "summary", "notify_when", "throttle" ], "type": "object", "properties": { "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "summary": { "type": "boolean", "description": "Indicates whether the action is a summary." }, "throttle": { "type": [ "null", "string" ], "description": "The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if `notify_when` is set to `onThrottleInterval`. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "additionalProperties": false, "description": "An action that runs under defined conditions." }, "default": [ ] }, "alert_delay": { "required": [ "active" ], "type": "object", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "additionalProperties": false, "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions." }, "artifacts": { "type": "object", "properties": { "dashboards": { "maxItems": 10, "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } }, "additionalProperties": false } }, "investigation_guide": { "required": [ "blob" ], "type": "object", "properties": { "blob": { "maxLength": 10000, "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false }, "flapping": { "required": [ "look_back_window", "status_change_threshold" ], "type": [ "null", "object" ], "properties": { "look_back_window": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "additionalProperties": false, "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced." }, "name": { "type": "string", "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule." }, "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": [ "null", "string" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the rule." }, "schedule": { "required": [ "interval" ], "type": "object", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "additionalProperties": false }, "tags": { "type": "array", "items": { "type": "string", "description": "The tags for the rule." }, "default": [ ] }, "throttle": { "type": [ "null", "string" ], "description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "examples": { "updateRuleRequest": { "$ref": "#/components/examples/update_rule_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "enabled", "name", "tags", "rule_type_id", "consumer", "schedule", "actions", "params", "created_by", "updated_by", "created_at", "updated_at", "api_key_owner", "mute_all", "muted_alert_ids", "execution_status", "revision" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "id", "connector_type_id", "params" ], "type": "object", "properties": { "alerts_filter": { "type": "object", "properties": { "query": { "required": [ "kql", "filters" ], "type": "object", "properties": { "dsl": { "type": "string", "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)." }, "filters": { "type": "array", "items": { "required": [ "meta" ], "type": "object", "properties": { "$state": { "required": [ "store" ], "type": "object", "properties": { "store": { "enum": [ "appState", "globalState" ], "type": "string", "description": "A filter can be either specific to an application context or applied globally." } }, "additionalProperties": false }, "meta": { "type": "object", "additionalProperties": { } }, "query": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false }, "timeframe": { "required": [ "days", "hours", "timezone" ], "type": "object", "properties": { "days": { "type": "array", "items": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer" }, "description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week." }, "hours": { "required": [ "start", "end" ], "type": "object", "properties": { "end": { "type": "string", "description": "The end of the time frame in 24-hour notation (`hh:mm`)." }, "start": { "type": "string", "description": "The start of the time frame in 24-hour notation (`hh:mm`)." } }, "additionalProperties": false }, "timezone": { "type": "string", "description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Defines a period that limits whether the action runs." }, "connector_type_id": { "type": "string", "description": "The type of connector. This property appears in responses but cannot be set in requests." }, "frequency": { "required": [ "summary", "notify_when", "throttle" ], "type": "object", "properties": { "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "summary": { "type": "boolean", "description": "Indicates whether the action is a summary." }, "throttle": { "type": [ "null", "string" ], "description": "The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "additionalProperties": false } }, "active_snoozes": { "type": "array", "items": { "type": "string", "description": "List of active snoozes for the rule." } }, "alert_delay": { "required": [ "active" ], "type": "object", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "additionalProperties": false, "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions." }, "api_key_created_by_user": { "type": [ "null", "boolean" ], "description": "Indicates whether the API key that is associated with the rule was created by the user." }, "api_key_owner": { "type": [ "null", "string" ], "description": "The owner of the API key that is associated with the rule and used to run background tasks." }, "artifacts": { "type": "object", "properties": { "dashboards": { "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } }, "additionalProperties": false } }, "investigation_guide": { "required": [ "blob" ], "type": "object", "properties": { "blob": { "type": "string", "description": "User-created content that describes alert causes and remdiation." } }, "additionalProperties": false } }, "additionalProperties": false }, "consumer": { "type": "string", "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`." }, "created_at": { "type": "string", "description": "The date and time that the rule was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the rule." }, "enabled": { "type": "boolean", "description": "Indicates whether you want to run the rule on an interval basis after it is created." }, "execution_status": { "required": [ "status", "last_execution_date" ], "type": "object", "properties": { "error": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Error message." }, "reason": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate" ], "type": "string", "description": "Reason for error." } }, "additionalProperties": false }, "last_duration": { "type": "number", "description": "Duration of last execution of the rule." }, "last_execution_date": { "type": "string", "description": "The date and time when rule was executed last." }, "status": { "enum": [ "ok", "active", "error", "warning", "pending", "unknown" ], "type": "string", "description": "Status of rule execution." }, "warning": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Warning message." }, "reason": { "enum": [ "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": "string", "description": "Reason for warning." } }, "additionalProperties": false } }, "additionalProperties": false }, "flapping": { "required": [ "look_back_window", "status_change_threshold" ], "type": [ "null", "object" ], "properties": { "look_back_window": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "additionalProperties": false, "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced." }, "id": { "type": "string", "description": "The identifier for the rule." }, "is_snoozed_until": { "type": [ "null", "string" ], "description": "The date when the rule will no longer be snoozed." }, "last_run": { "required": [ "outcome", "alerts_count" ], "type": [ "null", "object" ], "properties": { "alerts_count": { "type": "object", "properties": { "active": { "type": [ "null", "number" ], "description": "Number of active alerts during last run." }, "ignored": { "type": [ "null", "number" ], "description": "Number of ignored alerts during last run." }, "new": { "type": [ "null", "number" ], "description": "Number of new alerts during last run." }, "recovered": { "type": [ "null", "number" ], "description": "Number of recovered alerts during last run." } }, "additionalProperties": false }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "outcome_msg": { "type": [ "null", "array" ], "items": { "type": "string", "description": "Outcome message generated during last rule run." } }, "outcome_order": { "type": "number", "description": "Order of the outcome." }, "warning": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate", "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": [ "null", "string" ], "description": "Warning of last rule execution." } }, "additionalProperties": false }, "mapped_params": { "type": "object", "additionalProperties": { } }, "monitoring": { "required": [ "run" ], "type": "object", "properties": { "run": { "required": [ "history", "calculated_metrics", "last_run" ], "type": "object", "properties": { "calculated_metrics": { "required": [ "success_ratio" ], "type": "object", "properties": { "p50": { "type": "number" }, "p95": { "type": "number" }, "p99": { "type": "number" }, "success_ratio": { "type": "number" } }, "additionalProperties": false, "description": "Calculation of different percentiles and success ratio." }, "history": { "type": "array", "items": { "required": [ "success", "timestamp" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule run." }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "success": { "type": "boolean", "description": "Indicates whether the rule run was successful." }, "timestamp": { "type": "number", "description": "Time of rule run." } }, "additionalProperties": false }, "description": "History of the rule run." }, "last_run": { "required": [ "timestamp", "metrics" ], "type": "object", "properties": { "metrics": { "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of most recent rule run." }, "gap_duration_s": { "type": [ "null", "number" ], "description": "Duration in seconds of rule run gap." }, "gap_range": { "required": [ "lte", "gte" ], "type": [ "null", "object" ], "properties": { "gte": { "type": "string", "description": "End of the gap range." }, "lte": { "type": "string", "description": "Start of the gap range." } }, "additionalProperties": false }, "total_alerts_created": { "type": [ "null", "number" ], "description": "Total number of alerts created during last rule run." }, "total_alerts_detected": { "type": [ "null", "number" ], "description": "Total number of alerts detected during last rule run." }, "total_indexing_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent indexing documents during last rule run in milliseconds." }, "total_search_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response." } }, "additionalProperties": false }, "timestamp": { "type": "string", "description": "Time of the most recent rule run." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Rule run details." } }, "additionalProperties": false, "description": "Monitoring details of the rule." }, "mute_all": { "type": "boolean", "description": "Indicates whether all alerts are muted." }, "muted_alert_ids": { "type": "array", "items": { "type": "string", "description": "List of identifiers of muted alerts. " } }, "name": { "type": "string", "description": " The name of the rule." }, "next_run": { "type": [ "null", "string" ], "description": "Date and time of the next run of the rule." }, "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": [ "null", "string" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the rule." }, "revision": { "type": "number", "description": "The rule revision number." }, "rule_type_id": { "type": "string", "description": "The rule type identifier." }, "running": { "type": [ "null", "boolean" ], "description": "Indicates whether the rule is running." }, "schedule": { "required": [ "interval" ], "type": "object", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "additionalProperties": false }, "scheduled_task_id": { "type": "string", "description": "Identifier of the scheduled task." }, "snooze_schedule": { "type": "array", "items": { "required": [ "duration", "rRule" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule snooze schedule." }, "id": { "type": "string", "description": "Identifier of the rule snooze schedule." }, "rRule": { "required": [ "dtstart", "tzid" ], "type": "object", "properties": { "byhour": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates hours of the day to recur." } }, "byminute": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates minutes of the hour to recur." } }, "bymonth": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates months of the year that this rule should recur." } }, "bymonthday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the month to recur." } }, "bysecond": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates seconds of the day to recur." } }, "bysetpos": { "type": [ "null", "array" ], "items": { "type": "number", "description": "A positive or negative integer affecting the nth day of the month. For example, -2 combined with `byweekday` of FR is 2nd to last Friday of the month. It is recommended to not set this manually and just use `byweekday`." } }, "byweekday": { "type": [ "null", "array" ], "items": { "type": [ "number", "string" ], "description": "Indicates the days of the week to recur or else nth-day-of-month strings. For example, \"+2TU\" second Tuesday of month, \"-1FR\" last Friday of the month, which are internally converted to a `byweekday/bysetpos` combination." } }, "byweekno": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates number of the week hours to recur." } }, "byyearday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the year that this rule should recur." } }, "count": { "type": "number", "description": "Number of times the rule should recur until it stops." }, "dtstart": { "type": "string", "description": "Rule start date in Coordinated Universal Time (UTC)." }, "freq": { "enum": [ 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "description": "Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY." }, "interval": { "type": "number", "description": "Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks." }, "tzid": { "type": "string", "description": "Indicates timezone abbreviation." }, "until": { "type": "string", "description": "Recur the rule until this date." }, "wkst": { "enum": [ "MO", "TU", "WE", "TH", "FR", "SA", "SU" ], "type": "string", "description": "Indicates the start of week, defaults to Monday." } }, "additionalProperties": false }, "skipRecurrences": { "type": "array", "items": { "type": "string", "description": "Skips recurrence of rule on this date." } } }, "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "string", "description": "The tags for the rule." } }, "throttle": { "type": [ "null", "string" ], "description": "Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.", "deprecated": true }, "updated_at": { "type": "string", "description": "The date and time that the rule was updated most recently." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that updated this rule most recently." }, "view_in_app_relative_url": { "type": [ "null", "string" ], "description": "Relative URL to view rule in the app." } }, "additionalProperties": false }, "examples": { "updateRuleResponse": { "$ref": "#/components/examples/update_rule_response" } } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." }, "409": { "description": "Indicates that the rule has already been updated by another user." } } } }, "/api/alerting/rule/{id}/_disable": { "post": { "tags": [ "alerting" ], "summary": "Disable a rule", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}/_disable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-id-disable", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": [ "null", "object" ], "properties": { "untrack": { "type": "boolean", "description": "Defines whether this rule's alerts should be untracked." } }, "additionalProperties": false, "x-oas-optional": true } } } }, "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." } } } }, "/api/alerting/rule/{id}/_enable": { "post": { "tags": [ "alerting" ], "summary": "Enable a rule", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}/_enable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-id-enable", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." } } } }, "/api/alerting/rule/{id}/_mute_all": { "post": { "tags": [ "alerting" ], "summary": "Mute all alerts", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}/_mute_all
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-id-mute-all", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." } } } }, "/api/alerting/rule/{id}/_unmute_all": { "post": { "tags": [ "alerting" ], "summary": "Unmute all alerts", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}/_unmute_all
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-id-unmute-all", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." } } } }, "/api/alerting/rule/{id}/_update_api_key": { "post": { "tags": [ "alerting" ], "summary": "Update the API key for a rule", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}/_update_api_key
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-id-update-api-key", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given ID does not exist." }, "409": { "description": "Indicates that the rule has already been updated by another user." } } } }, "/api/alerting/rule/{id}/snooze_schedule": { "post": { "tags": [ "alerting" ], "summary": "Schedule a snooze for the rule", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{id}/snooze_schedule
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWhen you snooze a rule, the rule checks continue to run but alerts will not generate actions. You can snooze for a specified period of time and schedule single or recurring downtimes.", "operationId": "post-alerting-rule-id-snooze-schedule", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "Identifier of the rule.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "schedule" ], "type": "object", "properties": { "schedule": { "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "minimum": 1, "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "minItems": 1, "type": "array", "items": { "maximum": 12, "minimum": 1, "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "minItems": 1, "type": "array", "items": { "maximum": 31, "minimum": 1, "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "body" ], "type": "object", "properties": { "body": { "required": [ "schedule" ], "type": "object", "properties": { "schedule": { "required": [ "id" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "minimum": 1, "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "minItems": 1, "type": "array", "items": { "maximum": 12, "minimum": 1, "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "minItems": 1, "type": "array", "items": { "maximum": 31, "minimum": 1, "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false }, "id": { "type": "string", "description": "Identifier of the snooze schedule." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given id does not exist." } } } }, "/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute": { "post": { "tags": [ "alerting" ], "summary": "Mute an alert", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-rule-id-alert-alert-id-mute", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "rule_id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } }, { "name": "alert_id", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule or alert with the given ID does not exist." } } } }, "/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute": { "post": { "tags": [ "alerting" ], "summary": "Unmute an alert", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-alerting-rule-rule-id-alert-alert-id-unmute", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "rule_id", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } }, { "name": "alert_id", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule or alert with the given ID does not exist." } } } }, "/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}": { "delete": { "tags": [ "alerting" ], "summary": "Delete a snooze schedule for a rule", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-alerting-rule-ruleid-snooze-schedule-scheduleid", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "ruleId", "in": "path", "description": "The identifier for the rule.", "required": true, "schema": { "type": "string" } }, { "name": "scheduleId", "in": "path", "description": "The identifier for the snooze schedule.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a rule with the given id does not exist." } } } }, "/api/alerting/rules/_find": { "get": { "tags": [ "alerting" ], "summary": "Get information about rules", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerting/rules/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-alerting-rules-find", "parameters": [ { "name": "per_page", "in": "query", "description": "The number of rules to return per page.", "schema": { "minimum": 0, "type": "number", "default": 10 } }, { "name": "page", "in": "query", "description": "The page number to return.", "schema": { "minimum": 1, "type": "number", "default": 1 } }, { "name": "search", "in": "query", "description": "An Elasticsearch simple_query_string query that filters the objects in the response.", "schema": { "type": "string" } }, { "name": "default_search_operator", "in": "query", "description": "The default operator to use for the simple_query_string.", "schema": { "enum": [ "OR", "AND" ], "type": "string", "default": "OR" } }, { "name": "search_fields", "in": "query", "description": "The fields to perform the simple_query_string parsed query against.", "schema": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ] } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.", "schema": { "type": "string" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order.", "schema": { "enum": [ "asc", "desc" ], "type": "string" } }, { "name": "has_reference", "in": "query", "description": "Filters the rules that have a relation with the reference objects with a specific type and identifier.", "schema": { "required": [ "type", "id" ], "type": [ "null", "object" ], "properties": { "id": { "type": "string" }, "type": { "type": "string" } }, "additionalProperties": false } }, { "name": "fields", "in": "query", "description": "The fields to return in the `attributes` key of the response.", "schema": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ] } }, { "name": "filter", "in": "query", "description": "A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: \"myTitle\"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.", "schema": { "type": "string" } }, { "name": "filter_consumers", "in": "query", "schema": { "type": "array", "items": { "type": "string", "description": "List of consumers to filter." } } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "enabled", "name", "tags", "rule_type_id", "consumer", "schedule", "actions", "params", "created_by", "updated_by", "created_at", "updated_at", "api_key_owner", "mute_all", "muted_alert_ids", "execution_status", "revision" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "id", "connector_type_id", "params" ], "type": "object", "properties": { "alerts_filter": { "type": "object", "properties": { "query": { "required": [ "kql", "filters" ], "type": "object", "properties": { "dsl": { "type": "string", "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL)." }, "filters": { "type": "array", "items": { "required": [ "meta" ], "type": "object", "properties": { "$state": { "required": [ "store" ], "type": "object", "properties": { "store": { "enum": [ "appState", "globalState" ], "type": "string", "description": "A filter can be either specific to an application context or applied globally." } }, "additionalProperties": false }, "meta": { "type": "object", "additionalProperties": { } }, "query": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false }, "timeframe": { "required": [ "days", "hours", "timezone" ], "type": "object", "properties": { "days": { "type": "array", "items": { "enum": [ 1, 2, 3, 4, 5, 6, 7 ], "type": "integer" }, "description": "Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week." }, "hours": { "required": [ "start", "end" ], "type": "object", "properties": { "end": { "type": "string", "description": "The end of the time frame in 24-hour notation (`hh:mm`)." }, "start": { "type": "string", "description": "The start of the time frame in 24-hour notation (`hh:mm`)." } }, "additionalProperties": false }, "timezone": { "type": "string", "description": "The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Defines a period that limits whether the action runs." }, "connector_type_id": { "type": "string", "description": "The type of connector. This property appears in responses but cannot be set in requests." }, "frequency": { "required": [ "summary", "notify_when", "throttle" ], "type": "object", "properties": { "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "summary": { "type": "boolean", "description": "Indicates whether the action is a summary." }, "throttle": { "type": [ "null", "string" ], "description": "The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "additionalProperties": false }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "additionalProperties": false } }, "active_snoozes": { "type": "array", "items": { "type": "string", "description": "List of active snoozes for the rule." } }, "alert_delay": { "required": [ "active" ], "type": "object", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "additionalProperties": false, "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions." }, "api_key_created_by_user": { "type": [ "null", "boolean" ], "description": "Indicates whether the API key that is associated with the rule was created by the user." }, "api_key_owner": { "type": [ "null", "string" ], "description": "The owner of the API key that is associated with the rule and used to run background tasks." }, "artifacts": { "type": "object", "properties": { "dashboards": { "type": "array", "items": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } }, "additionalProperties": false } }, "investigation_guide": { "required": [ "blob" ], "type": "object", "properties": { "blob": { "type": "string", "description": "User-created content that describes alert causes and remdiation." } }, "additionalProperties": false } }, "additionalProperties": false }, "consumer": { "type": "string", "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`." }, "created_at": { "type": "string", "description": "The date and time that the rule was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the rule." }, "enabled": { "type": "boolean", "description": "Indicates whether you want to run the rule on an interval basis after it is created." }, "execution_status": { "required": [ "status", "last_execution_date" ], "type": "object", "properties": { "error": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Error message." }, "reason": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate" ], "type": "string", "description": "Reason for error." } }, "additionalProperties": false }, "last_duration": { "type": "number", "description": "Duration of last execution of the rule." }, "last_execution_date": { "type": "string", "description": "The date and time when rule was executed last." }, "status": { "enum": [ "ok", "active", "error", "warning", "pending", "unknown" ], "type": "string", "description": "Status of rule execution." }, "warning": { "required": [ "reason", "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "Warning message." }, "reason": { "enum": [ "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": "string", "description": "Reason for warning." } }, "additionalProperties": false } }, "additionalProperties": false }, "flapping": { "required": [ "look_back_window", "status_change_threshold" ], "type": [ "null", "object" ], "properties": { "look_back_window": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "maximum": 20, "minimum": 2, "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "additionalProperties": false, "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced." }, "id": { "type": "string", "description": "The identifier for the rule." }, "is_snoozed_until": { "type": [ "null", "string" ], "description": "The date when the rule will no longer be snoozed." }, "last_run": { "required": [ "outcome", "alerts_count" ], "type": [ "null", "object" ], "properties": { "alerts_count": { "type": "object", "properties": { "active": { "type": [ "null", "number" ], "description": "Number of active alerts during last run." }, "ignored": { "type": [ "null", "number" ], "description": "Number of ignored alerts during last run." }, "new": { "type": [ "null", "number" ], "description": "Number of new alerts during last run." }, "recovered": { "type": [ "null", "number" ], "description": "Number of recovered alerts during last run." } }, "additionalProperties": false }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "outcome_msg": { "type": [ "null", "array" ], "items": { "type": "string", "description": "Outcome message generated during last rule run." } }, "outcome_order": { "type": "number", "description": "Order of the outcome." }, "warning": { "enum": [ "read", "decrypt", "execute", "unknown", "license", "timeout", "disabled", "validate", "maxExecutableActions", "maxAlerts", "maxQueuedActions", "ruleExecution" ], "type": [ "null", "string" ], "description": "Warning of last rule execution." } }, "additionalProperties": false }, "mapped_params": { "type": "object", "additionalProperties": { } }, "monitoring": { "required": [ "run" ], "type": "object", "properties": { "run": { "required": [ "history", "calculated_metrics", "last_run" ], "type": "object", "properties": { "calculated_metrics": { "required": [ "success_ratio" ], "type": "object", "properties": { "p50": { "type": "number" }, "p95": { "type": "number" }, "p99": { "type": "number" }, "success_ratio": { "type": "number" } }, "additionalProperties": false, "description": "Calculation of different percentiles and success ratio." }, "history": { "type": "array", "items": { "required": [ "success", "timestamp" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule run." }, "outcome": { "enum": [ "succeeded", "warning", "failed" ], "type": "string", "description": "Outcome of last run of the rule. Value could be succeeded, warning or failed." }, "success": { "type": "boolean", "description": "Indicates whether the rule run was successful." }, "timestamp": { "type": "number", "description": "Time of rule run." } }, "additionalProperties": false }, "description": "History of the rule run." }, "last_run": { "required": [ "timestamp", "metrics" ], "type": "object", "properties": { "metrics": { "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of most recent rule run." }, "gap_duration_s": { "type": [ "null", "number" ], "description": "Duration in seconds of rule run gap." }, "gap_range": { "required": [ "lte", "gte" ], "type": [ "null", "object" ], "properties": { "gte": { "type": "string", "description": "End of the gap range." }, "lte": { "type": "string", "description": "Start of the gap range." } }, "additionalProperties": false }, "total_alerts_created": { "type": [ "null", "number" ], "description": "Total number of alerts created during last rule run." }, "total_alerts_detected": { "type": [ "null", "number" ], "description": "Total number of alerts detected during last rule run." }, "total_indexing_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent indexing documents during last rule run in milliseconds." }, "total_search_duration_ms": { "type": [ "null", "number" ], "description": "Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response." } }, "additionalProperties": false }, "timestamp": { "type": "string", "description": "Time of the most recent rule run." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Rule run details." } }, "additionalProperties": false, "description": "Monitoring details of the rule." }, "mute_all": { "type": "boolean", "description": "Indicates whether all alerts are muted." }, "muted_alert_ids": { "type": "array", "items": { "type": "string", "description": "List of identifiers of muted alerts. " } }, "name": { "type": "string", "description": " The name of the rule." }, "next_run": { "type": [ "null", "string" ], "description": "Date and time of the next run of the rule." }, "notify_when": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": [ "null", "string" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." }, "params": { "type": "object", "additionalProperties": { }, "description": "The parameters for the rule." }, "revision": { "type": "number", "description": "The rule revision number." }, "rule_type_id": { "type": "string", "description": "The rule type identifier." }, "running": { "type": [ "null", "boolean" ], "description": "Indicates whether the rule is running." }, "schedule": { "required": [ "interval" ], "type": "object", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "additionalProperties": false }, "scheduled_task_id": { "type": "string", "description": "Identifier of the scheduled task." }, "snooze_schedule": { "type": "array", "items": { "required": [ "duration", "rRule" ], "type": "object", "properties": { "duration": { "type": "number", "description": "Duration of the rule snooze schedule." }, "id": { "type": "string", "description": "Identifier of the rule snooze schedule." }, "rRule": { "required": [ "dtstart", "tzid" ], "type": "object", "properties": { "byhour": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates hours of the day to recur." } }, "byminute": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates minutes of the hour to recur." } }, "bymonth": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates months of the year that this rule should recur." } }, "bymonthday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the month to recur." } }, "bysecond": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates seconds of the day to recur." } }, "bysetpos": { "type": [ "null", "array" ], "items": { "type": "number", "description": "A positive or negative integer affecting the nth day of the month. For example, -2 combined with `byweekday` of FR is 2nd to last Friday of the month. It is recommended to not set this manually and just use `byweekday`." } }, "byweekday": { "type": [ "null", "array" ], "items": { "type": [ "number", "string" ], "description": "Indicates the days of the week to recur or else nth-day-of-month strings. For example, \"+2TU\" second Tuesday of month, \"-1FR\" last Friday of the month, which are internally converted to a `byweekday/bysetpos` combination." } }, "byweekno": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates number of the week hours to recur." } }, "byyearday": { "type": [ "null", "array" ], "items": { "type": "number", "description": "Indicates the days of the year that this rule should recur." } }, "count": { "type": "number", "description": "Number of times the rule should recur until it stops." }, "dtstart": { "type": "string", "description": "Rule start date in Coordinated Universal Time (UTC)." }, "freq": { "enum": [ 0, 1, 2, 3, 4, 5, 6 ], "type": "integer", "description": "Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY." }, "interval": { "type": "number", "description": "Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks." }, "tzid": { "type": "string", "description": "Indicates timezone abbreviation." }, "until": { "type": "string", "description": "Recur the rule until this date." }, "wkst": { "enum": [ "MO", "TU", "WE", "TH", "FR", "SA", "SU" ], "type": "string", "description": "Indicates the start of week, defaults to Monday." } }, "additionalProperties": false }, "skipRecurrences": { "type": "array", "items": { "type": "string", "description": "Skips recurrence of rule on this date." } } }, "additionalProperties": false } }, "tags": { "type": "array", "items": { "type": "string", "description": "The tags for the rule." } }, "throttle": { "type": [ "null", "string" ], "description": "Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.", "deprecated": true }, "updated_at": { "type": "string", "description": "The date and time that the rule was updated most recently." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that updated this rule most recently." }, "view_in_app_relative_url": { "type": [ "null", "string" ], "description": "Relative URL to view rule in the app." } }, "additionalProperties": false }, "examples": { "findRulesResponse": { "$ref": "#/components/examples/find_rules_response" }, "findConditionalActionRulesResponse": { "$ref": "#/components/examples/find_rules_response_conditional_action" } } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." } } } }, "/api/alerts/alert/{alertId}": { "delete": { "tags": [ "alerting" ], "summary": "Delete an alert", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/alerts/alert/{alertId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the delete rule API instead. WARNING: After you delete an alert, you cannot recover it.\n", "operationId": "legaryDeleteAlert", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true }, "get": { "tags": [ "alerting" ], "summary": "Get an alert by identifier", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerts/alert/{alertId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the get rule API instead.", "operationId": "legacyGetAlert", "parameters": [ { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_alert_response_properties" } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true }, "post": { "tags": [ "alerting" ], "summary": "Create an alert", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the create rule API instead.", "operationId": "legacyCreateAlert", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "An UUID v1 or v4 identifier for the alert. If this parameter is omitted, the identifier is randomly generated.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "requestBody": { "content": { "application/json": { "schema": { "title": "Legacy create alert request properties", "required": [ "alertTypeId", "consumer", "name", "notifyWhen", "params", "schedule" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "actionTypeId", "group", "id", "params" ], "type": "object", "properties": { "actionTypeId": { "type": "string", "description": "The identifier for the action type." }, "group": { "type": "string", "description": "Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to `default`.\n" }, "id": { "type": "string", "description": "The ID of the action saved object." }, "params": { "type": "object", "description": "The map to the `params` that the action type will receive. `params` are handled as Mustache templates and passed a default set of context.\n" } } } }, "alertTypeId": { "type": "string", "description": "The ID of the alert type that you want to call when the alert is scheduled to run." }, "consumer": { "type": "string", "description": "The name of the application that owns the alert. This name has to match the Kibana feature name, as that dictates the required role-based access control privileges." }, "enabled": { "type": "boolean", "description": "Indicates if you want to run the alert on an interval basis after it is created." }, "name": { "type": "string", "description": "A name to reference and search." }, "notifyWhen": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "The condition for throttling the notification." }, "params": { "type": "object", "description": "The parameters to pass to the alert type executor `params` value. This will also validate against the alert type params validator, if defined." }, "schedule": { "type": "object", "properties": { "interval": { "type": "string", "description": "The interval format specifies the interval in seconds, minutes, hours or days at which the alert should run.", "example": "10s" } }, "description": "The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "A list of keywords to reference and search." }, "throttle": { "type": "string", "description": "How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of `10m` or `1h` will prevent it from sending 90 notifications during this period.\n" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_alert_response_properties" } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true }, "put": { "tags": [ "alerting" ], "summary": "Update an alert", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/alerts/alert/{alertId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the update rule API instead.", "operationId": "legacyUpdateAlert", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "requestBody": { "content": { "application/json": { "schema": { "title": "Legacy update alert request properties", "required": [ "name", "notifyWhen", "params", "schedule" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "required": [ "actionTypeId", "group", "id", "params" ], "type": "object", "properties": { "actionTypeId": { "type": "string", "description": "The identifier for the action type." }, "group": { "type": "string", "description": "Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to `default`.\n" }, "id": { "type": "string", "description": "The ID of the action saved object." }, "params": { "type": "object", "description": "The map to the `params` that the action type will receive. `params` are handled as Mustache templates and passed a default set of context.\n" } } } }, "name": { "type": "string", "description": "A name to reference and search." }, "notifyWhen": { "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ], "type": "string", "description": "The condition for throttling the notification." }, "params": { "type": "object", "description": "The parameters to pass to the alert type executor `params` value. This will also validate against the alert type params validator, if defined." }, "schedule": { "type": "object", "properties": { "interval": { "type": "string", "description": "The interval format specifies the interval in seconds, minutes, hours or days at which the alert should run.", "example": "1d" } }, "description": "The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "A list of keywords to reference and search." }, "throttle": { "type": "string", "description": "How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of `10m` or `1h` will prevent it from sending 90 notifications during this period.\n" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_alert_response_properties" } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alert/{alertId}/_disable": { "post": { "tags": [ "alerting" ], "summary": "Disable an alert", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}/_disable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the disable rule API instead.", "operationId": "legacyDisableAlert", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alert/{alertId}/_enable": { "post": { "tags": [ "alerting" ], "summary": "Enable an alert", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}/_enable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the enable rule API instead.", "operationId": "legacyEnableAlert", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alert/{alertId}/_mute_all": { "post": { "tags": [ "alerting" ], "summary": "Mute all alert instances", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}/_mute_all
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the mute all alerts API instead.", "operationId": "legacyMuteAllAlertInstances", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alert/{alertId}/_unmute_all": { "post": { "tags": [ "alerting" ], "summary": "Unmute all alert instances", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}/_unmute_all
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the unmute all alerts API instead.", "operationId": "legacyUnmuteAllAlertInstances", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "The identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute": { "post": { "tags": [ "alerting" ], "summary": "Mute an alert instance", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the mute alert API instead.", "operationId": "legacyMuteAlertInstance", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "An identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } }, { "name": "alertInstanceId", "in": "path", "description": "An identifier for the alert instance.", "required": true, "schema": { "type": "string", "example": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute": { "post": { "tags": [ "alerting" ], "summary": "Unmute an alert instance", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the unmute alert API instead.", "operationId": "legacyUnmuteAlertInstance", "parameters": [ { "$ref": "#/components/parameters/Alerting_kbn_xsrf" }, { "name": "alertId", "in": "path", "description": "An identifier for the alert.", "required": true, "schema": { "type": "string", "example": "41893910-6bca-11eb-9e0d-85d233e3ee35" } }, { "name": "alertInstanceId", "in": "path", "description": "An identifier for the alert instance.", "required": true, "schema": { "type": "string", "example": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alerts/_find": { "get": { "tags": [ "alerting" ], "summary": "Get a paginated set of alerts", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerts/alerts/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the find rules API instead. NOTE: Alert `params` are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.\n", "operationId": "legacyFindAlerts", "parameters": [ { "name": "default_search_operator", "in": "query", "description": "The default operator to use for the `simple_query_string`.", "schema": { "type": "string", "default": "OR" }, "example": "OR" }, { "name": "fields", "in": "query", "description": "The fields to return in the `attributes` key of the response.", "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "filter", "in": "query", "description": "A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: \"myTitle\"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.\n", "schema": { "type": "string" } }, { "name": "has_reference", "in": "query", "description": "Filters the rules that have a relation with the reference objects with a specific type and identifier.", "schema": { "type": "object", "properties": { "id": { "type": "string" }, "type": { "type": "string" } } } }, { "name": "page", "in": "query", "description": "The page number to return.", "schema": { "type": "integer", "default": 1 }, "example": 1 }, { "name": "per_page", "in": "query", "description": "The number of alerts to return per page.", "schema": { "type": "integer", "default": 20 }, "example": 20 }, { "name": "search", "in": "query", "description": "An Elasticsearch `simple_query_string` query that filters the alerts in the response.", "schema": { "type": "string" } }, { "name": "search_fields", "in": "query", "description": "The fields to perform the `simple_query_string` parsed query against.", "schema": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.\n", "schema": { "type": "string" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order.", "schema": { "enum": [ "asc", "desc" ], "type": "string", "default": "desc" }, "example": "asc" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Alerting_alert_response_properties" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alerts/_health": { "get": { "tags": [ "alerting" ], "summary": "Get the alerting framework health", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerts/alerts/_health
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the get alerting framework health API instead.", "operationId": "legacyGetAlertingHealth", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "alertingFrameworkHealth": { "type": "object", "properties": { "decryptionHealth": { "type": "object", "properties": { "status": { "enum": [ "error", "ok", "warn" ], "type": "string", "example": "ok" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-01-13T01:28:00.280Z" } }, "description": "The timestamp and status of the alert decryption." }, "executionHealth": { "type": "object", "properties": { "status": { "enum": [ "error", "ok", "warn" ], "type": "string", "example": "ok" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-01-13T01:28:00.280Z" } }, "description": "The timestamp and status of the alert execution." }, "readHealth": { "type": "object", "properties": { "status": { "enum": [ "error", "ok", "warn" ], "type": "string", "example": "ok" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-01-13T01:28:00.280Z" } }, "description": "The timestamp and status of the alert reading events." } }, "description": "Three substates identify the health of the alerting framework: `decryptionHealth`, `executionHealth`, and `readHealth`.\n" }, "hasPermanentEncryptionKey": { "type": "boolean", "description": "If `false`, the encrypted saved object plugin does not have a permanent encryption key.", "example": true }, "isSufficientlySecure": { "type": "boolean", "description": "If `false`, security is enabled but TLS is not.", "example": true } } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/alerts/alerts/list_alert_types": { "get": { "tags": [ "alerting" ], "summary": "Get the alert types", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/alerts/alerts/list_alert_types
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 7.13.0. Use the get rule types API instead.", "operationId": "legacyGetAlertTypes", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "actionGroups": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "description": "An explicit list of groups for which the alert type can schedule actions, each with the action group's unique ID and human readable name. Alert actions validation uses this configuration to ensure that groups are valid.\n" }, "actionVariables": { "type": "object", "properties": { "context": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" } } } }, "params": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" } } } }, "state": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" } } } } }, "description": "A list of action variables that the alert type makes available via context and state in action parameter templates, and a short human readable description. The Alert UI will use this information to prompt users for these variables in action parameter editors.\n" }, "authorizedConsumers": { "type": "object", "description": "The list of the plugins IDs that have access to the alert type." }, "defaultActionGroupId": { "type": "string", "description": "The default identifier for the alert type group." }, "enabledInLicense": { "type": "boolean", "description": "Indicates whether the rule type is enabled based on the subscription." }, "id": { "type": "string", "description": "The unique identifier for the alert type." }, "isExportable": { "type": "boolean", "description": "Indicates whether the alert type is exportable in Saved Objects Management UI." }, "minimumLicenseRequired": { "type": "string", "description": "The subscriptions required to use the alert type." }, "name": { "type": "string", "description": "The descriptive name of the alert type." }, "producer": { "type": "string", "description": "An identifier for the application that produces this alert type." }, "recoveryActionGroup": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "description": "An action group to use when an alert instance goes from an active state to an inactive one. If it is not specified, the default recovered action group is used.\n" } } } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alerting_401_response" } } } } }, "deprecated": true } }, "/api/apm/agent_keys": { "post": { "tags": [ "APM agent keys" ], "summary": "Create an APM agent key", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/apm/agent_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new agent key for APM.", "operationId": "createAgentKey", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_agent_keys_object" } } }, "required": true }, "responses": { "200": { "description": "Agent key created successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_agent_keys_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "500": { "description": "Internal Server Error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_500_response" } } } } } } }, "/api/apm/fleet/apm_server_schema": { "post": { "tags": [ "APM server schema" ], "summary": "Save APM server schema", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/apm/fleet/apm_server_schema
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "saveApmServerSchema", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "schema": { "type": "object", "description": "Schema object", "example": { "foo": "bar" } } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/services/{serviceName}/annotation": { "post": { "tags": [ "APM annotations" ], "summary": "Create a service annotation", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/apm/services/{serviceName}/annotation
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new annotation for a specific service.", "operationId": "createAnnotation", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" }, { "name": "serviceName", "in": "path", "description": "The name of the service", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_create_annotation_object" } } }, "required": true }, "responses": { "200": { "description": "Annotation created successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_create_annotation_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/services/{serviceName}/annotation/search": { "get": { "tags": [ "APM annotations" ], "summary": "Search for annotations", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/apm/services/{serviceName}/annotation/search
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSearch for annotations related to a specific service.", "operationId": "getAnnotation", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "name": "serviceName", "in": "path", "description": "The name of the service", "required": true, "schema": { "type": "string" } }, { "name": "environment", "in": "query", "description": "The environment to filter annotations by", "schema": { "type": "string" } }, { "name": "start", "in": "query", "description": "The start date for the search", "schema": { "type": "string" } }, { "name": "end", "in": "query", "description": "The end date for the search", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_annotation_search_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "500": { "description": "Internal Server Error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_500_response" } } } } } } }, "/api/apm/settings/agent-configuration": { "delete": { "tags": [ "APM agent configuration" ], "summary": "Delete agent configuration", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/apm/settings/agent-configuration
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "deleteAgentConfiguration", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_service_object" } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_delete_agent_configurations_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } }, "get": { "tags": [ "APM agent configuration" ], "summary": "Get a list of agent configurations", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/apm/settings/agent-configuration
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getAgentConfigurations", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_agent_configurations_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } }, "put": { "tags": [ "APM agent configuration" ], "summary": "Create or update agent configuration", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/apm/settings/agent-configuration
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "createUpdateAgentConfiguration", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" }, { "name": "overwrite", "in": "query", "description": "If the config exists ?overwrite=true is required", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_agent_configuration_intake_object" } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/settings/agent-configuration/agent_name": { "get": { "tags": [ "APM agent configuration" ], "summary": "Get agent name for service", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/apm/settings/agent-configuration/agent_name
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve `agentName` for a service.", "operationId": "getAgentNameForService", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "name": "serviceName", "in": "query", "description": "The name of the service", "required": true, "schema": { "type": "string" }, "example": "node" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_service_agent_name_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/settings/agent-configuration/environments": { "get": { "tags": [ "APM agent configuration" ], "summary": "Get environments for service", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/apm/settings/agent-configuration/environments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getEnvironmentsForService", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "name": "serviceName", "in": "query", "description": "The name of the service", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_service_environments_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/settings/agent-configuration/search": { "post": { "tags": [ "APM agent configuration" ], "summary": "Lookup single agent configuration", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/apm/settings/agent-configuration/search
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nThis endpoint allows to search for single agent configuration and update 'applied_by_agent' field.\n", "operationId": "searchSingleConfiguration", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_search_agent_configuration_object" } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_search_agent_configuration_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/settings/agent-configuration/view": { "get": { "tags": [ "APM agent configuration" ], "summary": "Get single agent configuration", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/apm/settings/agent-configuration/view
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getSingleAgentConfiguration", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "name": "name", "in": "query", "description": "Service name", "schema": { "type": "string" }, "example": "node" }, { "name": "environment", "in": "query", "description": "Service environment", "schema": { "type": "string" }, "example": "prod" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_single_agent_configuration_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_404_response" } } } } } } }, "/api/apm/sourcemaps": { "get": { "tags": [ "APM sourcemaps" ], "summary": "Get source maps", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/apm/sourcemaps
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns an array of Fleet artifacts, including source map uploads.", "operationId": "getSourceMaps", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "name": "page", "in": "query", "description": "Page number", "schema": { "type": "number" } }, { "name": "perPage", "in": "query", "description": "Number of records per page", "schema": { "type": "number" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_source_maps_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "500": { "description": "Internal Server Error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_500_response" } } } }, "501": { "description": "Not Implemented response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_501_response" } } } } } }, "post": { "tags": [ "APM sourcemaps" ], "summary": "Upload source map", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/apm/sourcemaps
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpload a source map for a specific service and version.", "operationId": "uploadSourceMap", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/APM_UI_upload_source_map_object" } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_upload_source_maps_response" } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "500": { "description": "Internal Server Error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_500_response" } } } }, "501": { "description": "Not Implemented response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_501_response" } } } } } } }, "/api/apm/sourcemaps/{id}": { "delete": { "tags": [ "APM sourcemaps" ], "summary": "Delete source map", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/apm/sourcemaps/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a previously uploaded source map.", "operationId": "deleteSourceMap", "parameters": [ { "$ref": "#/components/parameters/APM_UI_elastic_api_version" }, { "$ref": "#/components/parameters/APM_UI_kbn_xsrf" }, { "name": "id", "in": "path", "description": "Source map identifier", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false } } } }, "400": { "description": "Bad Request response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_401_response" } } } }, "403": { "description": "Forbidden response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_403_response" } } } }, "500": { "description": "Internal Server Error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_500_response" } } } }, "501": { "description": "Not Implemented response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APM_UI_501_response" } } } } } } }, "/api/asset_criticality": { "delete": { "tags": [ "Security Entity Analytics API" ], "summary": "Delete an asset criticality record", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/asset_criticality
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete the asset criticality record for a specific entity.", "operationId": "DeleteAssetCriticalityRecord", "parameters": [ { "name": "id_value", "in": "query", "description": "The ID value of the asset.", "required": true, "schema": { "type": "string" }, "example": "my_host" }, { "name": "id_field", "in": "query", "description": "The field representing the ID.", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_IdField" }, "example": "host.name" }, { "name": "refresh", "in": "query", "description": "If 'wait_for' the request will wait for the index refresh.", "schema": { "enum": [ "wait_for" ], "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "deleted" ], "type": "object", "properties": { "deleted": { "type": "boolean", "description": "True if the record was deleted or false if the record did not exist." }, "record": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord" } } } } } }, "400": { "description": "Invalid request" } } }, "get": { "tags": [ "Security Entity Analytics API" ], "summary": "Get an asset criticality record", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/asset_criticality
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the asset criticality record for a specific entity.", "operationId": "GetAssetCriticalityRecord", "parameters": [ { "name": "id_value", "in": "query", "description": "The ID value of the asset.", "required": true, "schema": { "type": "string" }, "example": "my_host" }, { "name": "id_field", "in": "query", "description": "The field representing the ID.", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_IdField" }, "example": "host.name" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord" } } } }, "400": { "description": "Invalid request" }, "404": { "description": "Criticality record not found" } } }, "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Upsert an asset criticality record", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/asset_criticality
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate or update an asset criticality record for a specific entity.\n\nIf a record already exists for the specified entity, that record is overwritten with the specified value. If a record doesn't exist for the specified entity, a new record is created.\n", "operationId": "CreateAssetCriticalityRecord", "requestBody": { "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord" }, { "type": "object", "properties": { "refresh": { "enum": [ "wait_for" ], "type": "string", "description": "If 'wait_for' the request will wait for the index refresh." } } } ], "example": { "criticality_level": "high_impact", "id_field": "host.name", "id_value": "my_host" } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord" } } } }, "400": { "description": "Invalid request" } } } }, "/api/asset_criticality/bulk": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Bulk upsert asset criticality records", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/asset_criticality/bulk
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nBulk upsert up to 1000 asset criticality records.\n\nIf asset criticality records already exist for the specified entities, those records are overwritten with the specified values. If asset criticality records don't exist for the specified entities, new records are created.\n", "operationId": "BulkUpsertAssetCriticalityRecords", "requestBody": { "content": { "application/json": { "schema": { "required": [ "records" ], "type": "object", "properties": { "records": { "maxItems": 1000, "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord" } } }, "example": { "records": [ { "criticality_level": "low_impact", "id_field": "host.name", "id_value": "host-1" }, { "criticality_level": "medium_impact", "id_field": "host.name", "id_value": "host-2" } ] } } } } }, "responses": { "200": { "description": "Bulk upload successful", "content": { "application/json": { "schema": { "required": [ "errors", "stats" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem" } }, "stats": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats" } }, "example": { "errors": [ { "index": 0, "message": "Invalid ID field" } ], "stats": { "failed": 1, "successful": 1, "total": 2 } } } } } }, "413": { "description": "File too large" } } } }, "/api/asset_criticality/list": { "get": { "tags": [ "Security Entity Analytics API" ], "summary": "List asset criticality records", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/asset_criticality/list
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList asset criticality records, paging, sorting and filtering as needed.", "operationId": "FindAssetCriticalityRecords", "parameters": [ { "name": "sort_field", "in": "query", "description": "The field to sort by.", "schema": { "enum": [ "id_value", "id_field", "criticality_level", "@timestamp" ], "type": "string" } }, { "name": "sort_direction", "in": "query", "description": "The order to sort by.", "schema": { "enum": [ "asc", "desc" ], "type": "string" } }, { "name": "page", "in": "query", "description": "The page number to return.", "schema": { "minimum": 1, "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of records to return per page.", "schema": { "maximum": 1000, "minimum": 1, "type": "integer" } }, { "name": "kuery", "in": "query", "description": "The kuery to filter by.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successfully retrieved asset criticality records", "content": { "application/json": { "schema": { "required": [ "records", "page", "per_page", "total" ], "type": "object", "properties": { "page": { "minimum": 1, "type": "integer" }, "per_page": { "maximum": 1000, "minimum": 1, "type": "integer" }, "records": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord" } }, "total": { "minimum": 0, "type": "integer" } }, "example": { "page": 1, "per_page": 10, "records": [ { "@timestamp": "2024-08-02T14:40:35.705Z", "asset": { "criticality": "medium_impact" }, "criticality_level": "medium_impact", "host": { "asset": { "criticality": "medium_impact" }, "name": "my_other_host" }, "id_field": "host.name", "id_value": "my_other_host" }, { "@timestamp": "2024-08-02T11:15:34.290Z", "asset": { "criticality": "high_impact" }, "criticality_level": "high_impact", "host": { "asset": { "criticality": "high_impact" }, "name": "my_host" }, "id_field": "host.name", "id_value": "my_host" } ], "total": 2 } } } } } } } }, "/api/cases": { "delete": { "tags": [ "cases" ], "summary": "Delete cases", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/cases
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n", "operationId": "deleteCaseDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_ids" } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } }, "patch": { "tags": [ "cases" ], "summary": "Update cases", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/cases
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating.\n", "operationId": "updateCaseDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_update_case_request" }, "examples": { "updateCaseRequest": { "$ref": "#/components/examples/Cases_update_case_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Cases_case_response_properties" } }, "examples": { "updateCaseResponse": { "$ref": "#/components/examples/Cases_update_case_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } }, "post": { "tags": [ "cases" ], "summary": "Create a case", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/cases
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating.\n", "operationId": "createCaseDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_create_case_request" }, "examples": { "createCaseRequest": { "$ref": "#/components/examples/Cases_create_case_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" }, "examples": { "createCaseResponse": { "$ref": "#/components/examples/Cases_create_case_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/_find": { "get": { "tags": [ "cases" ], "summary": "Search cases", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n", "operationId": "findCasesDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_assignees_filter" }, { "$ref": "#/components/parameters/Cases_category" }, { "$ref": "#/components/parameters/Cases_defaultSearchOperator" }, { "$ref": "#/components/parameters/Cases_from" }, { "$ref": "#/components/parameters/Cases_owner_filter" }, { "$ref": "#/components/parameters/Cases_page_index" }, { "$ref": "#/components/parameters/Cases_page_size" }, { "$ref": "#/components/parameters/Cases_reporters" }, { "$ref": "#/components/parameters/Cases_search" }, { "$ref": "#/components/parameters/Cases_searchFields" }, { "$ref": "#/components/parameters/Cases_severity" }, { "$ref": "#/components/parameters/Cases_sortField" }, { "$ref": "#/components/parameters/Cases_sort_order" }, { "$ref": "#/components/parameters/Cases_status" }, { "$ref": "#/components/parameters/Cases_tags" }, { "$ref": "#/components/parameters/Cases_to" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "cases": { "maxItems": 10000, "type": "array", "items": { "$ref": "#/components/schemas/Cases_case_response_properties" } }, "count_closed_cases": { "type": "integer" }, "count_in_progress_cases": { "type": "integer" }, "count_open_cases": { "type": "integer" }, "page": { "type": "integer" }, "per_page": { "type": "integer" }, "total": { "type": "integer" } } }, "examples": { "findCaseResponse": { "$ref": "#/components/examples/Cases_find_case_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}": { "get": { "tags": [ "cases" ], "summary": "Get case information", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n", "operationId": "getCaseDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" }, { "$ref": "#/components/parameters/Cases_includeComments" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" }, "examples": { "getDefaultCaseResponse": { "$ref": "#/components/examples/Cases_get_case_response" }, "getDefaultObservabilityCaseReponse": { "$ref": "#/components/examples/Cases_get_case_observability_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}/alerts": { "get": { "tags": [ "cases" ], "summary": "Get all alerts for a case", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}/alerts
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n", "operationId": "getCaseAlertsDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Cases_alert_response_properties" } }, "examples": { "getCaseAlertsResponse": { "$ref": "#/components/examples/Cases_get_case_alerts_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } }, "x-state": "Technical preview" } }, "/api/cases/{caseId}/comments": { "delete": { "tags": [ "cases" ], "summary": "Delete all case comments and alerts", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n", "operationId": "deleteCaseCommentsDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_case_id" } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } }, "get": { "tags": [ "cases" ], "summary": "Get all case comments", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDeprecated in 8.1.0. This API is deprecated and will be removed in a future release; instead, use the get case comment API, which requires a comment identifier in the path. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.\n", "operationId": "getAllCaseCommentsDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } }, "deprecated": true }, "patch": { "tags": [ "cases" ], "summary": "Update a case comment or alert", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.\n", "operationId": "updateCaseCommentDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_case_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_update_case_comment_request" }, "examples": { "updateCaseCommentRequest": { "$ref": "#/components/examples/Cases_update_comment_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" }, "examples": { "updateCaseCommentResponse": { "$ref": "#/components/examples/Cases_update_comment_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } }, "post": { "tags": [ "cases" ], "summary": "Add a case comment or alert", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/cases/{caseId}/comments
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.\n", "operationId": "addCaseCommentDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_case_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_add_case_comment_request" }, "examples": { "createCaseCommentRequest": { "$ref": "#/components/examples/Cases_add_comment_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" }, "examples": { "createCaseCommentResponse": { "$ref": "#/components/examples/Cases_add_comment_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}/comments/_find": { "get": { "tags": [ "cases" ], "summary": "Find case comments and alerts", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}/comments/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.\n", "operationId": "findCaseCommentsDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" }, { "$ref": "#/components/parameters/Cases_page_index" }, { "$ref": "#/components/parameters/Cases_page_size" }, { "$ref": "#/components/parameters/Cases_sort_order" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}/comments/{commentId}": { "delete": { "tags": [ "cases" ], "summary": "Delete a case comment or alert", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/cases/{caseId}/comments/{commentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n", "operationId": "deleteCaseCommentDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_case_id" }, { "$ref": "#/components/parameters/Cases_comment_id" } ], "responses": { "204": { "description": "Indicates a successful call." }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } }, "get": { "tags": [ "cases" ], "summary": "Get a case comment or alert", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}/comments/{commentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.\n", "operationId": "getCaseCommentDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" }, { "$ref": "#/components/parameters/Cases_comment_id" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_alert_comment_response_properties" }, { "$ref": "#/components/schemas/Cases_user_comment_response_properties" } ] }, "examples": { "getCaseCommentResponse": { "$ref": "#/components/examples/Cases_get_comment_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}/connector/{connectorId}/_push": { "post": { "tags": [ "cases" ], "summary": "Push a case to an external service", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/cases/{caseId}/connector/{connectorId}/_push
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're pushing.\n", "operationId": "pushCaseDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" }, { "$ref": "#/components/parameters/Cases_connector_id" }, { "$ref": "#/components/parameters/Cases_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": [ "null", "object" ] } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" }, "examples": { "pushCaseResponse": { "$ref": "#/components/examples/Cases_push_case_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}/files": { "post": { "tags": [ "cases" ], "summary": "Attach a file to a case", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/cases/{caseId}/files
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAttach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- The location of the file that is being uploaded.\n", "operationId": "addCaseFileDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_case_id" } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/Cases_add_case_file_request" } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_case_response_properties" }, "examples": { "addCaseFileResponse": { "$ref": "#/components/examples/Cases_add_comment_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/{caseId}/user_actions": { "get": { "tags": [ "cases" ], "summary": "Get case activity", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}/user_actions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n", "operationId": "getCaseActivityDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Cases_user_actions_response_properties" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } }, "deprecated": true } }, "/api/cases/{caseId}/user_actions/_find": { "get": { "tags": [ "cases" ], "summary": "Find case activity", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/{caseId}/user_actions/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrives a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n", "operationId": "findCaseActivityDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_case_id" }, { "$ref": "#/components/parameters/Cases_page_index" }, { "$ref": "#/components/parameters/Cases_page_size" }, { "$ref": "#/components/parameters/Cases_sort_order" }, { "$ref": "#/components/parameters/Cases_user_action_types" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" }, "userActions": { "maxItems": 10000, "type": "array", "items": { "$ref": "#/components/schemas/Cases_user_actions_find_response_properties" } } } }, "examples": { "findCaseActivityResponse": { "$ref": "#/components/examples/Cases_find_case_activity_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/alerts/{alertId}": { "get": { "tags": [ "cases" ], "summary": "Get cases for an alert", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/alerts/{alertId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n", "operationId": "getCasesByAlertDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_alert_id" }, { "$ref": "#/components/parameters/Cases_owner_filter" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "maxItems": 10000, "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "The case identifier." }, "title": { "type": "string", "description": "The case title." } } }, "example": [ { "id": "06116b80-e1c3-11ec-be9b-9b1838238ee6", "title": "security_case" } ] } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } }, "x-state": "Technical preview" } }, "/api/cases/configure": { "get": { "tags": [ "cases" ], "summary": "Get case settings", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/configure
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet setting details such as the closure type, custom fields, templatse, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.\n", "operationId": "getCaseConfigurationDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_owner_filter" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "closure_type": { "$ref": "#/components/schemas/Cases_closure_types" }, "connector": { "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`." }, "id": { "type": "string", "description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } } }, "created_at": { "type": "string", "format": "date-time", "example": "2022-06-01T17:07:17.767Z" }, "created_by": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "customFields": { "type": "array", "items": { "type": "object", "properties": { "defaultValue": { "type": [ "boolean", "string" ], "description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n" }, "key": { "maxLength": 36, "minLength": 1, "type": "string", "description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n" }, "label": { "maxLength": 50, "minLength": 1, "type": "string", "description": "The custom field label that is displayed in the case." }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The type of the custom field." }, "required": { "type": "boolean", "description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n" } } }, "description": "Custom fields configuration details." }, "error": { "type": [ "null", "string" ], "example": "null" }, "id": { "type": "string", "example": "4a97a440-e1cd-11ec-be9b-9b1838238ee6" }, "mappings": { "type": "array", "items": { "type": "object", "properties": { "action_type": { "type": "string", "example": "overwrite" }, "source": { "type": "string", "example": "title" }, "target": { "type": "string", "example": "summary" } } } }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "templates": { "$ref": "#/components/schemas/Cases_templates" }, "updated_at": { "type": [ "null", "string" ], "format": "date-time", "example": "2022-06-01T19:58:48.169Z" }, "updated_by": { "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "version": { "type": "string", "example": "WzIwNzMsMV0=" } } } }, "examples": { "getConfigurationResponse": { "$ref": "#/components/examples/Cases_get_case_configuration_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } }, "post": { "tags": [ "cases" ], "summary": "Add case settings", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/cases/configure
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCase settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.\n", "operationId": "setCaseConfigurationDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_set_case_configuration_request" }, "examples": { "setCaseConfigRequest": { "$ref": "#/components/examples/Cases_set_case_configuration_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "closure_type": { "$ref": "#/components/schemas/Cases_closure_types" }, "connector": { "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`." }, "id": { "type": "string", "description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } } }, "created_at": { "type": "string", "format": "date-time", "example": "2022-06-01T17:07:17.767Z" }, "created_by": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "customFields": { "type": "array", "items": { "type": "object", "properties": { "defaultValue": { "type": [ "boolean", "string" ], "description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n" }, "key": { "maxLength": 36, "minLength": 1, "type": "string", "description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n" }, "label": { "maxLength": 50, "minLength": 1, "type": "string", "description": "The custom field label that is displayed in the case." }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The type of the custom field." }, "required": { "type": "boolean", "description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n" } } }, "description": "Custom fields configuration details." }, "error": { "type": [ "null", "string" ], "example": "null" }, "id": { "type": "string", "example": "4a97a440-e1cd-11ec-be9b-9b1838238ee6" }, "mappings": { "type": "array", "items": { "type": "object", "properties": { "action_type": { "type": "string", "example": "overwrite" }, "source": { "type": "string", "example": "title" }, "target": { "type": "string", "example": "summary" } } } }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "templates": { "$ref": "#/components/schemas/Cases_templates" }, "updated_at": { "type": [ "null", "string" ], "format": "date-time", "example": "2022-06-01T19:58:48.169Z" }, "updated_by": { "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "version": { "type": "string", "example": "WzIwNzMsMV0=" } } }, "examples": { "setCaseConfigResponse": { "$ref": "#/components/examples/Cases_set_case_configuration_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/configure/{configurationId}": { "patch": { "tags": [ "cases" ], "summary": "Update case settings", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/cases/configure/{configurationId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the case was created.\n", "operationId": "updateCaseConfigurationDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_kbn_xsrf" }, { "$ref": "#/components/parameters/Cases_configuration_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_update_case_configuration_request" }, "examples": { "updateCaseConfigurationRequest": { "$ref": "#/components/examples/Cases_update_case_configuration_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "closure_type": { "$ref": "#/components/schemas/Cases_closure_types" }, "connector": { "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`." }, "id": { "type": "string", "description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } } }, "created_at": { "type": "string", "format": "date-time", "example": "2022-06-01T17:07:17.767Z" }, "created_by": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "customFields": { "type": "array", "items": { "type": "object", "properties": { "defaultValue": { "type": [ "boolean", "string" ], "description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n" }, "key": { "maxLength": 36, "minLength": 1, "type": "string", "description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n" }, "label": { "maxLength": 50, "minLength": 1, "type": "string", "description": "The custom field label that is displayed in the case." }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The type of the custom field." }, "required": { "type": "boolean", "description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n" } } }, "description": "Custom fields configuration details." }, "error": { "type": [ "null", "string" ], "example": "null" }, "id": { "type": "string", "example": "4a97a440-e1cd-11ec-be9b-9b1838238ee6" }, "mappings": { "type": "array", "items": { "type": "object", "properties": { "action_type": { "type": "string", "example": "overwrite" }, "source": { "type": "string", "example": "title" }, "target": { "type": "string", "example": "summary" } } } }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "templates": { "$ref": "#/components/schemas/Cases_templates" }, "updated_at": { "type": [ "null", "string" ], "format": "date-time", "example": "2022-06-01T19:58:48.169Z" }, "updated_by": { "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "version": { "type": "string", "example": "WzIwNzMsMV0=" } } }, "examples": { "updateCaseConfigurationResponse": { "$ref": "#/components/examples/Cases_update_case_configuration_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/configure/connectors/_find": { "get": { "tags": [ "cases" ], "summary": "Get case connectors", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/configure/connectors/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n", "operationId": "findCaseConnectorsDefaultSpace", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "maxItems": 1000, "type": "array", "items": { "type": "object", "properties": { "actionTypeId": { "$ref": "#/components/schemas/Cases_connector_types" }, "config": { "type": "object", "properties": { "apiUrl": { "type": "string" }, "projectKey": { "type": "string" } } }, "id": { "type": "string" }, "isDeprecated": { "type": "boolean" }, "isMissingSecrets": { "type": "boolean" }, "isPreconfigured": { "type": "boolean" }, "name": { "type": "string" }, "referencedByCount": { "type": "integer" } } } }, "examples": { "findConnectorResponse": { "$ref": "#/components/examples/Cases_find_connector_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/reporters": { "get": { "tags": [ "cases" ], "summary": "Get case creators", "description": "Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.\n", "operationId": "getCaseReportersDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_owner_filter" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "maxItems": 10000, "type": "array", "items": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } } }, "examples": { "getReportersResponse": { "$ref": "#/components/examples/Cases_get_reporters_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/cases/status": { "get": { "tags": [ "cases" ], "summary": "Get case status summary", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nReturns the number of cases that are open, closed, and in progress. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find cases API instead. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n", "operationId": "getCaseStatusDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_owner_filter" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "count_closed_cases": { "type": "integer" }, "count_in_progress_cases": { "type": "integer" }, "count_open_cases": { "type": "integer" } } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } }, "deprecated": true } }, "/api/cases/tags": { "get": { "tags": [ "cases" ], "summary": "Get case tags", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/cases/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n", "operationId": "getCaseTagsDefaultSpace", "parameters": [ { "$ref": "#/components/parameters/Cases_owner_filter" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "maxItems": 10000, "type": "array", "items": { "type": "string" } }, "examples": { "getTagsResponse": { "$ref": "#/components/examples/Cases_get_tags_response" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cases_4xx_response" } } } } } } }, "/api/data_views": { "get": { "tags": [ "data views" ], "summary": "Get all data views", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/data_views
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getAllDataViewsDefault", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data_view": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "namespaces": { "type": "array", "items": { "type": "string" } }, "title": { "type": "string" }, "typeMeta": { "type": "object" } } } } } }, "examples": { "getAllDataViewsResponse": { "$ref": "#/components/examples/Data_views_get_data_views_response" } } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/data_view": { "post": { "tags": [ "data views" ], "summary": "Create a data view", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/data_view
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "createDataViewDefaultw", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_create_data_view_request_object" }, "examples": { "createDataViewRequest": { "$ref": "#/components/examples/Data_views_create_data_view_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_data_view_response_object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/data_view/{viewId}": { "delete": { "tags": [ "data views" ], "summary": "Delete a data view", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/data_views/data_view/{viewId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: When you delete a data view, it cannot be recovered.\n", "operationId": "deleteDataViewDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "responses": { "204": { "description": "Indicates a successful call." }, "404": { "description": "Object is not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_404_response" } } } } } }, "get": { "tags": [ "data views" ], "summary": "Get a data view", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/data_views/data_view/{viewId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getDataViewDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_view_id" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_data_view_response_object" }, "examples": { "getDataViewResponse": { "$ref": "#/components/examples/Data_views_get_data_view_response" } } } } }, "404": { "description": "Object is not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_404_response" } } } } } }, "post": { "tags": [ "data views" ], "summary": "Update a data view", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/data_view/{viewId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "updateDataViewDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_update_data_view_request_object" }, "examples": { "updateDataViewRequest": { "$ref": "#/components/examples/Data_views_update_data_view_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_data_view_response_object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/data_view/{viewId}/fields": { "post": { "tags": [ "data views" ], "summary": "Update data view fields metadata", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/data_view/{viewId}/fields
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate fields presentation metadata such as count, customLabel, customDescription, and format.\n", "operationId": "updateFieldsMetadataDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "fields" ], "type": "object", "properties": { "fields": { "type": "object", "description": "The field object." } } }, "examples": { "updateFieldsMetadataRequest": { "$ref": "#/components/examples/Data_views_update_field_metadata_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "acknowledged": { "type": "boolean" } } } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/data_view/{viewId}/runtime_field": { "post": { "tags": [ "data views" ], "summary": "Create a runtime field", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/data_view/{viewId}/runtime_field
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "createRuntimeFieldDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "runtimeField" ], "type": "object", "properties": { "name": { "type": "string", "description": "The name for a runtime field.\n" }, "runtimeField": { "type": "object", "description": "The runtime field definition object.\n" } } }, "examples": { "createRuntimeFieldRequest": { "$ref": "#/components/examples/Data_views_create_runtime_field_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } } } }, "put": { "tags": [ "data views" ], "summary": "Create or update a runtime field", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/data_views/data_view/{viewId}/runtime_field
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "createUpdateRuntimeFieldDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" }, { "name": "viewId", "in": "path", "description": "The ID of the data view fields you want to update.\n", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "runtimeField" ], "type": "object", "properties": { "name": { "type": "string", "description": "The name for a runtime field.\n" }, "runtimeField": { "type": "object", "description": "The runtime field definition object.\n" } } }, "examples": { "updateRuntimeFieldRequest": { "$ref": "#/components/examples/Data_views_create_runtime_field_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data_view": { "type": "object" }, "fields": { "type": "array", "items": { "type": "object" } } } } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/data_view/{viewId}/runtime_field/{fieldName}": { "delete": { "tags": [ "data views" ], "summary": "Delete a runtime field from a data view", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/data_views/data_view/{viewId}/runtime_field/{fieldName}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "deleteRuntimeFieldDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_field_name" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "responses": { "200": { "description": "Indicates a successful call." }, "404": { "description": "Object is not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_404_response" } } } } } }, "get": { "tags": [ "data views" ], "summary": "Get a runtime field", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/data_views/data_view/{viewId}/runtime_field/{fieldName}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getRuntimeFieldDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_field_name" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data_view": { "type": "object" }, "fields": { "type": "array", "items": { "type": "object" } } } }, "examples": { "getRuntimeFieldResponse": { "$ref": "#/components/examples/Data_views_get_runtime_field_response" } } } } }, "404": { "description": "Object is not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_404_response" } } } } } }, "post": { "tags": [ "data views" ], "summary": "Update a runtime field", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/data_view/{viewId}/runtime_field/{fieldName}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "updateRuntimeFieldDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_field_name" }, { "$ref": "#/components/parameters/Data_views_view_id" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "runtimeField" ], "type": "object", "properties": { "runtimeField": { "type": "object", "description": "The runtime field definition object.\n\nYou can update following fields:\n\n- `type`\n- `script`\n" } } }, "examples": { "updateRuntimeFieldRequest": { "$ref": "#/components/examples/Data_views_update_runtime_field_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call." }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/default": { "get": { "tags": [ "data views" ], "summary": "Get the default data view", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/data_views/default
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "getDefaultDataViewDefault", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data_view_id": { "type": "string" } } }, "examples": { "getDefaultDataViewResponse": { "$ref": "#/components/examples/Data_views_get_default_data_view_response" } } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } }, "post": { "tags": [ "data views" ], "summary": "Set the default data view", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/default
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "setDefaultDatailViewDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "data_view_id" ], "type": "object", "properties": { "data_view_id": { "type": [ "null", "string" ], "description": "The data view identifier. NOTE: The API does not validate whether it is a valid identifier. Use `null` to unset the default data view.\n" }, "force": { "type": "boolean", "description": "Update an existing default data view identifier.", "default": false } } }, "examples": { "setDefaultDataViewRequest": { "$ref": "#/components/examples/Data_views_set_default_data_view_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "acknowledged": { "type": "boolean" } } } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_400_response" } } } } } } }, "/api/data_views/swap_references": { "post": { "tags": [ "data views" ], "summary": "Swap saved object references", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/swap_references
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nChanges saved object references from one data view identifier to another. WARNING: Misuse can break large numbers of saved objects! Practicing with a backup is recommended.\n", "operationId": "swapDataViewsDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_swap_data_view_request_object" }, "examples": { "swapDataViewRequest": { "$ref": "#/components/examples/Data_views_swap_data_view_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "deleteStatus": { "type": "object", "properties": { "deletePerformed": { "type": "boolean" }, "remainingRefs": { "type": "integer" } } }, "result": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "A saved object identifier." }, "type": { "type": "string", "description": "The saved object type." } } } } } } } } } } } }, "/api/data_views/swap_references/_preview": { "post": { "tags": [ "data views" ], "summary": "Preview a saved object reference swap", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/data_views/swap_references/_preview
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPreview the impact of swapping saved object references from one data view identifier to another.\n", "operationId": "previewSwapDataViewsDefault", "parameters": [ { "$ref": "#/components/parameters/Data_views_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Data_views_swap_data_view_request_object" }, "examples": { "previewSwapDataViewRequest": { "$ref": "#/components/examples/Data_views_preview_swap_data_view_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "result": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "A saved object identifier." }, "type": { "type": "string", "description": "The saved object type." } } } } } } } } } } } }, "/api/detection_engine/index": { "delete": { "tags": [ "Security Detections API" ], "summary": "Delete an alerts index", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/detection_engine/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "DeleteAlertsIndex", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "acknowledged" ], "type": "object", "properties": { "acknowledged": { "type": "boolean" } } } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough permissions response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } }, "404": { "description": "Index does not exist response", "content": { "application/json": { "schema": { "type": "string" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Detections API" ], "summary": "Reads the alert index name if it exists", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/detection_engine/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "ReadAlertsIndex", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "name", "index_mapping_outdated" ], "type": "object", "properties": { "index_mapping_outdated": { "type": [ "null", "boolean" ] }, "name": { "type": "string" } } } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough permissions response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Detections API" ], "summary": "Create an alerts index", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "CreateAlertsIndex", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "acknowledged" ], "type": "object", "properties": { "acknowledged": { "type": "boolean" } } } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough permissions response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/privileges": { "get": { "tags": [ "Security Detections API" ], "summary": "Returns user privileges for the Kibana space", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/detection_engine/privileges
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieves whether or not the user is authenticated, and the user's Kibana\nspace and index privileges, which determine if the user can create an\nindex for the Elastic Security alerts generated by\ndetection engine rules.\n", "operationId": "ReadPrivileges", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "is_authenticated", "has_encryption_key" ], "type": "object", "properties": { "has_encryption_key": { "type": "boolean" }, "is_authenticated": { "type": "boolean" } } } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/rules": { "delete": { "tags": [ "Security Detections API" ], "summary": "Delete a detection rule", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `DELETE /api/detection_engine/rules?id=`\n* `rule_id`- `DELETE /api/detection_engine/rules?rule_id=`\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n", "operationId": "DeleteRule", "parameters": [ { "name": "id", "in": "query", "description": "The rule's `id` value.", "schema": { "$ref": "#/components/schemas/Security_Detections_API_UUID" } }, { "name": "rule_id", "in": "query", "description": "The rule's `rule_id` value.", "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" } } } } }, "x-codeSamples": [ { "lang": "cURL", "source": "curl \\\n --request DELETE https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n" } ] }, "get": { "tags": [ "Security Detections API" ], "summary": "Retrieve a detection rule", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `GET /api/detection_engine/rules?id=`\n* `rule_id` - `GET /api/detection_engine/rules?rule_id=`\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n", "operationId": "ReadRule", "parameters": [ { "name": "id", "in": "query", "description": "The rule's `id` value.", "schema": { "$ref": "#/components/schemas/Security_Detections_API_UUID" } }, { "name": "rule_id", "in": "query", "description": "The rule's `rule_id` value.", "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" } } ], "responses": { "200": { "description": "Indicates a successful call.\n> info\n> These fields are under development and their usage or schema may change: execution_summary.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" }, "examples": { "example1": { "summary": "Example response for a retrieved rule", "value": { "created_at": "2020-02-03T11:19:04.259Z", "created_by": "elastic", "description": "Process started by MS Office program in user folder", "enabled": false, "execution_summary": { "last_execution": { "date": "2022-03-23T16:06:12.787Z", "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", "metrics": { "execution_gap_duration_s": 0, "total_indexing_duration_ms": 15, "total_search_duration_ms": 135 }, "status": "partial failure", "status_order": 20 } }, "false_positives": [ ], "filters": [ { "query": { "match": { "event.action": { "query": "Process Create (rule: ProcessCreate)", "type": "phrase" } } } } ], "from": "now-4200s", "id": "c41d170b-8ba6-4de6-b8ec-76440a35ace3", "immutable": false, "interval": "1h", "language": "kuery", "max_signals": 100, "name": "MS Office child process", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "process.name", "type": "keyword" }, { "ecs": true, "name": "process.parent.name", "type": "keyword" } ], "risk_score": 21, "rule_id": "process_started_by_ms_office_user_folder", "setup": "", "severity": "low", "tags": [ "child process", "ms office" ], "threat": [ { "framework": "MITRE ATT&CK", "tactic": { "id": "TA0001", "name": "Initial Access", "reference": "https://attack.mitre.org/tactics/TA0001" }, "technique": [ { "id": "T1193", "name": "Spearphishing Attachment", "reference": "https://attack.mitre.org/techniques/T1193" } ] } ], "to": "now-300s", "type": "query", "updated_at": "2020-02-03T11:19:04.462Z", "updated_by": "elastic", "version": 1 } } } } } } }, "x-codeSamples": [ { "lang": "cURL", "source": "curl \\\n --request GET https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n" } ] }, "patch": { "tags": [ "Security Detections API" ], "summary": "Patch a detection rule", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing detection rule using the `rule_id` or `id` field.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n", "operationId": "PatchRule", "requestBody": { "description": "> info\n> You cannot modify the `id` or `rule_id` values.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RulePatchProps" }, "examples": { "example1": { "summary": "Patch query rule", "value": { "id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76", "name": "New name" } }, "example2": { "summary": "Patch EQL rule", "value": { "rule_id": "process_started_by_ms_office_program_possible_payload", "threat": [ { "framework": "MITRE ATT&CK", "tactic": { "id": "TA0001", "name": "Initial Access", "reference": "https://attack.mitre.org/tactics/TA0001" }, "technique": [ { "id": "T1193", "name": "Spearphishing Attachment", "reference": "https://attack.mitre.org/techniques/T1193" } ] } ] } }, "example3": { "summary": "Patch threshold rule", "value": { "id": "005d2c4f-51ca-493d-a2bd-20ef076339b1", "query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"", "threshold": { "cardinality": [ ], "field": [ ], "value": 600 } } }, "example4": { "summary": "Patch new terms rule", "value": { "history_window_start": "now-3d", "id": "569aac91-40dc-4807-a8ae-a2c8698089c4", "new_terms_fields": [ "Endpoint.policy.applied.artifacts.global.identifiers.name" ] } }, "example5": { "summary": "Patch esql rule", "value": { "id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd", "query": "FROM logs-abc*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp)\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) \n| KEEP event_rate\n" } }, "example6": { "summary": "Patch indicator match rule", "value": { "id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd", "threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"false\"" } }, "example7": { "summary": "Patch machine learning rule", "value": { "anomaly_threshold": 50, "id": "60b13926-289b-41b1-a537-197ef1fa5059", "machine_learning_job_id": [ "auth_high_count_logon_events" ] } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" }, "examples": { "example1": { "summary": "Example response for an updated rule", "value": { "actions": [ ], "created_at": "2020-04-07T14:51:09.755Z", "created_by": "elastic", "description": "Updated description for the rule.", "enabled": false, "false_positives": [ ], "filters": [ { "query": "null" } ], "from": "now-70m", "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1", "immutable": false, "interval": "1h", "language": "kuery", "max_signals": 100, "name": "Updated Rule Name", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "references": [ ], "related_integrations": [ { "package": "o365" } ], "required_fields": [ { "name": "process.parent.name" } ], "risk_score": 50, "rule_id": "process_started_by_ms_office_program", "setup": "", "severity": "low", "tags": [ "child process", "ms office" ], "threat": [ ], "to": "now", "type": "query", "updated_at": "2020-04-07T14:51:09.970Z", "updated_by": "elastic", "version": 2 } } } } } } } }, "post": { "tags": [ "Security Detections API" ], "summary": "Create a detection rule", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new detection rule.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n\nYou can create the following types of rules:\n\n* **Custom query**: Searches the defined indices and creates an alert when a document matches the rule's KQL query.\n* **Event correlation**: Searches the defined indices and creates an alert when results match an [Event Query Language (EQL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) query.\n* **Threshold**: Searches the defined indices and creates an alert when the number of times the specified field's value meets the threshold during a single execution. When there are multiple values that meet the threshold, an alert is generated for each value.\n For example, if the threshold `field` is `source.ip` and its `value` is `10`, an alert is generated for every source IP address that appears in at least 10 of the rule's search results. If you're interested, see [Terms Aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) for more information.\n* **Indicator match**: Creates an alert when fields match values defined in the specified [Elasticsearch index](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html). For example, you can create an index for IP addresses and use this index to create an alert whenever an event's `destination.ip` equals a value in the index. The index's field mappings should be [ECS-compliant](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html).\n* **New terms**: Generates an alert for each new term detected in source documents within a specified time range.\n* **ES|QL**: Uses [Elasticsearch Query Language (ES|QL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html) to find events and aggregate search results.\n* **Machine learning rules**: Creates an alert when a machine learning job discovers an anomaly above the defined threshold.\n> info\n> To create machine learning rules, you must have the [appropriate license](https://www.elastic.co/subscriptions) or use a [cloud deployment](https://cloud.elastic.co/registration). Additionally, for the machine learning rule to function correctly, the associated machine learning job must be running.\n\nTo retrieve machine learning job IDs, which are required to create machine learning jobs, call the [Elasticsearch Get jobs API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-job.html). Machine learning jobs that contain `siem` in the `groups` field can be used to create rules:\n\n```json\n...\n\"job_id\": \"linux_anomalous_network_activity_ecs\",\n\"job_type\": \"anomaly_detector\",\n\"job_version\": \"7.7.0\",\n\"groups\": [\n \"auditbeat\",\n \"process\",\n \"siem\"\n],\n...\n```\n\nAdditionally, you can set up notifications for when rules create alerts. The notifications use the [Alerting and Actions framework](https://www.elastic.co/guide/en/kibana/current/alerting-getting-started.html). Each action type requires a connector. Connectors store the information required to send notifications via external systems. The following connector types are supported for rule notifications:\n\n* Slack\n* Email\n* PagerDuty\n* Webhook\n* Microsoft Teams\n* IBM Resilient\n* Jira\n* ServiceNow ITSM\n> info\n> For more information on PagerDuty fields, see [Send a v2 Event](https://developer.pagerduty.com/docs/events-api-v2/trigger-events/).\n\nTo retrieve connector IDs, which are required to configure rule notifications, call the [Find objects API](https://www.elastic.co/guide/en/kibana/current/saved-objects-api-find.html) with `\"type\": \"action\"` in the request payload.\n\nFor detailed information on Kibana actions and alerting, and additional API calls, see:\n\n* [Alerting API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting)\n* [Alerting and Actions framework](https://www.elastic.co/guide/en/kibana/current/alerting-getting-started.html)\n* [Connectors API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-connectors)\n", "operationId": "CreateRule", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleCreateProps" }, "examples": { "example1": { "summary": "Query rule", "description": "Query rule that searches for processes started by MS Office", "value": { "description": "Process started by MS Office program - possible payload", "enabled": false, "filters": [ { "query": { "match": { "event.action": { "query": "Process Create (rule: ProcessCreate)", "type": "phrase" } } } } ], "from": "now-70m", "interval": "1h", "language": "kuery", "name": "MS Office child process", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "name": "process.parent.name", "type": "keyword" } ], "risk_score": 50, "rule_id": "process_started_by_ms_office_program", "severity": "low", "tags": [ "child process", "ms office" ], "type": "query" } }, "example2": { "summary": "Threshold rule", "description": "Threshold rule that detects multiple failed login attempts to a Windows host from the same external source IP address", "value": { "description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.", "enabled": true, "exceptions_list": [ { "id": "int-ips", "namespace_type": "single", "type": "detection" } ], "from": "now-180s", "index": [ "winlogbeat-*" ], "interval": "2m", "name": "Windows server prml-19", "query": "host.name:prml-19 and event.category:authentication and event.outcome:failure", "required_fields": [ { "name": "source.ip", "type": "ip" } ], "risk_score": 30, "rule_id": "liv-win-ser-logins", "severity": "low", "severity_mapping": [ { "field": "source.geo.city_name", "operator": "equals", "severity": "low", "value": "Manchester" }, { "field": "source.geo.city_name", "operator": "equals", "severity": "medium", "value": "London" }, { "field": "source.geo.city_name", "operator": "equals", "severity": "high", "value": "Birmingham" }, { "field": "source.geo.city_name", "operator": "equals", "severity": "critical", "value": "Wallingford" } ], "tags": [ "Brute force" ], "threshold": { "field": "source.ip", "value": 20 }, "type": "threshold" } }, "example3": { "summary": "Machine learning rule", "description": "Machine learning rule that creates alerts, and sends Slack notifications, when the linux_anomalous_network_activity_ecs machine learning job discovers anomalies with a threshold of 70 or above.", "value": { "actions": [ { "action_type_id": ".slack", "group": "default", "id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5", "params": { "message": "Urgent: {{context.rule.description}}" } } ], "anomaly_threshold": 70, "description": "Generates alerts when the job discovers anomalies over 70", "enabled": true, "from": "now-6m", "interval": "5m", "machine_learning_job_id": "linux_anomalous_network_activity_ecs", "name": "Anomalous Linux network activity", "note": "Shut down the internet.", "risk_score": 70, "rule_id": "ml_linux_network_high_threshold", "setup": "This rule requires data coming in from Elastic Defend.", "severity": "high", "tags": [ "machine learning", "Linux" ], "type": "machine_learning" } }, "example4": { "summary": "EQL rule", "description": "Event correlation rule that creates alerts when the Windows rundll32.exe process makes unusual network connections", "value": { "description": "Unusual rundll32.exe network connection", "language": "eql", "name": "rundll32.exe network connection", "query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]", "required_fields": [ { "name": "event.type", "type": "keyword" }, { "name": "process.args", "type": "keyword" }, { "name": "process.args_count", "type": "long" }, { "name": "process.entity_id", "type": "keyword" }, { "name": "process.name", "type": "keyword" }, { "name": "process.pe.original_file_name", "type": "keyword" } ], "risk_score": 21, "rule_id": "eql-outbound-rundll32-connections", "severity": "low", "tags": [ "EQL", "Windows", "rundll32.exe" ], "type": "eql" } }, "example5": { "summary": "Indicator match rule", "description": "Indicator match rule that creates an alert when one of the following is true: The event's destination IP address and port number matches destination IP and port values in the threat_index index; The event's source IP address matches a host IP address value in the threat_index index.\n", "value": { "actions": [ ], "description": "Checks for bad IP addresses listed in the ip-threat-list index", "index": [ "packetbeat-*" ], "name": "Bad IP threat match", "query": "destination.ip:* or host.ip:*", "required_fields": [ { "name": "destination.ip", "type": "ip" }, { "name": "destination.port", "type": "long" }, { "name": "host.ip", "type": "ip" } ], "risk_score": 50, "severity": "medium", "threat_index": [ "ip-threat-list" ], "threat_mapping": [ { "entries": [ { "field": "destination.ip", "type": "mapping", "value": "destination.ip" }, { "field": "destination.port", "type": "mapping", "value": "destination.port" } ] }, { "entries": [ { "field": "source.ip", "type": "mapping", "value": "host.ip" } ] } ], "threat_query": "*:*", "type": "threat_match" } }, "example6": { "summary": "New terms rule", "description": "New terms rule that creates alerts a new IP address is detected for a user", "value": { "description": "Detects a user associated with a new IP address", "history_window_start": "now-30d", "index": [ "auditbeat*" ], "language": "kuery", "name": "New User IP Detected", "new_terms_fields": [ "user.id", "source.ip" ], "query": "*", "required_fields": [ { "name": "user.id", "type": "keyword" }, { "name": "source.ip", "type": "ip" } ], "risk_score": 21, "severity": "medium", "type": "new_terms" } }, "example7": { "summary": "Esql rule", "description": "esql rule that creates alerts from events that match an Excel parent process", "value": { "description": "Find Excel events", "enabled": false, "from": "now-360s", "interval": "5m", "language": "esql", "name": "Find Excel events", "query": "from auditbeat-8.10.2 METADATA _id, _version, _index | where process.parent.name == \"EXCEL.EXE\"", "required_fields": [ { "name": "process.parent.name", "type": "keyword" } ], "risk_score": 21, "severity": "low", "tags": [ ], "to": "now", "type": "esql" } }, "example8": { "summary": "Query rule 2", "description": "Query rule that searches for processes started by MS Office and suppresses alerts by the process.parent.name field within a 5-hour time period", "value": { "alert_suppression": { "duration": { "unit": "h", "value": 5 }, "group_by": [ "process.parent.name" ], "missing_fields_strategy": "suppress" }, "description": "Process started by MS Office program - possible payload", "enabled": false, "filters": [ { "query": { "match": { "event.action": { "query": "Process Create (rule: ProcessCreate)", "type": "phrase" } } } } ], "from": "now-70m", "interval": "1h", "language": "kuery", "name": "MS Office child process", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "risk_score": 50, "rule_id": "process_started_by_ms_office_program", "severity": "low", "tags": [ "child process", "ms office" ], "type": "query" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" }, "examples": { "example1": { "summary": "Query rule response", "description": "Example response for a query rule", "value": { "actions": [ ], "created_at": "2020-04-07T14:51:09.755Z", "created_by": "elastic", "description": "Process started by MS Office program - possible payload", "enabled": false, "false_positives": [ ], "filters": [ { "query": { "match": { "event.action": { "query": "Process Create (rule: ProcessCreate)", "type": "phrase" } } } } ], "from": "now-70m", "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1", "immutable": false, "interval": "1h", "language": "kuery", "max_signals": 100, "name": "MS Office child process", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" }, { "integration": "graphactivitylogs", "package": "azure", "version": "^1.11.4" } ], "required_fields": [ { "ecs": true, "name": "process.parent.name", "type": "keyword" } ], "risk_score": 50, "rule_id": "process_started_by_ms_office_program", "setup": "", "severity": "low", "tags": [ "child process", "ms office" ], "threat": [ ], "to": "now", "type": "query", "updated_at": "2020-04-07T14:51:09.970Z", "updated_by": "elastic", "version": 1 } }, "example2": { "summary": "Machine learning response", "description": "Example response for a machine learning job rule", "value": { "actions": [ { "action_type_id": ".slack", "frequency": { "notifyWhen": "onActiveAlert", "summary": true, "throttle": "null" }, "group": "default", "id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5", "params": { "message": "Urgent: {{context.rule.description}}" } } ], "anomaly_threshold": 70, "created_at": "2020-04-07T14:45:15.679Z", "created_by": "elastic", "description": "Generates alerts when the job discovers anomalies over 70", "enabled": true, "false_positives": [ ], "from": "now-6m", "id": "83876f66-3a57-4a99-bf37-416494c80f3b", "immutable": false, "interval": "5m", "machine_learning_job_id": "linux_anomalous_network_activity_ecs", "max_signals": 100, "name": "Anomalous Linux network activity", "note": "Shut down the internet.", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "risk_score": 70, "rule_id": "ml_linux_network_high_threshold", "setup": "", "severity": "high", "status": "going to run", "status_date": "2020-04-07T14:45:21.685Z", "tags": [ "machine learning", "Linux" ], "threat": [ ], "to": "now", "type": "machine_learning", "updated_at": "2020-04-07T14:45:15.892Z", "updated_by": "elastic", "version": 1 } }, "example3": { "summary": "Threshold rule response", "description": "Example response for a threshold rule", "value": { "actions": [ ], "author": [ ], "created_at": "2020-07-22T10:27:23.486Z", "created_by": "elastic", "description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.", "enabled": true, "exceptions_list": [ { "id": "int-ips", "namespace_type": "single", "type": "detection" } ], "false_positives": [ ], "from": "now-180s", "id": "15dbde26-b627-4d74-bb1f-a5e0ed9e4993", "immutable": false, "index": [ "winlogbeat-*" ], "interval": "2m", "language": "kuery", "max_signals": 100, "name": "Windows server prml-19", "query": "host.name:prml-19 and event.category:authentication and event.outcome:failure", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "source.ip", "type": "ip" } ], "risk_score": 30, "risk_score_mapping": [ ], "rule_id": "liv-win-ser-logins", "setup": "", "severity": "low", "severity_mapping": [ { "field": "source.geo.city_name", "operator": "equals", "severity": "low", "value": "Manchester" }, { "field": "source.geo.city_name", "operator": "equals", "severity": "medium", "value": "London" }, { "field": "source.geo.city_name", "operator": "equals", "severity": "high", "value": "Birmingham" }, { "field": "source.geo.city_name", "operator": "equals", "severity": "critical", "value": "Wallingford" } ], "tags": [ "Brute force" ], "threat": [ ], "threshold": { "field": "source.ip", "value": 20 }, "to": "now", "type": "threshold", "updated_at": "2020-07-22T10:27:23.673Z", "updated_by": "elastic", "version": 1 } }, "example4": { "summary": "EQL rule response", "description": "Example response for an EQL rule", "value": { "author": [ ], "created_at": "2020-10-05T09:06:16.392Z", "created_by": "elastic", "description": "Unusual rundll32.exe network connection", "enabled": true, "exceptions_list": [ ], "false_positives": [ ], "from": "now-6m", "id": "93808cae-b05b-4dc9-8479-73574b50f8b1", "immutable": false, "interval": "5m", "language": "eql", "max_signals": 100, "name": "rundll32.exe network connection", "query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "event.type", "type": "keyword" }, { "ecs": true, "name": "process.args", "type": "keyword" }, { "ecs": true, "name": "process.args_count", "type": "long" }, { "ecs": true, "name": "process.entity_id", "type": "keyword" }, { "ecs": true, "name": "process.name", "type": "keyword" }, { "ecs": true, "name": "process.pe.original_file_name", "type": "keyword" } ], "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "eql-outbound-rundll32-connections", "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ "EQL", "Windows", "rundll32.exe" ], "threat": [ ], "throttle": "no_actions", "to": "now", "type": "eql", "updated_at": "2020-10-05T09:06:16.403Z", "updated_by": "elastic", "version": 1 } }, "example5": { "summary": "Indicator match rule response", "description": "Example response for an indicator match rule", "value": { "author": [ ], "created_at": "2020-10-06T07:07:58.227Z", "created_by": "elastic", "description": "Checks for bad IP addresses listed in the ip-threat-list index", "enabled": true, "exceptions_list": [ ], "false_positives": [ ], "from": "now-6m", "id": "d5daa13f-81fb-4b13-be2f-31011e1d9ae1", "immutable": false, "index": [ "packetbeat-*" ], "interval": "5m", "language": "kuery", "max_signals": 100, "name": "Bad IP threat match", "query": "destination.ip:* or host.ip:*", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "destination.ip", "type": "ip" }, { "ecs": true, "name": "destination.port", "type": "long" }, { "ecs": true, "name": "host.ip", "type": "ip" } ], "risk_score": 50, "risk_score_mapping": [ ], "rule_id": "608501e4-c768-4f64-9326-cec55b5d439b", "setup": "", "severity": "medium", "severity_mapping": [ ], "tags": [ ], "threat": [ ], "threat_index": [ "ip-threat-list" ], "threat_mapping": [ { "entries": [ { "field": "destination.ip", "type": "mapping", "value": "destination.ip" }, { "field": "destination.port", "type": "mapping", "value": "destination.port" } ] }, { "entries": [ { "field": "source.ip", "type": "mapping", "value": "host.ip" } ] } ], "threat_query": "*:*", "to": "now", "type": "threat_match", "updated_at": "2020-10-06T07:07:58.237Z", "updated_by": "elastic", "version": 1 } }, "example6": { "summary": "New terms rule response", "description": "Example response for a new terms rule", "value": { "author": [ ], "created_at": "2020-10-06T07:07:58.227Z", "created_by": "elastic", "description": "Detects a user associated with a new IP address", "enabled": true, "exceptions_list": [ ], "false_positives": [ ], "from": "now-6m", "history_window_start": "now-30d", "id": "eb7225c0-566b-11ee-8b4f-bbf3afdeb9f4", "immutable": false, "index": [ "auditbeat*" ], "interval": "5m", "language": "kuery", "max_signals": 100, "name": "New User IP Detected", "new_terms_fields": [ "user.id", "source.ip" ], "query": "*", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "user.id", "type": "keyword" }, { "ecs": true, "name": "source.ip", "type": "ip" } ], "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "c6f5d0bc-7be9-47d4-b2f3-073d22641e30", "setup": "", "severity": "medium", "severity_mapping": [ ], "tags": [ ], "threat": [ ], "to": "now", "type": "new_terms", "updated_at": "2020-10-06T07:07:58.237Z", "updated_by": "elastic", "version": 1 } }, "example7": { "summary": "Esql rule response", "description": "Example response for an Esql rule", "value": { "actions": [ ], "author": [ ], "created_at": "2023-10-18T10:55:14.269Z", "created_by": "elastic", "description": "Find Excel events", "enabled": false, "exceptions_list": [ ], "false_positives": [ ], "from": "now-360s", "id": "d0f20490-6da4-11ee-b85e-09e9b661f2e2", "immutable": false, "interval": "5m", "language": "esql", "max_signals": 100, "name": "Find Excel events", "output_index": "", "query": "from auditbeat-8.10.2 METADATA _id | where process.parent.name == \"EXCEL.EXE\"", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "process.parent.name", "type": "keyword" } ], "revision": 0, "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "e4b53a89-debd-4a0d-a3e3-20606952e589", "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ ], "threat": [ ], "to": "now", "type": "esql", "updated_at": "2023-10-18T10:55:14.269Z", "updated_by": "elastic", "version": 1 } } } } } } } }, "put": { "tags": [ "Security Detections API" ], "summary": "Update a detection rule", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/detection_engine/rules
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n", "operationId": "UpdateRule", "requestBody": { "description": "> info\n> All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleUpdateProps" }, "examples": { "example1": { "summary": "Update query rule", "value": { "description": "A new description", "id": "14b7b513-3d8d-4b22-b7da-a7ae632f7e76", "name": "A new name for the rule", "risk_score": 22, "severity": "medium", "type": "query" } }, "example2": { "summary": "Update EQL rule", "value": { "description": "eql rule test", "id": "9b684efb-acf9-4323-9bff-8335b3867d14", "index": [ "apm-*-transaction*" ], "language": "eql", "name": "New name for EQL rule", "query": "process where process.name == \"regsvr32.exe\"", "risk_score": 21, "severity": "low", "type": "eql" } }, "example3": { "summary": "Update threshold rule", "value": { "description": "Description of threat rule test", "id": "005d2c4f-51ca-493d-a2bd-20ef076339b1", "language": "kuery", "name": "New name for threat rule", "query": "agent.version : * and agent.id : \"243d9b4f-ca01-4311-8e5c-9abbee91afd8\"", "risk_score": 21, "severity": "low", "tags": [ "new_tag" ], "threshold": { "cardinality": [ ], "field": [ ], "value": 400 }, "type": "threshold" } }, "example4": { "summary": "Update new terms rule", "value": { "description": "New description", "history_window_start": "now-7d", "id": "569aac91-40dc-4807-a8ae-a2c8698089c4", "interval": "5m", "name": "New terms rule name", "new_terms_fields": [ "Endpoint.policy.applied.artifacts.global.identifiers.name" ], "query": "agent.version : \"9.1.0\"", "risk_score": 21, "severity": "low", "type": "new_terms" } }, "example5": { "summary": "Update esql rule", "value": { "description": "New description for esql rule", "id": "0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd", "language": "esql", "name": "New name for esql rule", "query": "FROM logs*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */\n| KEEP event_rate\n", "risk_score": 21, "severity": "low", "type": "esql" } }, "example6": { "summary": "Update indicator match rule", "value": { "description": "New description", "id": "462f1986-10fe-40a3-a22c-2b1c9c4c48fd", "name": "New name for Indicator Match rule", "query": "source.ip:* or destination.ip:*\\n", "risk_score": 99, "severity": "critical", "threat_index": [ "filebeat-*", "logs-ti_*" ], "threat_mapping": [ { "entries": [ { "field": "source.ip", "type": "mapping", "value": "threat.indicator.ip" } ] }, { "entries": [ { "field": "destination.ip", "type": "mapping", "value": "threat.indicator.ip" } ] } ], "threat_query": "@timestamp >= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"", "type": "threat_match" } }, "example7": { "summary": "Update machine learning rule", "value": { "anomaly_threshold": 50, "description": "New description of ml rule", "id": "60b13926-289b-41b1-a537-197ef1fa5059", "machine_learning_job_id": [ "auth_high_count_logon_events" ], "name": "New name of ml rule", "risk_score": 21, "severity": "low", "type": "machine_learning" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" }, "examples": { "example1": { "summary": "Example response for an updated rule", "value": { "actions": [ ], "created_at": "2020-04-07T14:51:09.755Z", "created_by": "elastic", "description": "Updated description for the rule.", "enabled": false, "false_positives": [ ], "filters": [ { "query": "null" } ], "from": "now-70m", "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1", "immutable": false, "interval": "1h", "language": "kuery", "max_signals": 100, "name": "Updated Rule Name", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "references": [ ], "related_integrations": [ { "package": "o365" } ], "required_fields": [ { "name": "process.parent.name" } ], "risk_score": 50, "rule_id": "process_started_by_ms_office_program", "setup": "", "severity": "low", "tags": [ "child process", "ms office" ], "threat": [ ], "to": "now", "type": "query", "updated_at": "2020-04-07T14:51:09.970Z", "updated_by": "elastic", "version": 2 } } } } } } } } }, "/api/detection_engine/rules/_bulk_action": { "post": { "tags": [ "Security Detections API" ], "summary": "Apply a bulk action to detection rules", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.\n\nThe edit action allows you to add, delete, or set tags, index patterns, investigation fields, rule actions and schedules for multiple rules at once. \nThe edit action is idempotent, meaning that if you add a tag to a rule that already has that tag, no changes are made. The same is true for other edit actions, for example removing an index pattern that is not specified in a rule will not result in any changes. The only exception is the `add_rule_actions` and `set_rule_actions` action, which is non-idempotent. This means that if you add or set a rule action to a rule that already has that action, a new action is created with a new unique ID.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n", "operationId": "PerformRulesBulkAction", "parameters": [ { "name": "dry_run", "in": "query", "description": "Enables dry run mode for the request call.\n\nEnable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.\n\nTo enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.\n> info\n> Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.\n", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_BulkDeleteRules" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkDisableRules" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkEnableRules" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkExportRules" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkDuplicateRules" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkManualRuleRun" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkManualRuleFillGaps" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkEditRules" } ] }, "examples": { "example01": { "summary": "Enable - Enable all rules with the test tag", "description": "The following request activates all rules with the test tag.", "value": { "action": "enable", "query": "alert.attributes.tags: \"test\"" } }, "example02": { "summary": "Enable - Enable a specific rule by ID.", "description": "The following request enables the rule with the specified ID.", "value": { "action": "enable", "ids": [ "748694f0-6977-4ea5-8384-cd2e39730779" ] } }, "example03": { "summary": "Disable - Disable a specific rule by ID", "description": "The following request disables the rule with the specified ID.", "value": { "action": "disable", "ids": [ "748694f0-6977-4ea5-8384-cd2e39730779" ] } }, "example04": { "summary": "Duplicate - Duplicate rules with specific IDs", "description": "The following request duplicates rules with the specified IDs, including exceptions but not expired exceptions.", "value": { "action": "duplicate", "duplicate": { "include_exceptions": true, "include_expired_exceptions": false }, "ids": [ "748694f0-6977-4ea5-8384-cd2e39730779", "461a4c22-416e-4009-a9a7-cf79656454bf" ] } }, "example05": { "summary": "Delete - Delete a specific rule by ID", "description": "The following request deletes the rule with the specified ID.", "value": { "action": "delete", "ids": [ "cf4abfd1-7c37-4519-ab0f-5ea5c75fac60" ] } }, "example06": { "summary": "Run - Run a specific rule by ID", "description": "The following request runs the rule with the specified ID within the given date range.", "value": { "action": "run", "ids": [ "748694f0-6977-4ea5-8384-cd2e39730779" ], "run": { "end_date": "2025-03-10T23:59:59.999Z", "start_date": "2025-03-01T00:00:00.000Z" } } }, "example07": { "summary": "Export - Export specific rules by ID", "description": "The following request exports the rules with the specified IDs.", "value": { "action": "export", "ids": [ "748694f0-6977-4ea5-8384-cd2e39730779" ] } }, "example08": { "summary": "Edit - dry run - Validate add_index_patterns bulk action", "description": "The following request will validate that the add_index_patterns bulk action can be successfully applied to three rules. The dry_run parameter is specified in query parameters, e.g. POST api/detection_engine/rules/_bulk_action?dry_run=true", "value": { "action": "edit", "edit": [ { "type": "add_index_patterns", "value": [ "test-*" ] } ], "ids": [ "81aa0480-06af-11ed-94fb-dd1a0597d8d2", "dc015d10-0831-11ed-ac8b-05a222bd8d4a", "de8f5af0-0831-11ed-ac8b-05a222bd8d4a" ] } }, "example09": { "summary": "Edit - Add a tag to rules (idempotent)", "description": "The following request adds the tag \"tag-1\" to the rules with the specified IDs. If the tag already exists for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "add_tags", "value": [ "tag-1" ] } ], "ids": [ "8bc7dad0-9320-11ec-9265-8b772383a08d", "8e5c1a40-9320-11ec-9265-8b772383a08d" ] } }, "example10": { "summary": "Edit - Add two tags to rules (idempotent)", "description": "The following request adds two tags at the same time, tag-1 and tag-2, to the rules that have the IDs sent in the payload. If the tags already exist for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "add_tags", "value": [ "tag-1", "tag-2" ] } ], "ids": [ "8bc7dad0-9320-11ec-9265-8b772383a08d", "8e5c1a40-9320-11ec-9265-8b772383a08d" ] } }, "example11": { "summary": "Edit - Delete a tag from rules (idempotent)", "description": "The following request removes the tag \"tag-1\" from the rules with the specified IDs. If the tag does not exist for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "delete_tags", "value": [ "tag-1" ] } ], "ids": [ "8bc7dad0-9320-11ec-9265-8b772383a08d", "8e5c1a40-9320-11ec-9265-8b772383a08d" ] } }, "example12": { "summary": "Edit - Set (overwrite existing) tags for rules (idempotent)", "description": "The following request sets the tags \"tag-1\" and \"tag-2\" for the rules with the specified IDs, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "set_tags", "value": [ "tag-1", "tag-2" ] } ], "ids": [ "8bc7dad0-9320-11ec-9265-8b772383a08d", "8e5c1a40-9320-11ec-9265-8b772383a08d" ] } }, "example13": { "summary": "Edit - Add index patterns to rules (idempotent)", "description": "The following request adds the index pattern \"test-*\" to the rules with the specified IDs. If the index pattern already exists for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "add_index_patterns", "value": [ "test-*" ] } ], "ids": [ "81aa0480-06af-11ed-94fb-dd1a0597d8d2", "dc015d10-0831-11ed-ac8b-05a222bd8d4a" ] } }, "example14": { "summary": "Edit - Remove index patterns from rules (idempotent)", "description": "The following request removes the index pattern \"test-*\" from the rules with the specified IDs. If the index pattern does not exist for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "delete_index_patterns", "value": [ "test-*" ] } ], "ids": [ "81aa0480-06af-11ed-94fb-dd1a0597d8d2", "dc015d10-0831-11ed-ac8b-05a222bd8d4a" ] } }, "example15": { "summary": "Edit - Set (overwrite existing) index patterns for rules patterns (idempotent)", "description": "The following request sets the index patterns \"test-*\" and \"prod-*\" for the rules with the specified IDs, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "set_index_patterns", "value": [ "test-*" ] } ], "ids": [ "81aa0480-06af-11ed-94fb-dd1a0597d8d2", "dc015d10-0831-11ed-ac8b-05a222bd8d4a" ] } }, "example16": { "summary": "Edit - Add investigation field to rules", "description": "The following request adds investigation field to the rules with the specified IDs.", "value": { "action": "edit", "edit": [ { "type": "add_investigation_fields", "value": { "field_names": [ "alert.status" ] } } ], "ids": [ "12345678-1234-1234-1234-1234567890ab", "87654321-4321-4321-4321-0987654321ba" ] } }, "example17": { "summary": "Edit - Delete investigation fields from rules (idempotent)", "description": "The following request deletes investigation fields from the rules with the specified IDs. If the field does not exist for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "delete_investigation_fields" } ], "ids": [ "12345678-1234-1234-1234-1234567890ab", "87654321-4321-4321-4321-0987654321ba" ], "value": [ "field1", "field2" ] } }, "example18": { "summary": "Edit - Set (overwrite existing) investigation fields for rules (idempotent)", "description": "The following request sets investigation fields for the rules with the specified IDs, overwriting any existing investigation fields. If the set of investigation fields is the same as the existing investigation fields, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "set_investigation_fields", "value": [ "field1", "field2" ] } ], "ids": [ "12345678-1234-1234-1234-1234567890ab", "87654321-4321-4321-4321-0987654321ba" ] } }, "example19": { "summary": "Edit - Set (overwrite existing) timeline template for rules (idempotent)", "description": "The following request sets a timeline template for the rules with the specified IDs. If the same timeline template is already set for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "set_timeline", "value": { "timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd", "timeline_title": "Alerts Involving a Single User Timeline" } } ], "ids": [ "eacdfc95-e007-41c9-986e-4b2cbdfdc71b" ] } }, "example20": { "summary": "Edit - Set (overwrite existing) schedule for rules (idempotent)", "description": "The following request sets a schedule for the rules with the specified IDs. If the same schedule is already set for a rule, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "set_schedule", "value": { "interval": "1h", "lookback": "30m" } } ], "ids": [ "99887766-5544-3322-1100-aabbccddeeff" ] } }, "example21": { "summary": "Edit - Add rule actions to rules (non-idempotent)", "description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.", "value": { "action": "edit", "edit": [ { "type": "add_rule_actions", "value": { "actions": [ { "group": "default", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "body": "The message body" } } ] } } ], "ids": [ "9e946bfc-3118-4c77-bb25-67d781191928" ] } }, "example22": { "summary": "Edit - Set (overwrite existing) rule actions for rules (non-idempotent)", "description": "The following request sets rule actions for the rules with the specified IDs. Each action receives its own unique ID.", "value": { "action": "edit", "edit": [ { "type": "set_rule_actions", "value": { "actions": [ { "group": "default", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "body": "The message body" } } ] } } ], "ids": [ "9e946bfc-3118-4c77-bb25-67d781191928" ] } }, "example23": { "summary": "Edit - Add rule actions to rules for a webhook connector", "description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.", "value": { "action": "edit", "edit": [ { "type": "add_rule_actions", "value": { "actions": [ { "group": "default3", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "body": "The message body" } } ] } } ], "ids": [ "9e946bfc-3118-4c77-bb25-67d781191921" ] } }, "example24": { "summary": "Edit - Add rule actions to rules for an email connector", "description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.", "value": { "action": "edit", "edit": [ { "type": "add_rule_actions", "value": { "actions": [ { "group": "default3", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "message": "The message body", "subject": "Subject", "to": "address@domain.com" } } ] } } ], "ids": [ "9e946bfc-3118-4c77-bb25-67d781191921" ] } }, "example25": { "summary": "Edit - Add rule actions to rules for a slack connector", "description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.", "value": { "action": "edit", "edit": [ { "type": "add_rule_actions", "value": { "actions": [ { "group": "default3", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "message": "The content of the message" } } ] } } ], "ids": [ "9e946bfc-3118-4c77-bb25-67d781191921" ] } }, "example26": { "summary": "Edit - Add rule actions to rules for a PagerDuty connector", "description": "The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.", "value": { "action": "edit", "edit": [ { "type": "add_rule_actions", "value": { "actions": [ { "group": "default3", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "eventAction": "trigger", "severity": "critical", "summary": "The message body", "timestamp": "2023-10-31T00:00:00Z" } } ] } } ], "ids": [ "9e946bfc-3118-4c77-bb25-67d781191921" ] } }, "example27": { "summary": "Edit - Set alert suppression to rules (idempotent)", "description": "The following request set alert suppression to the rules with the specified IDs.", "value": { "action": "edit", "edit": [ { "type": "set_alert_suppression", "value": { "duration": { "unit": "h", "value": 1 }, "group_by": [ "source.ip" ], "missing_fields_strategy": "suppress" } } ], "ids": [ "12345678-1234-1234-1234-1234567890ab", "87654321-4321-4321-4321-0987654321ba" ] } }, "example28": { "summary": "Edit - Set alert suppression to threshold rules (idempotent)", "description": "The following request set alert suppression to threshold rules with the specified IDs.", "value": { "action": "edit", "edit": [ { "type": "set_alert_suppression_for_threshold", "value": { "duration": { "unit": "h", "value": 1 } } } ], "ids": [ "12345678-1234-1234-1234-1234567890ab", "87654321-4321-4321-4321-0987654321ba" ] } }, "example29": { "summary": "Edit - Removes alert suppression from rules (idempotent)", "description": "The following request removes alert suppression from the rules with the specified IDs. If the rules do not have alert suppression, no changes are made.", "value": { "action": "edit", "edit": [ { "type": "delete_alert_suppression" } ], "ids": [ "12345678-1234-1234-1234-1234567890ab", "87654321-4321-4321-4321-0987654321ba" ] } }, "example30": { "summary": "Fill Gaps - Manually trigger the filling of gaps for specified rules", "description": "The following request triggers the filling of gaps for the specified rule ids and time range", "value": { "action": "fill_gaps", "ids": [ "748694f0-6977-4ea5-8384-cd2e39730779", "164d0918-f720-4c9f-9f5c-c5122587cf19" ], "run": { "end_date": "2025-03-10T23:59:59.999Z", "start_date": "2025-03-01T00:00:00.000Z" } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_BulkEditActionResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkExportActionResponse" } ] }, "examples": { "example01": { "summary": "Successful response", "description": "In this response one rule was updated and one was skipped. Objects returned in attributes.results.skipped will only include rules' id, name, and skip_reason.", "value": { "attributes": { "results": { "created": [ ], "deleted": [ ], "skipped": [ { "id": "51658332-a15e-4c9e-912a-67214e2e2359", "name": "Skipped rule", "skip_reason": "RULE_NOT_MODIFIED" } ], "updated": [ { "anomaly_threshold": 50, "author": [ "Elastic" ], "created_at": "2022-02-21T14:14:13.801Z", "created_by": "elastic", "description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", "enabled": true, "exceptions_list": [ ], "execution_summary": { "last_execution": { "date": "2022-03-23T16:06:12.787Z", "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", "metrics": { "execution_gap_duration_s": 0, "total_indexing_duration_ms": 15, "total_search_duration_ms": 135 }, "status": "partial failure", "status_order": 20 } }, "false_positives": [ "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded." ], "from": "now-45m", "id": "8bc7dad0-9320-11ec-9265-8b772383a08d", "immutable": false, "interval": "15m", "license": "Elastic License v2", "machine_learning_job_id": [ "packetbeat_dns_tunneling" ], "max_signals": 100, "name": "DNS Tunneling [Duplicate]", "references": [ "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" ], "related_integrations": [ ], "required_fields": [ ], "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "7289bf08-4e91-4c70-bf01-e04c4c5d7756", "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ "Elastic", "Network", "Threat Detection", "ML" ], "threat": [ ], "to": "now", "type": "machine_learning", "updated_at": "2022-02-21T17:05:50.883Z", "updated_by": "elastic", "version": 6 } ] }, "summary": { "failed": 0, "skipped": 1, "succeeded": 1, "total": 2 } }, "rules_count": 1, "success": true } }, "example02": { "summary": "Partial failure", "description": "If processing of any rule fails, a partial error outputs the ID and/or name of the affected rule and the corresponding error, as well as successfully processed rules (in the same format as a successful 200 request).", "value": { "value": { "attributes": { "errors": [ { "message": "Index patterns can't be added. Machine learning rule doesn't have index patterns property", "rules": [ { "id": "8bc7dad0-9320-11ec-9265-8b772383a08d", "name": "DNS Tunneling [Duplicate]" } ], "status_code": 500 } ], "results": { "created": [ ], "deleted": [ ], "skipped": [ ], "updated": [ { "actions": [ ], "author": [ "Elastic" ], "created_at": "2022-02-21T14:14:17.883Z", "created_by": "elastic", "description": "Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.", "enabled": true, "exceptions_list": [ ], "execution_summary": { "last_execution": { "date": "2022-03-23T16:06:12.787Z", "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", "metrics": { "execution_gap_duration_s": 0, "total_indexing_duration_ms": 15, "total_search_duration_ms": 135 }, "status": "partial failure", "status_order": 20 } }, "false_positives": [ ], "from": "now-6m", "id": "8e5c1a40-9320-11ec-9265-8b772383a08d", "immutable": false, "index": [ "apm-*-transaction*", "traces-apm*", "auditbeat-*", "filebeat-*", "logs-*", "packetbeat-*", "winlogbeat-*", "added-by-id-*" ], "interval": "5m", "language": "kuery", "license": "Elastic License v2", "max_signals": 10000, "name": "External Alerts [Duplicate]", "query": "event.kind:alert and not event.module:(endgame or endpoint)\n", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "risk_score": 47, "risk_score_mapping": [ { "field": "event.risk_score", "operator": "equals", "value": "" } ], "rule_id": "941faf98-0cdc-4569-b16d-4af962914d61", "rule_name_override": "message", "setup": "", "severity": "medium", "severity_mapping": [ { "field": "event.severity", "operator": "equals", "severity": "low", "value": "21" }, { "field": "event.severity", "operator": "equals", "severity": "medium", "value": "47" }, { "field": "event.severity", "operator": "equals", "severity": "high", "value": "73" }, { "field": "event.severity", "operator": "equals", "severity": "critical", "value": "99" } ], "tags": [ "Elastic", "Network", "Windows", "APM", "macOS", "Linux" ], "threat": [ ], "timestamp_override": "event.ingested", "to": "now", "type": "query", "updated_at": "2022-02-21T16:56:22.818Z", "updated_by": "elastic", "version": 5 } ] }, "summary": { "failed": 1, "skipped": 0, "succeeded": 1, "total": 2 } }, "message": "Bulk edit partially failed", "rules_count": 2, "status_code": 500, "success": false } } }, "example03": { "summary": "Dry run", "description": "The attributes.errors section of the response shows that two rules failed to update and one succeeded. The same results would be returned if you ran the request without dry run mode enabled. Notice that there are no arrays in attributes.results. In dry run mode, rule updates are not applied and saved to Elasticsearch, so the endpoint wouldn’t return results for rules that have been updated, created, or deleted.", "value": { "attributes": { "errors": [ { "err_code": "IMMUTABLE", "message": "Elastic rule can't be edited", "rules": [ { "id": "81aa0480-06af-11ed-94fb-dd1a0597d8d2", "name": "Unusual AWS Command for a User" } ], "status_code": 500 }, { "err_code": "MACHINE_LEARNING_INDEX_PATTERN", "message": "Machine learning rule doesn't have index patterns", "rules": [ { "id": "dc015d10-0831-11ed-ac8b-05a222bd8d4a", "name": "Suspicious Powershell Script [Duplicate]" } ], "status_code": 500 } ], "results": { "created": [ ], "deleted": [ ], "skipped": [ ], "updated": [ ] }, "summary": { "failed": 2, "skipped": 0, "succeeded": 1, "total": 3 } }, "message": "Bulk edit partially failed", "status_code": 500 } }, "example04": { "summary": "Set tags successsully for 2 rules", "description": "This example presents the successful setting of tags for 2 rules. There was a difference between the set of tags that were being added and the tags that were already set in the rules, that's why the rules were updated.", "value": { "attributes": { "results": { "created": [ ], "deleted": [ ], "skipped": [ ], "updated": [ { "actions": [ ], "author": [ ], "created_at": "2025-03-25T11:46:41.899Z", "created_by": "elastic", "description": "test", "enabled": false, "exceptions_list": [ ], "false_positives": [ ], "filters": [ ], "from": "now-6m", "id": "738112cd-6cfa-414a-8457-2a658845d6ba", "immutable": false, "index": [ "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "traces-apm*", "winlogbeat-*", "-*elastic-cloud-logs-*" ], "interval": "5m", "language": "kuery", "license": "", "max_signals": 100, "meta": { "kibana_siem_app_url": "http://localhost:5601/kbn/app/security" }, "name": "Rule 1", "output_index": "", "query": "*", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "revision": 1, "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "6fb746a0-dfe5-40fa-b03f-5cbb84f3e32e", "rule_source": { "type": "internal" }, "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ "tag-1", "tag-2" ], "threat": [ ], "to": "now", "type": "query", "updated_at": "2025-03-25T11:47:11.350Z", "updated_by": "elastic", "version": 2 }, { "actions": [ { "action_type_id": ".webhook", "frequency": { "notifyWhen": "onActiveAlert", "summary": true, "throttle": "null" }, "group": "default", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "body": "Hello" }, "uuid": "580e2e16-5e91-411c-999b-7b75a11ed441" } ], "author": [ ], "created_at": "2025-03-25T09:49:08.343Z", "created_by": "elastic", "description": "test", "enabled": false, "exceptions_list": [ ], "false_positives": [ ], "filters": [ ], "from": "now-360s", "id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b", "immutable": false, "index": [ "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "traces-apm*", "winlogbeat-*", "-*elastic-cloud-logs-*" ], "interval": "3m", "investigation_fields": { "field_names": [ "alert.status", "Endpoint.policy.applied.artifacts.global.channel" ] }, "language": "kuery", "license": "", "max_signals": 100, "meta": { "from": "3m", "kibana_siem_app_url": "http://localhost:5601/kbn/app/security" }, "name": "Rule 2", "output_index": "", "query": "*", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "revision": 33, "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "43250a55-53a3-4ddd-96cb-82a1bd720180", "rule_source": { "type": "internal" }, "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ "tag-1", "tag-2" ], "threat": [ ], "timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd", "timeline_title": "Alerts Involving a Single User Timeline", "to": "now", "type": "query", "updated_at": "2025-03-25T11:47:11.357Z", "updated_by": "elastic", "version": 24 } ] }, "summary": { "failed": 0, "skipped": 0, "succeeded": 2, "total": 2 } }, "rules_count": 2, "success": true } }, "example05": { "summary": "Idempotent behavior of set_tags", "description": "This example presents the idempotent behavior of the edit action with set_tags request. Both rules already had exactly the same tags that were being added, so no changes were made in any of them.", "value": { "attributes": { "results": { "created": [ ], "deleted": [ ], "skipped": [ { "id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b", "name": "Rule 1", "skip_reason": "RULE_NOT_MODIFIED" }, { "id": "738112cd-6cfa-414a-8457-2a658845d6ba", "name": "Rule 2", "skip_reason": "RULE_NOT_MODIFIED" } ], "updated": [ ] }, "summary": { "failed": 0, "skipped": 2, "succeeded": 0, "total": 2 } }, "rules_count": 2, "success": true } }, "example06": { "summary": "Idempotent behavior of add_tags", "description": "This example presents the idempotent behavior of the edit action with add_tags request. One rule was updated and one was skipped. The rule that was skipped already had all the tags that were being added.", "value": { "attributes": { "results": { "created": [ ], "deleted": [ ], "skipped": [ { "id": "738112cd-6cfa-414a-8457-2a658845d6ba", "name": "Test Rule 2", "skip_reason": "RULE_NOT_MODIFIED" } ], "updated": [ { "actions": [ { "action_type_id": ".webhook", "frequency": { "notifyWhen": "onActiveAlert", "summary": true, "throttle": "null" }, "group": "default", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "body": "Hello" }, "uuid": "580e2e16-5e91-411c-999b-7b75a11ed441" } ], "author": [ ], "created_at": "2025-03-25T09:49:08.343Z", "created_by": "elastic", "description": "test", "enabled": false, "exceptions_list": [ ], "false_positives": [ ], "filters": [ ], "from": "now-360s", "id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b", "immutable": false, "index": [ "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "traces-apm*", "winlogbeat-*", "-*elastic-cloud-logs-*" ], "interval": "3m", "investigation_fields": { "field_names": [ "alert.status", "Endpoint.policy.applied.artifacts.global.channel" ] }, "language": "kuery", "license": "", "max_signals": 100, "meta": { "from": "3m", "kibana_siem_app_url": "http://localhost:5601/kbn/app/security" }, "name": "Test rule", "output_index": "", "query": "*", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "revision": 34, "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "43250a55-53a3-4ddd-96cb-82a1bd720180", "rule_source": { "type": "internal" }, "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ "tag-1", "tag-2", "tag-4" ], "threat": [ ], "timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd", "timeline_title": "Alerts Involving a Single User Timeline", "to": "now", "type": "query", "updated_at": "2025-03-25T11:55:12.752Z", "updated_by": "elastic", "version": 25 } ] }, "summary": { "failed": 0, "skipped": 1, "succeeded": 1, "total": 2 } }, "rules_count": 2, "success": true } }, "example07": { "summary": "Non-idempotent behavior for set_rule_actions", "description": "This example shows a non-idempotent nature of the set_rule_actions requests. Regardless if the actions are the same as the existing actions for a rule, the actions are always set in the rule and receive a new unique ID.", "value": { "attributes": { "results": { "created": [ ], "deleted": [ ], "skipped": [ ], "updated": [ { "actions": [ { "action_type_id": ".webhook", "frequency": { "notifyWhen": "onActiveAlert", "summary": true, "throttle": "null" }, "group": "default", "id": "20fbf986-a270-460e-80f3-7b83c08b430f", "params": { "body": "Hello" }, "uuid": "e48428e5-efac-4856-b8ad-b271c14eaa91" } ], "author": [ ], "created_at": "2025-03-25T09:49:08.343Z", "created_by": "elastic", "description": "test", "enabled": false, "exceptions_list": [ ], "false_positives": [ ], "filters": [ ], "from": "now-360s", "id": "eacdfc95-e007-41c9-986e-4b2cbdfdc71b", "immutable": false, "index": [ "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "traces-apm*", "winlogbeat-*", "-*elastic-cloud-logs-*" ], "interval": "3m", "investigation_fields": { "field_names": [ "alert.status", "Endpoint.policy.applied.artifacts.global.channel" ] }, "language": "kuery", "license": "", "max_signals": 100, "meta": { "from": "3m", "kibana_siem_app_url": "http://localhost:5601/kbn/app/security" }, "name": "Test rule", "output_index": "", "query": "*", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "revision": 39, "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "43250a55-53a3-4ddd-96cb-82a1bd720180", "rule_source": { "type": "internal" }, "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ "tag-1", "tag-2", "tag-4" ], "threat": [ ], "timeline_id": "3e827bab-838a-469f-bd1e-5e19a2bff2fd", "timeline_title": "Alerts Involving a Single User Timeline", "to": "now", "type": "query", "updated_at": "2025-03-25T12:17:40.528Z", "updated_by": "elastic", "version": 30 } ] }, "summary": { "failed": 0, "skipped": 0, "succeeded": 1, "total": 1 } }, "rules_count": 1, "success": true } }, "example08": { "summary": "Non-idempotent behavior for add_rule_actions", "description": "This example shows a non-idempotent nature of the add_rule_actions requests. Regardless if the added action is the same as another existing action for a rule, the new action is added to the rule and receives a new unique ID.", "value": { "attributes": { "results": { "created": [ ], "deleted": [ ], "skipped": [ ], "updated": [ { "actions": [ { "action_type_id": ".webhook", "frequency": { "notifyWhen": "onActiveAlert", "summary": true, "throttle": "null" }, "group": "default", "id": "76af173d-38d8-4a9a-b2cc-a3c695b845b4", "params": { "body": "Message body" }, "uuid": "0309347e-3954-429c-9168-5da2663389af" }, { "action_type_id": ".webhook", "frequency": { "notifyWhen": "onActiveAlert", "summary": true, "throttle": "null" }, "group": "default", "id": "76af173d-38d8-4a9a-b2cc-a3c695b845b4", "params": { "body": "Message body" }, "uuid": "49ddaa94-d63d-410e-90dc-8c1bad9552bd" } ], "author": [ ], "created_at": "2025-04-02T12:42:03.400Z", "created_by": "elastic", "description": "test", "enabled": false, "exceptions_list": [ ], "false_positives": [ ], "filters": [ ], "from": "now-6m", "id": "0d3eb0cd-88c4-4651-ac87-6d9f0cb87217", "immutable": false, "index": [ "apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "traces-apm*", "winlogbeat-*", "-*elastic-cloud-logs-*" ], "interval": "5m", "language": "kuery", "license": "", "max_signals": 100, "meta": { "kibana_siem_app_url": "http://localhost:5601/kbn/app/security" }, "name": "Jacek test rule", "output_index": "", "query": "*", "references": [ ], "related_integrations": [ ], "required_fields": [ ], "revision": 2, "risk_score": 21, "risk_score_mapping": [ ], "rule_id": "2684c020-1370-4719-ac27-eafe6428fe10", "rule_source": { "type": "internal" }, "setup": "", "severity": "low", "severity_mapping": [ ], "tags": [ ], "threat": [ ], "to": "now", "type": "query", "updated_at": "2025-04-02T12:51:40.215Z", "updated_by": "elastic", "version": 2 } ] }, "summary": { "failed": 0, "skipped": 0, "succeeded": 1, "total": 1 } }, "rules_count": 1, "success": true } } } } } } } } }, "/api/detection_engine/rules/_bulk_create": { "post": { "tags": [ "Security Detections API" ], "summary": "Create multiple detection rules", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/_bulk_create
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate new detection rules in bulk.\n> warn\n> This API is deprecated and will be removed in Kibana v9.0.\n\n> warn\n> When used with [API key](https://www.elastic.co/guide/en/kibana/current/api-keys.html) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n", "operationId": "BulkCreateRules", "requestBody": { "description": "A JSON array of rules, where each rule contains the required fields.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleCreateProps" } }, "examples": { "example1": { "value": [ { "description": "Process started by MS Office program - possible payload", "enabled": false, "filters": [ { "query": { "match": { "event.action": { "query": "Process Create (rule: ProcessCreate)", "type": "phrase" } } } } ], "from": "now-6m", "interval": "5m", "language": "kuery", "name": "MS Office child process", "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", "risk_score": 50, "rule_id": "process_started_by_ms_office_program_possible_payload", "severity": "low", "tags": [ "child process", "ms office" ], "type": "query" }, { "description": "Query with a rule_id for referencing an external id", "from": "now-6m", "name": "Second bulk rule", "query": "user.name: root or user.name: admin", "risk_score": 2, "rule_id": "query-rule-id-2", "severity": "low", "type": "query" } ] } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_BulkCrudRulesResponse" } } } } }, "deprecated": true } }, "/api/detection_engine/rules/_bulk_delete": { "delete": { "tags": [ "Security Detections API" ], "summary": "Delete multiple detection rules", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/detection_engine/rules/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete detection rules in bulk.\n> warn\n> This API is deprecated and will be removed in Kibana v9.0.\n", "operationId": "BulkDeleteRules", "requestBody": { "description": "A JSON array of `id` or `rule_id` fields of the rules you want to delete.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" } } } }, "examples": { "example1": { "value": [ { "rule_id": "process_started_by_ms_office_program_possible_payload" }, { "id": "51658332-a15e-4c9e-912a-67214e2e2359" } ] } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_BulkCrudRulesResponse" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } }, "deprecated": true }, "post": { "tags": [ "Security Detections API" ], "summary": "Delete multiple detection rules", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete detection rules in bulk.\n> warn\n> This API is deprecated and will be removed in Kibana v9.0.\n", "operationId": "BulkDeleteRulesPost", "requestBody": { "description": "A JSON array of `id` or `rule_id` fields of the rules you want to delete.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" } } } }, "examples": { "example1": { "value": [ { "rule_id": "process_started_by_ms_office_program_possible_payload" }, { "id": "51658332-a15e-4c9e-912a-67214e2e2359" } ] } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_BulkCrudRulesResponse" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } }, "deprecated": true } }, "/api/detection_engine/rules/_bulk_update": { "patch": { "tags": [ "Security Detections API" ], "summary": "Patch multiple detection rules", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/detection_engine/rules/_bulk_update
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of existing detection rules using the `rule_id` or `id` field.\n> warn\n> This API is deprecated and will be removed in Kibana v9.0.\n\n> warn\n> When used with [API key](https://www.elastic.co/guide/en/kibana/current/api-keys.html) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n", "operationId": "BulkPatchRules", "requestBody": { "description": "A JSON array of rules, where each rule contains the required fields.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RulePatchProps" } }, "examples": { "example1": { "value": [ { "rule_id": "process_started_by_ms_office_program_possible_payload", "threat": [ { "framework": "MITRE ATT&CK", "id": "TA0001", "name": "Initial Access", "reference": "https://attack.mitre.org/tactics/TA0001", "tactic": "null", "technique": [ { "id": "T1193", "name": "Spearphishing Attachment", "reference": "https://attack.mitre.org/techniques/T1193" } ] } ] }, { "id": "56b22b65-173e-4a5b-b27a-82599cb1433e", "name": "New name" } ] } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_BulkCrudRulesResponse" } } } } }, "deprecated": true }, "put": { "tags": [ "Security Detections API" ], "summary": "Update multiple detection rules", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/detection_engine/rules/_bulk_update
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate multiple detection rules using the `rule_id` or `id` field. The original rules are replaced, and all unspecified fields are deleted.\n> warn\n> This API is deprecated and will be removed in Kibana v9.0.\n\n> warn\n> When used with [API key](https://www.elastic.co/guide/en/kibana/current/api-keys.html) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n", "operationId": "BulkUpdateRules", "requestBody": { "description": "A JSON array where each element includes the `id` or `rule_id` field of the rule you want to update and the fields you want to be specified in this rule.\n> info\n> All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.\n", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleUpdateProps" } }, "examples": { "example1": { "value": [ { "description": "Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended user account to maintain access to the Google Workspace organization with a valid account.", "id": "7d2f5ed8-6c05-44ab-81ce-9160ae147057", "name": "Updated Google Workspace Suspended User Account Renewed", "risk_score": 21, "severity": "low", "tags": [ "new_tag" ], "type": "query" }, { "description": "Identifies the creation of an Amazon Redshift cluster. Unexpected creation of this cluster by a non-administrative user may indicate a permission or role issue with current users. If unexpected, the resource may not properly be configured and could introduce security vulnerabilities.", "id": "43b2dc3b-4f21-4a10-95e2-0dbc19e6e974", "name": "Updated AWS Redshift Cluster Creation", "risk_score": 21, "severity": "low", "tags": [ "new_tag" ], "type": "query" } ] } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_BulkCrudRulesResponse" } } } } }, "deprecated": true } }, "/api/detection_engine/rules/_export": { "post": { "tags": [ "Security Detections API" ], "summary": "Export detection rules", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:\n- Actions\n- Exception lists\n> info\n> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.\n\n> You can use Kibana’s [Saved Objects](https://www.elastic.co/guide/en/kibana/current/managing-saved-objects.html) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportsavedobjectsdefault) and [import](https://www.elastic.co/docs/api/doc/kibana/operation/operation-importsavedobjectsdefault) any necessary connectors before importing detection rules.\n\n> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/guide/en/security/current/value-lists-exceptions.html#manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.\n", "operationId": "ExportRules", "parameters": [ { "name": "exclude_export_details", "in": "query", "description": "Determines whether a summary of the exported rules is returned.", "schema": { "type": "boolean", "default": false } }, { "name": "file_name", "in": "query", "description": "File name for saving the exported rules.\n> info\n> When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.\n", "schema": { "type": "string", "default": "export.ndjson" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "objects" ], "type": [ "null", "object" ], "properties": { "objects": { "type": "array", "items": { "required": [ "rule_id" ], "type": "object", "properties": { "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" } } }, "description": "Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified." } } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/ndjson": { "schema": { "type": "string", "description": "An `.ndjson` file containing the returned rules.\n\nEach line in the file represents an object (a rule, exception list parent container, or exception list item), and the last line includes a summary of what was exported.\n", "format": "binary" } } } } }, "x-codeSamples": [ { "lang": "cURL", "source": "curl -X POST \"localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson\" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'\n{\n \"objects\": [\n {\n \"rule_id\":\"343580b5-c811-447c-8d2d-2ccf052c6900\"\n },\n {\n \"rule_id\":\"2938c9fa-53eb-4c04-b79c-33cbf041b18d\"\n }\n ]\n}\n" } ] } }, "/api/detection_engine/rules/_find": { "get": { "tags": [ "Security Detections API" ], "summary": "List all detection rules", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/detection_engine/rules/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.", "operationId": "FindRules", "parameters": [ { "name": "fields", "in": "query", "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "filter", "in": "query", "description": "Search query\n\nFilters the returned results according to the value of the specified field, using the alert.attributes.: syntax, where can be:\n- name\n- enabled\n- tags\n- createdBy\n- interval\n- updatedBy\n> info\n> Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.\n", "schema": { "type": "string" } }, { "name": "sort_field", "in": "query", "description": "Field to sort by", "schema": { "$ref": "#/components/schemas/Security_Detections_API_FindRulesSortField" } }, { "name": "sort_order", "in": "query", "description": "Sort order", "schema": { "$ref": "#/components/schemas/Security_Detections_API_SortOrder" } }, { "name": "page", "in": "query", "description": "Page number", "schema": { "minimum": 1, "type": "integer", "default": 1 } }, { "name": "per_page", "in": "query", "description": "Rules per page", "schema": { "minimum": 0, "type": "integer", "default": 20 } }, { "name": "gaps_range_start", "in": "query", "description": "Gaps range start", "schema": { "type": "string" } }, { "name": "gaps_range_end", "in": "query", "description": "Gaps range end", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response\n> info\n> These fields are under development and their usage or schema may change: execution_summary.\n", "content": { "application/json": { "schema": { "required": [ "page", "perPage", "total", "data" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } }, "examples": { "example1": { "value": { "data": [ { "created_at": "2020-02-02T10:05:19.613Z", "created_by": "elastic", "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", "enabled": false, "execution_summary": { "last_execution": { "date": "2022-03-23T16:06:12.787Z", "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", "metrics": { "execution_gap_duration_s": 0, "total_indexing_duration_ms": 15, "total_search_duration_ms": 135 }, "status": "partial failure", "status_order": 20 } }, "false_positives": [ ], "from": "now-6m", "id": "89761517-fdb0-4223-b67b-7621acc48f9e", "immutable": true, "index": [ "winlogbeat-*" ], "interval": "5m", "language": "kuery", "max_signals": 33, "name": "Windows Script Executing PowerShell", "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"", "references": [ ], "related_integrations": [ { "package": "o365", "version": "^2.3.2" } ], "required_fields": [ { "ecs": true, "name": "event.action", "type": "keyword" }, { "ecs": true, "name": "process.name", "type": "keyword" }, { "ecs": true, "name": "process.parent.name", "type": "keyword" } ], "risk_score": 21, "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", "setup": "", "severity": "low", "tags": [ "Elastic", "Windows" ], "threat": [ { "framework": "MITRE ATT&CK", "tactic": { "id": "TA0002", "name": "Execution", "reference": "https://attack.mitre.org/tactics/TA0002/" }, "technique": [ { "id": "T1193", "name": "Spearphishing Attachment", "reference": "https://attack.mitre.org/techniques/T1193/" } ] } ], "to": "now", "type": "query", "updated_at": "2020-02-02T10:05:19.830Z", "updated_by": "elastic" } ], "page": 1, "perPage": 5, "total": 4 } } } } } } }, "x-codeSamples": [ { "lang": "cURL", "source": "curl -X GET \"localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows\" -H 'kbn-xsrf: true'\n" } ] } }, "/api/detection_engine/rules/_import": { "post": { "tags": [ "Security Detections API" ], "summary": "Import detection rules", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport detection rules from an `.ndjson` file, including actions and exception lists. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- A link to the `.ndjson` file containing the rules.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n> info\n> To import rules with actions, you need at least Read privileges for the Action and Connectors feature. To overwrite or add new connectors, you need All privileges for the Actions and Connectors feature. To import rules without actions, you don’t need Actions and Connectors privileges. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for more information.\n\n> info\n> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.\n\n> You can use Kibana’s [Saved Objects](https://www.elastic.co/guide/en/kibana/current/managing-saved-objects.html) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](https://www.elastic.co/docs/api/doc/kibana/operation/operation-exportsavedobjectsdefault) and [import](https://www.elastic.co/docs/api/doc/kibana/operation/operation-importsavedobjectsdefault) any necessary connectors before importing detection rules.\n\n> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/guide/en/security/current/value-lists-exceptions.html#manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.\n", "operationId": "ImportRules", "parameters": [ { "name": "overwrite", "in": "query", "description": "Determines whether existing rules with the same `rule_id` are overwritten.", "schema": { "type": "boolean", "default": false } }, { "name": "overwrite_exceptions", "in": "query", "description": "Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.", "schema": { "type": "boolean", "default": false } }, { "name": "overwrite_action_connectors", "in": "query", "description": "Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.", "schema": { "type": "boolean", "default": false } }, { "name": "as_new_list", "in": "query", "description": "Generates a new list ID for each imported exception list.", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "description": "The `.ndjson` file containing the rules.", "format": "binary" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "exceptions_success", "exceptions_success_count", "exceptions_errors", "rules_count", "success", "success_count", "errors", "action_connectors_errors", "action_connectors_warnings", "action_connectors_success", "action_connectors_success_count" ], "type": "object", "properties": { "action_connectors_errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ErrorSchema" } }, "action_connectors_success": { "type": "boolean" }, "action_connectors_success_count": { "minimum": 0, "type": "integer" }, "action_connectors_warnings": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_WarningSchema" } }, "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ErrorSchema" } }, "exceptions_errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ErrorSchema" } }, "exceptions_success": { "type": "boolean" }, "exceptions_success_count": { "minimum": 0, "type": "integer" }, "rules_count": { "minimum": 0, "type": "integer" }, "success": { "type": "boolean" }, "success_count": { "minimum": 0, "type": "integer" } }, "additionalProperties": false }, "examples": { "example1": { "summary": "Import rules with success", "value": { "errors": [ ], "exceptions_errors": [ ], "exceptions_success": true, "exceptions_success_count": 0, "rules_count": 1, "success": true, "success_count": 1 } } } } } } }, "x-codeSamples": [ { "lang": "cURL", "source": "curl -X POST \"/api/detection_engine/rules/_import\"\n-u : -H 'kbn-xsrf: true'\n-H 'Content-Type: multipart/form-data'\n--form \"file=@\"\n" } ] } }, "/api/detection_engine/rules/{id}/exceptions": { "post": { "tags": [ "Security Exceptions API" ], "summary": "Create rule exception list items", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/{id}/exceptions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate exception items that apply to a single detection rule.", "operationId": "CreateRuleExceptionListItems", "parameters": [ { "name": "id", "in": "path", "description": "Detection rule's identifier", "required": true, "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_UUID" } } ], "requestBody": { "description": "Rule exception list items", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemProps" } } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItem" } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/rules/prepackaged": { "put": { "tags": [ "Security Detections API" ], "summary": "Install prebuilt detection rules and Timelines", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/detection_engine/rules/prepackaged
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall and update all Elastic prebuilt detection rules and Timelines.\n\nThis endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. \nWhen you call this endpoint, it will:\n- Install any new prebuilt detection rules that are not currently installed in your system.\n- Update any existing prebuilt detection rules that have been modified or improved by Elastic.\n- Install any new prebuilt Timelines that are not currently installed in your system.\n- Update any existing prebuilt Timelines that have been modified or improved by Elastic.\n\nThis ensures that your detection engine is always up-to-date with the latest rules and Timelines, \nproviding you with the most current and effective threat detection capabilities.\n", "operationId": "InstallPrebuiltRulesAndTimelines", "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "required": [ "rules_installed", "rules_updated", "timelines_installed", "timelines_updated" ], "type": "object", "properties": { "rules_installed": { "minimum": 0, "type": "integer", "description": "The number of rules installed" }, "rules_updated": { "minimum": 0, "type": "integer", "description": "The number of rules updated" }, "timelines_installed": { "minimum": 0, "type": "integer", "description": "The number of timelines installed" }, "timelines_updated": { "minimum": 0, "type": "integer", "description": "The number of timelines updated" } }, "additionalProperties": false }, "examples": { "example1": { "value": { "rules_installed": 112, "rules_updated": 0, "timelines_installed": 5, "timelines_updated": 2 } } } } } } } } }, "/api/detection_engine/rules/prepackaged/_status": { "get": { "tags": [ "Security Detections API" ], "summary": "Retrieve the status of prebuilt detection rules and Timelines", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/detection_engine/rules/prepackaged/_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve the status of all Elastic prebuilt detection rules and Timelines. \n\nThis endpoint provides detailed information about the number of custom rules, installed prebuilt rules, available prebuilt rules that are not installed, outdated prebuilt rules, installed prebuilt timelines, available prebuilt timelines that are not installed, and outdated prebuilt timelines.\n", "operationId": "ReadPrebuiltRulesAndTimelinesStatus", "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "required": [ "rules_custom_installed", "rules_installed", "rules_not_installed", "rules_not_updated", "timelines_installed", "timelines_not_installed", "timelines_not_updated" ], "type": "object", "properties": { "rules_custom_installed": { "minimum": 0, "type": "integer", "description": "The total number of custom rules" }, "rules_installed": { "minimum": 0, "type": "integer", "description": "The total number of installed prebuilt rules" }, "rules_not_installed": { "minimum": 0, "type": "integer", "description": "The total number of available prebuilt rules that are not installed" }, "rules_not_updated": { "minimum": 0, "type": "integer", "description": "The total number of outdated prebuilt rules" }, "timelines_installed": { "minimum": 0, "type": "integer", "description": "The total number of installed prebuilt timelines" }, "timelines_not_installed": { "minimum": 0, "type": "integer", "description": "The total number of available prebuilt timelines that are not installed" }, "timelines_not_updated": { "minimum": 0, "type": "integer", "description": "The total number of outdated prebuilt timelines" } }, "additionalProperties": false }, "examples": { "example1": { "value": { "rules_custom_installed": 0, "rules_installed": 0, "rules_not_installed": 112, "rules_not_updated": 0, "timelines_installed": 0, "timelines_not_installed": 0, "timelines_not_updated": 0 } } } } } } } } }, "/api/detection_engine/rules/preview": { "post": { "tags": [ "Security Detections API" ], "summary": "Preview rule alerts generated on specified time range", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/rules/preview
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "RulePreview", "parameters": [ { "name": "enable_logged_requests", "in": "query", "description": "Enables logging and returning in response ES queries, performed during rule execution", "schema": { "type": "boolean" } } ], "requestBody": { "description": "An object containing tags to add or remove and alert ids the changes will be applied", "content": { "application/json": { "schema": { "anyOf": [ { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] }, { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewParams" } ] } ], "discriminator": { "propertyName": "type" } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "logs" ], "type": "object", "properties": { "isAborted": { "type": "boolean" }, "logs": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewLogs" } }, "previewId": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/signals/assignees": { "post": { "tags": [ "Security Detections API" ], "summary": "Assign and unassign users from detection alerts", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/assignees
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAssign users to detection alerts, and unassign them from alerts.\n> info\n> You cannot add and remove the same assignee in the same request.\n", "operationId": "SetAlertAssignees", "requestBody": { "content": { "application/json": { "schema": { "required": [ "assignees", "ids" ], "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Security_Detections_API_AlertAssignees" }, "ids": { "$ref": "#/components/schemas/Security_Detections_API_AlertIds" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call." }, "400": { "description": "Invalid request." } } } }, "/api/detection_engine/signals/finalize_migration": { "post": { "tags": [ "Security Detections API" ], "summary": "Finalize detection alert migrations", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/finalize_migration
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFinalize successful migrations of detection alerts. This replaces the original index's alias with the successfully migrated index's alias.\nThe endpoint is idempotent; therefore, it can safely be used to poll a given migration and, upon completion,\nfinalize it.\n", "operationId": "FinalizeAlertsMigration", "requestBody": { "description": "Array of `migration_id`s to finalize", "content": { "application/json": { "schema": { "required": [ "migration_ids" ], "type": "object", "properties": { "migration_ids": { "minItems": 1, "type": "array", "items": { "type": "string" } } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_MigrationFinalizationResult" } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } }, "deprecated": true } }, "/api/detection_engine/signals/migration": { "delete": { "tags": [ "Security Detections API" ], "summary": "Clean up detection alert migrations", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/detection_engine/signals/migration
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nMigrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of\nthe migration process. A successful migration will result in both the old and new indices being present.\nAs such, the old, orphaned index can (and likely should) be deleted.\n\nWhile you can delete these indices manually,\nthe endpoint accomplishes this task by applying a deletion policy to the relevant index, causing it to be deleted\nafter 30 days. It also deletes other artifacts specific to the migration implementation.\n", "operationId": "AlertsMigrationCleanup", "requestBody": { "description": "Array of `migration_id`s to cleanup", "content": { "application/json": { "schema": { "required": [ "migration_ids" ], "type": "object", "properties": { "migration_ids": { "minItems": 1, "type": "array", "items": { "type": "string" } } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_MigrationCleanupResult" } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } }, "deprecated": true }, "post": { "tags": [ "Security Detections API" ], "summary": "Initiate a detection alert migration", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/migration
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInitiate a migration of detection alerts.\nMigrations are initiated per index. While the process is neither destructive nor interferes with existing data, it may be resource-intensive. As such, it is recommended that you plan your migrations accordingly.\n", "operationId": "CreateAlertsMigration", "requestBody": { "description": "Alerts migration parameters", "content": { "application/json": { "schema": { "allOf": [ { "required": [ "index" ], "type": "object", "properties": { "index": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } } }, { "$ref": "#/components/schemas/Security_Detections_API_AlertsReindexOptions" } ] } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "indices" ], "type": "object", "properties": { "indices": { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexMigrationSuccess" }, { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexMigrationError" }, { "$ref": "#/components/schemas/Security_Detections_API_SkippedAlertsIndexMigration" } ] } } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } }, "deprecated": true } }, "/api/detection_engine/signals/migration_status": { "post": { "tags": [ "Security Detections API" ], "summary": "Retrieve the status of detection alert migrations", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/migration_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve indices that contain detection alerts of a particular age, along with migration information for each of those indices.", "operationId": "ReadAlertsMigrationStatus", "parameters": [ { "name": "from", "in": "query", "description": "Maximum age of qualifying detection alerts", "required": true, "schema": { "type": "string", "description": "Time from which data is analyzed. For example, now-4200s means the rule analyzes data from 70 minutes\nbefore its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).\n", "format": "date-math" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "indices" ], "type": "object", "properties": { "indices": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_IndexMigrationStatus" } } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } }, "deprecated": true } }, "/api/detection_engine/signals/search": { "post": { "tags": [ "Security Detections API" ], "summary": "Find and/or aggregate detection alerts", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/search
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFind and/or aggregate detection alerts that match the given query.", "operationId": "SearchAlerts", "requestBody": { "description": "Search and/or aggregation query", "content": { "application/json": { "schema": { "type": "object", "properties": { "_source": { "oneOf": [ { "type": "boolean" }, { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "aggs": { "type": "object" }, "fields": { "type": "array", "items": { "type": "string" } }, "query": { "type": "object" }, "runtime_mappings": { "type": "object" }, "size": { "minimum": 0, "type": "integer" }, "sort": { "$ref": "#/components/schemas/Security_Detections_API_AlertsSort" }, "track_total_hits": { "type": "boolean" } }, "description": "Elasticsearch query and aggregation request" } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "description": "Elasticsearch search response" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/signals/status": { "post": { "tags": [ "Security Detections API" ], "summary": "Set a detection alert status", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSet the status of one or more detection alerts.", "operationId": "SetAlertsStatus", "requestBody": { "description": "An object containing desired status and explicit alert ids or a query to select alerts", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_SetAlertsStatusByIds" }, { "$ref": "#/components/schemas/Security_Detections_API_SetAlertsStatusByQuery" } ] } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "description": "Elasticsearch update by query response" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/signals/tags": { "post": { "tags": [ "Security Detections API" ], "summary": "Add and remove detection alert tags", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/detection_engine/signals/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAnd tags to detection alerts, and remove them from alerts.\n> info\n> You cannot add and remove the same alert tag in the same request.\n", "operationId": "SetAlertTags", "requestBody": { "description": "An object containing tags to add or remove and alert ids the changes will be applied", "content": { "application/json": { "schema": { "required": [ "ids", "tags" ], "type": "object", "properties": { "ids": { "$ref": "#/components/schemas/Security_Detections_API_AlertIds" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_SetAlertTags" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "description": "Elasticsearch update by query response" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_SiemErrorResponse" } } } } } } }, "/api/detection_engine/tags": { "get": { "tags": [ "Security Detections API" ], "summary": "List all detection rule tags", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/detection_engine/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList all unique tags from all detection rules.", "operationId": "ReadTags", "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "examples": { "example1": { "value": [ "zeek", "suricata", "windows", "linux", "network", "initial access", "remote access", "phishing" ] } } } } } } } }, "/api/encrypted_saved_objects/_rotate_key": { "post": { "tags": [ "saved objects" ], "summary": "Rotate a key for encrypted saved objects", "description": "Superuser role required.\n\nIf a saved object cannot be decrypted using the primary encryption key, then Kibana will attempt to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.\n\nThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n", "operationId": "rotateEncryptionKey", "parameters": [ { "name": "batch_size", "in": "query", "description": "Specifies a maximum number of saved objects that Kibana can process in a single batch. Bulk key rotation is an iterative process since Kibana may not be able to fetch and process all required saved objects in one go and splits processing into consequent batches. By default, the batch size is 10000, which is also a maximum allowed value.\n", "schema": { "type": "number", "default": 10000 } }, { "name": "type", "in": "query", "description": "Limits encryption key rotation only to the saved objects with the specified type. By default, Kibana tries to rotate the encryption key for all saved object types that may contain encrypted attributes.\n", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "failed": { "type": "number", "description": "Indicates the number of the saved objects that were still encrypted with one of the old encryption keys that Kibana failed to re-encrypt with the primary key.\n" }, "successful": { "type": "number", "description": "Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.\n\nNOTE: In most cases, `total` will be greater than `successful` even if `failed` is zero. The reason is that Kibana may not need or may not be able to rotate encryption keys for all encrypted saved objects.\n" }, "total": { "type": "number", "description": "Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.\n" } } }, "examples": { "rotateEncryptionKeyResponse": { "$ref": "#/components/examples/Saved_objects_key_rotation_response" } } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } }, "429": { "description": "Already in progress.", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/api/endpoint_list": { "post": { "tags": [ "Security Endpoint Exceptions API" ], "summary": "Create an Elastic Endpoint rule exception list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint_list
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate the exception list for Elastic Endpoint rule exceptions. When you create the exception list, it will have a `list_id` of `endpoint_list`. If the Elastic Endpoint exception list already exists, your request will return an empty response.", "operationId": "CreateEndpointList", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_EndpointList" } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Insufficient privileges", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/endpoint_list/items": { "delete": { "tags": [ "Security Endpoint Exceptions API" ], "summary": "Delete an Elastic Endpoint exception list item", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/endpoint_list/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.", "operationId": "DeleteEndpointListItem", "parameters": [ { "name": "id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } }, { "name": "item_id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Insufficient privileges", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Endpoint list item not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Endpoint Exceptions API" ], "summary": "Get an Elastic Endpoint rule exception list item", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint_list/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.", "operationId": "ReadEndpointListItem", "parameters": [ { "name": "id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } }, { "name": "item_id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem" } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Insufficient privileges", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Endpoint list item not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Endpoint Exceptions API" ], "summary": "Create an Elastic Endpoint rule exception list item", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint_list/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.", "operationId": "CreateEndpointListItem", "requestBody": { "description": "Exception list item's properties", "content": { "application/json": { "schema": { "required": [ "type", "name", "description", "entries" ], "type": "object", "properties": { "comments": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray" }, "description": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray" }, "item_id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "os_types": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags" }, "type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Insufficient privileges", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "409": { "description": "Endpoint list item already exists", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } } } }, "put": { "tags": [ "Security Endpoint Exceptions API" ], "summary": "Update an Elastic Endpoint rule exception list item", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/endpoint_list/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.", "operationId": "UpdateEndpointListItem", "requestBody": { "description": "Exception list item's properties", "content": { "application/json": { "schema": { "required": [ "type", "name", "description", "entries" ], "type": "object", "properties": { "_version": { "type": "string" }, "comments": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray" }, "description": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray" }, "id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "item_id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "os_types": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags" }, "type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Insufficient privileges", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Endpoint list item not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/endpoint_list/items/_find": { "get": { "tags": [ "Security Endpoint Exceptions API" ], "summary": "Get Elastic Endpoint exception list items", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint_list/items/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all Elastic Endpoint exception list items.", "operationId": "FindEndpointListItems", "parameters": [ { "name": "filter", "in": "query", "description": "Filters the returned results according to the value of the specified field,\nusing the `:` syntax.\n", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } }, { "name": "page", "in": "query", "description": "The page number to return", "schema": { "minimum": 0, "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of exception list items to return per page", "schema": { "minimum": 0, "type": "integer" } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order, which can be `desc` or `asc`", "schema": { "enum": [ "desc", "asc" ], "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "data", "page", "per_page", "total" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem" } }, "page": { "minimum": 0, "type": "integer" }, "per_page": { "minimum": 0, "type": "integer" }, "pit": { "type": "string" }, "total": { "minimum": 0, "type": "integer" } } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Insufficient privileges", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Endpoint list not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/endpoint/action": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get response actions", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all response actions.", "operationId": "EndpointGetActionsList", "parameters": [ { "name": "page", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Page" } }, { "name": "pageSize", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PageSize" } }, { "name": "commands", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Commands" } }, { "name": "agentIds", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentIds" } }, { "name": "userIds", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_UserIds" } }, { "name": "startDate", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_StartDate" } }, { "name": "endDate", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndDate" } }, { "name": "agentTypes", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" } }, { "name": "withOutputs", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_WithOutputs" } }, { "name": "types", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Types" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_GetEndpointActionListResponse" } } } } } } }, "/api/endpoint/action_log/{agent_id}": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get an action request log", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action_log/{agent_id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet an action request log for the specified agent ID.", "operationId": "EndpointGetActionLog", "parameters": [ { "name": "agent_id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentId" } }, { "name": "query", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ActionLogRequestQuery" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } }, "deprecated": true } }, "/api/endpoint/action_status": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get response actions status", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the status of response actions for the specified agent IDs.", "operationId": "EndpointGetActionsStatus", "parameters": [ { "name": "query", "in": "query", "required": true, "schema": { "type": "object", "properties": { "agent_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentIds" } } } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ActionStatusSuccessResponse" } } } } } } }, "/api/endpoint/action/{action_id}": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get action details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action/{action_id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a response action using the action ID.", "operationId": "EndpointGetActionsDetails", "parameters": [ { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string", "description": "The ID of the action to retrieve.", "example": "fr518850-681a-4y60-aa98-e22640cae2b8" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_GetEndpointActionResponse" } } } } } } }, "/api/endpoint/action/{action_id}/file/{file_id}": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get file information", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet information for the specified file using the file ID.\n> info\n> To construct a `file_id`, combine the `action_id` and `agent_id` values using a dot separator:\n> {`file_id`} = {`action_id`}`.`{`agent_id`}\n", "operationId": "EndpointFileInfo", "parameters": [ { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "file_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } } } }, "/api/endpoint/action/{action_id}/file/{file_id}/download": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Download a file", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDownload a file from an endpoint. \n> info\n> To construct a `file_id`, combine the `action_id` and `agent_id` values using a dot separator:\n> {`file_id`} = {`action_id`}`.`{`agent_id`}\n", "operationId": "EndpointFileDownload", "parameters": [ { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "file_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } } } }, "/api/endpoint/action/execute": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Run a command", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/execute
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRun a shell command on an endpoint.", "operationId": "EndpointExecuteAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ExecuteRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ExecuteRouteResponse" } } } } } } }, "/api/endpoint/action/get_file": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Get a file", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/get_file
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a file from an endpoint.", "operationId": "EndpointGetFileAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_GetFileRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_GetFileRouteResponse" } } } } } } }, "/api/endpoint/action/isolate": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Isolate an endpoint", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/isolate
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nIsolate an endpoint from the network. The endpoint remains isolated until it's released.", "operationId": "EndpointIsolateAction", "requestBody": { "content": { "application/json": { "schema": { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, "examples": { "multiple_endpoints": { "summary": "Isolates several hosts; includes a comment", "value": { "comment": "Locked down, pending further investigation", "endpoint_ids": [ "9972d10e-4b9e-41aa-a534-a85e2a28ea42", "bc0e4f0c-3bca-4633-9fee-156c0b505d16", "fa89271b-b9d4-43f2-a684-307cffddeb5a" ] } }, "single_endpoint": { "summary": "Isolates a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8", "value": { "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ] } }, "with_case_id": { "summary": "Isolates a single host with a case_id value of 1234", "value": { "case_ids": [ "4976be38-c134-4554-bd5e-0fd89ce63667" ], "comment": "Isolating as initial response", "endpoint_ids": [ "1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0", "b30a11bf-1395-4707-b508-fbb45ef9793e" ] } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_IsolateRouteResponse" } } } } } } }, "/api/endpoint/action/kill_process": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Terminate a process", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/kill_process
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nTerminate a running process on an endpoint.", "operationId": "EndpointKillProcessAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_KillProcessRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_KillProcessRouteResponse" } } } } } } }, "/api/endpoint/action/running_procs": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Get running processes", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/running_procs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all processes running on an endpoint.", "operationId": "EndpointGetProcessesAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_GetProcessesRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_GetProcessesRouteResponse" } } } } } } }, "/api/endpoint/action/runscript": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Run a script", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/runscript
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRun a shell command on an endpoint.", "operationId": "RunScriptAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_RunScriptRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } } } }, "/api/endpoint/action/scan": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Scan a file or directory", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/scan
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nScan a specific file or directory on an endpoint for malware.", "operationId": "EndpointScanAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ScanRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ScanRouteResponse" } } } } } } }, "/api/endpoint/action/state": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get actions state", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/action/state
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a response actions state, which reports whether encryption is enabled.", "operationId": "EndpointGetActionsState", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ActionStateSuccessResponse" } } } } } } }, "/api/endpoint/action/suspend_process": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Suspend a process", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/suspend_process
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSuspend a running process on an endpoint.", "operationId": "EndpointSuspendProcessAction", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuspendProcessRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuspendProcessRouteResponse" } } } } } } }, "/api/endpoint/action/unisolate": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Release an isolated endpoint", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/unisolate
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRelease an isolated endpoint, allowing it to rejoin a network.", "operationId": "EndpointUnisolateAction", "requestBody": { "content": { "application/json": { "schema": { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, "examples": { "multipleHosts": { "summary": "Releases several hosts; includes a comment:", "value": { "comment": "Benign process identified, releasing group", "endpoint_ids": [ "9972d10e-4b9e-41aa-a534-a85e2a28ea42", "bc0e4f0c-3bca-4633-9fee-156c0b505d16", "fa89271b-b9d4-43f2-a684-307cffddeb5a" ] } }, "singleHost": { "summary": "Releases a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8", "value": { "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ] } }, "withCaseId": { "summary": "Releases hosts with an associated case; includes a comment.", "value": { "case_ids": [ "4976be38-c134-4554-bd5e-0fd89ce63667" ], "comment": "Remediation complete, restoring network", "endpoint_ids": [ "1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0", "b30a11bf-1395-4707-b508-fbb45ef9793e" ] } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_UnisolateRouteResponse" } } } } } } }, "/api/endpoint/action/upload": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Upload a file", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/action/upload
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpload a file to an endpoint.", "operationId": "EndpointUploadAction", "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_UploadRouteRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_UploadRouteResponse" } } } } } } }, "/api/endpoint/isolate": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Isolate an endpoint", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/isolate
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nIsolate an endpoint from the network.\n> info\n> This URL will return a 308 permanent redirect to `POST :/api/endpoint/action/isolate`.\n", "operationId": "EndpointIsolateRedirect", "requestBody": { "content": { "application/json": { "schema": { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } }, "308": { "description": "Permanent Redirect", "headers": { "Location": { "description": "Permanently redirects to \"/api/endpoint/action/isolate\"", "schema": { "type": "string", "example": "/api/endpoint/action/isolate" } } } } }, "deprecated": true } }, "/api/endpoint/metadata": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get a metadata list", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/metadata
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetEndpointMetadataList", "parameters": [ { "name": "page", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Page" } }, { "name": "pageSize", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PageSize" } }, { "name": "kuery", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Kuery" } }, { "name": "hostStatuses", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_HostStatuses" } }, { "name": "sortField", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SortField" } }, { "name": "sortDirection", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SortDirection" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_MetadataListResponse" } } } } } } }, "/api/endpoint/metadata/{id}": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get metadata", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/metadata/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetEndpointMetadata", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "example": "ed518850-681a-4d60-bb98-e22640cae2a8" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointMetadataResponse" } } } } } } }, "/api/endpoint/metadata/transforms": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get metadata transforms", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/metadata/transforms
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetEndpointMetadataTransform", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } }, "deprecated": true } }, "/api/endpoint/policy_response": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get a policy response", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/policy_response
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetPolicyResponse", "parameters": [ { "name": "query", "in": "query", "required": true, "schema": { "type": "object", "properties": { "agentId": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentId" } } } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } } } }, "/api/endpoint/policy/summaries": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get an agent policy summary", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/policy/summaries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetAgentPolicySummary", "parameters": [ { "name": "query", "in": "query", "required": true, "schema": { "type": "object", "properties": { "package_name": { "type": "string" }, "policy_id": { "type": [ "null", "string" ] } } } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } }, "deprecated": true } }, "/api/endpoint/protection_updates_note/{package_policy_id}": { "get": { "tags": [ "Security Endpoint Management API" ], "summary": "Get a protection updates note", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetProtectionUpdatesNote", "parameters": [ { "name": "package_policy_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse" } } } } } }, "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Create or update a protection updates note", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "CreateUpdateProtectionUpdatesNote", "parameters": [ { "name": "package_policy_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "note": { "type": "string" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse" } } } } } } }, "/api/endpoint/suggestions/{suggestion_type}": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Get suggestions", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/suggestions/{suggestion_type}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "GetEndpointSuggestions", "parameters": [ { "name": "suggestion_type", "in": "path", "required": true, "schema": { "enum": [ "eventFilters" ], "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "parameters" ], "type": "object", "properties": { "field": { "type": "string" }, "fieldMeta": { }, "filters": { }, "query": { "type": "string" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } } }, "deprecated": true } }, "/api/endpoint/unisolate": { "post": { "tags": [ "Security Endpoint Management API" ], "summary": "Release an isolated endpoint", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/endpoint/unisolate
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRelease an isolated endpoint, allowing it to rejoin a network.\n> info\n> This URL will return a 308 permanent redirect to `POST :/api/endpoint/action/unisolate`.\n", "operationId": "EndpointUnisolateRedirect", "requestBody": { "content": { "application/json": { "schema": { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_SuccessResponse" } } } }, "308": { "description": "Permanent Redirect", "headers": { "Location": { "description": "Permanently redirects to \"/api/endpoint/action/unisolate\"", "schema": { "type": "string", "example": "/api/endpoint/action/unisolate" } } } } }, "deprecated": true } }, "/api/entity_store/enable": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Initialize the Entity Store", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/entity_store/enable
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInitialize the entire Entity Store, creating engines for all or specified entity types.", "operationId": "InitEntityStore", "requestBody": { "description": "Configuration for the entity store initialization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "delay": { "pattern": "[smdh]$", "type": "string", "description": "The delay before the transform will run.", "default": "1m" }, "docsPerSecond": { "type": "integer", "description": "The number of documents per second to process." }, "enrichPolicyExecutionInterval": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_Interval" }, "entityTypes": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" } }, "fieldHistoryLength": { "type": "integer", "description": "The number of historical values to keep for each field.", "default": 10 }, "filter": { "type": "string" }, "frequency": { "pattern": "[smdh]$", "type": "string", "description": "The frequency at which the transform will run.", "default": "1m" }, "indexPattern": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_IndexPattern" }, "lookbackPeriod": { "pattern": "[smdh]$", "type": "string", "description": "The amount of time the transform looks back to calculate the aggregations.", "default": "24h" }, "timeout": { "pattern": "[smdh]$", "type": "string", "description": "The timeout for initializing the aggregating transform.", "default": "180s" }, "timestampField": { "type": "string", "description": "The field to use as the timestamp.", "default": "@timestamp" } } }, "examples": { "initEntityStoreRequest": { "summary": "Initialize with default settings", "value": { "entityTypes": [ "host", "user" ] } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "engines": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor" }, "description": "The engine descriptors created during initialization." }, "succeeded": { "type": "boolean", "description": "Whether the Entity Store was initialized successfully." } } }, "examples": { "initEntityStoreExample": { "summary": "Entity Store initialized with host and user engines", "description": "The Entity Store was successfully initialized, creating host and user engines in the installing state.", "value": { "engines": [ { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "installing", "timeout": "180s", "timestampField": "@timestamp", "type": "host" }, { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "installing", "timeout": "180s", "timestampField": "@timestamp", "type": "user" } ], "succeeded": true } } } } } }, "400": { "description": "Invalid request" } } } }, "/api/entity_store/engines": { "get": { "tags": [ "Security Entity Analytics API" ], "summary": "List the Entity Engines", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/entity_store/engines
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all installed entity engines and their current status.", "operationId": "ListEntityEngines", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "count": { "type": "integer", "description": "The total number of entity engines." }, "engines": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor" }, "description": "An array of engine descriptors." } } }, "examples": { "listEntityEnginesExample": { "summary": "Two engines installed", "description": "Returns a list with one running host engine and one stopped user engine.", "value": { "count": 2, "engines": [ { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "started", "timeout": "180s", "timestampField": "@timestamp", "type": "host" }, { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "stopped", "timeout": "180s", "timestampField": "@timestamp", "type": "user" } ] } } } } } } } } }, "/api/entity_store/engines/{entityType}": { "delete": { "tags": [ "Security Entity Analytics API" ], "summary": "Delete the Entity Engine", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/entity_store/engines/{entityType}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "DeleteEntityEngine", "parameters": [ { "name": "entityType", "in": "path", "description": "The entity type of the engine (either 'user' or 'host').", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" } }, { "name": "data", "in": "query", "description": "Control flag to also delete the entity data.", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "deleted": { "type": "boolean", "description": "Whether the engine was successfully deleted." } } } } } } } }, "get": { "tags": [ "Security Entity Analytics API" ], "summary": "Get an Entity Engine", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/entity_store/engines/{entityType}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the engine descriptor for a specific entity type, including its configuration and current status.", "operationId": "GetEntityEngine", "parameters": [ { "name": "entityType", "in": "path", "description": "The entity type of the engine.", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" }, "example": "host" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor" }, "examples": { "getEntityEngineExample": { "summary": "A running host engine", "description": "Returns the engine descriptor for a host engine that is currently running with default settings.", "value": { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "started", "timeout": "180s", "timestampField": "@timestamp", "type": "host" } } } } } } } } }, "/api/entity_store/engines/{entityType}/init": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Initialize an Entity Engine", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/entity_store/engines/{entityType}/init
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInitialize a single entity engine for the specified entity type.", "operationId": "InitEntityEngine", "parameters": [ { "name": "entityType", "in": "path", "description": "The entity type of the engine (either 'user' or 'host').", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" } } ], "requestBody": { "description": "Schema for the engine initialization", "content": { "application/json": { "schema": { "type": "object", "properties": { "delay": { "pattern": "[smdh]$", "type": "string", "description": "The delay before the transform will run.", "default": "1m" }, "docsPerSecond": { "type": "integer", "description": "The number of documents per second to process." }, "enrichPolicyExecutionInterval": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_Interval" }, "fieldHistoryLength": { "type": "integer", "description": "The number of historical values to keep for each field.", "default": 10 }, "filter": { "type": "string" }, "frequency": { "pattern": "[smdh]$", "type": "string", "description": "The frequency at which the transform will run.", "default": "1m" }, "indexPattern": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_IndexPattern" }, "lookbackPeriod": { "pattern": "[smdh]$", "type": "string", "description": "The amount of time the transform looks back to calculate the aggregations.", "default": "24h" }, "timeout": { "pattern": "[smdh]$", "type": "string", "description": "The timeout for initializing the aggregating transform.", "default": "180s" }, "timestampField": { "type": "string", "description": "The field to use as the timestamp for the entity type.", "default": "@timestamp" } } }, "examples": { "initEntityEngineRequest": { "summary": "Initialize a host engine with default settings", "value": { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "3h", "timestampField": "@timestamp" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor" }, "examples": { "initEntityEngineExample": { "summary": "Host engine initialized", "description": "A host engine was successfully initialized and is now in the installing state.", "value": { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "3h", "status": "installing", "timeout": "180s", "timestampField": "@timestamp", "type": "host" } } } } } }, "400": { "description": "Invalid request" } } } }, "/api/entity_store/engines/{entityType}/start": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Start an Entity Engine", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/entity_store/engines/{entityType}/start
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nStart a previously stopped entity engine, resuming transform processing for the given entity type.", "operationId": "StartEntityEngine", "parameters": [ { "name": "entityType", "in": "path", "description": "The entity type of the engine to start.", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" }, "example": "host" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "started": { "type": "boolean", "description": "Whether the engine was successfully started." } } }, "examples": { "startEntityEngineExample": { "summary": "Engine started successfully", "description": "The engine was successfully started and is now processing data.", "value": { "started": true } } } } } } } } }, "/api/entity_store/engines/{entityType}/stop": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Stop an Entity Engine", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/entity_store/engines/{entityType}/stop
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nStop a running entity engine, pausing transform processing for the given entity type.", "operationId": "StopEntityEngine", "parameters": [ { "name": "entityType", "in": "path", "description": "The entity type of the engine to stop.", "required": true, "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" }, "example": "host" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "stopped": { "type": "boolean", "description": "Whether the engine was successfully stopped." } } }, "examples": { "stopEntityEngineExample": { "summary": "Engine stopped successfully", "description": "The engine was successfully stopped and is no longer processing data.", "value": { "stopped": true } } } } } } } } }, "/api/entity_store/engines/apply_dataview_indices": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Apply DataView indices to all installed engines", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/entity_store/engines/apply_dataview_indices
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSynchronize data view index patterns to all running entity engines so that newly added indices are picked up by the transforms.", "operationId": "ApplyEntityEngineDataviewIndices", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "result": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult" }, "description": "Per-engine update results." }, "success": { "type": "boolean", "description": "Whether all engines updated successfully." } } }, "examples": { "applyDataviewIndicesExample": { "summary": "All engines updated", "description": "All running engines were successfully updated with the current data view index patterns.", "value": { "result": [ { "changes": { "indexPatterns": [ "logs-*", "filebeat-*", "auditbeat-*" ] }, "type": "host" }, { "changes": { "indexPatterns": [ "logs-*", "filebeat-*", "auditbeat-*" ] }, "type": "user" } ], "success": true } } } } } }, "207": { "description": "Partial successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "string" }, "description": "Error messages for engines that failed to update." }, "result": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDataviewUpdateResult" }, "description": "Per-engine update results for engines that succeeded." }, "success": { "type": "boolean", "description": "Always `false` for a partial success." } } }, "examples": { "partialSuccessExample": { "summary": "One engine failed", "description": "The host engine was updated but the user engine failed due to insufficient privileges.", "value": { "errors": [ "Failed to update user engine: insufficient privileges" ], "result": [ { "changes": { "indexPatterns": [ "logs-*", "filebeat-*" ] }, "type": "host" } ], "success": false } } } } } }, "500": { "description": "Error response", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "Error message." }, "statusCode": { "type": "number", "description": "HTTP status code." } } }, "examples": { "serverErrorExample": { "summary": "Internal server error", "description": "An unexpected error occurred while applying data view indices.", "value": { "body": "An internal error occurred while updating engine indices", "statusCode": 500 } } } } } } } } }, "/api/entity_store/entities/list": { "get": { "tags": [ "Security Entity Analytics API" ], "summary": "List Entity Store Entities", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/entity_store/entities/list
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nList entities records, paging, sorting and filtering as needed.", "operationId": "ListEntities", "parameters": [ { "name": "sort_field", "in": "query", "description": "Field to sort results by.", "schema": { "type": "string" }, "example": "entity.name" }, { "name": "sort_order", "in": "query", "description": "Sort order.", "schema": { "enum": [ "asc", "desc" ], "type": "string" } }, { "name": "page", "in": "query", "description": "Page number to return (1-indexed).", "schema": { "minimum": 1, "type": "integer" }, "example": 1 }, { "name": "per_page", "in": "query", "description": "Number of entities per page.", "schema": { "maximum": 10000, "minimum": 1, "type": "integer" }, "example": 10 }, { "name": "filterQuery", "in": "query", "description": "An ES query to filter by.", "schema": { "type": "string" } }, { "name": "entity_types", "in": "query", "description": "Entity types to include in the results.", "required": true, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" } } } ], "responses": { "200": { "description": "Entities returned successfully", "content": { "application/json": { "schema": { "required": [ "records", "page", "per_page", "total" ], "type": "object", "properties": { "inspect": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_InspectQuery" }, "page": { "minimum": 1, "type": "integer", "description": "Current page number." }, "per_page": { "maximum": 1000, "minimum": 1, "type": "integer", "description": "Number of entities per page." }, "records": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_Entity" }, "description": "The entity records for this page." }, "total": { "minimum": 0, "type": "integer", "description": "Total number of entities matching the query." } } }, "examples": { "listEntitiesResponse": { "summary": "A page of host entities", "value": { "page": 1, "per_page": 10, "records": [ { "entity": { "id": "web-server-01", "name": "web-server-01", "type": "host" }, "host": { "ip": [ "10.0.0.1" ], "name": "web-server-01" } } ], "total": 1 } } } } } } } } }, "/api/entity_store/status": { "get": { "tags": [ "Security Entity Analytics API" ], "summary": "Get the status of the Entity Store", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/entity_store/status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the overall Entity Store status and per-engine statuses, optionally including component-level health details.", "operationId": "GetEntityStoreStatus", "parameters": [ { "name": "include_components", "in": "query", "description": "If true, returns a detailed status of each engine including all its components.", "schema": { "type": "boolean" }, "example": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "status", "engines" ], "type": "object", "properties": { "engines": { "type": "array", "items": { "allOf": [ { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor" }, { "type": "object", "properties": { "components": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineComponentStatus" }, "description": "Detailed component-level status. Only included when include_components is true." } } } ] }, "description": "Per-engine status information." }, "status": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_StoreStatus" } } }, "examples": { "entityStoreRunning": { "summary": "Entity Store running with two engines", "description": "The Entity Store is running with both host and user engines started and using default settings.", "value": { "engines": [ { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "started", "timeout": "180s", "timestampField": "@timestamp", "type": "host" }, { "delay": "1m", "fieldHistoryLength": 10, "frequency": "1m", "indexPattern": "", "lookbackPeriod": "24h", "status": "started", "timeout": "180s", "timestampField": "@timestamp", "type": "user" } ], "status": "running" } } } } } } } } }, "/api/exception_lists": { "delete": { "tags": [ "Security Exceptions API" ], "summary": "Delete an exception list", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/exception_lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an exception list using the `id` or `list_id` field.", "operationId": "DeleteExceptionList", "parameters": [ { "name": "id", "in": "query", "description": "Either `id` or `list_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "list_id", "in": "query", "description": "Either `id` or `list_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Exceptions API" ], "summary": "Get exception list details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/exception_lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an exception list using the `id` or `list_id` field.", "operationId": "ReadExceptionList", "parameters": [ { "name": "id", "in": "query", "description": "Either `id` or `list_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "list_id", "in": "query", "description": "Either `id` or `list_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Exceptions API" ], "summary": "Create an exception list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/exception_lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAn exception list groups exception items and can be associated with detection rules. You can assign detection rules with multiple exception lists.\n> info\n> All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.\n", "operationId": "CreateExceptionList", "requestBody": { "description": "Exception list's properties", "content": { "application/json": { "schema": { "required": [ "name", "description", "type" ], "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListDescription" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListName" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListTags" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListType" }, "version": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListVersion" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "409": { "description": "Exception list already exists response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } }, "put": { "tags": [ "Security Exceptions API" ], "summary": "Update an exception list", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/exception_lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an exception list using the `id` or `list_id` field.", "operationId": "UpdateExceptionList", "requestBody": { "description": "Exception list's properties", "content": { "application/json": { "schema": { "required": [ "name", "description", "type" ], "type": "object", "properties": { "_version": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListDescription" }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListName" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListTags" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListType" }, "version": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListVersion" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/_duplicate": { "post": { "tags": [ "Security Exceptions API" ], "summary": "Duplicate an exception list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/exception_lists/_duplicate
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDuplicate an existing exception list.", "operationId": "DuplicateExceptionList", "parameters": [ { "name": "list_id", "in": "query", "description": "Exception list's human identifier", "required": true, "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } }, { "name": "include_expired_exceptions", "in": "query", "description": "Determines whether to include expired exceptions in the exported list", "required": true, "schema": { "enum": [ "true", "false" ], "type": "string", "default": "true" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "405": { "description": "Exception list to duplicate not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/_export": { "post": { "tags": [ "Security Exceptions API" ], "summary": "Export an exception list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/exception_lists/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport an exception list and its associated items to an NDJSON file.", "operationId": "ExportExceptionList", "parameters": [ { "name": "id", "in": "query", "description": "Exception list's identifier", "required": true, "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "list_id", "in": "query", "description": "Exception list's human identifier", "required": true, "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } }, { "name": "include_expired_exceptions", "in": "query", "description": "Determines whether to include expired exceptions in the exported list", "required": true, "schema": { "enum": [ "true", "false" ], "type": "string", "default": "true" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/ndjson": { "schema": { "type": "string", "description": "A `.ndjson` file containing specified exception list and its items", "format": "binary" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/_find": { "get": { "tags": [ "Security Exceptions API" ], "summary": "Get exception lists", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/exception_lists/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all exception lists.", "operationId": "FindExceptionLists", "parameters": [ { "name": "filter", "in": "query", "description": "Filters the returned results according to the value of the specified field.\n\nUses the `so type.field name:field` value syntax, where `so type` can be:\n\n- `exception-list`: Specify a space-aware exception list.\n- `exception-list-agnostic`: Specify an exception list that is shared across spaces.\n", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_FindExceptionListsFilter" } }, { "name": "namespace_type", "in": "query", "description": "Determines whether the returned containers are Kibana associated with a Kibana space\nor available in all spaces (`agnostic` or `single`)\n", "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "default": [ "single" ] } }, { "name": "page", "in": "query", "description": "The page number to return", "schema": { "minimum": 1, "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of exception lists to return per page", "schema": { "minimum": 1, "type": "integer" } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results", "schema": { "type": "string" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order, which can be `desc` or `asc`", "schema": { "enum": [ "desc", "asc" ], "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "data", "page", "per_page", "total" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } }, "page": { "minimum": 1, "type": "integer" }, "per_page": { "minimum": 1, "type": "integer" }, "total": { "minimum": 0, "type": "integer" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/_import": { "post": { "tags": [ "Security Exceptions API" ], "summary": "Import an exception list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/exception_lists/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport an exception list and its associated items from an NDJSON file.", "operationId": "ImportExceptionList", "parameters": [ { "name": "overwrite", "in": "query", "description": "Determines whether existing exception lists with the same `list_id` are overwritten.\nIf any exception items have the same `item_id`, those are also overwritten.\n", "schema": { "type": "boolean", "default": false } }, { "name": "overwrite_exceptions", "in": "query", "schema": { "type": "boolean", "default": false } }, { "name": "overwrite_action_connectors", "in": "query", "schema": { "type": "boolean", "default": false } }, { "name": "as_new_list", "in": "query", "description": "Determines whether the list being imported will have a new `list_id` generated.\nAdditional `item_id`'s are generated for each exception item. Both the exception\nlist and its items are overwritten.\n", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "description": "A `.ndjson` file containing the exception list", "format": "binary" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "errors", "success", "success_count", "success_exception_lists", "success_count_exception_lists", "success_exception_list_items", "success_count_exception_list_items" ], "type": "object", "properties": { "errors": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkErrorArray" }, "success": { "type": "boolean" }, "success_count": { "minimum": 0, "type": "integer" }, "success_count_exception_list_items": { "minimum": 0, "type": "integer" }, "success_count_exception_lists": { "minimum": 0, "type": "integer" }, "success_exception_list_items": { "type": "boolean" }, "success_exception_lists": { "type": "boolean" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/items": { "delete": { "tags": [ "Security Exceptions API" ], "summary": "Delete an exception list item", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/exception_lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an exception list item using the `id` or `item_id` field.", "operationId": "DeleteExceptionListItem", "parameters": [ { "name": "id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "item_id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Exceptions API" ], "summary": "Get an exception list item", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/exception_lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an exception list item using the `id` or `item_id` field.", "operationId": "ReadExceptionListItem", "parameters": [ { "name": "id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "item_id", "in": "query", "description": "Either `id` or `item_id` must be specified", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Exceptions API" ], "summary": "Create an exception list item", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/exception_lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate an exception item and associate it with the specified exception list.\n> info\n> Before creating exception items, you must create an exception list.\n", "operationId": "CreateExceptionListItem", "requestBody": { "description": "Exception list item's properties", "content": { "application/json": { "schema": { "required": [ "list_id", "type", "name", "description", "entries" ], "type": "object", "properties": { "comments": { "$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemCommentArray" }, "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray" }, "expire_time": { "type": "string", "format": "date-time" }, "item_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "409": { "description": "Exception list item already exists response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } }, "put": { "tags": [ "Security Exceptions API" ], "summary": "Update an exception list item", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/exception_lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an exception list item using the `id` or `item_id` field.", "operationId": "UpdateExceptionListItem", "requestBody": { "description": "Exception list item's properties", "content": { "application/json": { "schema": { "required": [ "type", "name", "description", "entries" ], "type": "object", "properties": { "_version": { "type": "string" }, "comments": { "$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemCommentArray" }, "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray" }, "expire_time": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "item_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/items/_find": { "get": { "tags": [ "Security Exceptions API" ], "summary": "Get exception list items", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/exception_lists/items/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all exception list items in the specified list.", "operationId": "FindExceptionListItems", "parameters": [ { "name": "list_id", "in": "query", "description": "List's id", "required": true, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, { "name": "filter", "in": "query", "description": "Filters the returned results according to the value of the specified field,\nusing the `:` syntax.\n", "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "default": [ ] } }, { "name": "namespace_type", "in": "query", "description": "Determines whether the returned containers are Kibana associated with a Kibana space\nor available in all spaces (`agnostic` or `single`)\n", "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "default": [ "single" ] } }, { "name": "search", "in": "query", "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "The page number to return", "schema": { "minimum": 0, "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of exception list items to return per page", "schema": { "minimum": 0, "type": "integer" } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order, which can be `desc` or `asc`", "schema": { "enum": [ "desc", "asc" ], "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "data", "page", "per_page", "total" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItem" } }, "page": { "minimum": 1, "type": "integer" }, "per_page": { "minimum": 1, "type": "integer" }, "pit": { "type": "string" }, "total": { "minimum": 0, "type": "integer" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exception_lists/summary": { "get": { "tags": [ "Security Exceptions API" ], "summary": "Get an exception list summary", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/exception_lists/summary
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a summary of the specified exception list.", "operationId": "ReadExceptionListSummary", "parameters": [ { "name": "id", "in": "query", "description": "Exception list's identifier generated upon creation", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "list_id", "in": "query", "description": "Exception list's human readable identifier", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, { "name": "namespace_type", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" } }, { "name": "filter", "in": "query", "description": "Search filter clause", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "linux": { "minimum": 0, "type": "integer" }, "macos": { "minimum": 0, "type": "integer" }, "total": { "minimum": 0, "type": "integer" }, "windows": { "minimum": 0, "type": "integer" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "404": { "description": "Exception list not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/exceptions/shared": { "post": { "tags": [ "Security Exceptions API" ], "summary": "Create a shared exception list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/exceptions/shared
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAn exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.\n> info\n> All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.\n", "operationId": "CreateSharedExceptionList", "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "description" ], "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListDescription" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListName" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionList" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_PlatformErrorResponse" } } } }, "409": { "description": "Exception list already exists response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Exceptions_API_SiemErrorResponse" } } } } } } }, "/api/fleet/agent_download_sources": { "get": { "tags": [ "Elastic Agent binary download sources" ], "summary": "List agent binary download sources", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_download_sources
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-download-sources", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_download_sources" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Elastic Agent binary download sources" ], "summary": "Create agent binary download source", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agent_download_sources
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-download-sources", "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "host", "is_default" ], "type": "object", "properties": { "host": { "type": "string" }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "name": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_download_sources" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agent_download_sources/{sourceId}": { "delete": { "tags": [ "Elastic Agent binary download sources" ], "summary": "Delete agent binary download source by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/agent_download_sources/{sourceId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-download-source", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Elastic Agent binary download sources" ], "summary": "Get agent binary download source by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_download_sources/{sourceId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-one-download-source", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_download_sources" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Elastic Agent binary download sources" ], "summary": "Update agent binary download source by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/agent_download_sources/{sourceId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-download-source", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "is_default", "host" ], "type": "object", "properties": { "host": { "type": "string" }, "is_default": { "type": "boolean" }, "name": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_download_sources" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "sourceId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agent_policies": { "get": { "tags": [ "Elastic Agent policies" ], "summary": "List agent policies", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "agent-policy-list", "parameters": [ { "$ref": "#/components/parameters/Fleet_page_size" }, { "$ref": "#/components/parameters/Fleet_page_index" }, { "$ref": "#/components/parameters/Fleet_kuery" }, { "$ref": "#/components/parameters/Fleet_format" }, { "name": "full", "in": "query", "description": "When set to true, retrieve the related package policies for each agent policy.", "schema": { "type": "boolean" } }, { "name": "noAgentCount", "in": "query", "description": "When set to true, do not count how many agents are in the agent policy, this can improve performance if you are searching over a large number of agent policies. The \"agents\" property will always be 0 if set to true.", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items", "total", "page", "perPage" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent_policy" } }, "page": { "type": "number" }, "perPage": { "type": "number" }, "total": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Elastic Agent policies" ], "summary": "Create agent policy", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agent_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "create-agent-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_agent_policy_create_request" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agent_policies/_bulk_get": { "post": { "tags": [ "Elastic Agent policies" ], "summary": "Bulk get agent policies", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agent_policies/_bulk_get
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-get-agent-policies", "parameters": [ { "$ref": "#/components/parameters/Fleet_format" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "ids" ], "type": "object", "properties": { "full": { "type": "boolean", "description": "get full policies with package policies populated" }, "ids": { "type": "array", "items": { "type": "string" }, "description": "list of agent policy ids" }, "ignoreMissing": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent_policy" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agent_policies/{agentPolicyId}": { "get": { "tags": [ "Elastic Agent policies" ], "summary": "Get agent policy by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet one agent policy", "operationId": "agent-policy-info", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Elastic Agent policies" ], "summary": "Update agent policy by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-agent-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_agent_policy_update_request" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentPolicyId", "in": "path", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/Fleet_format" } ] }, "/api/fleet/agent_policies/{agentPolicyId}/copy": { "post": { "tags": [ "Elastic Agent policies" ], "summary": "Copy agent policy by ID", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "agent-policy-copy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "description": "", "content": { "application/json": { "schema": { "required": [ "name" ], "type": "object", "properties": { "description": { "type": "string" }, "name": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentPolicyId", "in": "path", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/Fleet_format" } ] }, "/api/fleet/agent_policies/{agentPolicyId}/download": { "get": { "tags": [ "Elastic Agent policies" ], "summary": "Download agent policy by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/download
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "agent-policy-download", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentPolicyId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "download", "in": "query", "schema": { "type": "string" } }, { "name": "standalone", "in": "query", "schema": { "type": "string" } }, { "name": "kubernetes", "in": "query", "schema": { "type": "string" } } ] }, "/api/fleet/agent_policies/{agentPolicyId}/full": { "get": { "tags": [ "Elastic Agent policies" ], "summary": "Get full agent policy by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/full
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "agent-policy-full", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "oneOf": [ { "type": "string" }, { "$ref": "#/components/schemas/Fleet_agent_policy_full" } ] } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentPolicyId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "download", "in": "query", "schema": { "type": "string" } }, { "name": "standalone", "in": "query", "schema": { "type": "string" } }, { "name": "kubernetes", "in": "query", "schema": { "type": "string" } } ] }, "/api/fleet/agent_policies/delete": { "post": { "tags": [ "Elastic Agent policies" ], "summary": "Delete agent policy by ID", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agent_policies/delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-agent-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "agentPolicyId" ], "type": "object", "properties": { "agentPolicyId": { "type": "string" }, "force": { "type": "boolean", "description": "bypass validation checks that can prevent agent policy deletion" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "id", "success" ], "type": "object", "properties": { "id": { "type": "string" }, "success": { "type": "boolean" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agent_status": { "get": { "tags": [ "Elastic Agent status" ], "summary": "Get agent status summary", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agent-status", "parameters": [ { "name": "policyId", "in": "query", "schema": { "type": "string" } }, { "name": "kuery", "in": "query", "deprecated": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "active", "all", "error", "events", "inactive", "offline", "online", "other", "total", "updating" ], "type": "object", "properties": { "active": { "type": "integer" }, "all": { "type": "integer" }, "error": { "type": "integer" }, "events": { "type": "integer" }, "inactive": { "type": "integer" }, "offline": { "type": "integer" }, "online": { "type": "integer" }, "other": { "type": "integer" }, "total": { "type": "integer", "deprecated": true }, "unenrolled": { "type": "integer" }, "updating": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agent_status/data": { "get": { "tags": [ "Elastic Agent status" ], "summary": "Get incoming agent data", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent_status/data
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agent-data", "parameters": [ { "name": "agentsIds", "in": "query", "required": true, "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "boolean" } } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agent-status": { "get": { "tags": [ "Elastic Agent status" ], "summary": "Get agent status summary", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agent-status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agent-status-deprecated", "parameters": [ { "name": "policyId", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "error", "events", "inactive", "offline", "online", "other", "total", "updating" ], "type": "object", "properties": { "error": { "type": "integer" }, "events": { "type": "integer" }, "inactive": { "type": "integer" }, "offline": { "type": "integer" }, "online": { "type": "integer" }, "other": { "type": "integer" }, "total": { "type": "integer" }, "updating": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true } }, "/api/fleet/agents": { "get": { "tags": [ "Elastic Agents" ], "summary": "List agents", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agents", "parameters": [ { "$ref": "#/components/parameters/Fleet_page_size" }, { "$ref": "#/components/parameters/Fleet_page_index" }, { "$ref": "#/components/parameters/Fleet_kuery" }, { "$ref": "#/components/parameters/Fleet_show_inactive" }, { "$ref": "#/components/parameters/Fleet_show_upgradeable" }, { "$ref": "#/components/parameters/Fleet_sort_field" }, { "$ref": "#/components/parameters/Fleet_sort_order" }, { "$ref": "#/components/parameters/Fleet_with_metrics" }, { "name": "getStatusSummary", "in": "query", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_get_agents_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Elastic Agents" ], "summary": "List agents by action ids", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agents-by-actions", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "policy_id" ], "type": "object", "properties": { "actionIds": { "type": "array", "items": { "type": "string" } } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_agent_get_by_actions" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/{agentId}": { "delete": { "tags": [ "Elastic Agents" ], "summary": "Delete agent by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/agents/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "deleted" ], "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Elastic Agents" ], "summary": "Get agent by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_with_metrics" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Elastic Agents" ], "summary": "Update agent by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/agents/{agentId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "tags": { "type": "array", "items": { "type": "string" } }, "user_provided_metadata": { "type": "object" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/{agentId}/actions": { "post": { "tags": [ "Elastic Agent actions" ], "summary": "Create agent action", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/{agentId}/actions
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "new-agent-action", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "$ref": "#/components/schemas/Fleet_agent_action" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "array", "items": { "type": "number" } }, "headers": { "type": "string" }, "statusCode": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/{agentId}/reassign": { "post": { "tags": [ "Elastic Agents" ], "summary": "Reassign agent", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/{agentId}/reassign
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "reassign-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "policy_id" ], "type": "object", "properties": { "policy_id": { "type": "string" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Elastic Agents" ], "summary": "Reassign agent", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/agents/{agentId}/reassign
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "reassign-agent-deprecated", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "policy_id" ], "type": "object", "properties": { "policy_id": { "type": "string" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/{agentId}/request_diagnostics": { "post": { "tags": [ "Elastic Agents" ], "summary": "Request agent diagnostics", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/{agentId}/request_diagnostics
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "request-diagnostics-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "additional_metrics": { "type": "array", "items": { "oneOf": [ { "enum": [ "CPU" ], "type": "string" } ] } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "actionId": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/{agentId}/unenroll": { "post": { "tags": [ "Elastic Agents" ], "summary": "Unenroll agent", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/{agentId}/unenroll
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "unenroll-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "force": { "type": "boolean" }, "revoke": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "BAD REQUEST", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "enum": [ 400 ], "type": "number" } } } } } } } }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/{agentId}/upgrade": { "post": { "tags": [ "Elastic Agents" ], "summary": "Upgrade agent", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/{agentId}/upgrade
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "upgrade-agent", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_upgrade_agent" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_upgrade_agent" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/{agentId}/uploads": { "get": { "tags": [ "Elastic Agents" ], "summary": "List agent uploads", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents/{agentId}/uploads
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "list-agent-uploads", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "object", "properties": { "item": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent_diagnostics" } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "agentId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/action_status": { "get": { "tags": [ "Elastic Agent actions" ], "summary": "Get agent action status", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents/action_status
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "agents-action-status", "parameters": [ { "$ref": "#/components/parameters/Fleet_page_size" }, { "$ref": "#/components/parameters/Fleet_page_index" }, { "name": "errorSize", "in": "query", "schema": { "type": "integer", "default": 5 } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "required": [ "actionId", "complete", "nbAgentsActioned", "nbAgentsActionCreated", "nbAgentsAck", "nbAgentsFailed", "status", "creationTime", "type" ], "type": "object", "properties": { "actionId": { "type": "string" }, "cancellationTime": { "type": "string" }, "completionTime": { "type": "string" }, "creationTime": { "type": "string", "description": "creation time of action" }, "expiration": { "type": "string" }, "latestErrors": { "type": "array", "items": { "type": "object", "properties": { "agentId": { "type": "string" }, "error": { "type": "string" }, "timestamp": { "type": "string" } } }, "description": "latest errors that happened when the agents executed the action" }, "nbAgentsAck": { "type": "number", "description": "number of agents that acknowledged the action" }, "nbAgentsActionCreated": { "type": "number", "description": "number of agents included in action from kibana" }, "nbAgentsActioned": { "type": "number", "description": "number of agents actioned" }, "nbAgentsFailed": { "type": "number", "description": "number of agents that failed to execute the action" }, "newPolicyId": { "type": "string", "description": "new policy id (POLICY_REASSIGN action)" }, "policyId": { "type": "string", "description": "policy id (POLICY_CHANGE action)" }, "revision": { "type": "string", "description": "new policy revision (POLICY_CHANGE action)" }, "startTime": { "type": "string", "description": "start time of action (scheduled actions)" }, "status": { "enum": [ "COMPLETE", "EXPIRED", "CANCELLED", "FAILED", "IN_PROGRESS", "ROLLOUT_PASSED" ], "type": "string" }, "type": { "enum": [ "POLICY_REASSIGN", "UPGRADE", "UNENROLL", "FORCE_UNENROLL", "UPDATE_TAGS", "CANCEL", "REQUEST_DIAGNOSTICS", "SETTINGS", "POLICY_CHANGE", "INPUT_ACTION" ], "type": "string" }, "version": { "type": "string", "description": "agent version number (UPGRADE action)" } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/actions/{actionId}/cancel": { "post": { "tags": [ "Elastic Agent actions" ], "summary": "Cancel agent action", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/actions/{actionId}/cancel
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "agent-action-cancel", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_agent_action" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "actionId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/bulk_reassign": { "post": { "tags": [ "Elastic Agents" ], "summary": "Bulk reassign agents", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/bulk_reassign
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-reassign-agents", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "policy_id", "agents" ], "type": "object", "properties": { "agents": { "oneOf": [ { "type": "string", "description": "KQL query string, leave empty to action all agents" }, { "type": "array", "items": { "type": "string" }, "description": "list of agent IDs" } ] }, "policy_id": { "type": "string", "description": "new agent policy id" } } }, "example": { "agents": "fleet-agents.policy_id : (\"policy1\" or \"policy2\")", "policy_id": "policy_id" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "actionId": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/bulk_request_diagnostics": { "post": { "tags": [ "Elastic Agents" ], "summary": "Bulk request diagnostics from agents", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/bulk_request_diagnostics
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-request-diagnostics", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "agents" ], "type": "object", "properties": { "additional_metrics": { "type": "array", "items": { "oneOf": [ { "enum": [ "CPU" ], "type": "string" } ] } }, "agents": { "oneOf": [ { "type": "string", "description": "KQL query string, leave empty to action all agents" }, { "type": "array", "items": { "type": "string" }, "description": "list of agent IDs" } ] }, "batchSize": { "type": "number" } } }, "example": { "agents": "fleet-agents.policy_id : (\"policy1\" or \"policy2\")" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "actionId": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/bulk_unenroll": { "post": { "tags": [ "Elastic Agents" ], "summary": "Bulk unenroll agents", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/bulk_unenroll
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-unenroll-agents", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "agents" ], "type": "object", "properties": { "agents": { "oneOf": [ { "type": "string", "description": "KQL query string, leave empty to action all agents" }, { "type": "array", "items": { "type": "string" }, "description": "list of agent IDs" } ] }, "force": { "type": "boolean", "description": "Unenrolls hosted agents too" }, "includeInactive": { "type": "boolean", "description": "When passing agents by KQL query, unenrolls inactive agents too" }, "revoke": { "type": "boolean", "description": "Revokes API keys of agents" } } }, "example": { "agents": [ "agent1", "agent2" ], "force": false, "revoke": true } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "actionId": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/bulk_update_agent_tags": { "post": { "tags": [ "Elastic Agents" ], "summary": "Bulk update agent tags", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/bulk_update_agent_tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-update-agent-tags", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "agents" ], "type": "object", "properties": { "agents": { "oneOf": [ { "type": "string", "description": "KQL query string, leave empty to action all agents" }, { "type": "array", "items": { "type": "string" }, "description": "list of agent IDs" } ] }, "batchSize": { "type": "number" }, "tagsToAdd": { "type": "array", "items": { "type": "string" } }, "tagsToRemove": { "type": "array", "items": { "type": "string" } } } }, "example": { "agents": [ "agent1", "agent2" ], "tagsToAdd": [ "newTag" ], "tagsToRemove": [ "existingTag" ] } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "actionId": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/bulk_upgrade": { "post": { "tags": [ "Elastic Agents" ], "summary": "Bulk upgrade agents", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/bulk_upgrade
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-upgrade-agents", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_bulk_upgrade_agents" }, "example": { "agents": [ "agent1", "agent2" ], "rollout_duration_seconds": 3600, "source_uri": "https://artifacts.elastic.co/downloads/beats/elastic-agent", "start_time": "2022-08-03T14:00:00.000Z", "version": "8.4.0" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "actionId": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/files/{fileId}": { "delete": { "tags": [ "Elastic Agents" ], "summary": "Delete file uploaded by agent", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/agents/files/{fileId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-agent-upload-file", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "object", "properties": { "deleted": { "type": "boolean" }, "id": { "type": "string" } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "fileId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/files/{fileId}/{fileName}": { "get": { "tags": [ "Elastic Agents" ], "summary": "Get file uploaded by agent", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents/files/{fileId}/{fileName}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agent-upload-file", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "object", "properties": { "items": { "type": "object", "properties": { "body": { }, "headers": { } } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "fileId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "fileName", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/agents/setup": { "get": { "tags": [ "Elastic Agents" ], "summary": "Get agent setup info", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents/setup
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agents-setup-status", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_fleet_status_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Elastic Agents" ], "summary": "Initiate agent setup", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/agents/setup
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "setup-agents", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "admin_username", "admin_password" ], "type": "object", "properties": { "admin_password": { "type": "string" }, "admin_username": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_fleet_setup_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/agents/tags": { "get": { "tags": [ "Elastic Agents" ], "summary": "List agent tags", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/agents/tags
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-agent-tags", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_get_agent_tags_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/data_streams": { "get": { "tags": [ "Data streams" ], "summary": "List data streams", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/data_streams
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "data-streams-list", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "data_streams": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_data_stream" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/enrollment_api_keys": { "get": { "tags": [ "Fleet enrollment API keys" ], "summary": "List enrollment API keys", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/enrollment_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-enrollment-api-keys", "parameters": [ { "$ref": "#/components/parameters/Fleet_page_size" }, { "$ref": "#/components/parameters/Fleet_page_index" }, { "$ref": "#/components/parameters/Fleet_kuery" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items", "page", "perPage", "total" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" } }, "list": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" }, "deprecated": true }, "page": { "type": "number" }, "perPage": { "type": "number" }, "total": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Fleet enrollment API keys" ], "summary": "Create enrollment API key", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/enrollment_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "create-enrollment-api-keys", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "policy_id" ], "type": "object", "properties": { "name": { "type": "string", "description": "The name of the enrollment API key. Must be unique." }, "policy_id": { "type": "string", "description": "The ID of the agent policy the Elastic Agent will be enrolled in." } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "enum": [ "created" ], "type": "string" }, "item": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/enrollment_api_keys/{keyId}": { "delete": { "tags": [ "Fleet enrollment API keys" ], "summary": "Revoke enrollment API key by ID by marking it as inactive", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/enrollment_api_keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-enrollment-api-key", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "deleted" ], "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Fleet enrollment API keys" ], "summary": "Get enrollment API key by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/enrollment_api_keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-enrollment-api-key", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "keyId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/enrollment-api-keys": { "get": { "tags": [ "Fleet enrollment API keys" ], "summary": "List enrollment API keys", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/enrollment-api-keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-enrollment-api-keys-deprecated", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items", "page", "perPage", "total" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" } }, "list": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" }, "deprecated": true }, "page": { "type": "number" }, "perPage": { "type": "number" }, "total": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true }, "post": { "tags": [ "Fleet enrollment API keys" ], "summary": "Create enrollment API key", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/enrollment-api-keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "create-enrollment-api-keys-deprecated", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "enum": [ "created" ], "type": "string" }, "item": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true } }, "/api/fleet/enrollment-api-keys/{keyId}": { "delete": { "tags": [ "Fleet enrollment API keys" ], "summary": "Delete enrollment API key by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/enrollment-api-keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-enrollment-api-key-deprecated", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "deleted" ], "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true }, "get": { "tags": [ "Fleet enrollment API keys" ], "summary": "Get enrollment API key by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/enrollment-api-keys/{keyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-enrollment-api-key-deprecated", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_enrollment_api_key" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true }, "parameters": [ { "name": "keyId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/epm/bulk_assets": { "post": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Bulk get assets", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/epm/bulk_assets
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-get-assets", "requestBody": { "content": { "application/json": { "schema": { "required": [ "assetIds" ], "type": "object", "properties": { "assetIds": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "type": { "type": "string" } } }, "description": "list of items necessary to fetch assets" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_get_bulk_assets_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/epm/categories": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "List package categories", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/categories
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-package-categories", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_get_categories_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "prerelease", "in": "query", "description": "Whether to include prerelease packages in categories count (e.g. beta, rc, preview)", "schema": { "type": "boolean", "default": false } }, { "name": "experimental", "in": "query", "deprecated": true, "schema": { "type": "boolean", "default": false } }, { "name": "include_policy_templates", "in": "query", "schema": { "type": "boolean", "default": false } } ] }, "/api/fleet/epm/packages": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "List packages", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/packages
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "list-all-packages", "parameters": [ { "name": "excludeInstallStatus", "in": "query", "description": "Whether to exclude the install status of each package. Enabling this option will opt in to caching for the response via `cache-control` headers. If you don't need up-to-date installation info for a package, and are querying for a list of available packages, providing this flag can improve performance substantially.", "schema": { "type": "boolean", "default": false } }, { "name": "prerelease", "in": "query", "description": "Whether to return prerelease versions of packages (e.g. beta, rc, preview)", "schema": { "type": "boolean", "default": false } }, { "name": "experimental", "in": "query", "deprecated": true, "schema": { "type": "boolean", "default": false } }, { "name": "category", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_get_packages_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Install by package by direct upload", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/epm/packages
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "install-package-by-upload", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "name": "ignoreMappingUpdateErrors", "in": "query", "description": "avoid erroring out on unexpected mapping update errors", "schema": { "type": "boolean", "default": false } }, { "name": "skipDataStreamRollover", "in": "query", "description": "Skip data stream rollover during index template mapping or settings update", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "application/gzip": { "schema": { "type": "string", "format": "binary" } }, "application/zip": { "schema": { "type": "string", "format": "binary" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "_meta": { "type": "object", "properties": { "install_source": { "enum": [ "upload", "registry", "bundled" ], "type": "string" } } }, "items": { "type": "array", "items": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "oneOf": [ { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" }, { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } ] } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" }, "429": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/epm/packages/_bulk": { "post": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Bulk install packages", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/epm/packages/_bulk
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-install-packages", "parameters": [ { "name": "prerelease", "in": "query", "description": "Whether to return prerelease versions of packages (e.g. beta, rc, preview)", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "packages" ], "type": "object", "properties": { "force": { "type": "boolean", "description": "force install to ignore package verification errors" }, "packages": { "type": "array", "items": { "oneOf": [ { "type": "string", "description": "package name" }, { "type": "object", "properties": { "name": { "type": "string", "description": "package name" }, "version": { "type": "string", "description": "package version" } } } ] }, "description": "list of packages to install" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_bulk_install_packages_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/epm/packages/{pkgkey}": { "delete": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Delete ackage", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/epm/packages/{pkgkey}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-package-deprecated", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "name": "pkgkey", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "force": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "response" ], "type": "object", "properties": { "response": { "type": "array", "items": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "oneOf": [ { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" }, { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } ] } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true }, "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get package", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/packages/{pkgkey}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-package-deprecated", "parameters": [ { "name": "pkgkey", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "prerelease", "in": "query", "description": "Whether to return prerelease versions of packages (e.g. beta, rc, preview)", "schema": { "type": "boolean", "default": false } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "properties": { "response": { "$ref": "#/components/schemas/Fleet_package_info" } } }, { "required": [ "status", "savedObject" ], "properties": { "savedObject": { "type": "string" }, "status": { "enum": [ "installed", "installing", "install_failed", "not_installed" ], "type": "string" } } } ] } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true }, "post": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Install package", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/epm/packages/{pkgkey}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "install-package-deprecated", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "name": "pkgkey", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "ignoreMappingUpdateErrors", "in": "query", "description": "avoid erroring out on unexpected mapping update errors", "schema": { "type": "boolean", "default": false } }, { "name": "skipDataStreamRollover", "in": "query", "description": "Skip data stream rollover during index template mapping or settings update", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "force": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "response" ], "type": "object", "properties": { "response": { "type": "array", "items": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "oneOf": [ { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" }, { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } ] } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true } }, "/api/fleet/epm/packages/{pkgName}/{pkgVersion}": { "delete": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Delete package", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-package", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "name": "force", "in": "query", "description": "delete package even if policies used by agents", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "force": { "type": "boolean" } }, "deprecated": true } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "oneOf": [ { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" }, { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } ] } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get package", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-package", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "properties": { "item": { "$ref": "#/components/schemas/Fleet_package_info" } } }, { "required": [ "status", "savedObject" ], "properties": { "keepPoliciesUpToDate": { "type": "boolean" }, "latestVersion": { "type": "string" }, "licensePath": { "type": "string" }, "notice": { "type": "string" }, "savedObject": { "type": "object", "deprecated": true }, "status": { "enum": [ "installed", "installing", "install_failed", "not_installed" ], "type": "string" } } } ] } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Install package", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "install-package", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "name": "ignoreMappingUpdateErrors", "in": "query", "description": "avoid erroring out on unexpected mapping update errors", "schema": { "type": "boolean", "default": false } }, { "name": "skipDataStreamRollover", "in": "query", "description": "Skip data stream rollover during index template mapping or settings update", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "force": { "type": "boolean" }, "ignore_constraints": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "_meta": { "type": "object", "properties": { "install_source": { "enum": [ "registry", "upload", "bundled" ], "type": "string" } } }, "items": { "type": "array", "items": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "oneOf": [ { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" }, { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } ] } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Update package settings", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-package", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "keepPoliciesUpToDate": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "oneOf": [ { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" }, { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } ] } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "pkgName", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "pkgVersion", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "ignoreUnverified", "in": "query", "description": "Ignore if the package is fails signature verification", "schema": { "type": "boolean" } }, { "name": "full", "in": "query", "description": "Return all fields from the package manifest, not just those supported by the Elastic Package Registry", "schema": { "type": "boolean" } }, { "name": "prerelease", "in": "query", "description": "Whether to return prerelease versions of packages (e.g. beta, rc, preview)", "schema": { "type": "boolean", "default": false } } ] }, "/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get package file", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "packages-get-file", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "object" }, "headers": { "type": "object" }, "statusCode": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "pkgName", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "pkgVersion", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "filePath", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize": { "post": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Authorize transforms", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "reauthorize-transforms", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "name": "pkgName", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "pkgVersion", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "prerelease", "in": "query", "description": "Whether to include prerelease packages in categories count (e.g. beta, rc, preview)", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "transforms": { "type": "array", "items": { "type": "object", "properties": { "transformId": { "type": "string" } } } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "required": [ "transformId", "error" ], "type": "object", "properties": { "error": { "type": "string" }, "success": { "type": "boolean" }, "transformId": { "type": "string" } } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/epm/packages/{pkgName}/stats": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get package stats", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/packages/{pkgName}/stats
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-package-stats", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "response" ], "type": "object", "properties": { "response": { "$ref": "#/components/schemas/Fleet_package_usage_stats" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "pkgName", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/epm/packages/limited": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get limited package list", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/packages/limited
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "list-limited-packages", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "type": "string" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get inputs template", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-inputs-template", "responses": { "200": { "description": "OK" }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "pkgName", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "pkgVersion", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "format", "in": "query", "description": "Format of response - json or yaml", "schema": { "enum": [ "json", "yaml", "yml" ], "type": "string" } }, { "name": "prerelease", "in": "query", "description": "Specify if version is prerelease", "schema": { "type": "boolean" } }, { "name": "ignoreUnverified", "in": "query", "description": "Ignore if the package is fails signature verification", "schema": { "type": "boolean" } } ] }, "/api/fleet/epm/verification_key_id": { "get": { "tags": [ "Elastic Package Manager (EPM)" ], "summary": "Get package signature verification key ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/epm/verification_key_id
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "packages-get-verification-key-id", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "object", "properties": { "id": { "type": [ "null", "string" ], "description": "the key ID of the GPG key used to verify package signatures" } } }, "headers": { "type": "object" }, "statusCode": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/fleet_server_hosts": { "get": { "tags": [ "Fleet Server hosts" ], "summary": "List Fleet Server hosts", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/fleet_server_hosts
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-fleet-server-hosts", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_fleet_server_host" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Fleet Server hosts" ], "summary": "Create Fleet Server host", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/fleet_server_hosts
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-fleet-server-hosts", "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "host_urls" ], "type": "object", "properties": { "host_urls": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "proxy_id": { "type": "string", "description": "The ID of the proxy to use for this fleet server host. See the proxies API for more information." } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_fleet_server_host" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/fleet_server_hosts/{itemId}": { "delete": { "tags": [ "Fleet Server hosts" ], "summary": "Delete Fleet Server host by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/fleet_server_hosts/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-fleet-server-hosts", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Fleet Server hosts" ], "summary": "Get Fleet Server host by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/fleet_server_hosts/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-one-fleet-server-hosts", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_fleet_server_host" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Fleet Server hosts" ], "summary": "Update Fleet Server host by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/fleet_server_hosts/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-fleet-server-hosts", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "host_urls": { "type": "array", "items": { "type": "string" } }, "is_default": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "proxy_id": { "type": [ "null", "string" ], "description": "The ID of the proxy to use for this fleet server host. See the proxies API for more information." } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_fleet_server_host" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "itemId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/health_check": { "post": { "tags": [ "Fleet internals" ], "summary": "Fleet Server health check", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/health_check
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "fleet-server-health-check", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "host": { "type": "string", "deprecated": true }, "id": { "type": "string" } } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "host": { "type": "string", "deprecated": true }, "id": { "type": "string", "description": "Fleet Server host id" }, "status": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/kubernetes": { "get": { "tags": [ "Fleet Kubernetes" ], "summary": "Get full K8s agent manifest", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/kubernetes
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-full-k8s-manifest", "parameters": [ { "name": "download", "in": "query", "schema": { "type": "boolean" } }, { "name": "fleetServer", "in": "query", "schema": { "type": "string" } }, { "name": "enrolToken", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/logstash_api_keys": { "post": { "tags": [ "Fleet outputs" ], "summary": "Generate Logstash API key", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/logstash_api_keys
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "generate-logstash-api-key", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "api_key": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/outputs": { "get": { "tags": [ "Fleet outputs" ], "summary": "List outputs", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/outputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-outputs", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_output_create_request" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Fleet outputs" ], "summary": "Create output", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/outputs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-outputs", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_output_create_request" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_output_create_request" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/outputs/{outputId}": { "delete": { "tags": [ "Fleet outputs" ], "summary": "Delete output by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/outputs/{outputId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-output", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Fleet outputs" ], "summary": "Get output by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/outputs/{outputId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-output", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_output_create_request" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Fleet outputs" ], "summary": "Update output by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/outputs/{outputId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-output", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_output_update_request" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_output_update_request" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "outputId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/outputs/{outputId}/health": { "get": { "tags": [ "Fleet outputs" ], "summary": "Get latest output health", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/outputs/{outputId}/health
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-output-health", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "description": "long message if unhealthy" }, "state": { "type": "string", "description": "state of output, HEALTHY or DEGRADED" }, "timestamp": { "type": "string", "description": "timestamp of reported state" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "outputId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/package_policies": { "get": { "tags": [ "Fleet package policies" ], "summary": "List package policies", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/package_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-package-policies", "parameters": [ { "$ref": "#/components/parameters/Fleet_page_size" }, { "$ref": "#/components/parameters/Fleet_page_index" }, { "$ref": "#/components/parameters/Fleet_kuery" }, { "$ref": "#/components/parameters/Fleet_format" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_package_policy" } }, "page": { "type": "number" }, "perPage": { "type": "number" }, "total": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Fleet package policies" ], "summary": "Create package policy", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/package_policies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "create-package-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "$ref": "#/components/parameters/Fleet_format" } ], "requestBody": { "description": "You should use inputs as an object and not use the deprecated inputs array.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_package_policy_request" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_package_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" }, "409": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/package_policies/_bulk_get": { "post": { "tags": [ "Fleet package policies" ], "summary": "Bulk get package policies", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/package_policies/_bulk_get
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulk-get-package-policies", "parameters": [ { "$ref": "#/components/parameters/Fleet_format" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "ids" ], "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "list of package policy ids" }, "ignoreMissing": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_package_policy" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/package_policies/{packagePolicyId}": { "delete": { "tags": [ "Fleet package policies" ], "summary": "Delete package policy by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/package_policies/{packagePolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-package-policy", "parameters": [ { "name": "force", "in": "query", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Fleet package policies" ], "summary": "Get package policy by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/package_policies/{packagePolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-package-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_format" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_package_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Fleet package policies" ], "summary": "Update package policy by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/package_policies/{packagePolicyId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-package-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" }, { "$ref": "#/components/parameters/Fleet_format" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_package_policy_request" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_package_policy" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "packagePolicyId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/package_policies/delete": { "post": { "tags": [ "Fleet package policies" ], "summary": "Delete package policy", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/package_policies/delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-delete-package-policy", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "packagePolicyIds" ], "type": "object", "properties": { "force": { "type": "boolean" }, "packagePolicyIds": { "type": "array", "items": { "type": "string" } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "required": [ "id", "success" ], "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "success": { "type": "boolean" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/package_policies/upgrade": { "post": { "tags": [ "Fleet package policies" ], "summary": "Upgrade package policy to a newer package version", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/package_policies/upgrade
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "upgrade-package-policy", "requestBody": { "content": { "application/json": { "schema": { "required": [ "packagePolicyIds" ], "type": "object", "properties": { "packagePolicyIds": { "type": "array", "items": { "type": "string" } } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "required": [ "id", "success" ], "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "success": { "type": "boolean" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" }, "409": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/package_policies/upgrade/dryrun": { "post": { "tags": [ "Fleet package policies" ], "summary": "Dry run package policy upgrade", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/package_policies/upgrade/dryrun
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "upgrade-package-policy-dry-run", "requestBody": { "content": { "application/json": { "schema": { "required": [ "packagePolicyIds" ], "type": "object", "properties": { "packagePolicyIds": { "type": "array", "items": { "type": "string" } }, "packageVersion": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "required": [ "hasErrors" ], "type": "object", "properties": { "agent_diff": { "$ref": "#/components/schemas/Fleet_upgrade_agent_diff" }, "diff": { "$ref": "#/components/schemas/Fleet_upgrade_diff" }, "hasErrors": { "type": "boolean" } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/proxies": { "get": { "tags": [ "Fleet proxies" ], "summary": "List proxies", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/proxies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-fleet-proxies", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_proxies" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "post": { "tags": [ "Fleet proxies" ], "summary": "Create proxy", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/proxies
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "post-fleet-proxies", "requestBody": { "content": { "application/json": { "schema": { "required": [ "name", "url" ], "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "string" }, "certificate_key": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "proxy_headers": { "type": "object" }, "url": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_proxies" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/proxies/{itemId}": { "delete": { "tags": [ "Fleet proxies" ], "summary": "Delete proxy by ID", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/fleet/proxies/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "delete-fleet-proxies", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "get": { "tags": [ "Fleet proxies" ], "summary": "Get proxy by ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/proxies/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-one-fleet-proxies", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_proxies" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Fleet proxies" ], "summary": "Update proxy by ID", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/proxies/{itemId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-fleet-proxies", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "string" }, "certificate_key": { "type": "string" }, "name": { "type": "string" }, "proxy_headers": { "type": "object" }, "url": { "type": "string" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_proxies" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "parameters": [ { "name": "itemId", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "/api/fleet/service_tokens": { "post": { "tags": [ "Fleet service tokens" ], "summary": "Create service token", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/service_tokens
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "generate-service-token", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/service-tokens": { "post": { "tags": [ "Fleet service tokens" ], "summary": "Create service token", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/service-tokens
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "generate-service-token-deprecated", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } }, "deprecated": true } }, "/api/fleet/settings": { "get": { "tags": [ "Fleet internals" ], "summary": "Get settings", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-settings", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_fleet_settings_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } }, "put": { "tags": [ "Fleet internals" ], "summary": "Update settings", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/fleet/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "update-settings", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "additional_yaml_config": { "type": "string" }, "delete_unenrolled_agents": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "is_preconfigured": { "type": "boolean" } } }, "fleet_server_hosts": { "type": "array", "items": { "type": "string" }, "description": "Protocol and path must be the same for each URL" }, "has_seen_add_data_notice": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_fleet_settings_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/setup": { "post": { "tags": [ "Fleet internals" ], "summary": "Initiate Fleet setup", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/fleet/setup
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "setup", "parameters": [ { "$ref": "#/components/parameters/Fleet_kbn_xsrf" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Fleet_fleet_setup_response" } } } }, "400": { "$ref": "#/components/responses/Fleet_error" }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" } } } } } } } } }, "/api/fleet/uninstall_tokens": { "get": { "tags": [ "Fleet uninstall tokens" ], "summary": "List metadata for latest uninstall tokens per agent policy", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/uninstall_tokens
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-uninstall-tokens", "parameters": [ { "name": "perPage", "in": "query", "description": "The number of items to return", "schema": { "minimum": 5, "type": "integer", "default": 20 } }, { "$ref": "#/components/parameters/Fleet_page_index" }, { "name": "policyId", "in": "query", "description": "Partial match filtering for policy IDs", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "items", "total", "page", "perPage" ], "type": "object", "properties": { "items": { "type": "array", "items": { "required": [ "id", "policy_id", "created_at" ], "type": "object", "properties": { "created_at": { "type": "string" }, "id": { "type": "string" }, "policy_id": { "type": "string" } } } }, "page": { "type": "number" }, "perPage": { "type": "number" }, "total": { "type": "number" } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/fleet/uninstall_tokens/{uninstallTokenId}": { "get": { "tags": [ "Fleet uninstall tokens" ], "summary": "Get one decrypted uninstall token by its ID", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/fleet/uninstall_tokens/{uninstallTokenId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-uninstall-token", "parameters": [ { "name": "uninstallTokenId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "required": [ "item" ], "type": "object", "properties": { "item": { "required": [ "id", "token", "policy_id", "created_at" ], "type": "object", "properties": { "created_at": { "type": "string" }, "id": { "type": "string" }, "policy_id": { "type": "string" }, "token": { "type": "string" } } } } } } } }, "400": { "$ref": "#/components/responses/Fleet_error" } } } }, "/api/lists": { "delete": { "tags": [ "Security Lists API" ], "summary": "Delete a list", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a list using the list ID.\n> info\n> When you delete a list, all of its list items are also deleted.\n", "operationId": "DeleteList", "parameters": [ { "name": "id", "in": "query", "description": "List's `id` value", "required": true, "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "deleteReferences", "in": "query", "schema": { "type": "boolean", "default": false } }, { "name": "ignoreReferences", "in": "query", "schema": { "type": "boolean", "default": false } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_List" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Lists API" ], "summary": "Get list details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a list using the list ID.", "operationId": "ReadList", "parameters": [ { "name": "id", "in": "query", "description": "List's `id` value", "required": true, "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_List" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "patch": { "tags": [ "Security Lists API" ], "summary": "Patch a list", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing list using the list ID.", "operationId": "PatchList", "requestBody": { "description": "List's properties", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "_version": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListMetadata" }, "name": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "version": { "minimum": 1, "type": "integer" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_List" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Lists API" ], "summary": "Create a list", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new list.", "operationId": "CreateList", "requestBody": { "description": "List's properties", "content": { "application/json": { "schema": { "required": [ "name", "description", "type" ], "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListMetadata" }, "name": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "type": { "$ref": "#/components/schemas/Security_Lists_API_ListType" }, "version": { "minimum": 1, "type": "integer", "default": 1 } } }, "examples": { "ip": { "value": { "description": "This list describes bad internet ips", "id": "ip_list", "name": "Simple list with ips", "type": "ip" } }, "ip_range": { "value": { "description": "This list has ip ranges", "id": "ip_range_list", "name": "Simple list with ip ranges", "type": "ip_range" } }, "keyword": { "value": { "description": "This list describes bad host names", "id": "keyword_list", "name": "Simple list with a keyword", "type": "keyword" } }, "keyword_custom_format": { "value": { "description": "This parses the first found ipv4 only", "id": "keyword_custom_format_list", "name": "Simple list with a keyword using a custom format", "type": "keyword" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_List" }, "examples": { "ip": { "value": { "_version": "WzAsMV0=", "@timestamp": "2025-01-08T04:47:34.273Z", "created_at": "2025-01-08T04:47:34.273Z", "created_by": "elastic", "description": "This list describes bad internet ips", "id": "ip_list", "immutable": false, "name": "Simple list with ips", "tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899", "type": "ip", "updated_at": "2025-01-08T04:47:34.273Z", "updated_by": "elastic", "version": 1 } }, "ip_range": { "value": { "_version": "WzAsMV0=", "@timestamp": "2025-01-09T18:23:52.241Z", "created_at": "2025-01-09T18:23:52.241Z", "created_by": "elastic", "description": "This list has ip ranges", "id": "ip_range_list", "immutable": false, "name": "Simple list with ip ranges", "tie_breaker_id": "74aebdaf-601f-4940-b351-155728ff7003", "type": "ip_range", "updated_at": "2025-01-09T18:23:52.241Z", "updated_by": "elastic", "version": 1 } }, "keyword": { "value": { "_version": "WzEsMV0=", "@timestamp": "2025-01-09T18:24:55.786Z", "created_at": "2025-01-09T18:24:55.786Z", "created_by": "elastic", "description": "This list describes bad host names", "id": "keyword_list", "immutable": false, "name": "Simple list with a keyword", "tie_breaker_id": "f7e7dbaa-daf7-4c9a-a3dc-56643923ef68", "type": "keyword", "updated_at": "2025-01-09T18:24:55.786Z", "updated_by": "elastic", "version": 1 } }, "keyword_custom_format": { "value": { "_version": "WzIsMV0=", "@timestamp": "2025-01-09T18:25:39.604Z", "created_at": "2025-01-09T18:25:39.604Z", "created_by": "elastic", "description": "This parses the first found ipv4 only", "id": "keyword_custom_format_list", "immutable": false, "name": "Simple list with a keyword using a custom format", "tie_breaker_id": "8247ae63-b780-47b8-9a89-948b643e9ec2", "type": "keyword", "updated_at": "2025-01-09T18:25:39.604Z", "updated_by": "elastic", "version": 1 } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "409": { "description": "List already exists response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "put": { "tags": [ "Security Lists API" ], "summary": "Update a list", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/lists
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a list using the list ID. The original list is replaced, and all unspecified fields are deleted.\n> info\n> You cannot modify the `id` value.\n", "operationId": "UpdateList", "requestBody": { "description": "List's properties", "content": { "application/json": { "schema": { "required": [ "id", "name", "description" ], "type": "object", "properties": { "_version": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListMetadata" }, "name": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "version": { "minimum": 1, "type": "integer" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_List" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/_find": { "get": { "tags": [ "Security Lists API" ], "summary": "Get lists", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/lists/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a paginated subset of lists. By default, the first page is returned, with 20 results per page.", "operationId": "FindLists", "parameters": [ { "name": "page", "in": "query", "description": "The page number to return", "schema": { "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of lists to return per page", "schema": { "type": "integer" } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order, which can be `desc` or `asc`", "schema": { "enum": [ "desc", "asc" ], "type": "string" } }, { "name": "cursor", "in": "query", "description": "Returns the list that come after the last list returned in the previous call\n(use the cursor value returned in the previous call). This parameter uses\nthe `tie_breaker_id` field to ensure all lists are sorted and returned correctly.\n", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "filter", "in": "query", "description": "Filters the returned results according to the value of the specified field,\nusing the : syntax.\n", "schema": { "$ref": "#/components/schemas/Security_Lists_API_FindListsFilter" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "data", "page", "per_page", "total", "cursor" ], "type": "object", "properties": { "cursor": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Lists_API_List" } }, "page": { "minimum": 0, "type": "integer" }, "per_page": { "minimum": 0, "type": "integer" }, "total": { "minimum": 0, "type": "integer" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/index": { "delete": { "tags": [ "Security Lists API" ], "summary": "Delete list data streams", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/lists/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete the `.lists` and `.items` data streams.", "operationId": "DeleteListIndex", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "acknowledged" ], "type": "object", "properties": { "acknowledged": { "type": "boolean" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List data stream not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Lists API" ], "summary": "Get status of list data streams", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/lists/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nVerify that `.lists` and `.items` data streams exist.", "operationId": "ReadListIndex", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "list_index", "list_item_index" ], "type": "object", "properties": { "list_index": { "type": "boolean" }, "list_item_index": { "type": "boolean" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List data stream(s) not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Lists API" ], "summary": "Create list data streams", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/lists/index
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate `.lists` and `.items` data streams in the relevant space.", "operationId": "CreateListIndex", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "acknowledged" ], "type": "object", "properties": { "acknowledged": { "type": "boolean" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "409": { "description": "List data stream exists response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/items": { "delete": { "tags": [ "Security Lists API" ], "summary": "Delete a list item", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a list item using its `id`, or its `list_id` and `value` fields.", "operationId": "DeleteListItem", "parameters": [ { "name": "id", "in": "query", "description": "Required if `list_id` and `value` are not specified", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "list_id", "in": "query", "description": "Required if `id` is not specified", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "value", "in": "query", "description": "Required if `id` is not specified", "schema": { "type": "string" } }, { "name": "refresh", "in": "query", "description": "Determines when changes made by the request are made visible to search", "schema": { "enum": [ "true", "false", "wait_for" ], "type": "string", "default": "false" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_ListItem" }, { "type": "array", "items": { "$ref": "#/components/schemas/Security_Lists_API_ListItem" } } ] } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "get": { "tags": [ "Security Lists API" ], "summary": "Get a list item", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a list item.", "operationId": "ReadListItem", "parameters": [ { "name": "id", "in": "query", "description": "Required if `list_id` and `value` are not specified", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "list_id", "in": "query", "description": "Required if `id` is not specified", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "value", "in": "query", "description": "Required if `id` is not specified", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_ListItem" }, { "type": "array", "items": { "$ref": "#/components/schemas/Security_Lists_API_ListItem" } } ] } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "patch": { "tags": [ "Security Lists API" ], "summary": "Patch a list item", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate specific fields of an existing list item using the list item ID.", "operationId": "PatchListItem", "requestBody": { "description": "List item's properties", "content": { "application/json": { "schema": { "required": [ "id" ], "type": "object", "properties": { "_version": { "type": "string" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListItemMetadata" }, "refresh": { "enum": [ "true", "false", "wait_for" ], "type": "string", "description": "Determines when changes made by the request are made visible to search" }, "value": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_ListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "post": { "tags": [ "Security Lists API" ], "summary": "Create a list item", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a list item and associate it with the specified list.\n\nAll list items in the same list must be the same type. For example, each list item in an `ip` list must define a specific IP address.\n> info\n> Before creating a list item, you must create a list.\n", "operationId": "CreateListItem", "requestBody": { "description": "List item's properties", "content": { "application/json": { "schema": { "required": [ "list_id", "value" ], "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListItemMetadata" }, "refresh": { "enum": [ "true", "false", "wait_for" ], "type": "string", "description": "Determines when changes made by the request are made visible to search" }, "value": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_ListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "409": { "description": "List item already exists response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } }, "put": { "tags": [ "Security Lists API" ], "summary": "Update a list item", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/lists/items
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted.\n> info\n> You cannot modify the `id` value.\n", "operationId": "UpdateListItem", "requestBody": { "description": "List item's properties", "content": { "application/json": { "schema": { "required": [ "id", "value" ], "type": "object", "properties": { "_version": { "type": "string" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListItemMetadata" }, "value": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_ListItem" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List item not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/items/_export": { "post": { "tags": [ "Security Lists API" ], "summary": "Export list items", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/lists/items/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport list item values from the specified list.", "operationId": "ExportListItems", "parameters": [ { "name": "list_id", "in": "query", "description": "List's id to export", "required": true, "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/ndjson": { "schema": { "type": "string", "description": "A `.txt` file containing list items from the specified list", "format": "binary" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "404": { "description": "List not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/items/_find": { "get": { "tags": [ "Security Lists API" ], "summary": "Get list items", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/lists/items/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet all list items in the specified list.", "operationId": "FindListItems", "parameters": [ { "name": "list_id", "in": "query", "description": "List's id", "required": true, "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "page", "in": "query", "description": "The page number to return", "schema": { "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of list items to return per page", "schema": { "type": "integer" } }, { "name": "sort_field", "in": "query", "description": "Determines which field is used to sort the results", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "sort_order", "in": "query", "description": "Determines the sort order, which can be `desc` or `asc`", "schema": { "enum": [ "desc", "asc" ], "type": "string" } }, { "name": "cursor", "in": "query", "description": "Returns the list that come after the last list returned in the previous call\n(use the cursor value returned in the previous call). This parameter uses\nthe `tie_breaker_id` field to ensure all lists are sorted and returned correctly.\n", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "filter", "in": "query", "description": "Filters the returned results according to the value of the specified field,\nusing the : syntax.\n", "schema": { "$ref": "#/components/schemas/Security_Lists_API_FindListItemsFilter" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "data", "page", "per_page", "total", "cursor" ], "type": "object", "properties": { "cursor": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Lists_API_ListItem" } }, "page": { "minimum": 0, "type": "integer" }, "per_page": { "minimum": 0, "type": "integer" }, "total": { "minimum": 0, "type": "integer" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/items/_import": { "post": { "tags": [ "Security Lists API" ], "summary": "Import list items", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/lists/items/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport list items from a TXT or CSV file. The maximum file size is 9 million bytes.\n\nYou can import items to a new or existing list.\n", "operationId": "ImportListItems", "parameters": [ { "name": "list_id", "in": "query", "description": "List's id.\n\nRequired when importing to an existing list.\n", "schema": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } }, { "name": "type", "in": "query", "description": "Type of the importing list.\n\nRequired when importing a new list that is `list_id` is not specified.\n", "schema": { "$ref": "#/components/schemas/Security_Lists_API_ListType" }, "examples": { "ip": { "value": "ip" } } }, { "name": "refresh", "in": "query", "description": "Determines when changes made by the request are made visible to search", "schema": { "enum": [ "true", "false", "wait_for" ], "type": "string" } } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "description": "A `.txt` or `.csv` file containing newline separated list items", "format": "binary" } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_List" } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "409": { "description": "List with specified list_id does not exist response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/lists/privileges": { "get": { "tags": [ "Security Lists API" ], "summary": "Get list privileges", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/lists/privileges
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "ReadListPrivileges", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "lists", "listItems", "is_authenticated" ], "type": "object", "properties": { "is_authenticated": { "type": "boolean" }, "listItems": { "$ref": "#/components/schemas/Security_Lists_API_ListItemPrivileges" }, "lists": { "$ref": "#/components/schemas/Security_Lists_API_ListPrivileges" } } } } } }, "400": { "description": "Invalid input data response", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" }, { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } ] } } } }, "401": { "description": "Unsuccessful authentication response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "403": { "description": "Not enough privileges response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_PlatformErrorResponse" } } } }, "500": { "description": "Internal server error response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Lists_API_SiemErrorResponse" } } } } } } }, "/api/logstash/pipeline/{id}": { "delete": { "tags": [ "logstash" ], "summary": "Delete a Logstash pipeline", "description": "Delete a centrally-managed Logstash pipeline.\nIf your Elasticsearch cluster is protected with basic authentication, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.\n", "externalDocs": { "description": "Secure your connection", "url": "https://www.elastic.co/guide/en/logstash/current/ls-security.html" }, "operationId": "delete-logstash-pipeline", "parameters": [ { "name": "id", "in": "path", "description": "An identifier for the pipeline.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call" } }, "x-state": "Technical Preview" }, "get": { "tags": [ "logstash" ], "summary": "Get a Logstash pipeline", "description": "Get information for a centrally-managed Logstash pipeline.\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.\n", "externalDocs": { "description": "Secure your connection", "url": "https://www.elastic.co/guide/en/logstash/current/ls-security.html" }, "operationId": "get-logstash-pipeline", "parameters": [ { "name": "id", "in": "path", "description": "An identifier for the pipeline.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "getLogstashPipelineResponseExample1": { "value": "{\n \"id\": \"hello-world\",\n \"description\": \"Just a simple pipeline\",\n \"username\": \"elastic\",\n \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n \"settings\": {\n \"queue.type\": \"persistent\"\n }\n}" } } } } } }, "x-state": "Technical Preview" }, "put": { "tags": [ "logstash" ], "summary": "Create or update a Logstash pipeline", "description": "Create a centrally-managed Logstash pipeline or update a pipeline.\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.\n", "externalDocs": { "description": "Secure your connection", "url": "https://www.elastic.co/guide/en/logstash/current/ls-security.html" }, "operationId": "put-logstash-pipeline", "parameters": [ { "name": "id", "in": "path", "description": "An identifier for the pipeline. Pipeline ID must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.\n", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "pipeline" ], "type": "object", "properties": { "description": { "type": "string", "description": "A description of the pipeline." }, "pipeline": { "type": "string", "description": "A definition for the pipeline." }, "settings": { "type": "object", "description": "Supported settings, represented as object keys, include the following:\n\n- `pipeline.workers`\n- `pipeline.batch.size`\n- `pipeline.batch.delay`\n- `pipeline.ecs_compatibility`\n- `pipeline.ordered`\n- `queue.type`\n- `queue.max_bytes`\n- `queue.checkpoint.writes`\n" } } }, "examples": { "putLogstashPipelineRequestExample1": { "value": "{\n \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n \"settings\": {\n \"queue.type\": \"persisted\"\n }\n}" } } } } }, "responses": { "204": { "description": "Indicates a successful call" } }, "x-state": "Technical Preview" } }, "/api/logstash/pipelines": { "get": { "tags": [ "logstash" ], "summary": "Get all Logstash pipelines", "description": "Get a list of all centrally-managed Logstash pipelines.\n\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.\n> info\n> Limit the number of pipelines to 10,000 or fewer. As the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana.\n\nThe `username` property appears in the response when security is enabled and depends on when the pipeline was created or last updated.\n", "externalDocs": { "description": "Secure your connection", "url": "https://www.elastic.co/guide/en/logstash/current/ls-security.html" }, "operationId": "get-logstash-pipelines", "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "getLogstashPipelinesResponseExample1": { "value": "{\n \"pipelines\": [\n {\n \"id\": \"hello-world\",\n \"description\": \"Just a simple pipeline\",\n \"last_modified\": \"2018-04-14T12:23:29.772Z\",\n \"username\": \"elastic\" \n },\n {\n \"id\": \"sleepy-pipeline\",\n \"description\": \"\",\n \"last_modified\": \"2018-03-24T03:41:30.554Z\"\n }\n ]\n}" } } } } } }, "x-state": "Technical Preview" } }, "/api/maintenance_window": { "post": { "tags": [ "maintenance-window" ], "summary": "Create a maintenance window.", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/maintenance_window
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window.", "operationId": "post-maintenance-window", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "title", "schedule" ], "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "minimum": 1, "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "minItems": 1, "type": "array", "items": { "maximum": 12, "minimum": 1, "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "minItems": 1, "type": "array", "items": { "maximum": 31, "minimum": 1, "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL). Only alerts matching this query will be supressed by the maintenance window." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "title": { "type": "string", "description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window." } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "title", "enabled", "created_by", "updated_by", "created_at", "updated_at", "status", "schedule" ], "type": "object", "properties": { "created_at": { "type": "string", "description": "The date and time when the maintenance window was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the maintenance window." }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "id": { "type": "string", "description": "The identifier for the maintenance window." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "type": "array", "items": { "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "type": "array", "items": { "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "status": { "enum": [ "running", "upcoming", "finished", "archived" ], "type": "string", "description": "The current status of the maintenance window." }, "title": { "type": "string", "description": "The name of the maintenance window." }, "updated_at": { "type": "string", "description": "The date and time when the maintenance window was last updated." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that last updated this maintenance window." } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." } } } }, "/api/maintenance_window/{id}": { "delete": { "tags": [ "maintenance-window" ], "summary": "Delete a maintenance window.", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/maintenance_window/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window.", "operationId": "delete-maintenance-window-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the maintenance window to be deleted.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a maintenance window with the given ID does not exist." } } }, "get": { "tags": [ "maintenance-window" ], "summary": "Get maintenance window details.", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/maintenance_window/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: read-maintenance-window.", "operationId": "get-maintenance-window-id", "parameters": [ { "name": "id", "in": "path", "description": "The identifier for the maintenance window.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "title", "enabled", "created_by", "updated_by", "created_at", "updated_at", "status", "schedule" ], "type": "object", "properties": { "created_at": { "type": "string", "description": "The date and time when the maintenance window was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the maintenance window." }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "id": { "type": "string", "description": "The identifier for the maintenance window." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "type": "array", "items": { "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "type": "array", "items": { "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "status": { "enum": [ "running", "upcoming", "finished", "archived" ], "type": "string", "description": "The current status of the maintenance window." }, "title": { "type": "string", "description": "The name of the maintenance window." }, "updated_at": { "type": "string", "description": "The date and time when the maintenance window was last updated." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that last updated this maintenance window." } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a maintenance window with the given ID does not exist." } } }, "patch": { "tags": [ "maintenance-window" ], "summary": "Update a maintenance window.", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/maintenance_window/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window.", "operationId": "patch-maintenance-window-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "minimum": 1, "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "minItems": 1, "type": "array", "items": { "maximum": 12, "minimum": 1, "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "minItems": 1, "type": "array", "items": { "maximum": 31, "minimum": 1, "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL). Only alerts matching this query will be supressed by the maintenance window." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "title": { "type": "string", "description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window." } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "title", "enabled", "created_by", "updated_by", "created_at", "updated_at", "status", "schedule" ], "type": "object", "properties": { "created_at": { "type": "string", "description": "The date and time when the maintenance window was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the maintenance window." }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "id": { "type": "string", "description": "The identifier for the maintenance window." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "type": "array", "items": { "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "type": "array", "items": { "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "status": { "enum": [ "running", "upcoming", "finished", "archived" ], "type": "string", "description": "The current status of the maintenance window." }, "title": { "type": "string", "description": "The name of the maintenance window." }, "updated_at": { "type": "string", "description": "The date and time when the maintenance window was last updated." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that last updated this maintenance window." } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a maintenance window with the given ID does not exist." }, "409": { "description": "Indicates that the maintenance window has already been updated by another user." } } } }, "/api/maintenance_window/{id}/_archive": { "post": { "tags": [ "maintenance-window" ], "summary": "Archive a maintenance window.", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/maintenance_window/{id}/_archive
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window.", "operationId": "post-maintenance-window-id-archive", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the maintenance window to be archived.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "title", "enabled", "created_by", "updated_by", "created_at", "updated_at", "status", "schedule" ], "type": "object", "properties": { "created_at": { "type": "string", "description": "The date and time when the maintenance window was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the maintenance window." }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "id": { "type": "string", "description": "The identifier for the maintenance window." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "type": "array", "items": { "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "type": "array", "items": { "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "status": { "enum": [ "running", "upcoming", "finished", "archived" ], "type": "string", "description": "The current status of the maintenance window." }, "title": { "type": "string", "description": "The name of the maintenance window." }, "updated_at": { "type": "string", "description": "The date and time when the maintenance window was last updated." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that last updated this maintenance window." } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a maintenance window with the given ID does not exist." } } } }, "/api/maintenance_window/{id}/_unarchive": { "post": { "tags": [ "maintenance-window" ], "summary": "Unarchive a maintenance window.", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/maintenance_window/{id}/_unarchive
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\n[Required authorization] Route required privileges: write-maintenance-window.", "operationId": "post-maintenance-window-id-unarchive", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The identifier for the maintenance window to be unarchived.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "required": [ "id", "title", "enabled", "created_by", "updated_by", "created_at", "updated_at", "status", "schedule" ], "type": "object", "properties": { "created_at": { "type": "string", "description": "The date and time when the maintenance window was created." }, "created_by": { "type": [ "null", "string" ], "description": "The identifier for the user that created the maintenance window." }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "id": { "type": "string", "description": "The identifier for the maintenance window." }, "schedule": { "required": [ "custom" ], "type": "object", "properties": { "custom": { "required": [ "start", "duration" ], "type": "object", "properties": { "duration": { "type": "string", "description": "The duration of the schedule. It allows values in `` format. `` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`." }, "recurring": { "type": "object", "properties": { "end": { "type": "string", "description": "The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`." }, "every": { "type": "string", "description": "The interval and frequency of a recurring schedule. It allows values in `` format. `` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`." }, "occurrences": { "type": "number", "description": "The total number of recurrences of the schedule." }, "onMonth": { "type": "array", "items": { "type": "number" }, "description": "The specific months for a recurring schedule. Valid values are 1-12." }, "onMonthDay": { "type": "array", "items": { "type": "number" }, "description": "The specific days of the month for a recurring schedule. Valid values are 1-31." }, "onWeekDay": { "type": "array", "items": { "type": "string" }, "description": "The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule." } }, "additionalProperties": false }, "start": { "type": "string", "description": "The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`." }, "timezone": { "type": "string", "description": "The timezone of the schedule. The default timezone is UTC." } }, "additionalProperties": false } }, "additionalProperties": false }, "scope": { "required": [ "alerting" ], "type": "object", "properties": { "alerting": { "required": [ "query" ], "type": "object", "properties": { "query": { "required": [ "kql" ], "type": "object", "properties": { "kql": { "type": "string", "description": "A filter written in Kibana Query Language (KQL)." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false }, "status": { "enum": [ "running", "upcoming", "finished", "archived" ], "type": "string", "description": "The current status of the maintenance window." }, "title": { "type": "string", "description": "The name of the maintenance window." }, "updated_at": { "type": "string", "description": "The date and time when the maintenance window was last updated." }, "updated_by": { "type": [ "null", "string" ], "description": "The identifier for the user that last updated this maintenance window." } }, "additionalProperties": false } } } }, "400": { "description": "Indicates an invalid schema or parameters." }, "403": { "description": "Indicates that this call is forbidden." }, "404": { "description": "Indicates a maintenance window with the given ID does not exist." } } } }, "/api/ml/saved_objects/sync": { "get": { "tags": [ "ml" ], "summary": "Sync saved objects in the default space", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/ml/saved_objects/sync
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSynchronizes Kibana saved objects for machine learning jobs and trained models in the default space. You must have `all` privileges for the **Machine Learning** feature in the **Analytics** section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.\n", "operationId": "mlSync", "parameters": [ { "$ref": "#/components/parameters/Machine_learning_APIs_simulateParam" } ], "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSync200Response" }, "examples": { "syncExample": { "$ref": "#/components/examples/Machine_learning_APIs_mlSyncExample" } } } } }, "401": { "description": "Authorization information is missing or invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSync4xxResponse" } } } } } } }, "/api/note": { "delete": { "tags": [ "Security Timeline API" ], "summary": "Delete a note", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a note from a Timeline using the note ID.", "operationId": "DeleteNote", "requestBody": { "description": "The ID of the note to delete.", "content": { "application/json": { "schema": { "oneOf": [ { "required": [ "noteId" ], "type": [ "null", "object" ], "properties": { "noteId": { "type": "string" } } }, { "required": [ "noteIds" ], "type": [ "null", "object" ], "properties": { "noteIds": { "type": [ "null", "array" ], "items": { "type": "string" } } } } ] } } }, "required": true }, "responses": { "200": { "description": "Indicates the note was successfully deleted.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object" } } } } } } } }, "get": { "tags": [ "Security Timeline API" ], "summary": "Get notes", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet all notes for a given document.", "operationId": "GetNotes", "parameters": [ { "name": "documentIds", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Timeline_API_DocumentIds" } }, { "name": "savedObjectIds", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Timeline_API_SavedObjectIds" } }, { "name": "page", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "perPage", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "search", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "sortField", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "sortOrder", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "filter", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "createdByFilter", "in": "query", "schema": { "type": [ "null", "string" ] } }, { "name": "associatedFilter", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Timeline_API_AssociatedFilterType" } } ], "responses": { "200": { "description": "Indicates the requested notes were returned.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_GetNotesResult" }, { "type": "object" } ] } } } } } }, "patch": { "tags": [ "Security Timeline API" ], "summary": "Add or update a note", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/note
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd a note to a Timeline or update an existing note.", "operationId": "PersistNoteRoute", "requestBody": { "description": "The note to add or update, along with additional metadata.", "content": { "application/json": { "schema": { "required": [ "note" ], "type": "object", "properties": { "note": { "$ref": "#/components/schemas/Security_Timeline_API_BareNote" }, "noteId": { "type": [ "null", "string" ], "description": "The `savedObjectId` of the note", "example": "709f99c6-89b6-4953-9160-35945c8e174e" }, "version": { "type": [ "null", "string" ], "description": "The version of the note", "example": "WzQ2LDFd" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the note was successfully created.", "content": { "application/json": { "schema": { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "persistNote" ], "type": "object", "properties": { "persistNote": { "$ref": "#/components/schemas/Security_Timeline_API_ResponseNote" } } } } } } } } } } }, "/api/osquery/live_queries": { "get": { "tags": [ "Security Osquery API" ], "summary": "Get live queries", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all live queries.", "operationId": "OsqueryFindLiveQueries", "parameters": [ { "name": "kuery", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_KueryOrUndefined" } }, { "name": "page", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined" } }, { "name": "pageSize", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined" } }, { "name": "sort", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined" } }, { "name": "sortOrder", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_FindLiveQueryResponse" } } } } } }, "post": { "tags": [ "Security Osquery API" ], "summary": "Create a live query", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and run a live query.", "operationId": "OsqueryCreateLiveQuery", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse" } } } } } } }, "/api/osquery/live_queries/{id}": { "get": { "tags": [ "Security Osquery API" ], "summary": "Get live query details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/live_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a live query using the query ID.", "operationId": "OsqueryGetLiveQueryDetails", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "description": "The ID of the live query result you want to retrieve.", "example": "3c42c847-eb30-4452-80e0-728584042334" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse" } } } } } } }, "/api/osquery/live_queries/{id}/results/{actionId}": { "get": { "tags": [ "Security Osquery API" ], "summary": "Get live query results", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the results of a live query using the query action ID.", "operationId": "OsqueryGetLiveQueryResults", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "description": "The ID of the live query result you want to retrieve.", "example": "3c42c847-eb30-4452-80e0-728584042334" } }, { "name": "actionId", "in": "path", "required": true, "schema": { "type": "string", "description": "The ID of the query action that generated the live query results.", "example": "609c4c66-ba3d-43fa-afdd-53e244577aa0" } }, { "name": "kuery", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_KueryOrUndefined" } }, { "name": "page", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined" } }, { "name": "pageSize", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined" } }, { "name": "sort", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined" } }, { "name": "sortOrder", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse" } } } } } } }, "/api/osquery/packs": { "get": { "tags": [ "Security Osquery API" ], "summary": "Get packs", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all query packs.", "operationId": "OsqueryFindPacks", "parameters": [ { "name": "page", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined" } }, { "name": "pageSize", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined" } }, { "name": "sort", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined" } }, { "name": "sortOrder", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_FindPacksResponse" } } } } } }, "post": { "tags": [ "Security Osquery API" ], "summary": "Create a pack", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a query pack.", "operationId": "OsqueryCreatePacks", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_CreatePacksRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_CreatePacksResponse" } } } } } } }, "/api/osquery/packs/{id}": { "delete": { "tags": [ "Security Osquery API" ], "summary": "Delete a pack", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a query pack using the pack ID.", "operationId": "OsqueryDeletePacks", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PackId" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object" } } } } } }, "get": { "tags": [ "Security Osquery API" ], "summary": "Get pack details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a query pack using the pack ID.", "operationId": "OsqueryGetPacksDetails", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PackId" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_FindPackResponse" } } } } } }, "put": { "tags": [ "Security Osquery API" ], "summary": "Update a pack", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a query pack using the pack ID.\n> info\n> You cannot update a prebuilt pack.\n", "operationId": "OsqueryUpdatePacks", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PackId" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_UpdatePacksRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_UpdatePacksResponse" } } } } } } }, "/api/osquery/saved_queries": { "get": { "tags": [ "Security Osquery API" ], "summary": "Get saved queries", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/saved_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all saved queries.", "operationId": "OsqueryFindSavedQueries", "parameters": [ { "name": "page", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageOrUndefined" } }, { "name": "pageSize", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_PageSizeOrUndefined" } }, { "name": "sort", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrUndefined" } }, { "name": "sortOrder", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SortOrderOrUndefined" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_FindSavedQueryResponse" } } } } } }, "post": { "tags": [ "Security Osquery API" ], "summary": "Create a saved query", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/osquery/saved_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and run a saved query.", "operationId": "OsqueryCreateSavedQuery", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_CreateSavedQueryRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_CreateSavedQueryResponse" } } } } } } }, "/api/osquery/saved_queries/{id}": { "delete": { "tags": [ "Security Osquery API" ], "summary": "Delete a saved query", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a saved query using the query ID.", "operationId": "OsqueryDeleteSavedQuery", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_DefaultSuccessResponse" } } } } } }, "get": { "tags": [ "Security Osquery API" ], "summary": "Get saved query details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a saved query using the query ID.", "operationId": "OsqueryGetSavedQueryDetails", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_FindSavedQueryDetailResponse" } } } } } }, "put": { "tags": [ "Security Osquery API" ], "summary": "Update a saved query", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a saved query using the query ID.\n> info\n> You cannot update a prebuilt saved query.\n", "operationId": "OsqueryUpdateSavedQuery", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_UpdateSavedQueryRequestBody" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Osquery_API_UpdateSavedQueryResponse" } } } } } } }, "/api/pinned_event": { "patch": { "tags": [ "Security Timeline API" ], "summary": "Pin/unpin an event", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/pinned_event
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nPin/unpin an event to/from an existing Timeline.", "operationId": "PersistPinnedEventRoute", "requestBody": { "description": "The pinned event to add or unpin, along with additional metadata.", "content": { "application/json": { "schema": { "required": [ "eventId", "timelineId" ], "type": "object", "properties": { "eventId": { "type": "string", "description": "The `_id` of the associated event for this pinned event.", "example": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc" }, "pinnedEventId": { "type": [ "null", "string" ], "description": "The `savedObjectId` of the pinned event you want to unpin.", "example": "10r1929b-0af7-42bd-85a8-56e234f98h2f3" }, "timelineId": { "type": "string", "description": "The `savedObjectId` of the timeline that you want this pinned event unpinned from.", "example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the event was successfully pinned to or unpinned from the Timeline.", "content": { "application/json": { "schema": { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "persistPinnedEventOnTimeline" ], "type": "object", "properties": { "persistPinnedEventOnTimeline": { "$ref": "#/components/schemas/Security_Timeline_API_PersistPinnedEventResponse" } } } } } } } } } } }, "/api/risk_score/engine/dangerously_delete_data": { "delete": { "tags": [ "Security Entity Analytics API" ], "summary": "Cleanup the Risk Engine", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/risk_score/engine/dangerously_delete_data
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCleaning up the the Risk Engine by removing the indices, mapping and transforms", "operationId": "CleanUpRiskEngine", "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "cleanup_successful": { "type": "boolean" } } } } } }, "400": { "description": "Task manager is unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse" } } } }, "default": { "description": "Unexpected error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse" } } } } } } }, "/api/risk_score/engine/saved_object/configure": { "patch": { "tags": [ "Security Entity Analytics API" ], "summary": "Configure the Risk Engine Saved Object", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/risk_score/engine/saved_object/configure
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nConfiguring the Risk Engine Saved Object", "operationId": "ConfigureRiskEngineSavedObject", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "exclude_alert_statuses": { "type": "array", "items": { "type": "string" } }, "exclude_alert_tags": { "type": "array", "items": { "type": "string" } }, "range": { "type": "object", "properties": { "end": { "type": "string" }, "start": { "type": "string" } } } } } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "risk_engine_saved_object_configured": { "type": "boolean" } } } } } }, "400": { "description": "Task manager is unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse" } } } }, "default": { "description": "Unexpected error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse" } } } } } } }, "/api/risk_score/engine/schedule_now": { "post": { "tags": [ "Security Entity Analytics API" ], "summary": "Run the risk scoring engine", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/risk_score/engine/schedule_now
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSchedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality.", "operationId": "ScheduleRiskEngineNow", "requestBody": { "content": { "application/json": { } } }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowResponse" } } } }, "400": { "description": "Task manager is unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse" } } } }, "default": { "description": "Unexpected error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse" } } } } } } }, "/api/saved_objects/_bulk_create": { "post": { "tags": [ "saved objects" ], "summary": "Create saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_bulk_create
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulkCreateSavedObjects", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "name": "overwrite", "in": "query", "description": "When true, overwrites the document with the same identifier.", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/saved_objects/_bulk_delete": { "post": { "tags": [ "saved objects" ], "summary": "Delete saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nWARNING: When you delete a saved object, it cannot be recovered.\n", "operationId": "bulkDeleteSavedObjects", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "name": "force", "in": "query", "description": "When true, force delete objects that exist in multiple namespaces. Note that the option applies to the whole request. Use the delete object API to specify per-object deletion behavior. TIP: Use this if you attempted to delete objects and received an HTTP 400 error with the following message: \"Unable to delete saved object that exists in multiple namespaces, use the force option to delete it anyway\". WARNING: When you bulk delete objects that exist in multiple namespaces, the API also deletes legacy url aliases that reference the object. These requests are batched to minimise the impact but they can place a heavy load on Kibana. Make sure you limit the number of objects that exist in multiple namespaces in a single bulk delete operation.\n", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call. NOTE: This HTTP response code indicates that the bulk operation succeeded. Errors pertaining to individual objects will be returned in the response body.\n", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/saved_objects/_bulk_get": { "post": { "tags": [ "saved objects" ], "summary": "Get saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_bulk_get
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "bulkGetSavedObjects", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/saved_objects/_bulk_resolve": { "post": { "tags": [ "saved objects" ], "summary": "Resolve saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_bulk_resolve
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve multiple Kibana saved objects by identifier using any legacy URL aliases if they exist. Under certain circumstances when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved by the bulk resolve API using either its new ID or its old ID.\n", "operationId": "bulkResolveSavedObjects", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call. NOTE: This HTTP response code indicates that the bulk operation succeeded. Errors pertaining to individual objects will be returned in the response body. \n", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/saved_objects/_bulk_update": { "post": { "tags": [ "saved objects" ], "summary": "Update saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_bulk_update
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the attributes for multiple Kibana saved objects.", "operationId": "bulkUpdateSavedObjects", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call. NOTE: This HTTP response code indicates that the bulk operation succeeded. Errors pertaining to individual objects will be returned in the response body. \n", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/saved_objects/_export": { "post": { "tags": [ "saved objects" ], "summary": "Export saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve sets of saved objects that you want to import into Kibana.\nYou must include `type` or `objects` in the request body.\n\nExported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n\nNOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be exported.\n", "operationId": "exportSavedObjectsDefault", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "excludeExportDetails": { "type": "boolean", "description": "Do not add export details entry at the end of the stream.", "default": false }, "includeReferencesDeep": { "type": "boolean", "description": "Includes all of the referenced objects in the exported objects." }, "objects": { "type": "array", "items": { "type": "object" }, "description": "A list of objects to export." }, "type": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "The saved object types to include in the export. Use `*` to export all the types." } } }, "examples": { "exportSavedObjectsRequest": { "$ref": "#/components/examples/Saved_objects_export_objects_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/x-ndjson": { "schema": { "type": "object" }, "examples": { "exportSavedObjectsResponse": { "$ref": "#/components/examples/Saved_objects_export_objects_response" } } } } }, "400": { "description": "Bad request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } } } }, "/api/saved_objects/_find": { "get": { "tags": [ "saved objects" ], "summary": "Search for saved objects", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/saved_objects/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a paginated set of Kibana saved objects.", "operationId": "findSavedObjects", "parameters": [ { "name": "aggs", "in": "query", "description": "An aggregation structure, serialized as a string. The field format is similar to filter, meaning that to use a saved object type attribute in the aggregation, the `savedObjectType.attributes.title: \"myTitle\"` format must be used. For root fields, the syntax is `savedObjectType.rootField`. NOTE: As objects change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.\n", "schema": { "type": "string" } }, { "name": "default_search_operator", "in": "query", "description": "The default operator to use for the `simple_query_string`.", "schema": { "type": "string" } }, { "name": "fields", "in": "query", "description": "The fields to return in the attributes key of the response.", "schema": { "type": [ "string", "array" ] } }, { "name": "filter", "in": "query", "description": "The filter is a KQL string with the caveat that if you filter with an attribute from your saved object type, it should look like that: `savedObjectType.attributes.title: \"myTitle\"`. However, if you use a root attribute of a saved object such as `updated_at`, you will have to define your filter like that: `savedObjectType.updated_at > 2018-12-22`.\n", "schema": { "type": "string" } }, { "name": "has_no_reference", "in": "query", "description": "Filters to objects that do not have a relationship with the type and identifier combination.", "schema": { "type": "object" } }, { "name": "has_no_reference_operator", "in": "query", "description": "The operator to use for the `has_no_reference` parameter. Either `OR` or `AND`. Defaults to `OR`.", "schema": { "type": "string" } }, { "name": "has_reference", "in": "query", "description": "Filters to objects that have a relationship with the type and ID combination.", "schema": { "type": "object" } }, { "name": "has_reference_operator", "in": "query", "description": "The operator to use for the `has_reference` parameter. Either `OR` or `AND`. Defaults to `OR`.", "schema": { "type": "string" } }, { "name": "page", "in": "query", "description": "The page of objects to return.", "schema": { "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of objects to return per page.", "schema": { "type": "integer" } }, { "name": "search", "in": "query", "description": "An Elasticsearch `simple_query_string` query that filters the objects in the response.", "schema": { "type": "string" } }, { "name": "search_fields", "in": "query", "description": "The fields to perform the `simple_query_string` parsed query against.", "schema": { "type": [ "string", "array" ] } }, { "name": "sort_field", "in": "query", "description": "Sorts the response. Includes \"root\" and \"type\" fields. \"root\" fields exist for all saved objects, such as \"updated_at\". \"type\" fields are specific to an object type, such as fields returned in the attributes key of the response. When a single type is defined in the type parameter, the \"root\" and \"type\" fields are allowed, and validity checks are made in that order. When multiple types are defined in the type parameter, only \"root\" fields are allowed.\n", "schema": { "type": "string" } }, { "name": "type", "in": "query", "description": "The saved object types to include.", "required": true, "schema": { "type": [ "string", "array" ] } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/saved_objects/_import": { "post": { "tags": [ "saved objects" ], "summary": "Import saved objects", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate sets of Kibana saved objects from a file created by the export API.\nSaved objects can be imported only into the same version, a newer minor on the same major, or the next major. Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n", "operationId": "importSavedObjectsDefault", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "name": "createNewCopies", "in": "query", "description": "Creates copies of saved objects, regenerates each object ID, and resets the origin. When used, potential conflict errors are avoided. NOTE: This option cannot be used with the `overwrite` and `compatibilityMode` options.\n", "schema": { "type": "boolean" } }, { "name": "overwrite", "in": "query", "description": "Overwrites saved objects when they already exist. When used, potential conflict errors are automatically resolved by overwriting the destination object. NOTE: This option cannot be used with the `createNewCopies` option.\n", "schema": { "type": "boolean" } }, { "name": "compatibilityMode", "in": "query", "description": "Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with imported saved objects. NOTE: This option cannot be used with the `createNewCopies` option.\n", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "description": "A file exported using the export API. Changing the contents of the exported file in any way before importing it can cause errors, crashes or data loss. NOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be included in this file. Similarly, the `savedObjects.maxImportPayloadBytes` setting limits the overall size of the file that can be imported.\n" } } }, "examples": { "importObjectsRequest": { "$ref": "#/components/examples/Saved_objects_import_objects_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object" }, "description": "Indicates the import was unsuccessful and specifies the objects that failed to import.\n\nNOTE: One object may result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and conflict error.\n" }, "success": { "type": "boolean", "description": "Indicates when the import was successfully completed. When set to false, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties.\n" }, "successCount": { "type": "integer", "description": "Indicates the number of successfully imported records." }, "successResults": { "type": "array", "items": { "type": "object" }, "description": "Indicates the objects that are successfully imported, with any metadata if applicable.\n\nNOTE: Objects are created only when all resolvable errors are addressed, including conflicts and missing references. If objects are created as new copies, each entry in the `successResults` array includes a `destinationId` attribute.\n" } } }, "examples": { "importObjectsResponse": { "$ref": "#/components/examples/Saved_objects_import_objects_response" } } } } }, "400": { "description": "Bad request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "x-codeSamples": [ { "label": "Import with createNewCopies", "lang": "cURL", "source": "curl \\\n -X POST api/saved_objects/_import?createNewCopies=true\n -H \"kbn-xsrf: true\"\n --form file=@file.ndjson\n" } ] } }, "/api/saved_objects/_resolve_import_errors": { "post": { "tags": [ "saved objects" ], "summary": "Resolve import errors", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/_resolve_import_errors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nTo resolve errors from the Import objects API, you can:\n\n* Retry certain saved objects\n* Overwrite specific saved objects\n* Change references to different saved objects\n", "operationId": "resolveImportErrors", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "name": "compatibilityMode", "in": "query", "description": "Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. When enabled during the initial import, also enable when resolving import errors. This option cannot be used with the `createNewCopies` option.\n", "schema": { "type": "boolean" } }, { "name": "createNewCopies", "in": "query", "description": "Creates copies of the saved objects, regenerates each object ID, and resets the origin. When enabled during the initial import, also enable when resolving import errors.\n", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "required": [ "retries" ], "type": "object", "properties": { "file": { "type": "string", "description": "The same file given to the import API.", "format": "binary" }, "retries": { "type": "array", "items": { "required": [ "type", "id" ], "type": "object", "properties": { "destinationId": { "type": "string", "description": "Specifies the destination ID that the imported object should have, if different from the current ID." }, "id": { "type": "string", "description": "The saved object ID." }, "ignoreMissingReferences": { "type": "boolean", "description": "When set to `true`, ignores missing reference errors. When set to `false`, does nothing." }, "overwrite": { "type": "boolean", "description": "When set to `true`, the source object overwrites the conflicting destination object. When set to `false`, does nothing." }, "replaceReferences": { "type": "array", "items": { "type": "object", "properties": { "from": { "type": "string" }, "to": { "type": "string" }, "type": { "type": "string" } } }, "description": "A list of `type`, `from`, and `to` used to change the object references." }, "type": { "type": "string", "description": "The saved object type." } } }, "description": "The retry operations, which can specify how to resolve different types of errors." } } }, "examples": { "resolveImportErrorsRequest": { "$ref": "#/components/examples/Saved_objects_resolve_missing_reference_request" } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object" }, "description": "Specifies the objects that failed to resolve.\n\nNOTE: One object can result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and a `conflict` error.\n" }, "success": { "type": "boolean", "description": "Indicates a successful import. When set to `false`, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties.\n" }, "successCount": { "type": "number", "description": "Indicates the number of successfully resolved records.\n" }, "successResults": { "type": "array", "items": { "type": "object" }, "description": "Indicates the objects that are successfully imported, with any metadata if applicable.\n\nNOTE: Objects are only created when all resolvable errors are addressed, including conflict and missing references.\n" } } }, "examples": { "resolveImportErrorsResponse": { "$ref": "#/components/examples/Saved_objects_resolve_missing_reference_response" } } } } }, "400": { "description": "Bad request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } } } }, "/api/saved_objects/{type}": { "post": { "tags": [ "saved objects" ], "summary": "Create a saved object", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/{type}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Kibana saved object with a randomly generated identifier.", "operationId": "createSavedObject", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_type" }, { "name": "overwrite", "in": "query", "description": "If true, overwrites the document with the same identifier.", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "attributes" ], "type": "object", "properties": { "attributes": { "$ref": "#/components/schemas/Saved_objects_attributes" }, "initialNamespaces": { "$ref": "#/components/schemas/Saved_objects_initial_namespaces" }, "references": { "$ref": "#/components/schemas/Saved_objects_references" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "409": { "description": "Indicates a conflict error.", "content": { "application/json": { "schema": { "type": "object" } } } } }, "deprecated": true } }, "/api/saved_objects/{type}/{id}": { "get": { "tags": [ "saved objects" ], "summary": "Get a saved object", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/saved_objects/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a single Kibana saved object by identifier.", "operationId": "getSavedObject", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_saved_object_id" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_type" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true }, "post": { "tags": [ "saved objects" ], "summary": "Create a saved object", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/saved_objects/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Kibana saved object and specify its identifier instead of using a randomly generated ID.", "operationId": "createSavedObjectId", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_id" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_type" }, { "name": "overwrite", "in": "query", "description": "If true, overwrites the document with the same identifier.", "schema": { "type": "boolean" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "attributes" ], "type": "object", "properties": { "attributes": { "$ref": "#/components/schemas/Saved_objects_attributes" }, "initialNamespaces": { "$ref": "#/components/schemas/Saved_objects_initial_namespaces" }, "references": { "$ref": "#/components/schemas/Saved_objects_initial_namespaces" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "409": { "description": "Indicates a conflict error.", "content": { "application/json": { "schema": { "type": "object" } } } } }, "deprecated": true }, "put": { "tags": [ "saved objects" ], "summary": "Update a saved object", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/saved_objects/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate the attributes for Kibana saved objects.", "operationId": "updateSavedObject", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_kbn_xsrf" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_id" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_type" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object" } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "404": { "description": "Indicates the object was not found.", "content": { "application/json": { "schema": { "type": "object" } } } }, "409": { "description": "Indicates a conflict error.", "content": { "application/json": { "schema": { "type": "object" } } } } }, "deprecated": true } }, "/api/saved_objects/resolve/{type}/{id}": { "get": { "tags": [ "saved objects" ], "summary": "Resolve a saved object", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/saved_objects/resolve/{type}/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a single Kibana saved object by identifier using any legacy URL alias if it exists. Under certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved using either its new ID or its old ID.\n", "operationId": "resolveSavedObject", "parameters": [ { "$ref": "#/components/parameters/Saved_objects_saved_object_id" }, { "$ref": "#/components/parameters/Saved_objects_saved_object_type" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Bad request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Saved_objects_400_response" } } } } }, "deprecated": true } }, "/api/security_ai_assistant/anonymization_fields/_bulk_action": { "post": { "tags": [ "Security AI Assistant API" ], "summary": "Apply a bulk action to anonymization fields", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/anonymization_fields/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs.", "operationId": "PerformAnonymizationFieldsBulkAction", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "create": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldCreateProps" }, "description": "Array of anonymization fields to create." }, "delete": { "type": "object", "properties": { "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of IDs to apply the action to.", "example": [ "1234", "5678" ] }, "query": { "type": "string", "description": "Query to filter the bulk action.", "example": "status: 'inactive'" } }, "description": "Object containing the query to filter anonymization fields and/or an array of anonymization field IDs to delete." }, "update": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldUpdateProps" }, "description": "Array of anonymization fields to update." } }, "example": { "create": [ { "allowed": true, "anonymized": false, "field": "host.name" }, { "allowed": false, "anonymized": true, "field": "user.name" } ], "delete": { "ids": [ "field5", "field6" ], "query": "field: host.name" }, "update": [ { "allowed": true, "anonymized": false, "id": "field8" }, { "allowed": false, "anonymized": true, "id": "field9" } ] } } } } }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse" }, "example": { "anonymization_fields_count": 5, "attributes": { "results": { "created": [ { "allowed": false, "anonymized": true, "createdAt": "2023-10-31T12:00:00Z", "createdBy": "user1", "field": "host.name", "id": "field2", "namespace": "default", "timestamp": "2023-10-31T12:00:00Z", "updatedAt": "2023-10-31T12:00:00Z", "updatedBy": "user1" } ], "deleted": [ "field3" ], "skipped": [ { "id": "field4", "name": "user.name", "skip_reason": "ANONYMIZATION_FIELD_NOT_MODIFIED" } ], "updated": [ { "allowed": true, "anonymized": false, "createdAt": "2023-10-31T12:00:00Z", "createdBy": "user1", "field": "url.domain", "id": "field8", "namespace": "default", "timestamp": "2023-10-31T12:00:00Z", "updatedAt": "2023-10-31T12:00:00Z", "updatedBy": "user1" } ] }, "summary": { "failed": 1, "skipped": 1, "succeeded": 2, "total": 5 } }, "message": "Bulk action completed successfully", "status_code": 200, "success": true } } } }, "400": { "description": "Generic Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type or name." }, "message": { "type": "string", "description": "Detailed error message." }, "statusCode": { "type": "number", "description": "Status code of the response." } } }, "example": { "error": "Bad Request", "message": "Invalid request body", "statusCode": 400 } } } } } } }, "/api/security_ai_assistant/anonymization_fields/_find": { "get": { "tags": [ "Security AI Assistant API" ], "summary": "Get anonymization fields", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/anonymization_fields/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all anonymization fields.", "operationId": "FindAnonymizationFields", "parameters": [ { "name": "fields", "in": "query", "description": "Fields to return", "schema": { "type": "array", "items": { "type": "string" } }, "example": [ "id", "field", "anonymized", "allowed" ] }, { "name": "filter", "in": "query", "description": "Search query", "schema": { "type": "string" }, "example": "field: \"user.name\"" }, { "name": "sort_field", "in": "query", "description": "Field to sort by", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_FindAnonymizationFieldsSortField" }, "example": "created_at" }, { "name": "sort_order", "in": "query", "description": "Sort order", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_SortOrder" }, "example": "asc" }, { "name": "page", "in": "query", "description": "Page number", "schema": { "minimum": 1, "type": "integer", "default": 1 }, "example": 1 }, { "name": "per_page", "in": "query", "description": "AnonymizationFields per page", "schema": { "minimum": 0, "type": "integer", "default": 20 }, "example": 20 }, { "name": "all_data", "in": "query", "description": "If true, additionally fetch all anonymization fields, otherwise fetch only the provided page", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "required": [ "page", "perPage", "total", "data" ], "type": "object", "properties": { "aggregations": { "type": "object", "properties": { "field_status": { "type": "object", "properties": { "buckets": { "type": "object", "properties": { "allowed": { "type": "object", "properties": { "doc_count": { "type": "integer", "default": 0 } } }, "anonymized": { "type": "object", "properties": { "doc_count": { "type": "integer", "default": 0 } } }, "denied": { "type": "object", "properties": { "doc_count": { "type": "integer", "default": 0 } } } } } } } } }, "all": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse" } }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse" } }, "page": { "type": "integer" }, "perPage": { "type": "integer" }, "total": { "type": "integer" } } }, "example": { "aggregations": { "anonymized": { "buckets": { "allowed": { "doc_count": 1 }, "anonymized": { "doc_count": 1 }, "denied": { "doc_count": 1 } } } }, "all": [ { "allowed": true, "anonymized": true, "createdAt": "2023-10-31T12:00:00Z", "createdBy": "user1", "field": "user.name", "id": "1", "namespace": "default", "timestamp": "2023-10-31T12:00:00Z", "updatedAt": "2023-10-31T12:00:00Z", "updatedBy": "user1" } ], "data": [ { "allowed": true, "anonymized": true, "createdAt": "2023-10-31T12:00:00Z", "createdBy": "user1", "field": "user.name", "id": "1", "namespace": "default", "timestamp": "2023-10-31T12:00:00Z", "updatedAt": "2023-10-31T12:00:00Z", "updatedBy": "user1" } ], "page": 1, "perPage": 20, "total": 100 } } } }, "400": { "description": "Generic Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "type": "number" } } }, "example": { "error": "Bad Request", "message": "Invalid request parameters", "statusCode": 400 } } } } } } }, "/api/security_ai_assistant/chat/complete": { "post": { "tags": [ "Security AI Assistant API" ], "summary": "Create a model response", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/chat/complete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a model response for the given chat conversation.", "operationId": "ChatComplete", "parameters": [ { "name": "content_references_disabled", "in": "query", "description": "If true, the response will not include content references.", "schema": { "type": "boolean", "default": false }, "example": false } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ChatCompleteProps" }, "example": { "connectorId": "conn-001", "conversationId": "abc123", "isStream": true, "langSmithApiKey": "sk-abc123", "langSmithProject": "security_ai_project", "messages": [ { "content": "What are some common phishing techniques?", "data": { "user_id": "user_789" }, "fields_to_anonymize": [ "user.name", "source.ip" ], "role": "user" } ], "model": "gpt-4", "persist": true, "promptId": "prompt_456", "responseLanguage": "en" } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful model response call.", "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } } } }, "400": { "description": "Generic Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type.", "example": "Bad Request" }, "message": { "type": "string", "description": "Human-readable error message.", "example": "Invalid request payload." }, "statusCode": { "type": "number", "description": "HTTP status code.", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/current_user/conversations": { "delete": { "tags": [ "Security AI Assistant API" ], "summary": "Delete conversations", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/security_ai_assistant/current_user/conversations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nThis endpoint allows users to permanently delete all conversations.", "operationId": "DeleteAllConversations", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "excludedIds": { "type": "array", "items": { "type": "string" }, "description": "Optional list of conversation IDs to delete.", "example": [ "abc123", "def456" ] } } } } } }, "responses": { "200": { "description": "Indicates a successful call. The conversations were deleted successfully.", "content": { "application/json": { "schema": { "type": "object", "properties": { "failures": { "type": "array", "items": { "type": "string" } }, "success": { "type": "boolean", "example": true }, "totalDeleted": { "type": "number", "example": 10 } } }, "example": { "success": true } } } }, "400": { "description": "Generic Error. This response indicates an issue with the request.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Invalid conversation ID" }, "statusCode": { "type": "number", "example": 400 } } } } } } } }, "post": { "tags": [ "Security AI Assistant API" ], "summary": "Create a conversation", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/current_user/conversations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters.", "operationId": "CreateConversation", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCreateProps" }, "example": { "apiConfig": { "actionTypeId": "67890", "connectorId": "12345" }, "category": "assistant", "excludeFromLastConversationStorage": false, "messages": [ { "content": "Hello, how can I assist you today?", "role": "system", "timestamp": "2023-10-31T12:00:00Z" } ], "replacements": { }, "title": "Security Discussion" } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call. The conversation was created successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationResponse" }, "example": { "apiConfig": { "actionTypeId": "67890", "connectorId": "12345" }, "category": "assistant", "createdAt": "2023-10-31T12:01:00Z", "excludeFromLastConversationStorage": false, "id": "abc123", "messages": [ { "content": "Hello, how can I assist you today?", "role": "system", "timestamp": "2023-10-31T12:00:00Z" } ], "replacements": { }, "title": "Security Discussion", "updatedAt": "2023-10-31T12:01:00Z", "users": [ { "id": "user1", "name": "John Doe" } ] } } } }, "400": { "description": "Generic Error. This response indicates an issue with the request, such as missing required parameters or incorrect data.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Missing required parameter: title" }, "statusCode": { "type": "number", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/current_user/conversations/_find": { "get": { "tags": [ "Security AI Assistant API" ], "summary": "Get conversations", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/current_user/conversations/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations.", "operationId": "FindConversations", "parameters": [ { "name": "fields", "in": "query", "description": "A list of fields to include in the response. If omitted, all fields are returned.", "schema": { "type": "array", "items": { "type": "string" }, "example": [ "id", "title", "createdAt" ] } }, { "name": "filter", "in": "query", "description": "A search query to filter the conversations. Can match against titles, messages, or other conversation attributes.", "schema": { "type": "string", "example": "Security Issue" } }, { "name": "sort_field", "in": "query", "description": "The field by which to sort the results. Valid fields are `created_at`, `title`, and `updated_at`.", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_FindConversationsSortField" } }, { "name": "sort_order", "in": "query", "description": "The order in which to sort the results. Can be either `asc` for ascending or `desc` for descending.", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_SortOrder" } }, { "name": "page", "in": "query", "description": "The page number of the results to retrieve. Default is 1.", "schema": { "minimum": 1, "type": "integer", "default": 1, "example": 1 } }, { "name": "per_page", "in": "query", "description": "The number of conversations to return per page. Default is 20.", "schema": { "minimum": 0, "type": "integer", "default": 20, "example": 20 } } ], "responses": { "200": { "description": "Successful response, returns a paginated list of conversations matching the specified criteria.", "content": { "application/json": { "schema": { "required": [ "page", "perPage", "total", "data" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationResponse" }, "description": "A list of conversations." }, "page": { "type": "integer", "description": "The current page of the results.", "example": 1 }, "perPage": { "type": "integer", "description": "The number of results returned per page.", "example": 20 }, "total": { "type": "integer", "description": "The total number of conversations matching the filter criteria.", "example": 100 } } } } } }, "400": { "description": "Generic Error. The request could not be processed due to an invalid query parameter or other issue.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Invalid filter query parameter" }, "statusCode": { "type": "number", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/current_user/conversations/{id}": { "delete": { "tags": [ "Security AI Assistant API" ], "summary": "Delete a conversation", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete an existing conversation using the conversation ID. This endpoint allows users to permanently delete a conversation.", "operationId": "DeleteConversation", "parameters": [ { "name": "id", "in": "path", "description": "The conversation's `id` value.", "required": true, "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "example": "abc123" } ], "responses": { "200": { "description": "Indicates a successful call. The conversation was deleted successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationResponse" }, "example": { "apiConfig": { "actionTypeId": "67890", "connectorId": "12345" }, "category": "assistant", "createdAt": "2023-10-31T12:01:00Z", "excludeFromLastConversationStorage": false, "id": "abc123", "messages": [ { "content": "The conversation has been deleted.", "role": "system", "timestamp": "2023-10-31T12:35:00Z" } ], "replacements": { }, "title": "Deleted Security Discussion", "updatedAt": "2023-10-31T12:01:00Z", "users": [ { "id": "user1", "name": "John Doe" } ] } } } }, "400": { "description": "Generic Error. This response indicates an issue with the request.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Invalid conversation ID" }, "statusCode": { "type": "number", "example": 400 } } } } } } } }, "get": { "tags": [ "Security AI Assistant API" ], "summary": "Get a conversation", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an existing conversation using the conversation ID. This allows users to fetch the specific conversation data by its unique ID.", "operationId": "ReadConversation", "parameters": [ { "name": "id", "in": "path", "description": "The conversation's `id` value, a unique identifier for the conversation.", "required": true, "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "example": "abc123" } ], "responses": { "200": { "description": "Indicates a successful call. The conversation details are returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationResponse" }, "example": { "apiConfig": { "actionTypeId": "67890", "connectorId": "12345" }, "category": "assistant", "createdAt": "2023-10-31T12:01:00Z", "excludeFromLastConversationStorage": false, "id": "abc123", "messages": [ { "content": "Hello, how can I assist you today?", "role": "system", "timestamp": "2023-10-31T12:00:00Z" } ], "replacements": { }, "title": "Security Discussion", "updatedAt": "2023-10-31T12:01:00Z", "users": [ { "id": "user1", "name": "John Doe" } ] } } } }, "400": { "description": "Generic Error. The request could not be processed due to an error.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Invalid conversation ID" }, "statusCode": { "type": "number", "example": 400 } } } } } } } }, "put": { "tags": [ "Security AI Assistant API" ], "summary": "Update a conversation", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing conversation using the conversation ID. This endpoint allows users to modify the details of an existing conversation.", "operationId": "UpdateConversation", "parameters": [ { "name": "id", "in": "path", "description": "The conversation's `id` value.", "required": true, "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "example": "abc123" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationUpdateProps" }, "example": { "apiConfig": { "actionTypeId": "09876", "connectorId": "54321" }, "category": "insights", "excludeFromLastConversationStorage": true, "messages": [ { "content": "The issue was resolved.", "role": "assistant", "timestamp": "2023-10-31T12:30:00Z" } ], "replacements": { }, "title": "Updated Security Discussion" } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call. The conversation was updated successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationResponse" }, "example": { "apiConfig": { "actionTypeId": "09876", "connectorId": "54321" }, "category": "insights", "createdAt": "2023-10-31T12:01:00Z", "excludeFromLastConversationStorage": true, "id": "abc123", "messages": [ { "content": "The issue was resolved.", "role": "assistant", "timestamp": "2023-10-31T12:30:00Z" } ], "replacements": { }, "title": "Updated Security Discussion", "updatedAt": "2023-10-31T12:31:00Z", "users": [ { "id": "user1", "name": "John Doe" } ] } } } }, "400": { "description": "Generic Error. This response indicates an issue with the request, such as missing required parameters or incorrect data.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Missing required field: title" }, "statusCode": { "type": "number", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/knowledge_base/{resource}": { "get": { "tags": [ "Security AI Assistant API" ], "summary": "Read a KnowledgeBase", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRead a single KB", "operationId": "ReadKnowledgeBase", "parameters": [ { "name": "resource", "in": "path", "description": "The KnowledgeBase `resource` value.", "required": true, "schema": { "type": "string" }, "example": "kb12345" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "elser_exists": { "type": "boolean", "description": "Indicates if the ELSER model exists for the KnowledgeBase.", "example": true }, "is_setup_available": { "type": "boolean", "description": "Indicates if the setup process is available for the KnowledgeBase.", "example": true }, "is_setup_in_progress": { "type": "boolean", "description": "Indicates if the setup process is currently in progress.", "example": false }, "product_documentation_status": { "type": "string", "description": "The status of the product documentation in the KnowledgeBase.", "example": "complete" }, "security_labs_exists": { "type": "boolean", "description": "Indicates if Security Labs documentation exists in the KnowledgeBase.", "example": true }, "user_data_exists": { "type": "boolean", "description": "Indicates if user data exists in the KnowledgeBase.", "example": false } } } } } }, "400": { "description": "Generic Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "A short description of the error.", "example": "Bad Request" }, "message": { "type": "string", "description": "A detailed error message.", "example": "Invalid resource ID provided." }, "statusCode": { "type": "number", "description": "The HTTP status code of the error.", "example": 400 } } } } } } } }, "post": { "tags": [ "Security AI Assistant API" ], "summary": "Create a KnowledgeBase", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a KnowledgeBase", "operationId": "CreateKnowledgeBase", "parameters": [ { "name": "resource", "in": "path", "description": "The KnowledgeBase `resource` value.", "required": true, "schema": { "type": "string" }, "example": "kb12345" }, { "name": "modelId", "in": "query", "description": "ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.", "schema": { "type": "string" }, "example": "elser-model-001" }, { "name": "ignoreSecurityLabs", "in": "query", "description": "Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.", "schema": { "type": "boolean", "default": false }, "example": true } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse" } } } }, "400": { "description": "Generic Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "A short description of the error.", "example": "Bad Request" }, "message": { "type": "string", "description": "A detailed error message.", "example": "Invalid resource ID provided." }, "statusCode": { "type": "number", "description": "The HTTP status code of the error.", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/knowledge_base/entries": { "post": { "tags": [ "Security AI Assistant API" ], "summary": "Create a Knowledge Base Entry", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/knowledge_base/entries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a Knowledge Base Entry", "operationId": "CreateKnowledgeBaseEntry", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps" }, "example": { "content": "To reset your password, go to the settings page and click 'Reset Password'.", "tags": [ "password", "reset", "help" ], "title": "How to reset a password" } } }, "required": true }, "responses": { "200": { "description": "Successful request returning Knowledge Base Entries", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse" }, "example": { "content": "To reset your password, go to the settings page and click 'Reset Password'.", "id": "12345", "tags": [ "password", "reset", "help" ], "title": "How to reset a password" } } } }, "400": { "description": "A generic error occurred, such as invalid input or missing required fields.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema" }, "example": { "error": "Invalid input", "message": "The 'title' field is required." } } } } } } }, "/api/security_ai_assistant/knowledge_base/entries/_bulk_action": { "post": { "tags": [ "Security AI Assistant API" ], "summary": "Applies a bulk action to multiple Knowledge Base Entries", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nThe bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.", "operationId": "PerformKnowledgeBaseEntryBulkAction", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "create": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps" }, "description": "List of Knowledge Base Entries to create.", "example": [ { "content": "This is the content of the new entry.", "title": "New Entry" } ] }, "delete": { "type": "object", "properties": { "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of Knowledge Base Entry IDs.", "example": [ "123", "456", "789" ] }, "query": { "type": "string", "description": "Query to filter Knowledge Base Entries.", "example": "status:active AND category:technology" } } }, "update": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps" }, "description": "List of Knowledge Base Entries to update.", "example": [ { "content": "Updated content.", "id": "123", "title": "Updated Entry" } ] } } } } } }, "responses": { "200": { "description": "Successful bulk operation request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse" } } } }, "400": { "description": "Generic Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema" } } } } } } }, "/api/security_ai_assistant/knowledge_base/entries/_find": { "get": { "tags": [ "Security AI Assistant API" ], "summary": "Finds Knowledge Base Entries that match the given query.", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFinds Knowledge Base Entries that match the given query.", "operationId": "FindKnowledgeBaseEntries", "parameters": [ { "name": "fields", "in": "query", "description": "A list of fields to include in the response. If not provided, all fields will be included.", "schema": { "type": "array", "items": { "type": "string" }, "example": [ "title", "created_at" ] } }, { "name": "filter", "in": "query", "description": "Search query to filter Knowledge Base Entries by specific criteria.", "schema": { "type": "string", "example": "error handling" } }, { "name": "sort_field", "in": "query", "description": "Field to sort the Knowledge Base Entries by.", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField" } }, { "name": "sort_order", "in": "query", "description": "Sort order for the results, either asc or desc.", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_SortOrder" } }, { "name": "page", "in": "query", "description": "Page number for paginated results. Defaults to 1.", "schema": { "minimum": 1, "type": "integer", "default": 1, "example": 2 } }, { "name": "per_page", "in": "query", "description": "Number of Knowledge Base Entries to return per page. Defaults to 20.", "schema": { "minimum": 0, "type": "integer", "default": 20, "example": 10 } } ], "responses": { "200": { "description": "Successful response containing the paginated Knowledge Base Entries.", "content": { "application/json": { "schema": { "required": [ "page", "perPage", "total", "data" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse" }, "description": "The list of Knowledge Base Entries for the current page." }, "page": { "type": "integer", "description": "The current page number.", "example": 1 }, "perPage": { "type": "integer", "description": "The number of Knowledge Base Entries returned per page.", "example": 20 }, "total": { "type": "integer", "description": "The total number of Knowledge Base Entries available.", "example": 100 } } } } } }, "400": { "description": "Generic Error indicating an issue with the request.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "A short description of the error.", "example": "Bad Request" }, "message": { "type": "string", "description": "A detailed message explaining the error.", "example": "Invalid query parameter: sort_order" }, "statusCode": { "type": "number", "description": "The HTTP status code of the error.", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/knowledge_base/entries/{id}": { "delete": { "tags": [ "Security AI Assistant API" ], "summary": "Deletes a single Knowledge Base Entry using the `id` field", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a Knowledge Base Entry by its unique `id`.", "operationId": "DeleteKnowledgeBaseEntry", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier (`id`) of the Knowledge Base Entry to delete.", "required": true, "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "example": "12345" } ], "responses": { "200": { "description": "Successful request returning the `id` of the deleted Knowledge Base Entry.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields" }, "example": { "id": "12345", "message": "Knowledge Base Entry successfully deleted." } } } }, "400": { "description": "A generic error occurred, such as an invalid `id` or the entry not being found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema" }, "example": { "error": "Not Found", "message": "No Knowledge Base Entry found with the provided `id`." } } } } } }, "get": { "tags": [ "Security AI Assistant API" ], "summary": "Read a Knowledge Base Entry", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRetrieve a Knowledge Base Entry by its unique `id`.", "operationId": "ReadKnowledgeBaseEntry", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier (`id`) of the Knowledge Base Entry to retrieve.", "required": true, "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "example": "12345" } ], "responses": { "200": { "description": "Successful request returning the requested Knowledge Base Entry.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse" }, "example": { "content": "To reset your password, go to the settings page and click 'Reset Password'.", "id": "12345", "tags": [ "password", "reset", "help" ], "title": "How to reset a password" } } } }, "400": { "description": "A generic error occurred, such as an invalid `id` or the entry not being found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema" }, "example": { "error": "Not Found", "message": "No Knowledge Base Entry found with the provided `id`." } } } } } }, "put": { "tags": [ "Security AI Assistant API" ], "summary": "Update a Knowledge Base Entry", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing Knowledge Base Entry by its unique `id`.", "operationId": "UpdateKnowledgeBaseEntry", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier (`id`) of the Knowledge Base Entry to update.", "required": true, "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "example": "12345" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps" }, "example": { "content": "To reset your password, go to the settings page, click 'Reset Password', and follow the instructions.", "tags": [ "password", "reset", "help", "update" ], "title": "How to reset a password (updated)" } } }, "required": true }, "responses": { "200": { "description": "Successful request returning the updated Knowledge Base Entry.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse" }, "example": { "content": "To reset your password, go to the settings page, click 'Reset Password', and follow the instructions.", "id": "12345", "tags": [ "password", "reset", "help", "update" ], "title": "How to reset a password (updated)" } } } }, "400": { "description": "A generic error occurred, such as invalid input or the entry not being found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema" }, "example": { "error": "Invalid input", "message": "The 'content' field cannot be empty." } } } } } } }, "/api/security_ai_assistant/prompts/_bulk_action": { "post": { "tags": [ "Security AI Assistant API" ], "summary": "Apply a bulk action to prompts", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/security_ai_assistant/prompts/_bulk_action
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nApply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs. This action allows for bulk create, update, or delete operations.", "operationId": "PerformPromptsBulkAction", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "create": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptCreateProps" }, "description": "List of prompts to be created." }, "delete": { "type": "object", "properties": { "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of IDs to apply the action to.", "example": [ "1234", "5678" ] }, "query": { "type": "string", "description": "Query to filter the bulk action.", "example": "status: 'inactive'" } }, "description": "Criteria for deleting prompts in bulk." }, "update": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptUpdateProps" }, "description": "List of prompts to be updated." } } }, "example": { "create": [ { "content": "Please verify the security settings.", "name": "New Security Prompt", "promptType": "system" } ], "delete": { "ids": [ "prompt1", "prompt2" ] }, "update": [ { "content": "Updated content for security prompt.", "id": "prompt123" } ] } } } }, "responses": { "200": { "description": "Indicates a successful call with the results of the bulk action.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResponse" }, "examples": { "success": { "value": { "attributes": { "errors": [ ], "results": { "created": [ { "content": "Please verify the security settings.", "id": "prompt6", "name": "New Security Prompt", "promptType": "system" } ], "deleted": [ "prompt2", "prompt3" ], "skipped": [ { "id": "prompt4", "name": "Security Prompt", "skip_reason": "PROMPT_FIELD_NOT_MODIFIED" } ], "updated": [ { "content": "Updated security settings prompt", "id": "prompt1", "name": "Security Prompt", "promptType": "system" } ] }, "summary": { "failed": 0, "skipped": 1, "succeeded": 4, "total": 5 } }, "message": "Bulk action completed successfully.", "prompts_count": 5, "status_code": 200, "success": true } } } } } }, "400": { "description": "Indicates a generic error due to a bad request.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "A short error message.", "example": "Bad Request" }, "message": { "type": "string", "description": "A detailed error message.", "example": "Invalid prompt ID or missing required fields." }, "statusCode": { "type": "number", "description": "The HTTP status code for the error.", "example": 400 } } } } } } } } }, "/api/security_ai_assistant/prompts/_find": { "get": { "tags": [ "Security AI Assistant API" ], "summary": "Get prompts", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/security_ai_assistant/prompts/_find
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all prompts based on optional filters, sorting, and pagination.", "operationId": "FindPrompts", "parameters": [ { "name": "fields", "in": "query", "description": "List of specific fields to include in each returned prompt.", "schema": { "type": "array", "items": { "type": "string" }, "example": [ "id", "name", "content" ] } }, { "name": "filter", "in": "query", "description": "Search query string to filter prompts by matching fields.", "schema": { "type": "string", "example": "error handling" } }, { "name": "sort_field", "in": "query", "description": "Field to sort prompts by.", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_FindPromptsSortField" } }, { "name": "sort_order", "in": "query", "description": "Sort order, either asc or desc.", "schema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_SortOrder" } }, { "name": "page", "in": "query", "description": "Page number for pagination.", "schema": { "minimum": 1, "type": "integer", "default": 1, "example": 1 } }, { "name": "per_page", "in": "query", "description": "Number of prompts per page.", "schema": { "minimum": 0, "type": "integer", "default": 20, "example": 20 } } ], "responses": { "200": { "description": "Successful response containing a list of prompts.", "content": { "application/json": { "schema": { "required": [ "page", "perPage", "total", "data" ], "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptResponse" }, "description": "The list of prompts returned based on the search query, sorting, and pagination." }, "page": { "type": "integer", "description": "Current page number.", "example": 1 }, "perPage": { "type": "integer", "description": "Number of prompts per page.", "example": 20 }, "total": { "type": "integer", "description": "Total number of prompts matching the query.", "example": 142 } }, "example": { "data": [ { "categories": [ "troubleshooting", "logging" ], "color": "#FF5733", "consumer": "security", "content": "If you encounter an error, check the logs and retry.", "createdAt": "2025-04-20T21:00:00Z", "createdBy": "jdoe", "id": "prompt-123", "isDefault": true, "isNewConversationDefault": false, "name": "Error Troubleshooting Prompt", "namespace": "default", "promptType": "standard", "timestamp": "2025-04-30T22:30:00Z", "updatedAt": "2025-04-30T22:45:00Z", "updatedBy": "jdoe", "users": [ { "full_name": "John Doe", "username": "jdoe" } ] } ], "page": 1, "perPage": 20, "total": 142 } } } } }, "400": { "description": "Bad request due to invalid parameters or malformed query.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "description": "Short error message.", "example": "Bad Request" }, "message": { "type": "string", "description": "Detailed description of the error.", "example": "Invalid sort order value provided." }, "statusCode": { "type": "number", "description": "HTTP status code for the error.", "example": 400 } } } } } } } } }, "/api/security/role": { "get": { "tags": [ "roles" ], "summary": "Get all roles", "operationId": "get-security-role", "parameters": [ { "name": "replaceDeprecatedPrivileges", "in": "query", "description": "If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getRolesResponse1": { "$ref": "#/components/examples/get_roles_response1" } } } } } } } }, "/api/security/role/_query": { "post": { "summary": "Query roles", "operationId": "post-security-role-query", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "filters": { "type": "object", "properties": { "showReservedRoles": { "type": "boolean" } }, "additionalProperties": false }, "from": { "type": "number" }, "query": { "type": "string" }, "size": { "type": "number" }, "sort": { "required": [ "field", "direction" ], "type": "object", "properties": { "direction": { "enum": [ "asc", "desc" ], "type": "string" }, "field": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call." } } } }, "/api/security/role/{name}": { "delete": { "tags": [ "roles" ], "summary": "Delete a role", "operationId": "delete-security-role-name", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "name", "in": "path", "required": true, "schema": { "minLength": 1, "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." } } }, "get": { "tags": [ "roles" ], "summary": "Get a role", "operationId": "get-security-role-name", "parameters": [ { "name": "name", "in": "path", "description": "The role name.", "required": true, "schema": { "minLength": 1, "type": "string" } }, { "name": "replaceDeprecatedPrivileges", "in": "query", "description": "If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getRoleResponse1": { "$ref": "#/components/examples/get_role_response1" } } } } } } }, "put": { "tags": [ "roles" ], "summary": "Create or update a role", "description": "Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.", "operationId": "put-security-role-name", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "name", "in": "path", "description": "The role name.", "required": true, "schema": { "maxLength": 1024, "minLength": 1, "type": "string" } }, { "name": "createOnly", "in": "query", "description": "When true, a role is not overwritten if it already exists.", "schema": { "type": "boolean", "default": false } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "elasticsearch" ], "type": "object", "properties": { "description": { "maxLength": 2048, "type": "string", "description": "A description for the role." }, "elasticsearch": { "type": "object", "properties": { "cluster": { "type": "array", "items": { "type": "string", "description": "Cluster privileges that define the cluster level actions that users can perform." } }, "indices": { "type": "array", "items": { "required": [ "names", "privileges" ], "type": "object", "properties": { "allow_restricted_indices": { "type": "boolean", "description": "Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too." }, "field_security": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string", "description": "The document fields that the role members have read access to." } } }, "names": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*)." } }, "privileges": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The index level privileges that the role members have for the data streams and indices." } }, "query": { "type": "string", "description": "A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members." } }, "additionalProperties": false } }, "remote_cluster": { "type": "array", "items": { "required": [ "privileges", "clusters" ], "type": "object", "properties": { "clusters": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions." } }, "privileges": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges." } } }, "additionalProperties": false } }, "remote_indices": { "type": "array", "items": { "required": [ "clusters", "names", "privileges" ], "type": "object", "properties": { "allow_restricted_indices": { "type": "boolean", "description": "Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too." }, "clusters": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions." } }, "field_security": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string", "description": "The document fields that the role members have read access to." } } }, "names": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*)." } }, "privileges": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The index level privileges that role members have for the specified indices." } }, "query": { "type": "string", "description": "A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. " } }, "additionalProperties": false } }, "run_as": { "type": "array", "items": { "type": "string", "description": "A user name that the role member can impersonate." } } }, "additionalProperties": false }, "kibana": { "maxItems": 1000, "type": "array", "items": { "required": [ "base" ], "type": "object", "properties": { "base": { "anyOf": [ { "type": "array", "items": { } }, { "type": "boolean" }, { "type": "number" }, { "type": "object" }, { "type": "string" } ], "oneOf": [ { "type": "array", "items": { "type": "string", "description": "A base privilege that grants applies to all spaces." } }, { "type": "array", "items": { "type": "string", "description": "A base privilege that applies to specific spaces." } } ] }, "feature": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string", "description": "The privileges that the role member has for the feature." } } }, "spaces": { "anyOf": [ { "maxItems": 1, "minItems": 1, "type": "array", "items": { "enum": [ "*" ], "type": "string" } }, { "type": "array", "items": { "type": "string", "description": "A space that the privilege applies to." } } ], "default": [ "*" ] } }, "additionalProperties": false } }, "metadata": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false }, "examples": { "createRoleRequest1": { "$ref": "#/components/examples/create_role_request1" }, "createRoleRequest2": { "$ref": "#/components/examples/create_role_request2" }, "createRoleRequest3": { "$ref": "#/components/examples/create_role_request3" }, "createRoleRequest4": { "$ref": "#/components/examples/create_role_request4" } } } } }, "responses": { "204": { "description": "Indicates a successful call." } } } }, "/api/security/roles": { "post": { "tags": [ "roles" ], "summary": "Create or update roles", "operationId": "post-security-roles", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "roles" ], "type": "object", "properties": { "roles": { "type": "object", "additionalProperties": { "required": [ "elasticsearch" ], "type": "object", "properties": { "description": { "maxLength": 2048, "type": "string", "description": "A description for the role." }, "elasticsearch": { "type": "object", "properties": { "cluster": { "type": "array", "items": { "type": "string", "description": "Cluster privileges that define the cluster level actions that users can perform." } }, "indices": { "type": "array", "items": { "required": [ "names", "privileges" ], "type": "object", "properties": { "allow_restricted_indices": { "type": "boolean", "description": "Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too." }, "field_security": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string", "description": "The document fields that the role members have read access to." } } }, "names": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*)." } }, "privileges": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The index level privileges that the role members have for the data streams and indices." } }, "query": { "type": "string", "description": "A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members." } }, "additionalProperties": false } }, "remote_cluster": { "type": "array", "items": { "required": [ "privileges", "clusters" ], "type": "object", "properties": { "clusters": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions." } }, "privileges": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges." } } }, "additionalProperties": false } }, "remote_indices": { "type": "array", "items": { "required": [ "clusters", "names", "privileges" ], "type": "object", "properties": { "allow_restricted_indices": { "type": "boolean", "description": "Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too." }, "clusters": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions." } }, "field_security": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string", "description": "The document fields that the role members have read access to." } } }, "names": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*)." } }, "privileges": { "minItems": 1, "type": "array", "items": { "type": "string", "description": "The index level privileges that role members have for the specified indices." } }, "query": { "type": "string", "description": "A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. " } }, "additionalProperties": false } }, "run_as": { "type": "array", "items": { "type": "string", "description": "A user name that the role member can impersonate." } } }, "additionalProperties": false }, "kibana": { "maxItems": 1000, "type": "array", "items": { "required": [ "base" ], "type": "object", "properties": { "base": { "anyOf": [ { "type": "array", "items": { } }, { "type": "boolean" }, { "type": "number" }, { "type": "object" }, { "type": "string" } ], "oneOf": [ { "type": "array", "items": { "type": "string", "description": "A base privilege that grants applies to all spaces." } }, { "type": "array", "items": { "type": "string", "description": "A base privilege that applies to specific spaces." } } ] }, "feature": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string", "description": "The privileges that the role member has for the feature." } } }, "spaces": { "anyOf": [ { "maxItems": 1, "minItems": 1, "type": "array", "items": { "enum": [ "*" ], "type": "string" } }, { "type": "array", "items": { "type": "string", "description": "A space that the privilege applies to." } } ], "default": [ "*" ] } }, "additionalProperties": false } }, "metadata": { "type": "object", "additionalProperties": { } } }, "additionalProperties": false } } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call." } } } }, "/api/security/session/_invalidate": { "post": { "tags": [ "user session" ], "summary": "Invalidate user sessions", "description": "Invalidate user sessions that match a query. To use this API, you must be a superuser.\n", "operationId": "post-security-session-invalidate", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "match" ], "type": "object", "properties": { "match": { "enum": [ "all", "query" ], "type": "string", "description": "The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.\n" }, "query": { "required": [ "provider" ], "type": "object", "properties": { "provider": { "required": [ "type" ], "type": "object", "properties": { "name": { "type": "string", "description": "The authentication provider name." }, "type": { "type": "string", "description": "The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.\n" } }, "description": "The authentication providers that will have their user sessions invalidated." }, "username": { "type": "string", "description": "The username that will have its sessions invalidated." } }, "description": "The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.\n" } } }, "examples": { "invalidateRequestExample1": { "summary": "Invalidate all sessions", "description": "Run `POST api/security/session/_invalidate` to invalidate all existing sessions.", "value": "{\n \"match\" : \"all\"\n}" }, "invalidateRequestExample2": { "summary": "Invalidate all SAML sessions", "description": "Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any SAML authentication provider.", "value": "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"saml\" }\n }\n}" }, "invalidateRequestExample3": { "summary": "Invalidate sessions for a provider", "description": "Run `POST api/security/session/_invalidate` to invalidate sessions that were created by the SAML authentication provider named `saml1`.", "value": "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"saml\", \"name\": \"saml1\" }\n }\n}" }, "invalidateRequestExample4": { "summary": "Invalidate sessions for a user", "description": "Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any OpenID Connect authentication provider for the user with the username `user@my-oidc-sso.com`.", "value": "{\n \"match\" : \"query\",\n \"query\": {\n \"provider\" : { \"type\": \"oidc\" },\n \"username\": \"user@my-oidc-sso.com\"\n }\n}" } } } } }, "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "type": "object", "properties": { "total": { "type": "integer", "description": "The number of sessions that were successfully invalidated." } } } } } }, "403": { "description": "Indicates that the user may not be authorized to invalidate sessions for other users." } } } }, "/api/short_url": { "post": { "tags": [ "short url" ], "summary": "Create a short URL", "description": "Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share.\nShort URLs are created by specifying the locator ID and locator parameters. When a short URL is resolved, the locator ID and locator parameters are used to redirect user to the right Kibana page.\n", "operationId": "post-url", "requestBody": { "content": { "application/json": { "schema": { "required": [ "locatorId", "params" ], "type": "object", "properties": { "humanReadableSlug": { "type": "boolean", "description": "When the `slug` parameter is omitted, the API will generate a random human-readable slug if `humanReadableSlug` is set to true.\n" }, "locatorId": { "type": "string", "description": "The identifier for the locator." }, "params": { "type": "object", "description": "An object which contains all necessary parameters for the given locator to resolve to a Kibana location.\n> warn\n> When you create a short URL, locator params are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.\n" }, "slug": { "type": "string", "description": "A custom short URL slug. The slug is the part of the short URL that identifies it. You can provide a custom slug which consists of latin alphabet letters, numbers, and `-._` characters. The slug must be at least 3 characters long, but no longer than 255 characters.\n" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Short_URL_APIs_urlResponse" } } } } }, "x-state": "Technical Preview" } }, "/api/short_url/_slug/{slug}": { "get": { "tags": [ "short url" ], "summary": "Resolve a short URL", "description": "Resolve a Kibana short URL by its slug.\n", "operationId": "resolve-url", "parameters": [ { "name": "slug", "in": "path", "description": "The slug of the short URL.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Short_URL_APIs_urlResponse" } } } } }, "x-state": "Technical Preview" } }, "/api/short_url/{id}": { "delete": { "tags": [ "short url" ], "summary": "Delete a short URL", "description": "Delete a Kibana short URL.\n", "operationId": "delete-url", "parameters": [ { "$ref": "#/components/parameters/Short_URL_APIs_idParam" } ], "responses": { "200": { "description": "Indicates a successful call." } }, "x-state": "Technical Preview" }, "get": { "tags": [ "short url" ], "summary": "Get a short URL", "description": "Get a single Kibana short URL.\n", "operationId": "get-url", "parameters": [ { "$ref": "#/components/parameters/Short_URL_APIs_idParam" } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Short_URL_APIs_urlResponse" } } } } }, "x-state": "Technical Preview" } }, "/api/spaces/_copy_saved_objects": { "post": { "tags": [ "spaces" ], "summary": "Copy saved objects between spaces", "description": "It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required. You can request to overwrite any objects that already exist in the target space if they share an identifier or you can use the resolve copy saved objects conflicts API to do this on a per-object basis.

[Required authorization] Route required privileges: copySavedObjectsToSpaces.", "operationId": "post-spaces-copy-saved-objects", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "spaces", "objects" ], "type": "object", "properties": { "compatibilityMode": { "type": "boolean", "description": "Apply various adjustments to the saved objects that are being copied to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with copied saved objects. This option cannot be used with the `createNewCopies` option.", "default": false }, "createNewCopies": { "type": "boolean", "description": "Create new copies of saved objects, regenerate each object identifier, and reset the origin. When used, potential conflict errors are avoided. This option cannot be used with the `overwrite` and `compatibilityMode` options.", "default": true }, "includeReferences": { "type": "boolean", "description": "When set to true, all saved objects related to the specified saved objects will also be copied into the target spaces.", "default": false }, "objects": { "type": "array", "items": { "required": [ "type", "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The identifier of the saved object to copy." }, "type": { "type": "string", "description": "The type of the saved object to copy." } }, "additionalProperties": false } }, "overwrite": { "type": "boolean", "description": "When set to true, all conflicts are automatically overridden. When a saved object with a matching type and identifier exists in the target space, that version is replaced with the version from the source space. This option cannot be used with the `createNewCopies` option.", "default": false }, "spaces": { "type": "array", "items": { "type": "string", "description": "The identifiers of the spaces where you want to copy the specified objects." } } }, "additionalProperties": false }, "examples": { "copySavedObjectsRequestExample1": { "$ref": "#/components/examples/copy_saved_objects_request1" }, "copySavedObjectsRequestExample2": { "$ref": "#/components/examples/copy_saved_objects_request2" } } } } }, "responses": { "200": { "description": "OK: A successful request.", "content": { "application/json": { "examples": { "copySavedObjectsResponseExample1": { "$ref": "#/components/examples/copy_saved_objects_response1" }, "copySavedObjectsResponseExample2": { "$ref": "#/components/examples/copy_saved_objects_response2" }, "copySavedObjectsResponseExample3": { "$ref": "#/components/examples/copy_saved_objects_response3" }, "copySavedObjectsResponseExample4": { "$ref": "#/components/examples/copy_saved_objects_response4" } } } } } } } }, "/api/spaces/_disable_legacy_url_aliases": { "post": { "tags": [ "spaces" ], "summary": "Disable legacy URL aliases", "operationId": "post-spaces-disable-legacy-url-aliases", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "aliases" ], "type": "object", "properties": { "aliases": { "type": "array", "items": { "required": [ "targetSpace", "targetType", "sourceId" ], "type": "object", "properties": { "sourceId": { "type": "string", "description": "The alias source object identifier. This is the legacy object identifier." }, "targetSpace": { "type": "string", "description": "The space where the alias target object exists." }, "targetType": { "type": "string", "description": "The type of alias target object. " } }, "additionalProperties": false } } }, "additionalProperties": false }, "examples": { "disableLegacyURLRequestExample1": { "$ref": "#/components/examples/disable_legacy_url_request1" } } } } }, "responses": { "204": { "description": "Indicates a successful call." } } } }, "/api/spaces/_get_shareable_references": { "post": { "tags": [ "spaces" ], "summary": "Get shareable references", "description": "Collect references and space contexts for saved objects.", "operationId": "post-spaces-get-shareable-references", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "objects" ], "type": "object", "properties": { "objects": { "type": "array", "items": { "required": [ "type", "id" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "type": "string" } }, "additionalProperties": false } } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "Indicates a successful call." } } } }, "/api/spaces/_resolve_copy_saved_objects_errors": { "post": { "summary": "Resolve conflicts copying saved objects", "description": "Overwrite saved objects that are returned as errors from the copy saved objects to space API.

[Required authorization] Route required privileges: copySavedObjectsToSpaces.", "operationId": "post-spaces-resolve-copy-saved-objects-errors", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "retries", "objects" ], "type": "object", "properties": { "compatibilityMode": { "type": "boolean", "default": false }, "createNewCopies": { "type": "boolean", "default": true }, "includeReferences": { "type": "boolean", "default": false }, "objects": { "type": "array", "items": { "required": [ "type", "id" ], "type": "object", "properties": { "id": { "type": "string" }, "type": { "type": "string" } }, "additionalProperties": false } }, "retries": { "type": "object", "additionalProperties": { "type": "array", "items": { "required": [ "type", "id" ], "type": "object", "properties": { "createNewCopy": { "type": "boolean", "description": "Creates new copies of the saved objects, regenerates each object ID, and resets the origin." }, "destinationId": { "type": "string", "description": "Specifies the destination identifier that the copied object should have, if different from the current identifier." }, "id": { "type": "string", "description": "The saved object identifier." }, "ignoreMissingReferences": { "type": "boolean", "description": "When set to true, any missing references errors are ignored." }, "overwrite": { "type": "boolean", "description": "When set to true, the saved object from the source space overwrites the conflicting object in the destination space.", "default": false }, "type": { "type": "string", "description": "The saved object type." } }, "additionalProperties": false } } } }, "additionalProperties": false }, "examples": { "resolveCopySavedObjectsRequestExample1": { "$ref": "#/components/examples/resolve_copy_saved_objects_request1" }, "resolveCopySavedObjectsRequestExample2": { "$ref": "#/components/examples/resolve_copy_saved_objects_request2" } } } } }, "responses": { "200": { "description": "OK: A successful request.", "content": { "application/json": { "examples": { "resolveCopySavedObjectsResponseExample1": { "$ref": "#/components/examples/copy_saved_objects_response1" }, "resolveCopySavedObjectsResponseExample2": { "$ref": "#/components/examples/copy_saved_objects_response2" } } } } } } } }, "/api/spaces/_update_objects_spaces": { "post": { "tags": [ "spaces" ], "summary": "Update saved objects in spaces", "description": "Update one or more saved objects to add or remove them from some spaces.", "operationId": "post-spaces-update-objects-spaces", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "objects", "spacesToAdd", "spacesToRemove" ], "type": "object", "properties": { "objects": { "type": "array", "items": { "required": [ "type", "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The identifier of the saved object to update." }, "type": { "type": "string", "description": "The type of the saved object to update." } }, "additionalProperties": false } }, "spacesToAdd": { "type": "array", "items": { "type": "string", "description": "The identifiers of the spaces the saved objects should be added to or removed from." } }, "spacesToRemove": { "type": "array", "items": { "type": "string", "description": "The identifiers of the spaces the saved objects should be added to or removed from." } } }, "additionalProperties": false }, "examples": { "updateObjectSpacesRequestExample1": { "$ref": "#/components/examples/update_saved_objects_spaces_request1" } } } } }, "responses": { "200": { "description": "OK: A successful request.", "content": { "application/json": { "examples": { "updateObjectSpacesResponseExample1": { "$ref": "#/components/examples/update_saved_objects_spaces_response1" } } } } } } } }, "/api/spaces/space": { "get": { "tags": [ "spaces" ], "summary": "Get all spaces", "operationId": "get-spaces-space", "parameters": [ { "name": "purpose", "in": "query", "description": "Specifies which authorization checks are applied to the API call. The default value is `any`.", "schema": { "enum": [ "any", "copySavedObjectsIntoSpace", "shareSavedObjectsIntoSpace" ], "type": "string" } }, { "name": "include_authorized_purposes", "in": "query", "description": "When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.", "required": true, "schema": { "anyOf": [ { "type": "array", "items": { } }, { "type": "boolean" }, { "type": "number" }, { "type": "object" }, { "type": "string" } ], "oneOf": [ { "enum": [ false ], "type": "boolean", "x-oas-optional": true }, { "type": "boolean", "x-oas-optional": true } ] } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getSpacesResponseExample1": { "$ref": "#/components/examples/get_spaces_response1" }, "getSpacesResponseExample2": { "$ref": "#/components/examples/get_spaces_response2" } } } } } } }, "post": { "tags": [ "spaces" ], "summary": "Create a space", "operationId": "post-spaces-space", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "id", "name" ], "type": "object", "properties": { "_reserved": { "type": "boolean" }, "color": { "type": "string", "description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name." }, "description": { "type": "string", "description": "A description for the space." }, "disabledFeatures": { "type": "array", "items": { "type": "string", "description": "The list of features that are turned off in the space." }, "default": [ ] }, "id": { "type": "string", "description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation." }, "imageUrl": { "type": "string", "description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images." }, "initials": { "maxLength": 2, "type": "string", "description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name." }, "name": { "minLength": 1, "type": "string", "description": "The display name for the space. " }, "solution": { "enum": [ "security", "oblt", "es", "classic" ], "type": "string" } }, "additionalProperties": false }, "examples": { "createSpaceRequest": { "$ref": "#/components/examples/create_space_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call." } } } }, "/api/spaces/space/{id}": { "delete": { "tags": [ "spaces" ], "summary": "Delete a space", "description": "When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone.", "operationId": "delete-spaces-space-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The space identifier.", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "Indicates a successful call." }, "404": { "description": "Indicates that the request failed." } } }, "get": { "tags": [ "spaces" ], "summary": "Get a space", "operationId": "get-spaces-space-id", "parameters": [ { "name": "id", "in": "path", "description": "The space identifier.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getSpaceResponseExample": { "$ref": "#/components/examples/get_space_response" } } } } } } }, "put": { "tags": [ "spaces" ], "summary": "Update a space", "operationId": "put-spaces-space-id", "parameters": [ { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, { "name": "id", "in": "path", "description": "The space identifier. You are unable to change the ID with the update operation.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "id", "name" ], "type": "object", "properties": { "_reserved": { "type": "boolean" }, "color": { "type": "string", "description": "The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name." }, "description": { "type": "string", "description": "A description for the space." }, "disabledFeatures": { "type": "array", "items": { "type": "string", "description": "The list of features that are turned off in the space." }, "default": [ ] }, "id": { "type": "string", "description": "The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation." }, "imageUrl": { "type": "string", "description": "The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images." }, "initials": { "maxLength": 2, "type": "string", "description": "One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name." }, "name": { "minLength": 1, "type": "string", "description": "The display name for the space. " }, "solution": { "enum": [ "security", "oblt", "es", "classic" ], "type": "string" } }, "additionalProperties": false }, "examples": { "updateSpaceRequest": { "$ref": "#/components/examples/update_space_request" } } } } }, "responses": { "200": { "description": "Indicates a successful call." } } } }, "/api/status": { "get": { "tags": [ "system" ], "summary": "Get Kibana's current status", "operationId": "get-status", "parameters": [ { "name": "v7format", "in": "query", "description": "Set to \"true\" to get the response in v7 format.", "schema": { "type": "boolean" } }, { "name": "v8format", "in": "query", "description": "Set to \"true\" to get the response in v8 format.", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Overall status is OK and Kibana should be functioning normally.", "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_response" }, { "$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse" } ], "description": "Kibana's operational status. A minimal response is sent for unauthorized users." } } } }, "503": { "description": "Kibana or some of it's essential services are unavailable. Kibana may be degraded or unavailable.", "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_response" }, { "$ref": "#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse" } ], "description": "Kibana's operational status. A minimal response is sent for unauthorized users." } } } } } } }, "/api/synthetics/monitors": { "get": { "tags": [ "synthetics" ], "summary": "Get monitors", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/synthetics/monitors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of monitors.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "get-synthetic-monitors", "parameters": [ { "name": "filter", "in": "query", "description": "Additional filtering criteria.", "schema": { "type": "string" } }, { "name": "locations", "in": "query", "description": "The locations to filter by.", "schema": { "type": [ "string", "array" ] } }, { "name": "monitorTypes", "in": "query", "description": "The monitor types to filter.", "schema": { "oneOf": [ { "enum": [ "browser", "http", "icmp", "tcp" ], "type": "string" }, { "type": "array" } ] } }, { "name": "page", "in": "query", "description": "The page number for paginated results.", "schema": { "type": "integer" } }, { "name": "per_page", "in": "query", "description": "The number of items to return per page.", "schema": { "type": "integer" } }, { "name": "projects", "in": "query", "description": "The projects to filter by.", "schema": { "type": [ "string", "array" ] } }, { "name": "query", "in": "query", "description": "A free-text query string.", "schema": { "type": "string" } }, { "name": "schedules", "in": "query", "description": "The schedules to filter by.", "schema": { "type": [ "string", "array" ] } }, { "name": "sortField", "in": "query", "description": "The field to sort the results by.", "schema": { "enum": [ "name", "createdAt", "updatedAt", "status" ], "type": "string" } }, { "name": "sortOrder", "in": "query", "description": "The sort order.", "schema": { "enum": [ "asc", "desc" ], "type": "string" } }, { "name": "status", "in": "query", "description": "The status to filter by.", "schema": { "type": [ "string", "array" ] } }, { "name": "tags", "in": "query", "description": "Tags to filter monitors.", "schema": { "type": [ "string", "array" ] } }, { "name": "useLogicalAndFor", "in": "query", "description": "Specifies whether to apply logical AND filtering for specific fields. Accepts either a string with values \"tags\" or \"locations\" or an array containing both.\n", "schema": { "oneOf": [ { "enum": [ "tags", "locations" ], "type": "string" }, { "type": "array", "items": { "enum": [ "tags", "locations" ], "type": "string" } } ] } } ], "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "getSyntheticMonitorsResponseExample1": { "description": "A successful response from `GET /api/synthetics/monitors?tags=prod&monitorTypes=http&locations=us-east-1&projects=project1&status=up`.", "value": "{\n \"page\": 1,\n \"total\": 24,\n \"monitors\": [\n {\n \"type\": \"icmp\",\n \"enabled\": false,\n \"alert\": {\n \"status\": {\n \"enabled\": true\n },\n \"tls\": {\n \"enabled\": true\n }\n },\n \"schedule\": {\n \"number\": \"3\",\n \"unit\": \"m\"\n },\n \"config_id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n \"timeout\": \"16\",\n \"name\": \"8.8.8.8:80\",\n \"locations\": [\n {\n \"id\": \"us_central\",\n \"label\": \"North America - US Central\",\n \"geo\": {\n \"lat\": 41.25,\n \"lon\": -95.86\n },\n \"isServiceManaged\": true\n }\n ],\n \"namespace\": \"default\",\n \"origin\": \"ui\",\n \"id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n \"max_attempts\": 2,\n \"wait\": \"7\",\n \"revision\": 3,\n \"mode\": \"all\",\n \"ipv4\": true,\n \"ipv6\": true,\n \"created_at\": \"2023-11-07T09:57:04.152Z\",\n \"updated_at\": \"2023-12-04T19:19:34.039Z\",\n \"host\": \"8.8.8.8:80\"\n }\n ],\n \"absoluteTotal\": 24,\n \"perPage\": 10,\n}" } } } } } } }, "post": { "tags": [ "synthetics" ], "summary": "Create a monitor", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/synthetics/monitors
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new monitor with the specified attributes. A monitor can be one of the following types: HTTP, TCP, ICMP, or Browser. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "post-synthetic-monitors", "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Synthetics_browserMonitorFields" }, { "$ref": "#/components/schemas/Synthetics_httpMonitorFields" }, { "$ref": "#/components/schemas/Synthetics_icmpMonitorFields" }, { "$ref": "#/components/schemas/Synthetics_tcpMonitorFields" } ], "description": "The request body should contain the attributes of the monitor you want to create. The required and default fields differ depending on the monitor type.\n", "discriminator": { "propertyName": "type" } }, "examples": { "postSyntheticMonitorsRequestExample1": { "summary": "HTTP monitor", "description": "Create an HTTP monitor to check a website's availability.", "value": "{\n \"type\": \"http\",\n \"name\": \"Website Availability\",\n \"url\": \"https://example.com\",\n \"tags\": [\"website\", \"availability\"],\n \"locations\": [\"united_kingdom\"]\n}" }, "postSyntheticMonitorsRequestExample2": { "summary": "TCP monitor", "description": "Create a TCP monitor to monitor a server's availability.", "value": "{\n \"type\": \"tcp\",\n \"name\": \"Server Availability\",\n \"host\": \"example.com\",\n \"private_locations\": [\"my_private_location\"]\n}" }, "postSyntheticMonitorsRequestExample3": { "summary": "ICMP monitor", "description": "Create an ICMP monitor to perform ping checks.", "value": "{\n \"type\": \"icmp\",\n \"name\": \"Ping Test\",\n \"host\": \"example.com\",\n \"locations\": [\"united_kingdom\"]\n}" }, "postSyntheticMonitorsRequestExample4": { "summary": "Browser monitor", "description": "Create a browser monitor to check a website.", "value": "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n \"locations\": [\"united_kingdom\"]\n}" } } } }, "required": true }, "responses": { "200": { "description": "A successful response." } } } }, "/api/synthetics/monitors/_bulk_delete": { "post": { "tags": [ "synthetics" ], "summary": "Delete monitors", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/synthetics/monitors/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete multiple monitors by sending a list of config IDs.\n", "operationId": "delete-synthetic-monitors", "requestBody": { "content": { "application/json": { "schema": { "required": [ "ids" ], "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "An array of monitor IDs to delete." } } }, "examples": { "bulkDeleteRequestExample1": { "description": "Run `POST /api/synthetics/monitors/_bulk_delete` to delete a list of monitors.", "value": "{\n \"ids\": [\n \"monitor1-id\",\n \"monitor2-id\"\n ]\n}" } } } }, "required": true }, "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "deleted": { "type": "boolean", "description": "If it is `true`, the monitor was successfully deleted If it is `false`, the monitor was not deleted.\n" }, "ids": { "type": "string", "description": "The unique identifier of the deleted monitor." } }, "description": "The API response includes information about the deleted monitors." } }, "examples": { "deleteMonitorsResponseExample1": { "description": "A response from successfully deleting multiple monitors.", "value": "[\n {\n \"id\": \"monitor1-id\",\n \"deleted\": true\n },\n {\n \"id\": \"monitor2-id\",\n \"deleted\": true\n }\n]" } } } } } } } }, "/api/synthetics/monitors/{id}": { "delete": { "tags": [ "synthetics" ], "summary": "Delete a monitor", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a monitor from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "delete-synthetic-monitor", "parameters": [ { "name": "id", "in": "path", "description": "The identifier for the monitor that you want to delete.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "synthetics" ], "summary": "Get a monitor", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "get-synthetic-monitor", "parameters": [ { "name": "id", "in": "path", "description": "The ID of the monitor.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "getSyntheticMonitorResponseExample1": { "description": "A successful response from `GET /api/synthetics/monitors/`.", "value": "{\n \"type\": \"http\",\n \"enabled\": true,\n \"alert\": {\n \"status\": {\n \"enabled\": true\n },\n \"tls\": {\n \"enabled\": true\n }\n },\n \"schedule\": {\n \"number\": \"3\",\n \"unit\": \"m\"\n },\n \"config_id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n \"timeout\": \"16\",\n \"name\": \"am i something\",\n \"locations\": [\n {\n \"id\": \"us_central\",\n \"label\": \"North America - US Central\",\n \"geo\": {\n \"lat\": 41.25,\n \"lon\": -95.86\n },\n \"isServiceManaged\": true\n }\n ],\n \"namespace\": \"default\",\n \"origin\": \"ui\",\n \"id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n \"max_attempts\": 2,\n \"__ui\": {\n \"is_tls_enabled\": false\n },\n \"max_redirects\": \"0\",\n \"response.include_body\": \"on_error\",\n \"response.include_headers\": true,\n \"check.request.method\": \"GET\",\n \"mode\": \"any\",\n \"response.include_body_max_bytes\": \"1024\",\n \"ipv4\": true,\n \"ipv6\": true,\n \"ssl.verification_mode\": \"full\",\n \"ssl.supported_protocols\": [\n \"TLSv1.1\",\n \"TLSv1.2\",\n \"TLSv1.3\"\n ],\n \"revision\": 13,\n \"created_at\": \"2023-11-08T08:45:29.334Z\",\n \"updated_at\": \"2023-12-18T20:31:44.770Z\",\n \"url\": \"https://fast.com\"\n}" } } } } }, "404": { "description": "If the monitor is not found, the API returns a 404 error." } } }, "put": { "tags": [ "synthetics" ], "summary": "Update a monitor", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/synthetics/monitors/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a monitor with the specified attributes. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\nYou can also partially update a monitor. This will only update the fields that are specified in the request body. All other fields are left unchanged. The specified fields should conform to the monitor type. For example, you can't update the `inline_scipt` field of a HTTP monitor.\n", "operationId": "put-synthetic-monitor", "parameters": [ { "name": "id", "in": "path", "description": "The identifier for the monitor that you want to update.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "oneOf": [ { "$ref": "#/components/schemas/Synthetics_browserMonitorFields" }, { "$ref": "#/components/schemas/Synthetics_httpMonitorFields" }, { "$ref": "#/components/schemas/Synthetics_icmpMonitorFields" }, { "$ref": "#/components/schemas/Synthetics_tcpMonitorFields" } ], "description": "The request body should contain the attributes of the monitor you want to update. The required and default fields differ depending on the monitor type.\n", "discriminator": { "propertyName": "type" } }, "examples": { "putSyntheticMonitorsRequestExample1": { "summary": "HTTP monitor", "description": "Update an HTTP monitor that checks a website's availability.", "value": "{\n \"type\": \"http\",\n \"name\": \"Website Availability\",\n \"url\": \"https://example.com\",\n \"tags\": [\"website\", \"availability\"],\n \"locations\": [\"united_kingdom\"]\n}" }, "putSyntheticMonitorsRequestExample2": { "summary": "TCP monitor", "description": "Update a TCP monitor that monitors a server's availability.", "value": "{\n \"type\": \"tcp\",\n \"name\": \"Server Availability\",\n \"host\": \"example.com\",\n \"private_locations\": [\"my_private_location\"]\n}" }, "putSyntheticMonitorsRequestExample3": { "summary": "ICMP monitor", "description": "Update an ICMP monitor that performs ping checks.", "value": "{\n \"type\": \"icmp\",\n \"name\": \"Ping Test\",\n \"host\": \"example.com\",\n \"locations\": [\"united_kingdom\"]\n}" }, "putSyntheticMonitorsRequestExample4": { "summary": "Browser monitor", "description": "Update a browser monitor that checks a website.", "value": "{\n \"type\": \"browser\",\n \"name\": \"Example journey\",\n \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n \"locations\": [\"united_kingdom\"]\n}" } } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/api/synthetics/params": { "get": { "tags": [ "synthetics" ], "summary": "Get parameters", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/synthetics/params
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all parameters. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "get-parameters", "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Synthetics_getParameterResponse" } }, "examples": { "getParametersResponseExample1": { "summary": "Read access", "description": "A successful response for a user with read-only permissions to get a list of parameters.", "value": "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"description\": \"Description for param1\",\n \"tags\": [\"tag1\", \"tag2\"],\n \"namespaces\": [\"namespace1\"]\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"description\": \"Description for param2\",\n \"tags\": [\"tag3\"],\n \"namespaces\": [\"namespace2\"]\n }\n]" }, "getParametersResponseExample2": { "summary": "Write access", "description": "A successful response for a user with write permissions to get a list of parameters.", "value": "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"description\": \"Description for param1\",\n \"tags\": [\"tag1\", \"tag2\"],\n \"namespaces\": [\"namespace1\"],\n \"value\": \"value1\"\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"description\": \"Description for param2\",\n \"tags\": [\"tag3\"],\n \"namespaces\": [\"namespace2\"],\n \"value\": \"value2\"\n }\n]" } } } } } } }, "post": { "tags": [ "synthetics" ], "summary": "Add parameters", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/synthetics/params
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nAdd one or more parameters to the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "post-parameters", "requestBody": { "description": "The request body can contain either a single parameter object or an array of parameter objects.", "content": { "application/json": { "schema": { "oneOf": [ { "type": "array", "items": { "$ref": "#/components/schemas/Synthetics_parameterRequest" } }, { "$ref": "#/components/schemas/Synthetics_parameterRequest" } ] }, "examples": { "postParametersRequestExample1": { "summary": "Single parameter", "description": "Add a single parameter.", "value": "{\n \"key\": \"your-key-name\",\n \"value\": \"your-parameter-value\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"share_across_spaces\": true\n}" }, "postParametersRequestExample2": { "summary": "Multiple parameters", "description": "Add multiple parameters.", "value": "[\n {\n \"key\": \"param1\",\n \"value\": \"value1\"\n },\n {\n \"key\": \"param2\",\n \"value\": \"value2\"\n }\n]" } } } }, "required": true }, "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "oneOf": [ { "type": "array", "items": { "$ref": "#/components/schemas/Synthetics_postParameterResponse" } }, { "$ref": "#/components/schemas/Synthetics_postParameterResponse" } ] }, "examples": { "postParametersResponseExample1": { "summary": "Single parameter", "description": "A successful response for a single added parameter.", "value": "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-key-name\",\n \"value\": \"your-param-value\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"share_across_spaces\": true\n}" }, "postParametersResponseExample2": { "summary": "Multiple parameters", "description": "A successful response for multiple added parameters.", "value": "[\n {\n \"id\": \"param1-id\",\n \"key\": \"param1\",\n \"value\": \"value1\"\n },\n {\n \"id\": \"param2-id\",\n \"key\": \"param2\",\n \"value\": \"value2\"\n }\n]" } } } } } } } }, "/api/synthetics/params/_bulk_delete": { "post": { "tags": [ "synthetics" ], "summary": "Delete parameters", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/synthetics/params/_bulk_delete
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete parameters from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "delete-parameters", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "An array of parameter IDs to delete." } } }, "examples": { "deleteParametersRequestExample1": { "description": "Run `POST /api/synthetics/params/_bulk_delete` to delete multiple parameters.", "value": "{\n \"ids\": [\"param1-id\", \"param2-id\"]\n}" } } } }, "required": true }, "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "deleted": { "type": "boolean", "description": "Indicates whether the parameter was successfully deleted. It is `true` if it was deleted. It is `false` if it was not deleted.\n" }, "id": { "type": "string", "description": "The unique identifier for the deleted parameter." } } } }, "examples": { "deleteParametersResponseExample1": { "value": "[\n {\n \"id\": \"param1-id\",\n \"deleted\": true\n }\n]" } } } } } } } }, "/api/synthetics/params/{id}": { "delete": { "tags": [ "synthetics" ], "summary": "Delete a parameter", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a parameter from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "delete-parameter", "parameters": [ { "name": "id", "in": "path", "description": "The ID for the parameter to delete.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "synthetics" ], "summary": "Get a parameter", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a parameter from the Synthetics app.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "get-parameter", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier for the parameter.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Synthetics_getParameterResponse" }, "examples": { "getParameterResponseExample1": { "summary": "Read access", "description": "A successful response for a user with read-only permissions to get a single parameter.", "value": "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-api-key\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"namespaces\": [\"namespace1\", \"namespace2\"]\n}" }, "getParameterResponseExample2": { "summary": "Write access", "description": "A successful response for a user with write permissions to get a single parameter.", "value": "{\n \"id\": \"unique-parameter-id\",\n \"key\": \"your-param-key\",\n \"description\": \"Param to use in browser monitor\",\n \"tags\": [\"authentication\", \"security\"],\n \"namespaces\": [\"namespace1\", \"namespace2\"],\n \"value\": \"your-param-value\"\n}" } } } } } } }, "put": { "tags": [ "synthetics" ], "summary": "Update a parameter", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/synthetics/params/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a parameter in the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n", "operationId": "put-parameter", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier for the parameter.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "description": "The request body cannot be empty; at least one attribute is required.", "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string", "description": "The updated description of the parameter." }, "key": { "type": "string", "description": "The key of the parameter." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of updated tags to categorize the parameter." }, "value": { "type": "string", "description": "The updated value associated with the parameter." } } }, "examples": { "putParameterRequestExample1": { "value": "{\n \"key\": \"updated_param_key\",\n \"value\": \"updated-param-value\",\n \"description\": \"Updated Param to be used in browser monitor\",\n \"tags\": [\"authentication\", \"security\", \"updated\"]\n}" } } } }, "required": true }, "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "putParameterResponseExample1": { "value": "{\n \"id\": \"param_id1\",\n \"key\": \"updated_param_key\",\n \"value\": \"updated-param-value\",\n \"description\": \"Updated Param to be used in browser monitor\",\n \"tags\": [\"authentication\", \"security\", \"updated\"]\n}" } } } } } } } }, "/api/synthetics/private_locations": { "get": { "tags": [ "synthetics" ], "summary": "Get private locations", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/synthetics/private_locations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of private locations.\nYou must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n", "operationId": "get-private-locations", "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Synthetics_getPrivateLocation" } }, "examples": { "getPrivateLocationsResponseExample1": { "value": "[\n {\n \"label\": \"Test private location\",\n \"id\": \"fleet-server-policy\",\n \"agentPolicyId\": \"fleet-server-policy\",\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"default\"\n },\n {\n \"label\": \"Test private location 2\",\n \"id\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n \"agentPolicyId\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"test\"\n }\n]" } } } } } } }, "post": { "tags": [ "synthetics" ], "summary": "Create a private location", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/synthetics/private_locations
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.", "operationId": "post-private-location", "requestBody": { "content": { "application/json": { "schema": { "required": [ "agentPolicyId", "label" ], "type": "object", "properties": { "agentPolicyId": { "type": "string", "description": "The ID of the agent policy associated with the private location." }, "geo": { "required": [ "lat", "lon" ], "type": "object", "properties": { "lat": { "type": "number", "description": "The latitude of the location." }, "lon": { "type": "number", "description": "The longitude of the location." } }, "description": "Geographic coordinates (WGS84) for the location." }, "label": { "type": "string", "description": "A label for the private location." }, "spaces": { "type": "array", "items": { "type": "string" }, "description": "An array of space IDs where the private location is available. If it is not provided, the private location is available in all spaces.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of tags to categorize the private location." } } }, "examples": { "postPrivateLocationRequestExample1": { "description": "Run `POST /api/private_locations` to create a private location.", "value": "{\n \"label\": \"Private Location 1\",\n \"agentPolicyId\": \"abcd1234\",\n \"tags\": [\"private\", \"testing\"],\n \"geo\": {\n \"lat\": 40.7128,\n \"lon\": -74.0060\n }\n \"spaces\": [\"default\"]\n}" } } } }, "required": true }, "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "postPrivateLocationResponseExample1": { "value": "{\n \"id\": \"abcd1234\",\n \"label\": \"Private Location 1\",\n \"agentPolicyId\": \"abcd1234\",\n \"tags\": [\"private\", \"testing\"],\n \"geo\": {\n \"lat\": 40.7128,\n \"lon\": -74.0060\n }\n}" } } } } }, "400": { "description": "If the `agentPolicyId` is already used by an existing private location or if the `label` already exists, the API will return a 400 Bad Request response with a corresponding error message." } } } }, "/api/synthetics/private_locations/{id}": { "delete": { "tags": [ "synthetics" ], "summary": "Delete a private location", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/synthetics/private_locations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nThe API does not return a response body for deletion, but it will return an appropriate status code upon successful deletion.\nA location cannot be deleted if it has associated monitors in use. You must delete all monitors associated with the location before deleting the location.\n", "operationId": "delete-private-location", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the private location to be deleted.", "required": true, "schema": { "maxLength": 1024, "minLength": 1, "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "synthetics" ], "summary": "Get a private location", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/synthetics/private_locations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n", "operationId": "get-private-location", "parameters": [ { "name": "id", "in": "path", "description": "A private location identifier or label.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Synthetics_getPrivateLocation" }, "examples": { "getPrivateLocationResponseExample1": { "value": "{\n \"label\": \"Test private location\",\n \"id\": \"test-private-location-id\",\n \"agentPolicyId\": \"test-private-location-id\",\n \"isServiceManaged\": false,\n \"isInvalid\": false,\n \"geo\": {\n \"lat\": 0,\n \"lon\": 0\n },\n \"namespace\": \"default\"\n}" } } } } } } }, "put": { "tags": [ "synthetics" ], "summary": "Update a private location", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/synthetics/private_locations/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing private location's label.\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nWhen a private location's label is updated, all monitors using this location will also be updated to maintain data consistency.\n", "operationId": "put-private-location", "parameters": [ { "name": "id", "in": "path", "description": "The unique identifier of the private location to be updated.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "required": [ "label" ], "type": "object", "properties": { "label": { "minLength": 1, "type": "string", "description": "A new label for the private location. Must be at least 1 character long." } } }, "examples": { "putPrivateLocationRequestExample1": { "description": "Update a private location's label.", "value": "{\n \"label\": \"Updated Private Location Name\"\n}" } } } }, "required": true }, "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Synthetics_getPrivateLocation" }, "examples": { "putPrivateLocationResponseExample1": { "value": "{\n \"label\": \"Updated Private Location Name\",\n \"id\": \"test-private-location-id\",\n \"agentPolicyId\": \"test-private-location-id\",\n \"isServiceManaged\": false,\n \"isInvalid\": false,\n \"tags\": [\"private\", \"testing\", \"updated\"],\n \"geo\": {\n \"lat\": 37.7749,\n \"lon\": -122.4194\n },\n \"spaces\": [\"*\"]\n}" } } } } }, "400": { "description": "If the `label` is shorter than 1 character the API will return a 400 Bad Request response with a corresponding error message." }, "404": { "description": "If the private location with the specified ID does not exist, the API will return a 404 Not Found response." } } } }, "/api/task_manager/_health": { "get": { "tags": [ "task manager" ], "summary": "Get the task manager health", "description": "Get the health status of the Kibana task manager.\n", "operationId": "task-manager-health", "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Task_manager_health_APIs_health_response" }, "examples": { "taskManagerHealthResponse1": { "$ref": "#/components/examples/Task_manager_health_APIs_health_200response" } } } } } } } }, "/api/timeline": { "delete": { "tags": [ "Security Timeline API" ], "summary": "Delete Timelines or Timeline templates", "description": "**Spaces method and path for this operation:**\n\n
delete /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete one or more Timelines or Timeline templates.", "operationId": "DeleteTimelines", "requestBody": { "description": "The IDs of the Timelines or Timeline templates to delete.", "content": { "application/json": { "schema": { "required": [ "savedObjectIds" ], "type": "object", "properties": { "savedObjectIds": { "maxItems": 100, "type": "array", "items": { "type": "string" }, "description": "The list of IDs of the Timelines or Timeline templates to delete", "example": [ "15c1929b-0af7-42bd-85a8-56e234cc7c4e" ] }, "searchIds": { "maxItems": 100, "type": "array", "items": { "type": "string" }, "description": "Saved search IDs that should be deleted alongside the timelines", "example": [ "23f3-43g34g322-e5g5hrh6h-45454", "6ce1b592-84e3-4b4a-9552-f189d4b82075" ] } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the Timeline was successfully deleted.", "content": { "application/json": { "schema": { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "deleteTimeline" ], "type": "object", "properties": { "deleteTimeline": { "type": "boolean" } } } } } } } } } }, "get": { "tags": [ "Security Timeline API" ], "summary": "Get Timeline or Timeline template details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of an existing saved Timeline or Timeline template.", "operationId": "GetTimeline", "parameters": [ { "name": "template_timeline_id", "in": "query", "description": "The `savedObjectId` of the template timeline to retrieve", "schema": { "type": "string" } }, { "name": "id", "in": "query", "description": "The `savedObjectId` of the Timeline to retrieve.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates that the (template) Timeline was found and returned.", "content": { "application/json": { "schema": { "oneOf": [ { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "getOneTimeline" ], "type": "object", "properties": { "getOneTimeline": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse" } } } } }, { "type": "object", "additionalProperties": false } ] } } } } } }, "patch": { "tags": [ "Security Timeline API" ], "summary": "Update a Timeline", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate an existing Timeline. You can update the title, description, date range, pinned events, pinned queries, and/or pinned saved queries of an existing Timeline.", "operationId": "PatchTimeline", "requestBody": { "description": "The Timeline updates, along with the Timeline ID and version.", "content": { "application/json": { "schema": { "required": [ "timelineId", "version", "timeline" ], "type": "object", "properties": { "timeline": { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, "timelineId": { "type": [ "null", "string" ], "description": "The `savedObjectId` of the Timeline or Timeline template that you’re updating.", "example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e" }, "version": { "type": [ "null", "string" ], "description": "The version of the Timeline or Timeline template that you’re updating.", "example": "WzE0LDFd" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates that the Timeline was successfully updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_PersistTimelineResponse" } } } }, "405": { "description": "Indicates that the user does not have the required access to create a Timeline.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "The error message", "example": "update timeline error" }, "statusCode": { "type": "number", "example": 405 } } } } } } } }, "post": { "tags": [ "Security Timeline API" ], "summary": "Create a Timeline or Timeline template", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/timeline
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a new Timeline or Timeline template.", "operationId": "CreateTimelines", "requestBody": { "description": "The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.", "content": { "application/json": { "schema": { "required": [ "timeline" ], "type": "object", "properties": { "status": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineStatus" }, "templateTimelineId": { "type": [ "null", "string" ], "description": "A unique identifier for the Timeline template.", "example": "6ce1b592-84e3-4b4a-9552-f189d4b82075" }, "templateTimelineVersion": { "type": [ "null", "number" ], "description": "Timeline template version number.", "example": 12 }, "timeline": { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, "timelineId": { "type": [ "null", "string" ], "description": "A unique identifier for the Timeline.", "example": "6ce1b592-84e3-4b4a-9552-f189d4b82075" }, "timelineType": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" }, "version": { "type": [ "null", "string" ] } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the Timeline was successfully created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_PersistTimelineResponse" } } } }, "405": { "description": "Indicates that there was an error in the Timeline creation.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "The error message", "example": "update timeline error" }, "statusCode": { "type": "number", "example": 405 } } } } } } } } }, "/api/timeline/_copy": { "get": { "tags": [ "Security Timeline API" ], "summary": "Copies timeline or timeline template", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/timeline/_copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCopies and returns a timeline or timeline template.\n", "operationId": "CopyTimeline", "requestBody": { "content": { "application/json": { "schema": { "required": [ "timeline", "timelineIdToCopy" ], "type": "object", "properties": { "timeline": { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, "timelineIdToCopy": { "type": "string" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates that the timeline has been successfully copied.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_PersistTimelineResponse" } } } } } } }, "/api/timeline/_draft": { "get": { "tags": [ "Security Timeline API" ], "summary": "Get draft Timeline or Timeline template details", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/timeline/_draft
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned.", "operationId": "GetDraftTimelines", "parameters": [ { "name": "timelineType", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" } } ], "responses": { "200": { "description": "Indicates that the draft Timeline was successfully retrieved.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_PersistTimelineResponse" } } } }, "403": { "description": "If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "number" } } } } } }, "409": { "description": "This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given `timelineId`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "number" } } } } } } } }, "post": { "tags": [ "Security Timeline API" ], "summary": "Create a clean draft Timeline or Timeline template", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/timeline/_draft
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a clean draft Timeline or Timeline template for the current user.\n> info\n> If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.\n", "operationId": "CleanDraftTimelines", "requestBody": { "description": "The type of Timeline to create. Valid values are `default` and `template`.", "content": { "application/json": { "schema": { "required": [ "timelineType" ], "type": "object", "properties": { "timelineType": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates that the draft Timeline was successfully created. In the event the user already has a draft Timeline, the existing draft Timeline is cleared and returned.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_PersistTimelineResponse" } } } }, "403": { "description": "Indicates that the user does not have the required permissions to create a draft Timeline.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "number" } } } } } }, "409": { "description": "Indicates that there is already a draft Timeline with the given `timelineId`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "number" } } } } } } } } }, "/api/timeline/_export": { "post": { "tags": [ "Security Timeline API" ], "summary": "Export Timelines", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/timeline/_export
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nExport Timelines as an NDJSON file.", "operationId": "ExportTimelines", "parameters": [ { "name": "file_name", "in": "query", "description": "The name of the file to export", "required": true, "schema": { "type": "string" } } ], "requestBody": { "description": "The IDs of the Timelines to export.", "content": { "application/json": { "schema": { "type": "object", "properties": { "ids": { "maxItems": 1000, "minItems": 1, "type": [ "null", "array" ], "items": { "type": "string" } } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the Timelines were successfully exported.", "content": { "application/ndjson": { "schema": { "type": "string", "description": "NDJSON of the exported Timelines" } } } }, "400": { "description": "Indicates that the export size limit was exceeded.", "content": { "application/ndjson": { "schema": { "type": "object", "properties": { "body": { "type": "string" }, "statusCode": { "type": "number" } } } } } } } } }, "/api/timeline/_favorite": { "patch": { "tags": [ "Security Timeline API" ], "summary": "Favorite a Timeline or Timeline template", "description": "**Spaces method and path for this operation:**\n\n
patch /s/{space_id}/api/timeline/_favorite
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nFavorite a Timeline or Timeline template for the current user.", "operationId": "PersistFavoriteRoute", "requestBody": { "description": "The required fields used to favorite a (template) Timeline.", "content": { "application/json": { "schema": { "required": [ "timelineId", "templateTimelineId", "templateTimelineVersion", "timelineType" ], "type": "object", "properties": { "templateTimelineId": { "type": [ "null", "string" ] }, "templateTimelineVersion": { "type": [ "null", "number" ] }, "timelineId": { "type": [ "null", "string" ] }, "timelineType": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the favorite status was successfully updated.", "content": { "application/json": { "schema": { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "persistFavorite" ], "type": "object", "properties": { "persistFavorite": { "$ref": "#/components/schemas/Security_Timeline_API_FavoriteTimelineResponse" } } } } } } } }, "403": { "description": "Indicates the user does not have the required permissions to persist the favorite status.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string" }, "statusCode": { "type": "number" } } } } } } } } }, "/api/timeline/_import": { "post": { "tags": [ "Security Timeline API" ], "summary": "Import Timelines", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/timeline/_import
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nImport Timelines.", "operationId": "ImportTimelines", "requestBody": { "description": "The Timelines to import as a readable stream.", "content": { "application/json": { "schema": { "required": [ "file" ], "type": "object", "properties": { "file": { }, "isImmutable": { "enum": [ "true", "false" ], "type": "string", "description": "Whether the Timeline should be immutable" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the import of Timelines was successful.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_ImportTimelineResult" } } } }, "400": { "description": "Indicates the import of Timelines was unsuccessful because of an invalid file extension.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "The error message", "example": "Invalid file extension" }, "statusCode": { "type": "number", "example": 400 } } } } } }, "404": { "description": "Indicates that we were unable to locate the saved object client necessary to handle the import.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "The error message", "example": "Unable to find saved object client" }, "statusCode": { "type": "number", "example": 404 } } } } } }, "409": { "description": "Indicates the import of Timelines was unsuccessful.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "The error message", "example": "Could not import timelines" }, "statusCode": { "type": "number", "example": 409 } } } } } } } } }, "/api/timeline/_prepackaged": { "post": { "tags": [ "Security Timeline API" ], "summary": "Install prepackaged Timelines", "description": "**Spaces method and path for this operation:**\n\n
post /s/{space_id}/api/timeline/_prepackaged
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nInstall or update prepackaged Timelines.", "operationId": "InstallPrepackedTimelines", "requestBody": { "description": "The Timelines to install or update.", "content": { "application/json": { "schema": { "required": [ "timelinesToInstall", "timelinesToUpdate", "prepackagedTimelines" ], "type": "object", "properties": { "prepackagedTimelines": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject" } }, "timelinesToInstall": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_ImportTimelines" } }, "timelinesToUpdate": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_ImportTimelines" } } } } } }, "required": true }, "responses": { "200": { "description": "Indicates the installation of prepackaged Timelines was successful.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Security_Timeline_API_ImportTimelineResult" } } } }, "500": { "description": "Indicates the installation of prepackaged Timelines was unsuccessful.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string" }, "statusCode": { "type": "number" } } } } } } } } }, "/api/timeline/resolve": { "get": { "tags": [ "Security Timeline API" ], "summary": "Get an existing saved Timeline or Timeline template", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/timeline/resolve
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.", "operationId": "ResolveTimeline", "parameters": [ { "name": "template_timeline_id", "in": "query", "description": "The ID of the template timeline to resolve", "schema": { "type": "string" } }, { "name": "id", "in": "query", "description": "The ID of the timeline to resolve", "schema": { "type": "string" } } ], "responses": { "200": { "description": "The (template) Timeline has been found", "content": { "application/json": { "schema": { "oneOf": [ { "required": [ "data" ], "type": "object", "properties": { "data": { "$ref": "#/components/schemas/Security_Timeline_API_ResolvedTimeline" } } }, { "type": "object", "additionalProperties": false } ] } } } }, "400": { "description": "The request is missing parameters" }, "404": { "description": "The (template) Timeline was not found" } } } }, "/api/timelines": { "get": { "tags": [ "Security Timeline API" ], "summary": "Get Timelines or Timeline templates", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/timelines
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all saved Timelines or Timeline templates.", "operationId": "GetTimelines", "parameters": [ { "name": "only_user_favorite", "in": "query", "description": "If true, only timelines that are marked as favorites by the user are returned.", "schema": { "enum": [ "true", "false" ], "type": [ "null", "string" ] } }, { "name": "timeline_type", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" } }, { "name": "sort_field", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Timeline_API_SortFieldTimeline" } }, { "name": "sort_order", "in": "query", "description": "Whether to sort the results `ascending` or `descending`", "schema": { "enum": [ "asc", "desc" ], "type": "string" } }, { "name": "page_size", "in": "query", "description": "How many results should returned at once", "schema": { "type": [ "null", "string" ] } }, { "name": "page_index", "in": "query", "description": "How many pages should be skipped", "schema": { "type": [ "null", "string" ] } }, { "name": "search", "in": "query", "description": "Allows to search for timelines by their title", "schema": { "type": [ "null", "string" ] } }, { "name": "status", "in": "query", "schema": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineStatus" } } ], "responses": { "200": { "description": "Indicates that the (template) Timelines were found and returned.", "content": { "application/json": { "schema": { "required": [ "timeline", "totalCount" ], "type": "object", "properties": { "customTemplateTimelineCount": { "type": "number", "description": "The amount of custom Timeline templates in the results", "example": 2 }, "defaultTimelineCount": { "type": "number", "description": "The amount of `default` type Timelines in the results", "example": 90 }, "elasticTemplateTimelineCount": { "type": "number", "description": "The amount of Elastic's Timeline templates in the results", "example": 8 }, "favoriteCount": { "type": "number", "description": "The amount of favorited Timelines", "example": 5 }, "templateTimelineCount": { "type": "number", "description": "The amount of Timeline templates in the results", "example": 10 }, "timeline": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse" } }, "totalCount": { "type": "number", "description": "The total amount of results", "example": 100 } } } } } }, "400": { "description": "Bad request. The user supplied invalid data.", "content": { "application/json": { "schema": { "type": "object", "properties": { "body": { "type": "string", "description": "The error message", "example": "get timeline error" }, "statusCode": { "type": "number", "example": 405 } } } } } } } } }, "/api/upgrade_assistant/reindex/{index}": { "get": { "tags": [ "upgrade" ], "summary": "Get the reindex status", "description": "Check the status of the reindex task.\n", "operationId": "get-upgrade-reindex", "parameters": [ { "name": "index", "in": "path", "description": "The name of the index that is reindexing.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "hasRequiredPrivileges": { "type": "boolean", "description": "Specifies whether the user has sufficient privileges to reindex this index. When security is unavailable or disabled, it is `true`.\n" }, "reindexOp": { "type": "object", "properties": { "errorMessage": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_errorMessage" }, "indexName": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_indexName" }, "lastCompletedStep": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep" }, "newIndexName": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_newIndexName" }, "reindexTaskId": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskId" }, "reindexTaskPercComplete": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete" }, "status": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_status" } } }, "warnings": { "type": "array", "description": "An array of any warning codes that explain what changes are required for this reindex. For example:\n- `0` specifies to remove the `_all` meta field. - `1` specifies to convert any coerced boolean values in the source document. For example, `yes`, `1`, and `off`. - `2` specifies to convert documents to support Elastic Common Schema. Applies only to APM indices created in 6.x.\n" } } }, "examples": { "getUpgradeReindexResponseExample1": { "value": "{\n \"reindexOp\": {\n \"indexName\": \".ml-state\",\n \"newIndexName\": \".reindexed-v7-ml-state\", \n \"status\": 0, \n \"lastCompletedStep\": 40, \n \"reindexTaskId\": \"QprwvTMzRQ2MLWOW22oQ4Q:11819\", \n \"reindexTaskPercComplete\": 0.3, \n \"errorMessage\": null \n },\n \"warnings\": [], \n \"hasRequiredPrivileges\": true \n}" } } } } } }, "x-state": "Technical Preview" }, "post": { "tags": [ "upgrade" ], "summary": "Start or resume reindexing", "description": "Start a new reindex or resume a paused reindex.\nThe following steps are performed during a reindex task:\n\n1. Set the index to read-only.\n1. Create a new index.\n1. Reindex documents into the new index.\n1. Create an index alias for the new index.\n1. Delete the old index.\n", "operationId": "start-upgrade-reindex", "parameters": [ { "name": "index", "in": "path", "description": "The name of the index to reindex.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "errorMessage": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_errorMessage" }, "indexName": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_indexName" }, "lastCompletedStep": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep" }, "newIndexName": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_newIndexName" }, "reindexTaskId": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskId" }, "reindexTaskPercComplete": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete" }, "status": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_status" } } }, "examples": { "startUpgradeReindexResponseExample1": { "value": "{\n \"indexName\": \".ml-state\",\n \"newIndexName\": \".reindexed-v7-ml-state\", \n \"status\": 0, \n \"lastCompletedStep\": 0, \n \"reindexTaskId\": null, \n \"reindexTaskPercComplete\": null, \n \"errorMessage\": null \n}" } } } } } }, "x-state": "Technical Preview" } }, "/api/upgrade_assistant/reindex/{index}/cancel": { "post": { "tags": [ "upgrade" ], "summary": "Cancel reindexing", "description": "Cancel reindexes that are waiting for the Elasticsearch reindex task to complete. For example, cancel reindexing if the `lastCompletedStep` has the value `40`.\n", "operationId": "cancel-upgrade-reindex", "parameters": [ { "name": "index", "in": "path", "description": "The name of the index that was reindexing.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "acknowledged": { "type": "boolean" } } }, "examples": { "cancelUpgradeReindexResponseExample1": { "value": "{\n \"acknowledged\": true\n}" } } } } } }, "x-state": "Technical Preview" } }, "/api/upgrade_assistant/reindex/batch": { "post": { "tags": [ "upgrade" ], "summary": "Batch start or resume reindexing", "description": "Start or resume multiple reindexing tasks in one request. Additionally, reindexing tasks started or resumed via the batch endpoint will be placed on a queue and run one-by-one, which ensures that minimal cluster resources are consumed over time.\n", "operationId": "batch-start-upgrade-reindex", "requestBody": { "content": { "application/json": { "schema": { "required": [ "indexNames" ], "type": "object", "properties": { "indexNames": { "type": "array", "items": { "type": "string" }, "description": "The list of index names to be reindexed. The order of the indices determines the order that the reindex tasks are run.\n" } } } } }, "required": true }, "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "enqueued": { "type": "array", "items": { "type": "object", "properties": { "errorMessage": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_errorMessage" }, "indexName": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_indexName" }, "lastCompletedStep": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep" }, "locked": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_locked" }, "reindexOptions": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexOptions" }, "reindexTaskId": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskId" }, "reindexTaskPercComplete": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete" }, "runningReindexCount": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_runningReindexCount" } } }, "description": "A list of reindex tasks created. The order in the array indicates the order in which tasks will be run.\n" }, "errors": { "type": "array", "items": { "type": "object" }, "description": "A list of errors that may have occurred preventing the reindex task from being created.\n" } } }, "examples": { "batchStartUpgradeReindexResponseExample1": { "value": "{\n \"enqueued\": [ \n {\n \"indexName\": \"index1\",\n \"newIndexName\": \"reindexed-v8-index1\",\n \"status\": 3,\n \"lastCompletedStep\": 0,\n \"locked\": null,\n \"reindexTaskId\": null,\n \"reindexTaskPercComplete\": null,\n \"errorMessage\": null,\n \"runningReindexCount\": null,\n \"reindexOptions\": { \n \"queueSettings\": {\n \"queuedAt\": 1583406985489 \n }\n }\n }\n ],\n \"errors\": [ \n {\n \"indexName\": \"index2\",\n \"message\": \"Something went wrong!\"\n }\n ]\n}" } } } } } }, "x-state": "Technical Preview" } }, "/api/upgrade_assistant/reindex/batch/queue": { "get": { "tags": [ "upgrade" ], "summary": "Get the batch reindex queue", "description": "Check the current reindex batch queue.\n", "operationId": "get-batch-upgrade-reindex", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", "properties": { "queue": { "type": "array", "items": { "type": "object", "properties": { "errorMessage": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_errorMessage" }, "indexName": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_indexName" }, "lastCompletedStep": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_lastCompletedStep" }, "locked": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_locked" }, "reindexOptions": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexOptions" }, "reindexTaskId": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskId" }, "reindexTaskPercComplete": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_reindexTaskPercComplete" }, "runningReindexCount": { "$ref": "#/components/schemas/Upgrade_assistant_APIs_runningReindexCount" } } }, "description": "Items in this array indicate reindex tasks at a given point in time and the order in which they will be run.\n" } } }, "examples": { "getBatchUpgradeReindexResponseExample1": { "value": "{\n \"queue\": [ \n {\n \"indexName\": \"index1\",\n \"newIndexName\": \"reindexed-v8-index2\",\n \"status\": 3,\n \"lastCompletedStep\": 0,\n \"locked\": null,\n \"reindexTaskId\": null,\n \"reindexTaskPercComplete\": null,\n \"errorMessage\": null,\n \"runningReindexCount\": null,\n \"reindexOptions\": {\n \"queueSettings\": {\n \"queuedAt\": 1583406985489\n }\n }\n },\n {\n \"indexName\": \"index2\",\n \"newIndexName\": \"reindexed-v8-index2\",\n \"status\": 3,\n \"lastCompletedStep\": 0,\n \"locked\": null,\n \"reindexTaskId\": null,\n \"reindexTaskPercComplete\": null,\n \"errorMessage\": null,\n \"runningReindexCount\": null,\n \"reindexOptions\": {\n \"queueSettings\": {\n \"queuedAt\": 1583406987334\n }\n }\n }\n ]\n}" } } } } } }, "x-state": "Technical Preview" } }, "/api/upgrade_assistant/status": { "get": { "tags": [ "upgrade" ], "summary": "Get the upgrade readiness status", "description": "Check the status of your cluster.", "operationId": "get-upgrade-status", "responses": { "200": { "description": "Indicates a successful call.", "content": { "application/json": { "examples": { "getUpgradeStatusResponseExample1": { "value": "{\n \"readyForUpgrade\": false,\n \"cluster\": [\n {\n \"message\": \"Cluster deprecated issue\",\n \"details\":\"You have 2 system indices that must be migrated and 5 Elasticsearch deprecation issues and 0 Kibana deprecation issues that must be resolved before upgrading.\"\n }\n ]\n}" } } } } } }, "x-state": "Technical Preview" } }, "/api/uptime/settings": { "get": { "tags": [ "uptime" ], "summary": "Get uptime settings", "description": "**Spaces method and path for this operation:**\n\n
get /s/{space_id}/api/uptime/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nYou must have `read` privileges for the uptime feature in the Observability section of the Kibana feature privileges.\n", "operationId": "get-uptime-settings", "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "getUptimeSettingsResponseExample1": { "value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}" } } } } } } }, "put": { "tags": [ "uptime" ], "summary": "Update uptime settings", "description": "**Spaces method and path for this operation:**\n\n
put /s/{space_id}/api/uptime/settings
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate uptime setting attributes like `heartbeatIndices`, `certExpirationThreshold`, `certAgeThreshold`, `defaultConnectors`, or `defaultEmail`. You must have `all` privileges for the uptime feature in the Observability section of the Kibana feature privileges. A partial update is supported, provided settings keys will be merged with existing settings.\n", "operationId": "put-uptime-settings", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "certAgeThreshold": { "type": "number", "description": "The number of days after a certificate is created to trigger an alert.", "default": 730 }, "certExpirationThreshold": { "type": "number", "description": "The number of days before a certificate expires to trigger an alert.", "default": 30 }, "defaultConnectors": { "type": "array", "description": "A list of connector IDs to be used as default connectors for new alerts.", "default": [ ] }, "defaultEmail": { "type": "object", "properties": { "bcc": { "type": "array", "items": { "type": "string" }, "default": [ ] }, "cc": { "type": "array", "items": { "type": "string" }, "default": [ ] }, "to": { "type": "array", "items": { "type": "string" }, "default": [ ] } }, "description": "The default email configuration for new alerts.\n" }, "heartbeatIndices": { "type": "string", "description": "An index pattern string to be used within the Uptime app and alerts to query Heartbeat data. \n", "default": "heartbeat-*" } } }, "examples": { "putUptimeSettingsRequestExample1": { "summary": "Update multiple settings", "description": "Run `PUT api/uptime/settings` to update multiple Uptime settings.", "value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}" }, "putUptimeSettingsRequestExample2": { "summary": "Update a setting", "description": "Run `PUT api/uptime/settings` to update a single Uptime setting.", "value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n}" } } } } }, "responses": { "200": { "description": "Indicates a successful call", "content": { "application/json": { "schema": { "type": "object" }, "examples": { "putUptimeSettingsResponseExample1": { "description": "A successful response from `PUT api/uptime/settings`.", "value": "{\n \"heartbeatIndices\": \"heartbeat-8*\",\n \"certExpirationThreshold\": 30,\n \"certAgeThreshold\": 730,\n \"defaultConnectors\": [\n \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n \"db25f830-2318-11ee-9391-6b0c030836d6\"\n ],\n \"defaultEmail\": {\n \"to\": [],\n \"cc\": [],\n \"bcc\": []\n }\n}" } } } } } } } }, "/s/{spaceId}/api/observability/slos": { "get": { "tags": [ "slo" ], "summary": "Get a paginated list of SLOs", "description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "findSlosOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "name": "kqlQuery", "in": "query", "description": "A valid kql query to filter the SLO with", "schema": { "type": "string" }, "example": "slo.name:latency* and slo.tags : \"prod\"" }, { "name": "size", "in": "query", "description": "The page size to use for cursor-based pagination, must be greater or equal than 1", "schema": { "type": "integer", "default": 1 }, "example": 1 }, { "name": "searchAfter", "in": "query", "description": "The cursor to use for fetching the results from, when using a cursor-base pagination.", "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "page", "in": "query", "description": "The page to use for pagination, must be greater or equal than 1", "schema": { "type": "integer", "default": 1 }, "example": 1 }, { "name": "perPage", "in": "query", "description": "Number of SLOs returned by page", "schema": { "maximum": 5000, "type": "integer", "default": 25 }, "example": 25 }, { "name": "sortBy", "in": "query", "description": "Sort by field", "schema": { "enum": [ "sli_value", "status", "error_budget_consumed", "error_budget_remaining" ], "type": "string", "default": "status" }, "example": "status" }, { "name": "sortDirection", "in": "query", "description": "Sort order", "schema": { "enum": [ "asc", "desc" ], "type": "string", "default": "asc" }, "example": "asc" }, { "name": "hideStale", "in": "query", "description": "Hide stale SLOs from the list as defined by stale SLO threshold in SLO settings", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_find_slo_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } }, "post": { "tags": [ "slo" ], "summary": "Create an SLO", "description": "You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "createSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_create_slo_request" } } }, "required": true }, "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_create_slo_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "409": { "description": "Conflict - The SLO id already exists", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_409_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/_bulk_delete": { "post": { "tags": [ "slo" ], "summary": "Bulk delete SLO definitions and their associated summary and rollup data.", "description": "Bulk delete SLO definitions and their associated summary and rollup data. This endpoint initiates a bulk deletion operation for SLOs, which may take some time to complete. The status of the operation can be checked using the `GET /api/slo/_bulk_delete/{taskId}` endpoint.\n", "operationId": "bulkDeleteOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_bulk_delete_request" } } }, "required": true }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_bulk_delete_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/_bulk_delete/{taskId}": { "get": { "tags": [ "slo" ], "summary": "Retrieve the status of the bulk deletion", "description": "Retrieve the status of the bulk deletion operation for SLOs. This endpoint returns the status of the bulk deletion operation, including whether it is completed and the results of the operation.\n", "operationId": "bulkDeleteStatusOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "name": "taskId", "in": "path", "description": "The task id of the bulk delete operation", "required": true, "schema": { "type": "string", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_bulk_delete_status_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/_bulk_purge_rollup": { "post": { "tags": [ "slo" ], "summary": "Batch delete rollup and summary data", "description": "The deletion occurs for the specified list of `sloId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "deleteRollupDataOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_bulk_purge_rollup_request" } } }, "required": true }, "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_bulk_purge_rollup_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/_delete_instances": { "post": { "tags": [ "slo" ], "summary": "Batch delete rollup and summary data", "description": "The deletion occurs for the specified list of `sloId` and `instanceId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "deleteSloInstancesOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_delete_slo_instances_request" } } }, "required": true }, "responses": { "204": { "description": "Successful request" }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/{sloId}": { "delete": { "tags": [ "slo" ], "summary": "Delete an SLO", "description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "deleteSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "$ref": "#/components/parameters/SLOs_slo_id" } ], "responses": { "204": { "description": "Successful request" }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } }, "get": { "tags": [ "slo" ], "summary": "Get an SLO", "description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "getSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "$ref": "#/components/parameters/SLOs_slo_id" }, { "name": "instanceId", "in": "query", "description": "the specific instanceId used by the summary calculation", "schema": { "type": "string" }, "example": "host-abcde" } ], "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_slo_with_summary_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } }, "put": { "tags": [ "slo" ], "summary": "Update an SLO", "description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "updateSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "$ref": "#/components/parameters/SLOs_slo_id" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_update_slo_request" } } }, "required": true }, "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_slo_definition_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/{sloId}/_reset": { "post": { "tags": [ "slo" ], "summary": "Reset an SLO", "description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "resetSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "$ref": "#/components/parameters/SLOs_slo_id" } ], "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_slo_definition_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/{sloId}/disable": { "post": { "tags": [ "slo" ], "summary": "Disable an SLO", "description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "disableSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "$ref": "#/components/parameters/SLOs_slo_id" } ], "responses": { "204": { "description": "Successful request" }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } } }, "/s/{spaceId}/api/observability/slos/{sloId}/enable": { "post": { "tags": [ "slo" ], "summary": "Enable an SLO", "description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "enableSloOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "$ref": "#/components/parameters/SLOs_slo_id" } ], "responses": { "204": { "description": "Successful request" }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } }, "404": { "description": "Not found response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_404_response" } } } } } } }, "/s/{spaceId}/internal/observability/slos/_definitions": { "get": { "tags": [ "slo" ], "summary": "Get the SLO definitions", "description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n", "operationId": "getDefinitionsOp", "parameters": [ { "$ref": "#/components/parameters/SLOs_kbn_xsrf" }, { "$ref": "#/components/parameters/SLOs_space_id" }, { "name": "includeOutdatedOnly", "in": "query", "description": "Indicates if the API returns only outdated SLO or all SLO definitions", "schema": { "type": "boolean" }, "example": true }, { "name": "tags", "in": "query", "description": "Filters the SLOs by tag", "schema": { "type": "string" } }, { "name": "search", "in": "query", "description": "Filters the SLOs by name", "schema": { "type": "string" }, "example": "my service availability" }, { "name": "page", "in": "query", "description": "The page to use for pagination, must be greater or equal than 1", "schema": { "type": "number" }, "example": 1 }, { "name": "perPage", "in": "query", "description": "Number of SLOs returned by page", "schema": { "maximum": 1000, "type": "integer", "default": 100 }, "example": 100 } ], "responses": { "200": { "description": "Successful request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_find_slo_definitions_response" } } } }, "400": { "description": "Bad request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_400_response" } } } }, "401": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_401_response" } } } }, "403": { "description": "Unauthorized response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SLOs_403_response" } } } } } } } }, "components": { "schemas": { "Alerting_401_response": { "title": "Unsuccessful rule API response", "type": "object", "properties": { "error": { "enum": [ "Unauthorized" ], "type": "string", "example": "Unauthorized" }, "message": { "type": "string" }, "statusCode": { "enum": [ 401 ], "type": "integer", "example": 401 } } }, "Alerting_alert_response_properties": { "title": "Legacy alert response properties", "type": "object", "properties": { "actions": { "type": "array", "items": { "type": "object" } }, "alertTypeId": { "type": "string", "example": ".index-threshold" }, "apiKeyOwner": { "type": [ "null", "string" ], "example": "elastic" }, "createdAt": { "type": "string", "description": "The date and time that the alert was created.", "format": "date-time", "example": "2022-12-05T23:36:58.284Z" }, "createdBy": { "type": "string", "description": "The identifier for the user that created the alert.", "example": "elastic" }, "enabled": { "type": "boolean", "description": "Indicates whether the alert is currently enabled.", "example": true }, "executionStatus": { "type": "object", "properties": { "lastExecutionDate": { "type": "string", "format": "date-time", "example": "2022-12-06T00:13:43.890Z" }, "status": { "type": "string", "example": "ok" } } }, "id": { "type": "string", "description": "The identifier for the alert.", "example": "b530fed0-74f5-11ed-9801-35303b735aef" }, "muteAll": { "type": "boolean", "example": false }, "mutedInstanceIds": { "type": [ "null", "array" ], "items": { "type": "string" } }, "name": { "type": "string", "description": "The name of the alert.", "example": "my alert" }, "notifyWhen": { "type": "string", "example": "onActionGroupChange" }, "params": { "type": "object" }, "schedule": { "type": "object", "properties": { "interval": { "type": "string" } } }, "scheduledTaskId": { "type": "string", "example": "b530fed0-74f5-11ed-9801-35303b735aef" }, "tags": { "type": "array", "items": { "type": "string" } }, "throttle": { "type": [ "null", "string" ] }, "updatedAt": { "type": "string", "example": "2022-12-05T23:36:58.284Z" }, "updatedBy": { "type": [ "null", "string" ], "description": "The identifier for the user that updated this alert most recently.", "example": "elastic" } } }, "Alerting_fieldmap_properties": { "title": "Field map objects in the get rule types response", "type": "object", "properties": { "array": { "type": "boolean", "description": "Indicates whether the field is an array." }, "dynamic": { "type": "boolean", "description": "Indicates whether it is a dynamic field mapping." }, "format": { "type": "string", "description": "Indicates the format of the field. For example, if the `type` is `date_range`, the `format` can be `epoch_millis||strict_date_optional_time`.\n" }, "ignore_above": { "type": "integer", "description": "Specifies the maximum length of a string field. Longer strings are not indexed or stored." }, "index": { "type": "boolean", "description": "Indicates whether field values are indexed." }, "path": { "type": "string", "description": "TBD" }, "properties": { "type": "object", "additionalProperties": { "type": "object", "properties": { "type": { "type": "string", "description": "The data type for each object property." } } }, "description": "Details about the object properties. This property is applicable when `type` is `object`.\n" }, "required": { "type": "boolean", "description": "Indicates whether the field is required." }, "scaling_factor": { "type": "integer", "description": "The scaling factor to use when encoding values. This property is applicable when `type` is `scaled_float`. Values will be multiplied by this factor at index time and rounded to the closest long value. \n" }, "type": { "type": "string", "description": "Specifies the data type for the field.", "example": "scaled_float" } } }, "APM_UI_400_response": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type", "example": "Not Found" }, "message": { "type": "string", "description": "Error message", "example": "Not Found" }, "statusCode": { "type": "number", "description": "Error status code", "example": 400 } } }, "APM_UI_401_response": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type", "example": "Unauthorized" }, "message": { "type": "string", "description": "Error message" }, "statusCode": { "type": "number", "description": "Error status code", "example": 401 } } }, "APM_UI_403_response": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type", "example": "Forbidden" }, "message": { "type": "string", "description": "Error message" }, "statusCode": { "type": "number", "description": "Error status code", "example": 403 } } }, "APM_UI_404_response": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type", "example": "Not Found" }, "message": { "type": "string", "description": "Error message", "example": "Not Found" }, "statusCode": { "type": "number", "description": "Error status code", "example": 404 } } }, "APM_UI_500_response": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type", "example": "Internal Server Error" }, "message": { "type": "string", "description": "Error message" }, "statusCode": { "type": "number", "description": "Error status code", "example": 500 } } }, "APM_UI_501_response": { "type": "object", "properties": { "error": { "type": "string", "description": "Error type", "example": "Not Implemented" }, "message": { "type": "string", "description": "Error message", "example": "Not Implemented" }, "statusCode": { "type": "number", "description": "Error status code", "example": 501 } } }, "APM_UI_agent_configuration_intake_object": { "required": [ "service", "settings" ], "type": "object", "properties": { "agent_name": { "type": "string", "description": "Agent name" }, "service": { "$ref": "#/components/schemas/APM_UI_service_object" }, "settings": { "$ref": "#/components/schemas/APM_UI_settings_object" } } }, "APM_UI_agent_configuration_object": { "required": [ "service", "settings", "@timestamp", "etag" ], "type": "object", "properties": { "@timestamp": { "type": "number", "description": "Timestamp", "example": 1730194190636 }, "agent_name": { "type": "string", "description": "Agent name" }, "applied_by_agent": { "type": "boolean", "description": "Applied by agent", "example": true }, "etag": { "type": "string", "description": "Etag", "example": "0bc3b5ebf18fba8163fe4c96f491e3767a358f85" }, "service": { "$ref": "#/components/schemas/APM_UI_service_object" }, "settings": { "$ref": "#/components/schemas/APM_UI_settings_object" } }, "description": "Agent configuration" }, "APM_UI_agent_configurations_response": { "type": "object", "properties": { "configurations": { "type": "array", "items": { "$ref": "#/components/schemas/APM_UI_agent_configuration_object" }, "description": "Agent configuration" } } }, "APM_UI_agent_keys_object": { "required": [ "name", "privileges" ], "type": "object", "properties": { "name": { "type": "string", "description": "Agent name" }, "privileges": { "type": "array", "items": { "enum": [ "event:write", "config_agent:read" ], "type": "string" }, "description": "Privileges configuration" } } }, "APM_UI_agent_keys_response": { "type": "object", "properties": { "agentKey": { "required": [ "id", "name", "api_key", "encoded" ], "type": "object", "properties": { "api_key": { "type": "string" }, "encoded": { "type": "string" }, "expiration": { "type": "integer", "format": "int64" }, "id": { "type": "string" }, "name": { "type": "string" } }, "description": "Agent key" } } }, "APM_UI_annotation_search_response": { "type": "object", "properties": { "annotations": { "type": "array", "items": { "type": "object", "properties": { "@timestamp": { "type": "number" }, "id": { "type": "string" }, "text": { "type": "string" }, "type": { "enum": [ "version" ], "type": "string" } } }, "description": "Annotations" } } }, "APM_UI_base_source_map_object": { "type": "object", "properties": { "compressionAlgorithm": { "type": "string", "description": "Compression Algorithm" }, "created": { "type": "string", "description": "Created date" }, "decodedSha256": { "type": "string", "description": "Decoded SHA-256" }, "decodedSize": { "type": "number", "description": "Decoded size" }, "encodedSha256": { "type": "string", "description": "Encoded SHA-256" }, "encodedSize": { "type": "number", "description": "Encoded size" }, "encryptionAlgorithm": { "type": "string", "description": "Encryption Algorithm" }, "id": { "type": "string", "description": "Identifier" }, "identifier": { "type": "string", "description": "Identifier" }, "packageName": { "type": "string", "description": "Package name" }, "relative_url": { "type": "string", "description": "Relative URL" }, "type": { "type": "string", "description": "Type" } } }, "APM_UI_create_annotation_object": { "required": [ "@timestamp", "service" ], "type": "object", "properties": { "@timestamp": { "type": "string", "description": "Timestamp" }, "message": { "type": "string", "description": "Message" }, "service": { "required": [ "version" ], "type": "object", "properties": { "environment": { "type": "string" }, "version": { "type": "string" } }, "description": "Service" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Tags" } } }, "APM_UI_create_annotation_response": { "type": "object", "properties": { "_id": { "type": "string", "description": "Identifier" }, "_index": { "type": "string", "description": "Index" }, "_source": { "type": "object", "properties": { "@timestamp": { "type": "string" }, "annotation": { "type": "object", "properties": { "title": { "type": "string" }, "type": { "type": "string" } } }, "event": { "type": "object", "properties": { "created": { "type": "string" } } }, "message": { "type": "string" }, "service": { "type": "object", "properties": { "environment": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "tags": { "type": "array", "items": { "type": "string" } } }, "description": "Response" } } }, "APM_UI_delete_agent_configurations_response": { "type": "object", "properties": { "result": { "type": "string", "description": "Result" } } }, "APM_UI_search_agent_configuration_object": { "required": [ "service" ], "type": "object", "properties": { "etag": { "type": "string", "description": "If etags match then `applied_by_agent` field will be set to `true`", "example": "0bc3b5ebf18fba8163fe4c96f491e3767a358f85" }, "mark_as_applied_by_agent": { "type": "boolean", "description": "`markAsAppliedByAgent=true` means \"force setting it to true regardless of etag\".\nThis is needed for Jaeger agent that doesn't have etags\n" }, "service": { "$ref": "#/components/schemas/APM_UI_service_object" } } }, "APM_UI_search_agent_configuration_response": { "type": "object", "properties": { "_id": { "type": "string", "description": "Identifier" }, "_index": { "type": "string", "description": "Index" }, "_score": { "type": "number", "description": "Score" }, "_source": { "$ref": "#/components/schemas/APM_UI_agent_configuration_object" } } }, "APM_UI_service_agent_name_response": { "type": "object", "properties": { "agentName": { "type": "string", "description": "Agent name", "example": "nodejs" } } }, "APM_UI_service_environment_object": { "type": "object", "properties": { "alreadyConfigured": { "type": "boolean", "description": "Already configured" }, "name": { "type": "string", "description": "Service environment name", "example": "ALL_OPTION_VALUE" } } }, "APM_UI_service_environments_response": { "type": "object", "properties": { "environments": { "type": "array", "items": { "$ref": "#/components/schemas/APM_UI_service_environment_object" }, "description": "Service environment list" } } }, "APM_UI_service_object": { "type": "object", "properties": { "environment": { "type": "string", "description": "Environment", "example": "prod" }, "name": { "type": "string", "description": "Name", "example": "node" } }, "description": "Service" }, "APM_UI_settings_object": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Agent configuration settings" }, "APM_UI_single_agent_configuration_response": { "allOf": [ { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" } } }, { "$ref": "#/components/schemas/APM_UI_agent_configuration_object" } ] }, "APM_UI_source_maps_response": { "type": "object", "properties": { "artifacts": { "type": "array", "items": { "allOf": [ { "type": "object", "properties": { "body": { "type": "object", "properties": { "bundleFilepath": { "type": "string" }, "serviceName": { "type": "string" }, "serviceVersion": { "type": "string" }, "sourceMap": { "type": "object", "properties": { "file": { "type": "string" }, "mappings": { "type": "string" }, "sourceRoot": { "type": "string" }, "sources": { "type": "array", "items": { "type": "string" } }, "sourcesContent": { "type": "array", "items": { "type": "string" } }, "version": { "type": "number" } } } } } } }, { "$ref": "#/components/schemas/APM_UI_base_source_map_object" } ] }, "description": "Artifacts" } } }, "APM_UI_upload_source_map_object": { "required": [ "service_name", "service_version", "bundle_filepath", "sourcemap" ], "type": "object", "properties": { "bundle_filepath": { "type": "string", "description": "The absolute path of the final bundle as used in the web application." }, "service_name": { "type": "string", "description": "The name of the service that the service map should apply to." }, "service_version": { "type": "string", "description": "The version of the service that the service map should apply to." }, "sourcemap": { "type": "string", "description": "The source map. String or file upload. It must follow the\n[source map revision 3 proposal](https://docs.google.com/document/d/1U1RGAehQwRypUTovF1KRlpiOFze0b-_2gc6fAH0KY0k).\n", "format": "binary" } } }, "APM_UI_upload_source_maps_response": { "allOf": [ { "type": "object", "properties": { "body": { "type": "string" } } }, { "$ref": "#/components/schemas/APM_UI_base_source_map_object" } ] }, "Cases_4xx_response": { "title": "Unsuccessful cases API response", "type": "object", "properties": { "error": { "type": "string", "example": "Unauthorized" }, "message": { "type": "string" }, "statusCode": { "type": "integer", "example": 401 } } }, "Cases_action_types": { "enum": [ "assignees", "create_case", "comment", "connector", "delete_case", "description", "pushed", "tags", "title", "status", "settings", "severity" ], "type": "string", "description": "The type of action.", "example": "create_case" }, "Cases_actions": { "enum": [ "add", "create", "delete", "push_to_service", "update" ], "type": "string", "example": "create" }, "Cases_add_alert_comment_request_properties": { "title": "Add case comment request properties for alerts", "required": [ "alertId", "index", "owner", "rule", "type" ], "type": "object", "properties": { "alertId": { "$ref": "#/components/schemas/Cases_alert_identifiers" }, "index": { "$ref": "#/components/schemas/Cases_alert_indices" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "rule": { "$ref": "#/components/schemas/Cases_rule" }, "type": { "enum": [ "alert" ], "type": "string", "description": "The type of comment.", "example": "alert" } }, "description": "Defines properties for case comment requests when type is alert." }, "Cases_add_case_comment_request": { "title": "Add case comment request", "oneOf": [ { "$ref": "#/components/schemas/Cases_add_alert_comment_request_properties" }, { "$ref": "#/components/schemas/Cases_add_user_comment_request_properties" } ], "description": "The add comment to case API request body varies depending on whether you are adding an alert or a comment.", "discriminator": { "propertyName": "type", "mapping": { "alert": "#/components/schemas/Cases_add_alert_comment_request_properties", "user": "#/components/schemas/Cases_add_user_comment_request_properties" } } }, "Cases_add_case_file_request": { "title": "Add case file request properties", "required": [ "file" ], "type": "object", "properties": { "file": { "type": "string", "description": "The file being attached to the case.", "format": "binary" }, "filename": { "type": "string", "description": "The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**" } }, "description": "Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined." }, "Cases_add_user_comment_request_properties": { "title": "Add case comment request properties for user comments", "required": [ "comment", "owner", "type" ], "type": "object", "properties": { "comment": { "maxLength": 30000, "type": "string", "description": "The new comment. It is required only when `type` is `user`.", "example": "A new comment." }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "type": { "enum": [ "user" ], "type": "string", "description": "The type of comment.", "example": "user" } }, "description": "Defines properties for case comment requests when type is user." }, "Cases_alert_comment_response_properties": { "title": "Add case comment response properties for alerts", "required": [ "type" ], "type": "object", "properties": { "alertId": { "type": "array", "items": { "type": "string", "example": "a6e12ac4-7bce-457b-84f6-d7ce8deb8446" } }, "created_at": { "type": "string", "format": "date-time", "example": "2023-11-06T19:29:38.424Z" }, "created_by": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "id": { "type": "string", "example": "73362370-ab1a-11ec-985f-97e55adae8b9" }, "index": { "type": "array", "items": { "type": "string", "example": ".internal.alerts-security.alerts-default-000001" } }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "pushed_at": { "type": [ "null", "string" ], "format": "date-time", "example": "null" }, "pushed_by": { "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "rule": { "type": "object", "properties": { "id": { "type": "string", "description": "The rule identifier.", "example": "94d80550-aaf4-11ec-985f-97e55adae8b9" }, "name": { "type": "string", "description": "The rule name.", "example": "security_rule" } } }, "type": { "enum": [ "alert" ], "type": "string", "example": "alert" }, "updated_at": { "type": [ "null", "string" ], "format": "date-time" }, "updated_by": { "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "version": { "type": "string", "example": "WzMwNDgsMV0=" } } }, "Cases_alert_identifiers": { "title": "Alert identifiers", "oneOf": [ { "type": "string" }, { "maxItems": 1000, "type": "array", "items": { "type": "string" } } ], "description": "The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n", "example": "6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42", "x-state": "Technical preview" }, "Cases_alert_indices": { "title": "Alert indices", "oneOf": [ { "type": "string" }, { "maxItems": 1000, "type": "array", "items": { "type": "string" } } ], "description": "The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n", "x-state": "Technical preview" }, "Cases_alert_response_properties": { "type": "object", "properties": { "attached_at": { "type": "string", "format": "date-time" }, "id": { "type": "string", "description": "The alert identifier." }, "index": { "type": "string", "description": "The alert index." } } }, "Cases_assignees": { "maxItems": 10, "type": [ "null", "array" ], "items": { "required": [ "uid" ], "type": "object", "properties": { "uid": { "type": "string", "description": "A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.", "example": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0" } } }, "description": "An array containing users that are assigned to the case." }, "Cases_case_categories": { "maxItems": 100, "type": "array", "items": { "$ref": "#/components/schemas/Cases_case_category" } }, "Cases_case_category": { "maxLength": 50, "type": "string", "description": "A word or phrase that categorizes the case." }, "Cases_case_description": { "maxLength": 30000, "type": "string", "description": "The description for the case." }, "Cases_case_response_closed_by_properties": { "title": "Case response properties for closed_by", "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "Cases_case_response_created_by_properties": { "title": "Case response properties for created_by", "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "Cases_case_response_properties": { "title": "Case response properties", "required": [ "closed_at", "closed_by", "comments", "connector", "created_at", "created_by", "description", "duration", "external_service", "id", "owner", "settings", "severity", "status", "tags", "title", "totalAlerts", "totalComment", "updated_at", "updated_by", "version" ], "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Cases_assignees" }, "category": { "type": [ "null", "string" ], "description": "The case category." }, "closed_at": { "type": [ "null", "string" ], "format": "date-time" }, "closed_by": { "$ref": "#/components/schemas/Cases_case_response_closed_by_properties" }, "comments": { "title": "Case response properties for comments", "maxItems": 10000, "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/Cases_alert_comment_response_properties" }, { "$ref": "#/components/schemas/Cases_user_comment_response_properties" } ], "discriminator": { "propertyName": "type", "mapping": { "alert": "#/components/schemas/Cases_alert_comment_response_properties", "user": "#/components/schemas/Cases_user_comment_response_properties" } } }, "description": "An array of comment objects for the case." }, "connector": { "title": "Case response properties for connectors", "oneOf": [ { "$ref": "#/components/schemas/Cases_connector_properties_none" }, { "$ref": "#/components/schemas/Cases_connector_properties_cases_webhook" }, { "$ref": "#/components/schemas/Cases_connector_properties_jira" }, { "$ref": "#/components/schemas/Cases_connector_properties_resilient" }, { "$ref": "#/components/schemas/Cases_connector_properties_servicenow" }, { "$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir" }, { "$ref": "#/components/schemas/Cases_connector_properties_swimlane" } ], "discriminator": { "propertyName": "type", "mapping": { ".cases-webhook": "#/components/schemas/Cases_connector_properties_cases_webhook", ".jira": "#/components/schemas/Cases_connector_properties_jira", ".none": "#/components/schemas/Cases_connector_properties_none", ".resilient": "#/components/schemas/Cases_connector_properties_resilient", ".servicenow": "#/components/schemas/Cases_connector_properties_servicenow", ".servicenow-sir": "#/components/schemas/Cases_connector_properties_servicenow_sir", ".swimlane": "#/components/schemas/Cases_connector_properties_swimlane" } } }, "created_at": { "type": "string", "format": "date-time", "example": "2022-05-13T09:16:17.416Z" }, "created_by": { "$ref": "#/components/schemas/Cases_case_response_created_by_properties" }, "customFields": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n" }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The custom field type. It must match the type specified in the case configuration settings.\n" }, "value": { "oneOf": [ { "maxLength": 160, "minLength": 1, "type": [ "null", "string" ] }, { "type": "boolean" } ], "description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n" } } }, "description": "Custom field values for the case." }, "description": { "type": "string", "example": "A case description." }, "duration": { "type": [ "null", "integer" ], "description": "The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.\n", "example": 120 }, "external_service": { "$ref": "#/components/schemas/Cases_external_service" }, "id": { "type": "string", "example": "66b9aa00-94fa-11ea-9f74-e7e108796192" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "settings": { "$ref": "#/components/schemas/Cases_settings" }, "severity": { "$ref": "#/components/schemas/Cases_case_severity" }, "status": { "$ref": "#/components/schemas/Cases_case_status" }, "tags": { "type": "array", "items": { "type": "string" }, "example": [ "tag-1" ] }, "title": { "type": "string", "example": "Case title 1" }, "totalAlerts": { "type": "integer", "example": 0 }, "totalComment": { "type": "integer", "example": 0 }, "updated_at": { "type": [ "null", "string" ], "format": "date-time" }, "updated_by": { "$ref": "#/components/schemas/Cases_case_response_updated_by_properties" }, "version": { "type": "string", "example": "WzUzMiwxXQ==" } } }, "Cases_case_response_pushed_by_properties": { "title": "Case response properties for pushed_by", "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "Cases_case_response_updated_by_properties": { "title": "Case response properties for updated_by", "required": [ "email", "full_name", "username" ], "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "Cases_case_severity": { "enum": [ "critical", "high", "low", "medium" ], "type": "string", "description": "The severity of the case.", "default": "low" }, "Cases_case_status": { "enum": [ "closed", "in-progress", "open" ], "type": "string", "description": "The status of the case." }, "Cases_case_tags": { "maxItems": 200, "type": "array", "items": { "maxLength": 256, "type": "string" }, "description": "The words and phrases that help categorize cases. It can be an empty array.\n" }, "Cases_case_title": { "maxLength": 160, "type": "string", "description": "A title for the case." }, "Cases_closure_types": { "enum": [ "close-by-pushing", "close-by-user" ], "type": "string", "description": "Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).", "example": "close-by-user" }, "Cases_connector_properties_cases_webhook": { "title": "Create or upate case request properties for Cases Webhook connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "type": [ "null", "string" ], "example": "null" }, "id": { "type": "string", "description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API." }, "name": { "type": "string", "description": "The name of the connector." }, "type": { "enum": [ ".cases-webhook" ], "type": "string", "description": "The type of connector.", "example": ".cases-webhook" } }, "description": "Defines properties for connectors when type is `.cases-webhook`." }, "Cases_connector_properties_jira": { "title": "Create or update case request properties for a Jira connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "required": [ "issueType", "parent", "priority" ], "type": "object", "properties": { "issueType": { "type": [ "null", "string" ], "description": "The type of issue." }, "parent": { "type": [ "null", "string" ], "description": "The key of the parent issue, when the issue type is sub-task." }, "priority": { "type": [ "null", "string" ], "description": "The priority of the issue." } }, "description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value." }, "id": { "type": "string", "description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API." }, "name": { "type": "string", "description": "The name of the connector." }, "type": { "enum": [ ".jira" ], "type": "string", "description": "The type of connector.", "example": ".jira" } }, "description": "Defines properties for connectors when type is `.jira`." }, "Cases_connector_properties_none": { "title": "Create or update case request properties for no connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "type": [ "null", "string" ], "description": "An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.", "example": "null" }, "id": { "type": "string", "description": "The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.", "example": "none" }, "type": { "enum": [ ".none" ], "type": "string", "description": "The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.", "example": ".none" } }, "description": "Defines properties for connectors when type is `.none`." }, "Cases_connector_properties_resilient": { "title": "Create case request properties for a IBM Resilient connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "required": [ "issueTypes", "severityCode" ], "type": [ "null", "object" ], "properties": { "issueTypes": { "type": "array", "items": { "type": "string" }, "description": "The type of incident." }, "severityCode": { "type": "string", "description": "The severity code of the incident." } }, "description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value." }, "id": { "type": "string", "description": "The identifier for the connector." }, "name": { "type": "string", "description": "The name of the connector." }, "type": { "enum": [ ".resilient" ], "type": "string", "description": "The type of connector.", "example": ".resilient" } }, "description": "Defines properties for connectors when type is `.resilient`." }, "Cases_connector_properties_servicenow": { "title": "Create case request properties for a ServiceNow ITSM connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "required": [ "category", "impact", "severity", "subcategory", "urgency" ], "type": "object", "properties": { "category": { "type": [ "null", "string" ], "description": "The category of the incident." }, "impact": { "type": [ "null", "string" ], "description": "The effect an incident had on business." }, "severity": { "type": [ "null", "string" ], "description": "The severity of the incident." }, "subcategory": { "type": [ "null", "string" ], "description": "The subcategory of the incident." }, "urgency": { "type": [ "null", "string" ], "description": "The extent to which the incident resolution can be delayed." } }, "description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value." }, "id": { "type": "string", "description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API." }, "name": { "type": "string", "description": "The name of the connector." }, "type": { "enum": [ ".servicenow" ], "type": "string", "description": "The type of connector.", "example": ".servicenow" } }, "description": "Defines properties for connectors when type is `.servicenow`." }, "Cases_connector_properties_servicenow_sir": { "title": "Create case request properties for a ServiceNow SecOps connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "required": [ "category", "destIp", "malwareHash", "malwareUrl", "priority", "sourceIp", "subcategory" ], "type": "object", "properties": { "category": { "type": [ "null", "string" ], "description": "The category of the incident." }, "destIp": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of destination IPs." }, "malwareHash": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of malware hashes." }, "malwareUrl": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of malware URLs." }, "priority": { "type": [ "null", "string" ], "description": "The priority of the issue." }, "sourceIp": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of source IPs." }, "subcategory": { "type": [ "null", "string" ], "description": "The subcategory of the incident." } }, "description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value." }, "id": { "type": "string", "description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API." }, "name": { "type": "string", "description": "The name of the connector." }, "type": { "enum": [ ".servicenow-sir" ], "type": "string", "description": "The type of connector.", "example": ".servicenow-sir" } }, "description": "Defines properties for connectors when type is `.servicenow-sir`." }, "Cases_connector_properties_swimlane": { "title": "Create case request properties for a Swimlane connector", "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "required": [ "caseId" ], "type": "object", "properties": { "caseId": { "type": [ "null", "string" ], "description": "The case identifier for Swimlane connectors." } }, "description": "An object containing the connector fields. If you want to omit any individual field, specify null as its value." }, "id": { "type": "string", "description": "The identifier for the connector. To retrieve connector IDs, use the find connectors API." }, "name": { "type": "string", "description": "The name of the connector." }, "type": { "enum": [ ".swimlane" ], "type": "string", "description": "The type of connector.", "example": ".swimlane" } }, "description": "Defines properties for connectors when type is `.swimlane`." }, "Cases_connector_types": { "enum": [ ".cases-webhook", ".jira", ".none", ".resilient", ".servicenow", ".servicenow-sir", ".swimlane" ], "type": "string", "description": "The type of connector.", "example": ".none" }, "Cases_create_case_request": { "title": "Create case request", "required": [ "connector", "description", "owner", "settings", "tags", "title" ], "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Cases_assignees" }, "category": { "$ref": "#/components/schemas/Cases_case_category" }, "connector": { "oneOf": [ { "$ref": "#/components/schemas/Cases_connector_properties_none" }, { "$ref": "#/components/schemas/Cases_connector_properties_cases_webhook" }, { "$ref": "#/components/schemas/Cases_connector_properties_jira" }, { "$ref": "#/components/schemas/Cases_connector_properties_resilient" }, { "$ref": "#/components/schemas/Cases_connector_properties_servicenow" }, { "$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir" }, { "$ref": "#/components/schemas/Cases_connector_properties_swimlane" } ] }, "customFields": { "maxItems": 10, "minItems": 0, "type": "array", "items": { "required": [ "key", "type", "value" ], "type": "object", "properties": { "key": { "type": "string", "description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n" }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The custom field type. It must match the type specified in the case configuration settings.\n" }, "value": { "oneOf": [ { "maxLength": 160, "minLength": 1, "type": [ "null", "string" ] }, { "type": "boolean" } ], "description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n" } } }, "description": "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n" }, "description": { "$ref": "#/components/schemas/Cases_case_description" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "settings": { "$ref": "#/components/schemas/Cases_settings" }, "severity": { "$ref": "#/components/schemas/Cases_case_severity" }, "tags": { "$ref": "#/components/schemas/Cases_case_tags" }, "title": { "$ref": "#/components/schemas/Cases_case_title" } }, "description": "The create case API request body varies depending on the type of connector." }, "Cases_external_service": { "type": [ "null", "object" ], "properties": { "connector_id": { "type": "string" }, "connector_name": { "type": "string" }, "external_id": { "type": "string" }, "external_title": { "type": "string" }, "external_url": { "type": "string" }, "pushed_at": { "type": "string", "format": "date-time" }, "pushed_by": { "type": [ "null", "object" ], "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } } } }, "Cases_owner": { "enum": [ "cases", "observability", "securitySolution" ], "type": "string", "description": "The application that owns the cases: Stack Management, Observability, or Elastic Security.\n", "example": "cases" }, "Cases_owners": { "type": "array", "items": { "$ref": "#/components/schemas/Cases_owner" } }, "Cases_payload_alert_comment": { "type": "object", "properties": { "comment": { "type": "object", "properties": { "alertId": { "oneOf": [ { "type": "string", "example": "1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d" }, { "type": "array", "items": { "type": "string" } } ] }, "index": { "oneOf": [ { "type": "string", "example": ".alerts-observability.logs.alerts-default" }, { "type": "array", "items": { "type": "string" } } ] }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "rule": { "type": "object", "properties": { "id": { "type": "string", "description": "The rule identifier.", "example": "94d80550-aaf4-11ec-985f-97e55adae8b9" }, "name": { "type": "string", "description": "The rule name.", "example": "security_rule" } } }, "type": { "enum": [ "alert" ], "type": "string" } } } } }, "Cases_payload_assignees": { "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Cases_assignees" } } }, "Cases_payload_connector": { "type": "object", "properties": { "connector": { "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "properties": { "caseId": { "type": "string", "description": "The case identifier for Swimlane connectors." }, "category": { "type": "string", "description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors." }, "destIp": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors." }, "impact": { "type": "string", "description": "The effect an incident had on business for ServiceNow ITSM connectors." }, "issueType": { "type": "string", "description": "The type of issue for Jira connectors." }, "issueTypes": { "type": "array", "items": { "type": "string" }, "description": "The type of incident for IBM Resilient connectors." }, "malwareHash": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors." }, "malwareUrl": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors." }, "parent": { "type": "string", "description": "The key of the parent issue, when the issue type is sub-task for Jira connectors." }, "priority": { "type": "string", "description": "The priority of the issue for Jira and ServiceNow SecOps connectors." }, "severity": { "type": "string", "description": "The severity of the incident for ServiceNow ITSM connectors." }, "severityCode": { "type": "string", "description": "The severity code of the incident for IBM Resilient connectors." }, "sourceIp": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors." }, "subcategory": { "type": "string", "description": "The subcategory of the incident for ServiceNow ITSM connectors." }, "urgency": { "type": "string", "description": "The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors." } }, "description": "An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.", "example": "null" }, "id": { "type": "string", "description": "The identifier for the connector. To create a case without a connector, use `none`.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. To create a case without a connector, use `none`.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } } } } }, "Cases_payload_create_case": { "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Cases_assignees" }, "connector": { "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "properties": { "caseId": { "type": "string", "description": "The case identifier for Swimlane connectors." }, "category": { "type": "string", "description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors." }, "destIp": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors." }, "impact": { "type": "string", "description": "The effect an incident had on business for ServiceNow ITSM connectors." }, "issueType": { "type": "string", "description": "The type of issue for Jira connectors." }, "issueTypes": { "type": "array", "items": { "type": "string" }, "description": "The type of incident for IBM Resilient connectors." }, "malwareHash": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors." }, "malwareUrl": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors." }, "parent": { "type": "string", "description": "The key of the parent issue, when the issue type is sub-task for Jira connectors." }, "priority": { "type": "string", "description": "The priority of the issue for Jira and ServiceNow SecOps connectors." }, "severity": { "type": "string", "description": "The severity of the incident for ServiceNow ITSM connectors." }, "severityCode": { "type": "string", "description": "The severity code of the incident for IBM Resilient connectors." }, "sourceIp": { "type": [ "null", "boolean" ], "description": "Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors." }, "subcategory": { "type": "string", "description": "The subcategory of the incident for ServiceNow ITSM connectors." }, "urgency": { "type": "string", "description": "The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors." } }, "description": "An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.", "example": "null" }, "id": { "type": "string", "description": "The identifier for the connector. To create a case without a connector, use `none`.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. To create a case without a connector, use `none`.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } } }, "description": { "type": "string" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "settings": { "$ref": "#/components/schemas/Cases_settings" }, "severity": { "$ref": "#/components/schemas/Cases_case_severity" }, "status": { "$ref": "#/components/schemas/Cases_case_status" }, "tags": { "type": "array", "items": { "type": "string", "example": [ "tag-1" ] } }, "title": { "type": "string" } } }, "Cases_payload_delete": { "type": [ "null", "object" ], "description": "If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable." }, "Cases_payload_description": { "type": "object", "properties": { "description": { "type": "string" } } }, "Cases_payload_pushed": { "type": "object", "properties": { "externalService": { "$ref": "#/components/schemas/Cases_external_service" } } }, "Cases_payload_settings": { "type": "object", "properties": { "settings": { "$ref": "#/components/schemas/Cases_settings" } } }, "Cases_payload_severity": { "type": "object", "properties": { "severity": { "$ref": "#/components/schemas/Cases_case_severity" } } }, "Cases_payload_status": { "type": "object", "properties": { "status": { "$ref": "#/components/schemas/Cases_case_status" } } }, "Cases_payload_tags": { "type": "object", "properties": { "tags": { "type": "array", "items": { "type": "string" }, "example": [ "tag-1" ] } } }, "Cases_payload_title": { "type": "object", "properties": { "title": { "type": "string" } } }, "Cases_payload_user_comment": { "type": "object", "properties": { "comment": { "type": "object", "properties": { "comment": { "type": "string" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "type": { "enum": [ "user" ], "type": "string" } } } } }, "Cases_rule": { "title": "Alerting rule", "type": "object", "properties": { "id": { "type": "string", "description": "The rule identifier.", "example": "94d80550-aaf4-11ec-985f-97e55adae8b9" }, "name": { "type": "string", "description": "The rule name.", "example": "security_rule" } }, "description": "The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n", "x-state": "Technical preview" }, "Cases_searchFieldsType": { "enum": [ "description", "title" ], "type": "string", "description": "The fields to perform the `simple_query_string` parsed query against." }, "Cases_searchFieldsTypeArray": { "type": "array", "items": { "$ref": "#/components/schemas/Cases_searchFieldsType" } }, "Cases_set_case_configuration_request": { "title": "Set case configuration request", "required": [ "closure_type", "connector", "owner" ], "type": "object", "properties": { "closure_type": { "$ref": "#/components/schemas/Cases_closure_types" }, "connector": { "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`." }, "id": { "type": "string", "description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } }, "description": "An object that contains the connector configuration." }, "customFields": { "maxItems": 10, "minItems": 0, "type": "array", "items": { "required": [ "key", "label", "required", "type" ], "type": "object", "properties": { "defaultValue": { "type": [ "boolean", "string" ], "description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n" }, "key": { "maxLength": 36, "minLength": 1, "type": "string", "description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n" }, "label": { "maxLength": 50, "minLength": 1, "type": "string", "description": "The custom field label that is displayed in the case." }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The type of the custom field." }, "required": { "type": "boolean", "description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n" } } }, "description": "Custom fields case configuration." }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "templates": { "$ref": "#/components/schemas/Cases_templates" } }, "description": "External connection details, such as the closure type and default connector for cases." }, "Cases_settings": { "required": [ "syncAlerts" ], "type": "object", "properties": { "syncAlerts": { "type": "boolean", "description": "Turns alert syncing on or off.", "example": true } }, "description": "An object that contains the case settings." }, "Cases_string": { "type": "string" }, "Cases_string_array": { "maxItems": 100, "type": "array", "items": { "$ref": "#/components/schemas/Cases_string" } }, "Cases_template_tags": { "maxItems": 200, "type": "array", "items": { "maxLength": 256, "type": "string" }, "description": "The words and phrases that help categorize templates. It can be an empty array.\n" }, "Cases_templates": { "type": "array", "items": { "type": "object", "properties": { "caseFields": { "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Cases_assignees" }, "category": { "$ref": "#/components/schemas/Cases_case_category" }, "connector": { "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`." }, "id": { "type": "string", "description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } } }, "customFields": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "description": "The unique key for the custom field." }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The type of the custom field." }, "value": { "type": [ "boolean", "string" ], "description": "The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n" } } }, "description": "Custom field values in the template.", "x-state": "Technical preview" }, "description": { "$ref": "#/components/schemas/Cases_case_description" }, "settings": { "$ref": "#/components/schemas/Cases_settings" }, "severity": { "$ref": "#/components/schemas/Cases_case_severity" }, "tags": { "$ref": "#/components/schemas/Cases_case_tags" }, "title": { "$ref": "#/components/schemas/Cases_case_title" } } }, "description": { "type": "string", "description": "A description for the template." }, "key": { "type": "string", "description": "A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.\n" }, "name": { "type": "string", "description": "The name of the template." }, "tags": { "$ref": "#/components/schemas/Cases_template_tags" } } }, "x-state": "Technical preview" }, "Cases_update_alert_comment_request_properties": { "title": "Update case comment request properties for alerts", "required": [ "alertId", "id", "index", "owner", "rule", "type", "version" ], "type": "object", "properties": { "alertId": { "$ref": "#/components/schemas/Cases_alert_identifiers" }, "id": { "type": "string", "description": "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n", "example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6" }, "index": { "$ref": "#/components/schemas/Cases_alert_indices" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "rule": { "$ref": "#/components/schemas/Cases_rule" }, "type": { "enum": [ "alert" ], "type": "string", "description": "The type of comment.", "example": "alert" }, "version": { "type": "string", "description": "The current comment version. To retrieve version values, use the get comments API.\n", "example": "Wzk1LDFd" } }, "description": "Defines properties for case comment requests when type is alert." }, "Cases_update_case_comment_request": { "title": "Update case comment request", "oneOf": [ { "$ref": "#/components/schemas/Cases_update_alert_comment_request_properties" }, { "$ref": "#/components/schemas/Cases_update_user_comment_request_properties" } ], "description": "The update case comment API request body varies depending on whether you are updating an alert or a comment.", "discriminator": { "propertyName": "type", "mapping": { "alert": "#/components/schemas/Cases_update_alert_comment_request_properties", "user": "#/components/schemas/Cases_update_user_comment_request_properties" } } }, "Cases_update_case_configuration_request": { "title": "Update case configuration request", "required": [ "version" ], "type": "object", "properties": { "closure_type": { "$ref": "#/components/schemas/Cases_closure_types" }, "connector": { "required": [ "fields", "id", "name", "type" ], "type": "object", "properties": { "fields": { "type": [ "null", "object" ], "description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`." }, "id": { "type": "string", "description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.", "example": "none" }, "name": { "type": "string", "description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.", "example": "none" }, "type": { "$ref": "#/components/schemas/Cases_connector_types" } }, "description": "An object that contains the connector configuration." }, "customFields": { "type": "array", "items": { "required": [ "key", "label", "required", "type" ], "type": "object", "properties": { "defaultValue": { "type": [ "boolean", "string" ], "description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n" }, "key": { "maxLength": 36, "minLength": 1, "type": "string", "description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n" }, "label": { "maxLength": 50, "minLength": 1, "type": "string", "description": "The custom field label that is displayed in the case." }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The type of the custom field." }, "required": { "type": "boolean", "description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n" } } }, "description": "Custom fields case configuration." }, "templates": { "$ref": "#/components/schemas/Cases_templates" }, "version": { "type": "string", "description": "The version of the connector. To retrieve the version value, use the get configuration API.\n", "example": "WzIwMiwxXQ==" } }, "description": "You can update settings such as the closure type, custom fields, templates, and the default connector for cases.\n" }, "Cases_update_case_request": { "title": "Update case request", "required": [ "cases" ], "type": "object", "properties": { "cases": { "maxItems": 100, "minItems": 1, "type": "array", "items": { "required": [ "id", "version" ], "type": "object", "properties": { "assignees": { "$ref": "#/components/schemas/Cases_assignees" }, "category": { "$ref": "#/components/schemas/Cases_case_category" }, "connector": { "oneOf": [ { "$ref": "#/components/schemas/Cases_connector_properties_none" }, { "$ref": "#/components/schemas/Cases_connector_properties_cases_webhook" }, { "$ref": "#/components/schemas/Cases_connector_properties_jira" }, { "$ref": "#/components/schemas/Cases_connector_properties_resilient" }, { "$ref": "#/components/schemas/Cases_connector_properties_servicenow" }, { "$ref": "#/components/schemas/Cases_connector_properties_servicenow_sir" }, { "$ref": "#/components/schemas/Cases_connector_properties_swimlane" } ] }, "customFields": { "maxItems": 10, "minItems": 0, "type": "array", "items": { "required": [ "key", "type", "value" ], "type": "object", "properties": { "key": { "type": "string", "description": "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n" }, "type": { "enum": [ "text", "toggle" ], "type": "string", "description": "The custom field type. It must match the type specified in the case configuration settings.\n" }, "value": { "oneOf": [ { "maxLength": 160, "minLength": 1, "type": [ "null", "string" ] }, { "type": "boolean" } ], "description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n" } } }, "description": "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n" }, "description": { "$ref": "#/components/schemas/Cases_case_description" }, "id": { "maxLength": 30000, "type": "string", "description": "The identifier for the case." }, "settings": { "$ref": "#/components/schemas/Cases_settings" }, "severity": { "$ref": "#/components/schemas/Cases_case_severity" }, "status": { "$ref": "#/components/schemas/Cases_case_status" }, "tags": { "$ref": "#/components/schemas/Cases_case_tags" }, "title": { "$ref": "#/components/schemas/Cases_case_title" }, "version": { "type": "string", "description": "The current version of the case. To determine this value, use the get case or find cases APIs." } } }, "description": "An array containing one or more case objects." } }, "description": "The update case API request body varies depending on the type of connector." }, "Cases_update_user_comment_request_properties": { "title": "Update case comment request properties for user comments", "required": [ "comment", "id", "owner", "type", "version" ], "type": "object", "properties": { "comment": { "maxLength": 30000, "type": "string", "description": "The new comment. It is required only when `type` is `user`.", "example": "A new comment." }, "id": { "type": "string", "description": "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n", "example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "type": { "enum": [ "user" ], "type": "string", "description": "The type of comment.", "example": "user" }, "version": { "type": "string", "description": "The current comment version. To retrieve version values, use the get comments API.\n", "example": "Wzk1LDFd" } }, "description": "Defines properties for case comment requests when type is user." }, "Cases_user_actions_find_response_properties": { "required": [ "action", "comment_id", "created_at", "created_by", "id", "owner", "payload", "type", "version" ], "type": "object", "properties": { "action": { "$ref": "#/components/schemas/Cases_actions" }, "comment_id": { "type": [ "null", "string" ], "example": "578608d0-03b1-11ed-920c-974bfa104448" }, "created_at": { "type": "string", "format": "date-time", "example": "2022-05-13T09:16:17.416Z" }, "created_by": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "id": { "type": "string", "example": "22fd3e30-03b1-11ed-920c-974bfa104448" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "payload": { "oneOf": [ { "$ref": "#/components/schemas/Cases_payload_alert_comment" }, { "$ref": "#/components/schemas/Cases_payload_assignees" }, { "$ref": "#/components/schemas/Cases_payload_connector" }, { "$ref": "#/components/schemas/Cases_payload_create_case" }, { "$ref": "#/components/schemas/Cases_payload_delete" }, { "$ref": "#/components/schemas/Cases_payload_description" }, { "$ref": "#/components/schemas/Cases_payload_pushed" }, { "$ref": "#/components/schemas/Cases_payload_settings" }, { "$ref": "#/components/schemas/Cases_payload_severity" }, { "$ref": "#/components/schemas/Cases_payload_status" }, { "$ref": "#/components/schemas/Cases_payload_tags" }, { "$ref": "#/components/schemas/Cases_payload_title" }, { "$ref": "#/components/schemas/Cases_payload_user_comment" } ] }, "type": { "enum": [ "assignees", "create_case", "comment", "connector", "description", "pushed", "tags", "title", "status", "settings", "severity" ], "type": "string", "description": "The type of action.", "example": "create_case" }, "version": { "type": "string", "example": "WzM1ODg4LDFd" } } }, "Cases_user_actions_response_properties": { "required": [ "action", "action_id", "case_id", "comment_id", "created_at", "created_by", "owner", "payload", "type" ], "type": "object", "properties": { "action": { "$ref": "#/components/schemas/Cases_actions" }, "action_id": { "type": "string", "example": "22fd3e30-03b1-11ed-920c-974bfa104448" }, "case_id": { "type": "string", "example": "22df07d0-03b1-11ed-920c-974bfa104448" }, "comment_id": { "type": [ "null", "string" ], "example": "578608d0-03b1-11ed-920c-974bfa104448" }, "created_at": { "type": "string", "format": "date-time", "example": "2022-05-13T09:16:17.416Z" }, "created_by": { "required": [ "email", "full_name", "username" ], "type": "object", "properties": { "email": { "type": [ "null", "string" ], "example": "null" }, "full_name": { "type": [ "null", "string" ], "example": "null" }, "profile_uid": { "type": "string", "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0" }, "username": { "type": [ "null", "string" ], "example": "elastic" } } }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "payload": { "oneOf": [ { "$ref": "#/components/schemas/Cases_payload_alert_comment" }, { "$ref": "#/components/schemas/Cases_payload_assignees" }, { "$ref": "#/components/schemas/Cases_payload_connector" }, { "$ref": "#/components/schemas/Cases_payload_create_case" }, { "$ref": "#/components/schemas/Cases_payload_delete" }, { "$ref": "#/components/schemas/Cases_payload_description" }, { "$ref": "#/components/schemas/Cases_payload_pushed" }, { "$ref": "#/components/schemas/Cases_payload_settings" }, { "$ref": "#/components/schemas/Cases_payload_severity" }, { "$ref": "#/components/schemas/Cases_payload_status" }, { "$ref": "#/components/schemas/Cases_payload_tags" }, { "$ref": "#/components/schemas/Cases_payload_title" }, { "$ref": "#/components/schemas/Cases_payload_user_comment" } ] }, "type": { "$ref": "#/components/schemas/Cases_action_types" } } }, "Cases_user_comment_response_properties": { "title": "Case response properties for user comments", "required": [ "type" ], "type": "object", "properties": { "comment": { "type": "string", "example": "A new comment." }, "created_at": { "type": "string", "format": "date-time", "example": "2022-05-13T09:16:17.416Z" }, "created_by": { "$ref": "#/components/schemas/Cases_case_response_created_by_properties" }, "id": { "type": "string", "example": "8af6ac20-74f6-11ea-b83a-553aecdb28b6" }, "owner": { "$ref": "#/components/schemas/Cases_owner" }, "pushed_at": { "type": [ "null", "string" ], "format": "date-time", "example": "null" }, "pushed_by": { "$ref": "#/components/schemas/Cases_case_response_pushed_by_properties" }, "type": { "enum": [ "user" ], "type": "string", "example": "user" }, "updated_at": { "type": [ "null", "string" ], "format": "date-time", "example": "null" }, "updated_by": { "$ref": "#/components/schemas/Cases_case_response_updated_by_properties" }, "version": { "type": "string", "example": "WzIwNDMxLDFd" } } }, "Data_views_400_response": { "title": "Bad request", "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string" }, "statusCode": { "type": "number", "example": 400 } } }, "Data_views_404_response": { "type": "object", "properties": { "error": { "enum": [ "Not Found" ], "type": "string", "example": "Not Found" }, "message": { "type": "string", "example": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found" }, "statusCode": { "enum": [ 404 ], "type": "integer", "example": 404 } } }, "Data_views_allownoindex": { "type": "boolean", "description": "Allows the data view saved object to exist before the data is available." }, "Data_views_create_data_view_request_object": { "title": "Create data view request", "required": [ "data_view" ], "type": "object", "properties": { "data_view": { "required": [ "title" ], "type": "object", "properties": { "allowNoIndex": { "$ref": "#/components/schemas/Data_views_allownoindex" }, "fieldAttrs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Data_views_fieldattrs" } }, "fieldFormats": { "$ref": "#/components/schemas/Data_views_fieldformats" }, "fields": { "type": "object" }, "id": { "type": "string" }, "name": { "type": "string", "description": "The data view name." }, "namespaces": { "$ref": "#/components/schemas/Data_views_namespaces" }, "runtimeFieldMap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Data_views_runtimefieldmap" } }, "sourceFilters": { "$ref": "#/components/schemas/Data_views_sourcefilters" }, "timeFieldName": { "$ref": "#/components/schemas/Data_views_timefieldname" }, "title": { "$ref": "#/components/schemas/Data_views_title" }, "type": { "$ref": "#/components/schemas/Data_views_type" }, "typeMeta": { "$ref": "#/components/schemas/Data_views_typemeta" }, "version": { "type": "string" } }, "description": "The data view object." }, "override": { "type": "boolean", "description": "Override an existing data view if a data view with the provided title already exists.", "default": false } } }, "Data_views_data_view_response_object": { "title": "Data view response properties", "type": "object", "properties": { "data_view": { "type": "object", "properties": { "allowNoIndex": { "$ref": "#/components/schemas/Data_views_allownoindex" }, "fieldAttrs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Data_views_fieldattrs" } }, "fieldFormats": { "$ref": "#/components/schemas/Data_views_fieldformats" }, "fields": { "type": "object" }, "id": { "type": "string", "example": "ff959d40-b880-11e8-a6d9-e546fe2bba5f" }, "name": { "type": "string", "description": "The data view name." }, "namespaces": { "$ref": "#/components/schemas/Data_views_namespaces" }, "runtimeFieldMap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Data_views_runtimefieldmap" } }, "sourceFilters": { "$ref": "#/components/schemas/Data_views_sourcefilters" }, "timeFieldName": { "$ref": "#/components/schemas/Data_views_timefieldname" }, "title": { "$ref": "#/components/schemas/Data_views_title" }, "typeMeta": { "$ref": "#/components/schemas/Data_views_typemeta_response" }, "version": { "type": "string", "example": "WzQ2LDJd" } } } } }, "Data_views_fieldattrs": { "type": "object", "properties": { "count": { "type": "integer", "description": "Popularity count for the field." }, "customDescription": { "maxLength": 300, "type": "string", "description": "Custom description for the field." }, "customLabel": { "type": "string", "description": "Custom label for the field." } }, "description": "A map of field attributes by field name." }, "Data_views_fieldformats": { "type": "object", "description": "A map of field formats by field name." }, "Data_views_namespaces": { "type": "array", "items": { "type": "string", "default": "default" }, "description": "An array of space identifiers for sharing the data view between multiple spaces." }, "Data_views_runtimefieldmap": { "required": [ "script", "type" ], "type": "object", "properties": { "script": { "type": "object", "properties": { "source": { "type": "string", "description": "Script for the runtime field." } } }, "type": { "type": "string", "description": "Mapping type of the runtime field." } }, "description": "A map of runtime field definitions by field name." }, "Data_views_sourcefilters": { "type": "array", "items": { "required": [ "value" ], "type": "object", "properties": { "value": { "type": "string" } } }, "description": "The array of field names you want to filter out in Discover." }, "Data_views_swap_data_view_request_object": { "title": "Data view reference swap request", "required": [ "fromId", "toId" ], "type": "object", "properties": { "delete": { "type": "boolean", "description": "Deletes referenced saved object if all references are removed." }, "forId": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Limit the affected saved objects to one or more by identifier." }, "forType": { "type": "string", "description": "Limit the affected saved objects by type." }, "fromId": { "type": "string", "description": "The saved object reference to change." }, "fromType": { "type": "string", "description": "Specify the type of the saved object reference to alter. The default value is `index-pattern` for data views.\n" }, "toId": { "type": "string", "description": "New saved object reference value to replace the old value." } } }, "Data_views_timefieldname": { "type": "string", "description": "The timestamp field name, which you use for time-based data views." }, "Data_views_title": { "type": "string", "description": "Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (`*`)." }, "Data_views_type": { "type": "string", "description": "When set to `rollup`, identifies the rollup data views." }, "Data_views_typemeta": { "required": [ "aggs", "params" ], "type": "object", "properties": { "aggs": { "type": "object", "description": "A map of rollup restrictions by aggregation type and field name." }, "params": { "type": "object", "description": "Properties for retrieving rollup fields." } }, "description": "When you use rollup indices, contains the field list for the rollup data view API endpoints." }, "Data_views_typemeta_response": { "type": [ "null", "object" ], "properties": { "aggs": { "type": "object", "description": "A map of rollup restrictions by aggregation type and field name." }, "params": { "type": "object", "description": "Properties for retrieving rollup fields." } }, "description": "When you use rollup indices, contains the field list for the rollup data view API endpoints." }, "Data_views_update_data_view_request_object": { "title": "Update data view request", "required": [ "data_view" ], "type": "object", "properties": { "data_view": { "type": "object", "properties": { "allowNoIndex": { "$ref": "#/components/schemas/Data_views_allownoindex" }, "fieldFormats": { "$ref": "#/components/schemas/Data_views_fieldformats" }, "fields": { "type": "object" }, "name": { "type": "string" }, "runtimeFieldMap": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Data_views_runtimefieldmap" } }, "sourceFilters": { "$ref": "#/components/schemas/Data_views_sourcefilters" }, "timeFieldName": { "$ref": "#/components/schemas/Data_views_timefieldname" }, "title": { "$ref": "#/components/schemas/Data_views_title" }, "type": { "$ref": "#/components/schemas/Data_views_type" }, "typeMeta": { "$ref": "#/components/schemas/Data_views_typemeta" } }, "description": "The data view properties you want to update. Only the specified properties are updated in the data view. Unspecified fields stay as they are persisted.\n" }, "refresh_fields": { "type": "boolean", "description": "Reloads the data view fields after the data view is updated.", "default": false } } }, "Fleet_agent": { "title": "Agent", "required": [ "type", "active", "enrolled_at", "id", "status" ], "type": "object", "properties": { "access_api_key": { "type": "string" }, "access_api_key_id": { "type": "string" }, "active": { "type": "boolean" }, "components": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent_component" } }, "default_api_key": { "type": "string" }, "default_api_key_id": { "type": "string" }, "enrolled_at": { "type": "string" }, "id": { "type": "string" }, "last_checkin": { "type": "string" }, "local_metadata": { "$ref": "#/components/schemas/Fleet_agent_metadata" }, "metrics": { "type": "object", "properties": { "cpu_avg": { "type": "number", "description": "Average agent CPU usage during the last 5 minutes, number between 0-1" }, "memory_size_byte_avg": { "type": "number", "description": "Average agent memory consumption during the last 5 minutes" } } }, "policy_id": { "type": "string" }, "policy_revision": { "type": "number" }, "status": { "$ref": "#/components/schemas/Fleet_agent_status" }, "type": { "$ref": "#/components/schemas/Fleet_agent_type" }, "unenrolled_at": { "type": "string" }, "unenrollment_started_at": { "type": "string" }, "user_provided_metadata": { "$ref": "#/components/schemas/Fleet_agent_metadata" } } }, "Fleet_agent_action": { "title": "Agent action", "oneOf": [ { "properties": { "ack_data": { "type": "string" }, "data": { "type": "string" }, "type": { "enum": [ "UNENROLL", "UPGRADE", "POLICY_REASSIGN" ], "type": "string" } } }, { "properties": { "data": { "type": "object", "properties": { "log_level": { "enum": [ "debug", "info", "warning", "error" ], "type": [ "null", "string" ] } } }, "type": { "type": "string" } } } ] }, "Fleet_agent_component": { "title": "Agent component", "type": "object", "properties": { "id": { "type": "string" }, "message": { "type": "string" }, "status": { "$ref": "#/components/schemas/Fleet_agent_component_status" }, "type": { "type": "string" }, "units": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent_component_unit" } } } }, "Fleet_agent_component_status": { "title": "Agent component status", "enum": [ "starting", "configuring", "healthy", "degraded", "failed", "stopping", "stopped" ], "type": "string" }, "Fleet_agent_component_unit": { "title": "Agent component unit", "type": "object", "properties": { "id": { "type": "string" }, "message": { "type": "string" }, "payload": { "type": "object" }, "status": { "$ref": "#/components/schemas/Fleet_agent_component_status" }, "type": { "$ref": "#/components/schemas/Fleet_agent_component_unit_type" } } }, "Fleet_agent_component_unit_type": { "title": "Agent component unit type", "enum": [ "input", "output" ], "type": "string" }, "Fleet_agent_diagnostics": { "title": "Agent diagnostics", "required": [ "id", "name", "createTime", "filePath", "actionId", "status" ], "type": "object", "properties": { "actionId": { "type": "string" }, "createTime": { "type": "string" }, "filePath": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "status": { "enum": [ "READY", "AWAITING_UPLOAD", "DELETED", "IN_PROGRESS" ] } } }, "Fleet_agent_get_by_actions": { "title": "Agents get by action ids", "type": "array", "items": { "type": "array", "items": { "type": "string" } } }, "Fleet_agent_metadata": { "title": "Agent metadata", "type": "object" }, "Fleet_agent_policy": { "title": "Agent Policy", "required": [ "id", "status", "name", "namespace" ], "type": "object", "properties": { "advanced_settings": { "type": [ "null", "object" ], "description": "Advanced settings stored in the agent policy, e.g. agent_limits_go_max_procs" }, "agent_features": { "type": "array", "items": { "required": [ "name", "enabled" ], "type": "object", "properties": { "enabled": { "type": "boolean" }, "name": { "type": "string" } } } }, "agents": { "type": "number" }, "data_output_id": { "type": [ "null", "string" ] }, "description": { "type": "string" }, "download_source_id": { "type": [ "null", "string" ] }, "fleet_server_host_id": { "type": [ "null", "string" ] }, "global_data_tags": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": [ "number", "string" ] }, "description": "User defined data tags that are added to all of the inputs. The values can be strings or numbers." } }, "id": { "type": "string" }, "inactivity_timeout": { "type": "integer" }, "is_protected": { "type": "boolean", "description": "Indicates whether the agent policy has tamper protection enabled. Default false." }, "keep_monitoring_alive": { "type": [ "null", "boolean" ], "description": "When set to true, monitoring will be enabled but logs/metrics collection will be disabled" }, "monitoring_diagnostics": { "type": "object", "properties": { "limit": { "type": "object", "properties": { "burst": { "type": "number" }, "interval": { "type": "string" } } }, "uploader": { "type": "object", "properties": { "init_dur": { "type": "string" }, "max_dur": { "type": "string" }, "max_retries": { "type": "number" } } } } }, "monitoring_enabled": { "type": "array", "items": { "enum": [ "metrics", "logs" ], "type": "string" } }, "monitoring_http": { "required": [ "enabled" ], "type": "object", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string" }, "port": { "type": "number" } } }, "monitoring_output_id": { "type": [ "null", "string" ] }, "monitoring_pprof_enabled": { "type": "boolean" }, "name": { "type": "string" }, "namespace": { "type": "string" }, "overrides": { "type": [ "null", "object" ], "description": "Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure." }, "package_policies": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_package_policy" }, "description": "This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter" }, "revision": { "type": "number" }, "supports_agentless": { "type": "boolean", "description": "Indicates whether the agent policy supports agentless integrations. Only allowed in a serverless environment." }, "unenroll_timeout": { "type": "integer" }, "unprivileged_agents": { "type": "number" }, "updated_by": { "type": "string" }, "updated_on": { "type": "string", "format": "date-time" } } }, "Fleet_agent_policy_create_request": { "title": "Create agent policy request", "required": [ "name", "namespace" ], "type": "object", "properties": { "agent_features": { "type": "array", "items": { "required": [ "name", "enabled" ], "type": "object", "properties": { "enabled": { "type": "boolean" }, "name": { "type": "string" } } } }, "data_output_id": { "type": [ "null", "string" ] }, "description": { "type": "string" }, "download_source_id": { "type": [ "null", "string" ] }, "fleet_server_host_id": { "type": [ "null", "string" ] }, "force": { "type": "boolean", "description": "Force agent policy creation even if packages are not verified." }, "global_data_tags": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": [ "number", "string" ] }, "description": "User defined data tags that are added to all of the inputs. The values can be strings or numbers." } }, "id": { "type": "string" }, "inactivity_timeout": { "type": "integer" }, "is_protected": { "type": "boolean" }, "monitoring_enabled": { "type": "array", "items": { "enum": [ "metrics", "logs" ], "type": "string" } }, "monitoring_output_id": { "type": [ "null", "string" ] }, "name": { "type": "string" }, "namespace": { "type": "string" }, "unenroll_timeout": { "type": "integer" } } }, "Fleet_agent_policy_full": { "title": "Agent policy full response", "type": "object", "oneOf": [ { "type": "object", "properties": { "item": { "type": "string" } } }, { "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_full_agent_policy" } } } ] }, "Fleet_agent_policy_update_request": { "title": "Update agent policy request", "required": [ "name", "namespace" ], "type": "object", "properties": { "agent_features": { "type": "array", "items": { "required": [ "name", "enabled" ], "type": "object", "properties": { "enabled": { "type": "boolean" }, "name": { "type": "string" } } } }, "data_output_id": { "type": [ "null", "string" ] }, "description": { "type": "string" }, "download_source_id": { "type": [ "null", "string" ] }, "fleet_server_host_id": { "type": [ "null", "string" ] }, "force": { "type": "boolean", "description": "Force agent policy creation even if packages are not verified." }, "global_data_tags": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": [ "number", "string" ] }, "description": "User defined data tags that are added to all of the inputs. The values can be strings or numbers." } }, "inactivity_timeout": { "type": "integer" }, "is_protected": { "type": "boolean" }, "monitoring_enabled": { "type": "array", "items": { "enum": [ "metrics", "logs" ], "type": "string" } }, "monitoring_output_id": { "type": [ "null", "string" ] }, "name": { "type": "string" }, "namespace": { "type": "string" }, "unenroll_timeout": { "type": "integer" } } }, "Fleet_agent_status": { "title": "Elastic Agent status", "enum": [ "offline", "error", "online", "inactive", "warning" ], "type": "string" }, "Fleet_agent_type": { "title": "Agent type", "enum": [ "PERMANENT", "EPHEMERAL", "TEMPORARY" ], "type": "string" }, "Fleet_bulk_install_packages_response": { "title": "Bulk install packages response", "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" } } } }, "response": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" } } }, "deprecated": true } } }, "Fleet_bulk_upgrade_agents": { "title": "Bulk upgrade agents", "required": [ "agents", "version" ], "type": "object", "properties": { "agents": { "oneOf": [ { "type": "string", "description": "KQL query string, leave empty to action all agents" }, { "type": "array", "items": { "type": "string" }, "description": "list of agent IDs" } ] }, "force": { "type": "boolean", "description": "Force upgrade, skipping validation (should be used with caution)" }, "rollout_duration_seconds": { "type": "number", "description": "rolling upgrade window duration in seconds" }, "skipRateLimitCheck": { "type": "boolean", "description": "Skip rate limit check for upgrade" }, "source_uri": { "type": "string", "description": "alternative upgrade binary download url" }, "start_time": { "type": "string", "description": "start time of upgrade in ISO 8601 format" }, "version": { "type": "string", "description": "version to upgrade to" } } }, "Fleet_data_stream": { "title": "Data stream", "type": "object", "properties": { "dashboard": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "title": { "type": "string" } } } }, "dataset": { "type": "string" }, "index": { "type": "string" }, "last_activity_ms": { "type": "number" }, "namespace": { "type": "string" }, "package": { "type": "string" }, "package_version": { "type": "string" }, "size_in_bytes": { "type": "number" }, "size_in_bytes_formatted": { "type": "string" }, "type": { "type": "string" } } }, "Fleet_download_sources": { "title": "Download Source", "required": [ "is_default", "name", "host" ], "type": "object", "properties": { "host": { "type": "string" }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "name": { "type": "string" }, "proxy_id": { "type": [ "null", "string" ], "description": "The ID of the proxy to use for this download source. See the proxies API for more information." } } }, "Fleet_elasticsearch_asset_type": { "title": "Elasticsearch asset type", "enum": [ "component_template", "ingest_pipeline", "index_template", "ilm_policy", "transform", "data_stream_ilm_policy" ], "type": "string" }, "Fleet_enrollment_api_key": { "title": "Enrollment API key", "required": [ "id", "api_key_id", "api_key", "active", "created_at" ], "type": "object", "properties": { "active": { "type": "boolean", "description": "When false, the enrollment API key is revoked and cannot be used for enrolling Elastic Agents." }, "api_key": { "type": "string", "description": "The enrollment API key (token) used for enrolling Elastic Agents." }, "api_key_id": { "type": "string", "description": "The ID of the API key in the Security API." }, "created_at": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string", "description": "The name of the enrollment API key." }, "policy_id": { "type": "string", "description": "The ID of the agent policy the Elastic Agent will be enrolled in." } } }, "Fleet_fleet_server_host": { "title": "Fleet Server Host", "required": [ "fleet_server_hosts", "id", "is_default", "is_preconfigured", "host_urls" ], "type": "object", "properties": { "host_urls": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "is_preconfigured": { "type": "boolean" }, "name": { "type": "string" }, "proxy_id": { "type": "string" } } }, "Fleet_fleet_settings_response": { "title": "Fleet settings response", "required": [ "item" ], "type": "object", "properties": { "item": { "$ref": "#/components/schemas/Fleet_settings" } } }, "Fleet_fleet_setup_response": { "title": "Fleet Setup response", "required": [ "isInitialized", "nonFatalErrors" ], "type": "object", "properties": { "isInitialized": { "type": "boolean" }, "nonFatalErrors": { "type": "array", "items": { "required": [ "name", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "name": { "type": "string" } } } } } }, "Fleet_fleet_status_response": { "title": "Fleet status response", "required": [ "isReady", "missing_requirements", "missing_optional_features" ], "type": "object", "properties": { "isReady": { "type": "boolean" }, "missing_optional_features": { "type": "array", "items": { "enum": [ "encrypted_saved_object_encryption_key_required" ], "type": "string" } }, "missing_requirements": { "type": "array", "items": { "enum": [ "tls_required", "api_keys", "fleet_admin_user", "fleet_server" ], "type": "string" } }, "package_verification_key_id": { "type": "string" } } }, "Fleet_full_agent_policy": { "title": "Full agent policy", "required": [ "id", "outputs", "inputs" ], "type": "object", "properties": { "agent": { "type": [ "null", "string" ] }, "fleet": { "oneOf": [ { "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "string" } }, "proxy_headers": { }, "proxy_url": { "type": "string" }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" }, "renegotiation": { "type": "string" }, "verification_mode": { "type": "string" } } } } }, { "type": "object", "properties": { "kibana": { "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "string" } }, "path": { "type": "string" }, "protocol": { "type": "string" } } } } } ] }, "id": { "type": "string" }, "inputs": { "type": "string" }, "monitoring": { "required": [ "enabled", "metrics", "logs", "traces" ], "type": "object", "properties": { "diagnostics": { "type": "object", "properties": { "limit": { "type": "object", "properties": { "burst": { "type": "number" }, "interval": { "type": "string" } } }, "uploader": { "type": "object", "properties": { "init_dur": { "type": "string" }, "max_dur": { "type": "string" }, "max_retries": { "type": "number" } } } } }, "enabled": { "type": "boolean" }, "http": { "required": [ "enabled" ], "type": "object", "properties": { "enabled": { "type": "boolean" }, "host": { "type": "string" }, "port": { "type": "number" } } }, "logs": { "type": "boolean" }, "metrics": { "type": "boolean" }, "namespace": { "type": "string" }, "pprof": { "required": [ "enabled" ], "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "traces": { "type": "boolean" }, "use_output": { "type": "string" } } }, "output_permissions": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/Fleet_full_agent_policy_output_permissions" }, "output": { "type": "integer" } } } }, "outputs": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Fleet_full_agent_policy_output" } }, "revision": { "type": "number" }, "secret_references": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" } } } } } }, "Fleet_full_agent_policy_input": { "title": "Full agent policy input", "allOf": [ { "required": [ "id", "name", "revision", "type", "data_stream", "use_output" ], "type": "object", "properties": { "data_stream": { "required": [ "namespace" ], "type": "object", "properties": { "namespace": { "type": "string" } } }, "id": { "type": "string" }, "meta": { "type": "object", "properties": { "package": { "required": [ "name", "version" ], "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" } } } } }, "name": { "type": "string" }, "revision": { "type": "number" }, "streams": { "$ref": "#/components/schemas/Fleet_full_agent_policy_input_stream" }, "type": { "type": "string" }, "use_output": { "type": "string" } } } ] }, "Fleet_full_agent_policy_input_stream": { "title": "Full agent policy input stream", "allOf": [ { "required": [ "id", "data_stream" ], "type": "object", "properties": { "data_stream": { "required": [ "dataset", "type" ], "type": "object", "properties": { "dataset": { "type": "string" }, "type": { "type": "string" } } }, "id": { "type": "string" } } } ] }, "Fleet_full_agent_policy_output": { "title": "Full agent policy", "required": [ "type", "hosts", "ca_sha256" ], "type": "object", "properties": { "additionalProperties": { "type": "object", "properties": { "text": { } } }, "ca_sha256": { "type": [ "null", "string" ] }, "hosts": { "type": "array", "items": { "type": "string" } }, "proxy_headers": { }, "proxy_url": { "type": "string" }, "type": { } } }, "Fleet_full_agent_policy_output_permissions": { "title": "Full agent policy output permissions", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "cluster": { "type": "array", "items": { "type": "string" } }, "indices": { "type": "array", "items": { "type": "object", "properties": { "names": { "type": "array", "items": { "type": "string" } }, "privileges": { "type": "array", "items": { "type": "string" } } } } } } }, "packagePolicyName": { "type": "string" } } } }, "Fleet_get_agent_tags_response": { "title": "Get Agent Tags response", "type": "object", "properties": { "items": { "type": "array", "items": { "type": "string" } } } }, "Fleet_get_agents_response": { "title": "Get Agent response", "required": [ "items", "total", "page", "perPage" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent" } }, "list": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_agent" }, "deprecated": true }, "page": { "type": "number" }, "perPage": { "type": "number" }, "statusSummary": { "type": "object", "properties": { "degraded'": { "type": "number" }, "enrolling": { "type": "number" }, "error": { "type": "number" }, "inactive": { "type": "number" }, "offline": { "type": "number" }, "online": { "type": "number" }, "unenrolled": { "type": "number" }, "unenrolling": { "type": "number" }, "updating": { "type": "number" } } }, "total": { "type": "number" } } }, "Fleet_get_bulk_assets_response": { "title": "Bulk get assets response", "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "appLink": { "type": "string" }, "attributes": { "type": "object", "properties": { "description": { "type": "string" }, "title": { "type": "string" } } }, "id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Fleet_saved_object_type" }, "updatedAt": { "type": "string" } } } } }, "deprecated": true }, "Fleet_get_categories_response": { "title": "Get categories response", "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "required": [ "id", "title", "count" ], "type": "object", "properties": { "count": { "type": "number" }, "id": { "type": "string" }, "title": { "type": "string" } } } }, "response": { "type": "array", "items": { "required": [ "id", "title", "count" ], "type": "object", "properties": { "count": { "type": "number" }, "id": { "type": "string" }, "title": { "type": "string" } }, "deprecated": true } } } }, "Fleet_get_packages_response": { "title": "Get Packages response", "required": [ "items" ], "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_search_result" } }, "response": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_search_result" }, "deprecated": true } } }, "Fleet_installation_info": { "title": "Installation info object", "required": [ "installed_kibana", "installed_es", "name", "version", "install_status", "install_version", "install_started_at", "install_source", "verification_status", "latest_install_failed_attempts" ], "type": "object", "properties": { "created_at": { "type": "string" }, "experimental_data_stream_features": { "type": "array", "items": { "type": "object", "properties": { "data_stream": { "type": "string" }, "features": { "type": "object", "properties": { "doc_value_only_numeric": { "type": [ "null", "boolean" ] }, "doc_value_only_other": { "type": [ "null", "boolean" ] }, "synthetic_source": { "type": [ "null", "boolean" ] }, "tsdb": { "type": [ "null", "boolean" ] } } } } } }, "install_format_schema_version": { "type": "string" }, "install_kibana_space_id": { "type": "string" }, "install_source": { "enum": [ "registry", "upload", "bundled" ], "type": "string" }, "install_status": { "enum": [ "installed", "installing", "install_failed" ], "type": "string" }, "installed_es": { "type": "object", "properties": { "deferred": { "type": "boolean" }, "id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Fleet_elasticsearch_asset_type" } } }, "installed_kibana": { "type": "object", "properties": { "id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Fleet_kibana_saved_object_type" } } }, "latest_executed_state": { "type": "object", "properties": { "error": { "type": "string" }, "name": { "enum": [ "create_restart_installation", "install_kibana_assets", "install_ilm_policies", "install_ml_model", "install_index_template_pipelines", "remove_legacy_templates", "update_current_write_indices", "install_transforms", "delete_previous_pipelines", "save_archive_entries_from_assets_map", "update_so" ], "type": "string" }, "started_at": { "type": "string" } }, "description": "Latest successfully executed state in package install state machine" }, "latest_install_failed_attempts": { "type": "array", "items": { "type": "object", "properties": { "created_at": { "type": "string" }, "error": { "type": "object", "properties": { "message": { "type": "string" }, "name": { "type": "string" }, "stack": { "type": "string" } } }, "target_version": { "type": "string" } } }, "description": "Latest failed install errors" }, "name": { "type": "string" }, "namespaces": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string" }, "updated_at": { "type": "string" }, "verification_key_id": { "type": [ "null", "string" ] }, "verification_status": { "enum": [ "verified", "unverified", "unknown" ], "type": "string" }, "version": { "type": "string" } } }, "Fleet_kibana_saved_object_type": { "title": "Kibana saved object asset type", "enum": [ "dashboard", "visualization", "search", "index-pattern", "map", "lens", "ml-module", "security-rule", "csp_rule_template" ], "type": "string" }, "Fleet_new_package_policy": { "title": "New package policy", "required": [ "inputs", "name" ], "type": "object", "properties": { "description": { "type": "string" }, "enabled": { "type": "boolean" }, "inputs": { "type": "array", "items": { "required": [ "type", "enabled" ], "type": "object", "properties": { "config": { "type": "object" }, "enabled": { "type": "boolean" }, "processors": { "type": "array", "items": { "type": "string" } }, "streams": { "type": "array", "items": { } }, "type": { "type": "string" }, "vars": { "type": "object" } } } }, "name": { "type": "string" }, "namespace": { "type": "string" }, "output_id": { "type": "string" }, "overrides": { "type": "object" }, "package": { "required": [ "name", "version" ], "type": "object", "properties": { "name": { "type": "string" }, "requires_root": { "type": "boolean" }, "title": { "type": "string" }, "version": { "type": "string" } } }, "policy_id": { "type": [ "null", "string" ], "deprecated": true }, "policy_ids": { "type": "array", "items": { "type": "string" } } }, "description": "" }, "Fleet_output_create_request": { "title": "Output", "oneOf": [ { "$ref": "#/components/schemas/Fleet_output_create_request_elasticsearch" }, { "$ref": "#/components/schemas/Fleet_output_create_request_kafka" }, { "$ref": "#/components/schemas/Fleet_output_create_request_logstash" }, { "$ref": "#/components/schemas/Fleet_output_create_request_remote_elasticsearch" } ], "discriminator": { "propertyName": "type", "mapping": { "elasticsearch": "#/components/schemas/Fleet_output_create_request_elasticsearch", "kafka": "#/components/schemas/Fleet_output_create_request_kafka", "logstash": "#/components/schemas/Fleet_output_create_request_logstash", "remote_elasticsearch": "#/components/schemas/Fleet_output_create_request_remote_elasticsearch" } } }, "Fleet_output_create_request_elasticsearch": { "title": "elasticsearch", "required": [ "name" ], "type": "object", "properties": { "ca_sha256": { "type": "string" }, "ca_trusted_fingerprint": { "type": "string" }, "config": { "type": "object" }, "config_yaml": { "type": "string" }, "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "preset": { "enum": [ "balanced", "custom", "throughput", "scale", "latency" ], "type": "string" }, "proxy_id": { "type": "string" }, "shipper": { "type": "object", "properties": { "compression_level": { "type": "number" }, "disk_queue_compression_enabled": { "type": "boolean" }, "disk_queue_enabled": { "type": "boolean" }, "disk_queue_encryption_enabled": { "type": "boolean" }, "disk_queue_max_size": { "type": "number" }, "disk_queue_path": { "type": "string" }, "loadbalance": { "type": "boolean" } } }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" } } }, "type": { "enum": [ "elasticsearch" ], "type": "string" } } }, "Fleet_output_create_request_kafka": { "title": "kafka", "required": [ "name", "type", "topics", "auth_type", "hosts" ], "type": "object", "properties": { "auth_type": { "type": "string" }, "broker_timeout": { "type": "number" }, "ca_sha256": { "type": "string" }, "ca_trusted_fingerprint": { "type": "string" }, "client_id": { "type": "string" }, "compression": { "type": "string" }, "compression_level": { "type": "number" }, "config": { "type": "object" }, "config_yaml": { "type": "string" }, "connection_type": { "enum": [ "plaintext", "encryption" ], "type": "string" }, "headers": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } }, "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "key": { "type": "string" }, "name": { "type": "string" }, "partition": { "type": "string" }, "password": { "type": "string" }, "proxy_id": { "type": "string" }, "random": { "type": "object", "properties": { "group_events": { "type": "number" } } }, "required_acks": { "type": "number" }, "round_robin": { "type": "object", "properties": { "group_events": { "type": "number" } } }, "sasl": { "type": "object", "properties": { "mechanism": { "type": "string" } } }, "secrets": { "type": "object", "properties": { "password": { "type": "string" }, "ssl": { "type": "object", "properties": { "key": { "type": "string" } } } } }, "shipper": { "type": "object", "properties": { "compression_level": { "type": "number" }, "disk_queue_compression_enabled": { "type": "boolean" }, "disk_queue_enabled": { "type": "boolean" }, "disk_queue_encryption_enabled": { "type": "boolean" }, "disk_queue_max_size": { "type": "number" }, "disk_queue_path": { "type": "string" }, "loadbalance": { "type": "boolean" } } }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" }, "verification_mode": { "enum": [ "none", "full", "certificate", "strict" ], "type": "string" } } }, "timeout": { "type": "number" }, "topic": { "type": "string" }, "topics": { "type": "array", "items": { "type": "object", "properties": { "topic": { "type": "string" }, "when": { "type": "object", "properties": { "condition": { "type": "string" }, "type": { "type": "string" } }, "description": "Deprecated, kafka output do not support conditionnal topics anymore.", "deprecated": true } } }, "description": "Use topic instead.", "deprecated": true }, "type": { "enum": [ "kafka" ], "type": "string" }, "username": { "type": "string" }, "version": { "type": "string" } } }, "Fleet_output_create_request_logstash": { "title": "logstash", "required": [ "name", "hosts", "type" ], "type": "object", "properties": { "ca_sha256": { "type": "string" }, "ca_trusted_fingerprint": { "type": "string" }, "config": { "type": "object" }, "config_yaml": { "type": "string" }, "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "proxy_id": { "type": "string" }, "secrets": { "type": "object", "properties": { "ssl": { "type": "object", "properties": { "key": { "type": "string" } } } } }, "shipper": { "type": "object", "properties": { "compression_level": { "type": "number" }, "disk_queue_compression_enabled": { "type": "boolean" }, "disk_queue_enabled": { "type": "boolean" }, "disk_queue_encryption_enabled": { "type": "boolean" }, "disk_queue_max_size": { "type": "number" }, "disk_queue_path": { "type": "string" }, "loadbalance": { "type": "boolean" } } }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" } } }, "type": { "enum": [ "logstash" ], "type": "string" } } }, "Fleet_output_create_request_remote_elasticsearch": { "title": "remote_elasticsearch", "required": [ "name" ], "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "secrets": { "type": "object", "properties": { "service_token": { "type": "string" } } }, "service_token": { "type": "string" }, "type": { "enum": [ "remote_elasticsearch" ], "type": "string" } } }, "Fleet_output_update_request": { "title": "Output", "oneOf": [ { "$ref": "#/components/schemas/Fleet_output_update_request_elasticsearch" }, { "$ref": "#/components/schemas/Fleet_output_update_request_kafka" }, { "$ref": "#/components/schemas/Fleet_output_update_request_logstash" } ], "discriminator": { "propertyName": "type", "mapping": { "elasticsearch": "#/components/schemas/Fleet_output_update_request_elasticsearch", "kafka": "#/components/schemas/Fleet_output_update_request_kafka", "logstash": "#/components/schemas/Fleet_output_update_request_logstash" } } }, "Fleet_output_update_request_elasticsearch": { "title": "elasticsearch", "required": [ "name", "hosts", "type" ], "type": "object", "properties": { "ca_sha256": { "type": "string" }, "ca_trusted_fingerprint": { "type": "string" }, "config": { "type": "object" }, "config_yaml": { "type": "string" }, "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "preset": { "enum": [ "balanced", "custom", "throughput", "scale", "latency" ], "type": "string" }, "proxy_id": { "type": "string" }, "shipper": { "type": "object", "properties": { "compression_level": { "type": "number" }, "disk_queue_compression_enabled": { "type": "boolean" }, "disk_queue_enabled": { "type": "boolean" }, "disk_queue_encryption_enabled": { "type": "boolean" }, "disk_queue_max_size": { "type": "number" }, "disk_queue_path": { "type": "string" }, "loadbalance": { "type": "boolean" } } }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" } } }, "type": { "enum": [ "elasticsearch" ], "type": "string" } } }, "Fleet_output_update_request_kafka": { "title": "kafka", "required": [ "name" ], "type": "object", "properties": { "auth_type": { "type": "string" }, "broker_timeout": { "type": "number" }, "ca_sha256": { "type": "string" }, "ca_trusted_fingerprint": { "type": "string" }, "client_id": { "type": "string" }, "compression": { "type": "string" }, "compression_level": { "type": "number" }, "config": { "type": "object" }, "config_yaml": { "type": "string" }, "connection_type": { "enum": [ "plaintext", "encryption" ], "type": "string" }, "headers": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } }, "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "key": { "type": "string" }, "name": { "type": "string" }, "partition": { "type": "string" }, "password": { "type": "string" }, "proxy_id": { "type": "string" }, "random": { "type": "object", "properties": { "group_events": { "type": "number" } } }, "required_acks": { "type": "number" }, "round_robin": { "type": "object", "properties": { "group_events": { "type": "number" } } }, "sasl": { "type": "object", "properties": { "mechanism": { "type": "string" } } }, "shipper": { "type": "object", "properties": { "compression_level": { "type": "number" }, "disk_queue_compression_enabled": { "type": "boolean" }, "disk_queue_enabled": { "type": "boolean" }, "disk_queue_encryption_enabled": { "type": "boolean" }, "disk_queue_max_size": { "type": "number" }, "disk_queue_path": { "type": "string" }, "loadbalance": { "type": "boolean" } } }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" }, "verification_mode": { "enum": [ "none", "full", "certificate", "strict" ], "type": "string" } } }, "timeout": { "type": "number" }, "topic": { "type": "string" }, "topics": { "type": "array", "items": { "type": "object", "properties": { "topic": { "type": "string" }, "when": { "type": "object", "properties": { "condition": { "type": "string" }, "type": { "type": "string" } }, "description": "Deprecated, kafka output do not support conditionnal topics anymore.", "deprecated": true } } }, "description": "Use topic instead.", "deprecated": true }, "type": { "enum": [ "kafka" ], "type": "string" }, "username": { "type": "string" }, "version": { "type": "string" } } }, "Fleet_output_update_request_logstash": { "title": "logstash", "required": [ "name" ], "type": "object", "properties": { "ca_sha256": { "type": "string" }, "ca_trusted_fingerprint": { "type": "string" }, "config": { "type": "object" }, "config_yaml": { "type": "string" }, "hosts": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "is_default": { "type": "boolean" }, "is_default_monitoring": { "type": "boolean" }, "is_internal": { "type": "boolean" }, "name": { "type": "string" }, "proxy_id": { "type": "string" }, "shipper": { "type": "object", "properties": { "compression_level": { "type": "number" }, "disk_queue_compression_enabled": { "type": "boolean" }, "disk_queue_enabled": { "type": "boolean" }, "disk_queue_encryption_enabled": { "type": "boolean" }, "disk_queue_max_size": { "type": "number" }, "disk_queue_path": { "type": "string" }, "loadbalance": { "type": "boolean" } } }, "ssl": { "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "array", "items": { "type": "string" } }, "key": { "type": "string" } } }, "type": { "enum": [ "logstash" ], "type": "string" } } }, "Fleet_package_info": { "title": "Package information", "required": [ "name", "title", "version", "description", "type", "categories", "conditions", "assets", "format_version", "download", "path", "owner" ], "type": "object", "properties": { "agent": { "type": "object", "properties": { "privileges": { "type": "object", "properties": { "root": { "type": "boolean" } } } } }, "asset_tags": { "type": "array", "items": { "required": [ "text" ], "type": "object", "properties": { "asset_ids": { "type": "array", "items": { "type": "string" } }, "asset_types": { "type": "array", "items": { "type": "string" } }, "text": { "type": "string" } } } }, "assets": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string" } }, "conditions": { "type": "object", "properties": { "elasticsearch": { "type": "object", "properties": { "subscription": { "enum": [ "basic", "gold", "platinum", "enterprise" ], "type": "string" } } }, "kibana": { "type": "object", "properties": { "versions": { "type": "string" } } } } }, "data_streams": { "type": "array", "items": { "required": [ "title", "name", "release", "ingeset_pipeline", "type", "package" ], "type": "object", "properties": { "ingeset_pipeline": { "type": "string" }, "name": { "type": "string" }, "package": { "type": "string" }, "release": { "type": "string" }, "title": { "type": "string" }, "type": { "type": "string" }, "vars": { "type": "array", "items": { "required": [ "name", "default" ], "type": "object", "properties": { "default": { "type": "string" }, "name": { "type": "string" } } } } } } }, "description": { "type": "string" }, "discovery": { "type": "object", "properties": { "fields": { "type": "array", "items": { "required": [ "name" ], "type": "object", "properties": { "name": { "type": "string" } } } } } }, "download": { "type": "string" }, "elasticsearch": { "type": "object", "properties": { "privileges": { "type": "object", "properties": { "cluster": { "type": "array", "items": { "type": "string" } } } } } }, "format_version": { "type": "string" }, "icons": { "type": "array", "items": { "type": "string" } }, "internal": { "type": "boolean" }, "name": { "type": "string" }, "owner": { "required": [ "github" ], "type": "object", "properties": { "github": { "type": "string" }, "type": { "enum": [ "elastic", "partner", "community" ], "type": "string" } } }, "path": { "type": "string" }, "readme": { "type": "string" }, "release": { "enum": [ "experimental", "beta", "ga" ], "type": "string", "description": "release label is deprecated, derive from the version instead (packages follow semver)", "deprecated": true }, "screenshots": { "type": "array", "items": { "required": [ "src", "path" ], "type": "object", "properties": { "path": { "type": "string" }, "size": { "type": "string" }, "src": { "type": "string" }, "title": { "type": "string" }, "type": { "type": "string" } } } }, "source": { "type": "object", "properties": { "license": { "enum": [ "Apache-2.0", "Elastic-2.0" ], "type": "string" } } }, "title": { "type": "string" }, "type": { "enum": [ "integration", "input", "content" ], "type": "string" }, "version": { "type": "string" } } }, "Fleet_package_policy": { "title": "Package policy", "allOf": [ { "required": [ "id", "revision" ], "type": "object", "properties": { "id": { "type": "string" }, "inputs": { "oneOf": [ { "type": "array", "items": { } }, { "type": "object" } ] }, "revision": { "type": "number" } } }, { "$ref": "#/components/schemas/Fleet_new_package_policy" } ] }, "Fleet_package_policy_request": { "title": "Package Policy Request", "required": [ "name", "package" ], "type": "object", "properties": { "description": { "type": "string", "description": "Package policy description", "example": "my description" }, "force": { "type": "boolean", "description": "Force package policy creation even if package is not verified, or if the agent policy is managed." }, "id": { "type": "string", "description": "Package policy unique identifier" }, "inputs": { "type": "object", "additionalProperties": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "enable or disable that input, (default to true)" }, "streams": { "type": "object", "additionalProperties": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "enable or disable that stream, (default to true)" }, "vars": { "type": "object", "description": "Stream level variable (see integration documentation for more information)" } } }, "description": "Input streams (see integration documentation to know what streams are available)" }, "vars": { "type": "object", "description": "Input level variable (see integration documentation for more information)" } } }, "description": "Package policy inputs (see integration documentation to know what inputs are available)", "example": { "nginx-logfile": { "enabled": true, "streams": { "nginx.access": { "enabled": true, "vars": { "ignore_older": "72h", "paths": [ "/var/log/nginx/access.log*" ], "preserve_original_event": false, "tags": [ "nginx-access" ] } } } } } }, "name": { "type": "string", "description": "Package policy name (should be unique)", "example": "nginx-123" }, "namespace": { "type": "string", "description": "The package policy namespace. Leave blank to inherit the agent policy's namespace.", "example": "customnamespace" }, "output_id": { "type": [ "null", "string" ], "description": "Output ID to send package data to", "example": "output-id" }, "overrides": { "type": [ "null", "object" ], "properties": { "inputs": { "type": "object" } }, "description": "Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure." }, "package": { "required": [ "name", "version" ], "type": "object", "properties": { "name": { "type": "string", "description": "Package name", "example": "nginx" }, "version": { "type": "string", "description": "Package version", "example": "1.6.0" } } }, "policy_id": { "type": [ "null", "string" ], "description": "Agent policy ID where that package policy will be added", "example": "agent-policy-id", "deprecated": true }, "policy_ids": { "type": "array", "items": { "type": "string" }, "description": "Agent policy IDs where that package policy will be added", "example": [ "agent-policy-id" ] }, "vars": { "type": "object", "description": "Package root level variable (see integration documentation for more information)" } } }, "Fleet_package_usage_stats": { "title": "Package usage stats", "required": [ "agent_policy_count" ], "type": "object", "properties": { "agent_policy_count": { "type": "integer" } } }, "Fleet_proxies": { "title": "Fleet Proxy", "required": [ "name", "url" ], "type": "object", "properties": { "certificate": { "type": "string" }, "certificate_authorities": { "type": "string" }, "certificate_key": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "proxy_headers": { "type": "object" }, "url": { "type": "string" } } }, "Fleet_saved_object_type": { "title": "Saved Object type", "oneOf": [ { "enum": [ "dashboard", "visualization", "search", "index_pattern", "map", "lens", "security_rule", "csp_rule_template", "ml_module", "tag", "osquery_pack_asset", "osquery_saved_query" ], "type": "string" }, { "enum": [ "index", "component_template", "ingest_pipeline", "index_template", "ilm_policy", "transform", "data_stream_ilm_policy", "ml_model" ], "type": "string" } ] }, "Fleet_search_result": { "title": "Search result", "required": [ "description", "download", "icons", "name", "path", "title", "type", "version", "status" ], "type": "object", "properties": { "description": { "type": "string" }, "download": { "type": "string" }, "icons": { "type": "string" }, "installationInfo": { "$ref": "#/components/schemas/Fleet_installation_info" }, "name": { "type": "string" }, "path": { "type": "string" }, "savedObject": { "type": "object", "deprecated": true }, "status": { "type": "string" }, "title": { "type": "string" }, "type": { "type": "string" }, "version": { "type": "string" } } }, "Fleet_settings": { "title": "Settings", "required": [ "fleet_server_hosts", "id" ], "type": "object", "properties": { "delete_unenrolled_agents": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "is_preconfigured": { "type": "boolean" } } }, "fleet_server_hosts": { "type": "array", "items": { "type": "string" }, "deprecated": true }, "has_seen_add_data_notice": { "type": "boolean" }, "id": { "type": "string" }, "prerelease_integrations_enabled": { "type": "boolean" } } }, "Fleet_upgrade_agent": { "title": "Upgrade agent", "required": [ "version" ], "type": "object", "properties": { "force": { "type": "boolean", "description": "Force upgrade, skipping validation (should be used with caution)" }, "skipRateLimitCheck": { "type": "boolean", "description": "Skip rate limit check for upgrade" }, "source_uri": { "type": "string" }, "version": { "type": "string" } } }, "Fleet_upgrade_agent_diff": { "title": "Package policy Upgrade dryrun", "type": "array", "items": { "type": "array", "items": { "$ref": "#/components/schemas/Fleet_full_agent_policy_input" } } }, "Fleet_upgrade_diff": { "title": "Package policy Upgrade dryrun", "type": "array", "items": { "allOf": [ { "$ref": "#/components/schemas/Fleet_package_policy" }, { "type": "object", "allOf": [ { "$ref": "#/components/schemas/Fleet_new_package_policy" }, { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "message": { "type": "string" } } } }, "missingVars": { "type": "array", "items": { "type": "string" } } } } ] } ] } }, "Kibana_HTTP_APIs_core_status_redactedResponse": { "required": [ "status" ], "type": "object", "properties": { "status": { "required": [ "overall" ], "type": "object", "properties": { "overall": { "required": [ "level" ], "type": "object", "properties": { "level": { "enum": [ "available", "degraded", "unavailable", "critical" ], "type": "string", "description": "Service status levels as human and machine readable values." } }, "additionalProperties": false } }, "additionalProperties": false } }, "additionalProperties": false, "description": "A minimal representation of Kibana's operational status." }, "Kibana_HTTP_APIs_core_status_response": { "required": [ "name", "uuid", "version", "status", "metrics" ], "type": "object", "properties": { "metrics": { "required": [ "elasticsearch_client", "last_updated", "collection_interval_in_millis" ], "type": "object", "properties": { "collection_interval_in_millis": { "type": "number", "description": "The interval at which metrics should be collected." }, "elasticsearch_client": { "required": [ "totalActiveSockets", "totalIdleSockets", "totalQueuedRequests" ], "type": "object", "properties": { "totalActiveSockets": { "type": "number", "description": "Count of network sockets currently in use." }, "totalIdleSockets": { "type": "number", "description": "Count of network sockets currently idle." }, "totalQueuedRequests": { "type": "number", "description": "Count of requests not yet assigned to sockets." } }, "additionalProperties": false, "description": "Current network metrics of Kibana's Elasticsearch client." }, "last_updated": { "type": "string", "description": "The time metrics were collected." } }, "additionalProperties": false, "description": "Metric groups collected by Kibana." }, "name": { "type": "string", "description": "Kibana instance name." }, "status": { "required": [ "overall", "core", "plugins" ], "type": "object", "properties": { "core": { "required": [ "elasticsearch", "savedObjects" ], "type": "object", "properties": { "elasticsearch": { "required": [ "level", "summary", "meta" ], "type": "object", "properties": { "detail": { "type": "string", "description": "Human readable detail of the service status." }, "documentationUrl": { "type": "string", "description": "A URL to further documentation regarding this service." }, "level": { "enum": [ "available", "degraded", "unavailable", "critical" ], "type": "string", "description": "Service status levels as human and machine readable values." }, "meta": { "type": "object", "additionalProperties": { }, "description": "An unstructured set of extra metadata about this service." }, "summary": { "type": "string", "description": "A human readable summary of the service status." } }, "additionalProperties": false }, "savedObjects": { "required": [ "level", "summary", "meta" ], "type": "object", "properties": { "detail": { "type": "string", "description": "Human readable detail of the service status." }, "documentationUrl": { "type": "string", "description": "A URL to further documentation regarding this service." }, "level": { "enum": [ "available", "degraded", "unavailable", "critical" ], "type": "string", "description": "Service status levels as human and machine readable values." }, "meta": { "type": "object", "additionalProperties": { }, "description": "An unstructured set of extra metadata about this service." }, "summary": { "type": "string", "description": "A human readable summary of the service status." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Statuses of core Kibana services." }, "overall": { "required": [ "level", "summary", "meta" ], "type": "object", "properties": { "detail": { "type": "string", "description": "Human readable detail of the service status." }, "documentationUrl": { "type": "string", "description": "A URL to further documentation regarding this service." }, "level": { "enum": [ "available", "degraded", "unavailable", "critical" ], "type": "string", "description": "Service status levels as human and machine readable values." }, "meta": { "type": "object", "additionalProperties": { }, "description": "An unstructured set of extra metadata about this service." }, "summary": { "type": "string", "description": "A human readable summary of the service status." } }, "additionalProperties": false }, "plugins": { "type": "object", "additionalProperties": { "required": [ "level", "summary", "meta" ], "type": "object", "properties": { "detail": { "type": "string", "description": "Human readable detail of the service status." }, "documentationUrl": { "type": "string", "description": "A URL to further documentation regarding this service." }, "level": { "enum": [ "available", "degraded", "unavailable", "critical" ], "type": "string", "description": "Service status levels as human and machine readable values." }, "meta": { "type": "object", "additionalProperties": { }, "description": "An unstructured set of extra metadata about this service." }, "summary": { "type": "string", "description": "A human readable summary of the service status." } }, "additionalProperties": false }, "description": "A dynamic mapping of plugin ID to plugin status." } }, "additionalProperties": false }, "uuid": { "type": "string", "description": "Unique, generated Kibana instance UUID. This UUID should persist even if the Kibana process restarts." }, "version": { "required": [ "number", "build_hash", "build_number", "build_snapshot", "build_flavor", "build_date" ], "type": "object", "properties": { "build_date": { "type": "string", "description": "The date and time of this build." }, "build_flavor": { "enum": [ "serverless", "traditional" ], "type": "string", "description": "The build flavour determines configuration and behavior of Kibana. On premise users will almost always run the \"traditional\" flavour, while other flavours are reserved for Elastic-specific use cases." }, "build_hash": { "type": "string", "description": "A unique hash value representing the git commit of this Kibana build." }, "build_number": { "type": "number", "description": "A monotonically increasing number, each subsequent build will have a higher number." }, "build_snapshot": { "type": "boolean", "description": "Whether this build is a snapshot build." }, "number": { "type": "string", "description": "A semantic version number." } }, "additionalProperties": false } }, "additionalProperties": false, "description": "Kibana's operational status as well as a detailed breakdown of plugin statuses indication of various loads (like event loop utilization and network traffic) at time of request." }, "Machine_learning_APIs_mlSync200Response": { "title": "Successful sync API response", "type": "object", "properties": { "datafeedsAdded": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds" }, "description": "If a saved object for an anomaly detection job is missing a datafeed identifier, it is added when you run the sync machine learning saved objects API." }, "datafeedsRemoved": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds" }, "description": "If a saved object for an anomaly detection job references a datafeed that no longer exists, it is deleted when you run the sync machine learning saved objects API." }, "savedObjectsCreated": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsCreated" }, "savedObjectsDeleted": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted" } } }, "Machine_learning_APIs_mlSync4xxResponse": { "title": "Unsuccessful sync API response", "type": "object", "properties": { "error": { "type": "string", "example": "Unauthorized" }, "message": { "type": "string" }, "statusCode": { "type": "integer", "example": 401 } } }, "Machine_learning_APIs_mlSyncResponseAnomalyDetectors": { "title": "Sync API response for anomaly detection jobs", "type": "object", "properties": { "success": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess" } }, "description": "The sync machine learning saved objects API response contains this object when there are anomaly detection jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status." }, "Machine_learning_APIs_mlSyncResponseDatafeeds": { "title": "Sync API response for datafeeds", "type": "object", "properties": { "success": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess" } }, "description": "The sync machine learning saved objects API response contains this object when there are datafeeds affected by the synchronization. There is an object for each relevant datafeed, which contains the synchronization status." }, "Machine_learning_APIs_mlSyncResponseDataFrameAnalytics": { "title": "Sync API response for data frame analytics jobs", "type": "object", "properties": { "success": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess" } }, "description": "The sync machine learning saved objects API response contains this object when there are data frame analytics jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status." }, "Machine_learning_APIs_mlSyncResponseSavedObjectsCreated": { "title": "Sync API response for created saved objects", "type": "object", "properties": { "anomaly-detector": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors" }, "description": "If saved objects are missing for anomaly detection jobs, they are created." }, "data-frame-analytics": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics" }, "description": "If saved objects are missing for data frame analytics jobs, they are created." }, "trained-model": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels" }, "description": "If saved objects are missing for trained models, they are created." } }, "description": "If saved objects are missing for machine learning jobs or trained models, they are created when you run the sync machine learning saved objects API." }, "Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted": { "title": "Sync API response for deleted saved objects", "type": "object", "properties": { "anomaly-detector": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors" }, "description": "If there are saved objects exist for nonexistent anomaly detection jobs, they are deleted." }, "data-frame-analytics": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics" }, "description": "If there are saved objects exist for nonexistent data frame analytics jobs, they are deleted." }, "trained-model": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels" }, "description": "If there are saved objects exist for nonexistent trained models, they are deleted." } }, "description": "If saved objects exist for machine learning jobs or trained models that no longer exist, they are deleted when you run the sync machine learning saved objects API." }, "Machine_learning_APIs_mlSyncResponseSuccess": { "type": "boolean", "description": "The success or failure of the synchronization." }, "Machine_learning_APIs_mlSyncResponseTrainedModels": { "title": "Sync API response for trained models", "type": "object", "properties": { "success": { "$ref": "#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess" } }, "description": "The sync machine learning saved objects API response contains this object when there are trained models affected by the synchronization. There is an object for each relevant trained model, which contains the synchronization status." }, "Saved_objects_400_response": { "title": "Bad request", "required": [ "error", "message", "statusCode" ], "type": "object", "properties": { "error": { "enum": [ "Bad Request" ], "type": "string" }, "message": { "type": "string" }, "statusCode": { "enum": [ 400 ], "type": "integer" } } }, "Saved_objects_attributes": { "type": "object", "description": "The data that you want to create. WARNING: When you create saved objects, attributes are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.\n" }, "Saved_objects_initial_namespaces": { "type": "array", "description": "Identifiers for the spaces in which this object is created. If this is provided, the object is created only in the explicitly defined spaces. If this is not provided, the object is created in the current space (default behavior). For shareable object types (registered with `namespaceType: 'multiple'`), this option can be used to specify one or more spaces, including the \"All spaces\" identifier ('*'). For isolated object types (registered with `namespaceType: 'single'` or `namespaceType: 'multiple-isolated'`), this option can only be used to specify a single space, and the \"All spaces\" identifier ('*') is not allowed. For global object types (`registered with `namespaceType: agnostic`), this option cannot be used.\n" }, "Saved_objects_references": { "type": "array", "description": "Objects with `name`, `id`, and `type` properties that describe the other saved objects that this object references. Use `name` in attributes to refer to the other saved object, but never the `id`, which can update automatically during migrations or import and export.\n" }, "Security_AI_Assistant_API_AnonymizationFieldCreateProps": { "required": [ "field" ], "type": "object", "properties": { "allowed": { "type": "boolean", "description": "Whether this field is allowed to be sent to the model.", "example": true }, "anonymized": { "type": "boolean", "description": "Whether this field should be anonymized.", "example": false }, "field": { "type": "string", "description": "Name of the anonymization field to create.", "example": "host.name" } } }, "Security_AI_Assistant_API_AnonymizationFieldDetailsInError": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the anonymization field.", "example": "field12" }, "name": { "type": "string", "description": "Name of the anonymization field.", "example": "host.name" } } }, "Security_AI_Assistant_API_AnonymizationFieldResponse": { "required": [ "id", "field" ], "type": "object", "properties": { "allowed": { "type": "boolean", "description": "Whether this field is allowed to be sent to the model.", "example": true }, "anonymized": { "type": "boolean", "description": "Whether this field should be anonymized.", "example": false }, "createdAt": { "type": "string", "description": "Timestamp of when the anonymization field was created.", "example": "2023-10-31T12:00:00Z" }, "createdBy": { "type": "string", "description": "Username of the person who created the anonymization field.", "example": "user1" }, "field": { "type": "string", "description": "Name of the anonymization field.", "example": "url.domain" }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "namespace": { "type": "string", "description": "Kibana space in which this anonymization field exists.", "example": "default" }, "timestamp": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp" }, "updatedAt": { "type": "string", "description": "Timestamp of the last update.", "example": "2023-10-31T12:00:00Z" }, "updatedBy": { "type": "string", "description": "Username of the person who last updated the field.", "example": "user1" } } }, "Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason": { "enum": [ "ANONYMIZATION_FIELD_NOT_MODIFIED" ], "type": "string", "description": "Reason why the anonymization field was not modified." }, "Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult": { "required": [ "id", "skip_reason" ], "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the anonymization field that was not modified.", "example": "field4" }, "name": { "type": "string", "description": "Name of the anonymization field that was not modified.", "example": "user.name" }, "skip_reason": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason" } } }, "Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse": { "required": [ "attributes" ], "type": "object", "properties": { "anonymization_fields_count": { "type": "integer", "description": "Total number of anonymization fields processed.", "example": 5 }, "attributes": { "required": [ "results", "summary" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NormalizedAnonymizationFieldError" }, "description": "List of errors that occurred during the bulk operation." }, "results": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults" }, "summary": { "$ref": "#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary" } } }, "message": { "type": "string", "description": "Message providing information about the bulk action result.", "example": "Bulk action completed successfully" }, "status_code": { "type": "integer", "description": "HTTP status code returned.", "example": 200 }, "success": { "type": "boolean", "description": "Indicates if the bulk action was successful.", "example": true } } }, "Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults": { "required": [ "updated", "created", "deleted", "skipped" ], "type": "object", "properties": { "created": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse" }, "description": "List of anonymization fields successfully created." }, "deleted": { "type": "array", "items": { "type": "string", "description": "Array of IDs of anonymization fields that were deleted.", "example": "field3" } }, "skipped": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult" }, "description": "List of anonymization fields that were skipped during the operation." }, "updated": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse" }, "description": "List of anonymization fields successfully updated." } } }, "Security_AI_Assistant_API_AnonymizationFieldUpdateProps": { "required": [ "id" ], "type": "object", "properties": { "allowed": { "type": "boolean", "description": "Whether this field is allowed to be sent to the model.", "example": true }, "anonymized": { "type": "boolean", "description": "Whether this field should be anonymized.", "example": false }, "id": { "type": "string", "description": "The ID of the anonymization field to update.", "example": "field8" } } }, "Security_AI_Assistant_API_ApiConfig": { "required": [ "connectorId", "actionTypeId" ], "type": "object", "properties": { "actionTypeId": { "type": "string", "description": "Action type ID", "example": "actionType456" }, "connectorId": { "type": "string", "description": "Connector ID", "example": "connector123" }, "defaultSystemPromptId": { "type": "string", "description": "Default system prompt ID", "example": "systemPrompt001" }, "model": { "type": "string", "description": "Model", "example": "gpt-4" }, "provider": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Provider" } } }, "Security_AI_Assistant_API_BaseContentReference": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "type": "string", "description": "Id of the content reference", "example": "content123" }, "type": { "type": "string", "description": "Type of the content reference", "example": "SecurityAlert" } }, "description": "The basis of a content reference" }, "Security_AI_Assistant_API_BulkCrudActionSummary": { "required": [ "failed", "skipped", "succeeded", "total" ], "type": "object", "properties": { "failed": { "type": "integer", "description": "The number of failed actions.", "example": 0 }, "skipped": { "type": "integer", "description": "The number of skipped actions.", "example": 1 }, "succeeded": { "type": "integer", "description": "The number of successfully performed actions.", "example": 10 }, "total": { "type": "integer", "description": "The total number of actions attempted.", "example": 12 } } }, "Security_AI_Assistant_API_ChatCompleteProps": { "required": [ "messages", "persist", "connectorId" ], "type": "object", "properties": { "connectorId": { "type": "string", "description": "Required connector identifier to route the request.", "example": "conn-001" }, "conversationId": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "isStream": { "type": "boolean", "description": "If true, the response will be streamed in chunks.", "example": true }, "langSmithApiKey": { "type": "string", "description": "API key for LangSmith integration.", "example": "sk-abc123" }, "langSmithProject": { "type": "string", "description": "LangSmith project name for tracing.", "example": "security_ai_project" }, "messages": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ChatMessage" }, "description": "List of chat messages exchanged so far." }, "model": { "type": "string", "description": "Model ID or name to use for the response.", "example": "gpt-4" }, "persist": { "type": "boolean", "description": "Whether to persist the chat and response to storage.", "example": true }, "promptId": { "type": "string", "description": "Prompt template identifier.", "example": "prompt_001" }, "responseLanguage": { "type": "string", "description": "ISO language code for the assistant's response.", "example": "en" } }, "description": "The request payload for creating a chat completion.", "example": { "connectorId": "conn-001", "conversationId": "abc123", "isStream": true, "langSmithApiKey": "sk-abc123", "langSmithProject": "security_ai_project", "messages": [ { "content": "How do I detect ransomware on my endpoints?", "data": { "device_id": "device-567" }, "fields_to_anonymize": [ "device.name", "file.path" ], "role": "user" } ], "model": "gpt-4", "persist": true, "promptId": "prompt_456", "responseLanguage": "en" } }, "Security_AI_Assistant_API_ChatMessage": { "required": [ "role" ], "type": "object", "properties": { "content": { "type": "string", "description": "The textual content of the message.", "example": "What security incidents have been reported today?" }, "data": { "$ref": "#/components/schemas/Security_AI_Assistant_API_MessageData" }, "fields_to_anonymize": { "type": "array", "items": { "type": "string" }, "description": "List of field names within the data object that should be anonymized.", "example": [ "user.name", "source.ip" ] }, "role": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ChatMessageRole" } }, "description": "A message exchanged within the AI chat conversation." }, "Security_AI_Assistant_API_ChatMessageRole": { "enum": [ "system", "user", "assistant" ], "type": "string", "description": "The role associated with the message in the chat.", "example": "user" }, "Security_AI_Assistant_API_ContentReferences": { "type": "object", "additionalProperties": { "oneOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryContentReference" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_SecurityAlertContentReference" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_SecurityAlertsPageContentReference" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_ProductDocumentationContentReference" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_EsqlContentReference" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_HrefContentReference" } ] }, "description": "A union of all content reference types" }, "Security_AI_Assistant_API_ConversationCategory": { "enum": [ "assistant", "insights" ], "type": "string", "description": "The conversation category.", "example": "assistant" }, "Security_AI_Assistant_API_ConversationConfidence": { "enum": [ "low", "medium", "high" ], "type": "string", "description": "The conversation confidence.", "example": "high" }, "Security_AI_Assistant_API_ConversationCreateProps": { "required": [ "title" ], "type": "object", "properties": { "apiConfig": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ApiConfig" }, "category": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCategory" }, "excludeFromLastConversationStorage": { "type": "boolean", "description": "Exclude from last conversation storage." }, "id": { "type": "string", "description": "The conversation id.", "example": "conversation123" }, "messages": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Message" }, "description": "The conversation messages." }, "replacements": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Replacements" }, "title": { "type": "string", "description": "The conversation title.", "example": "Security AI Assistant Setup" } } }, "Security_AI_Assistant_API_ConversationResponse": { "required": [ "id", "title", "createdAt", "users", "namespace", "category" ], "type": "object", "properties": { "apiConfig": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ApiConfig" }, "category": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCategory" }, "createdAt": { "type": "string", "description": "The time conversation was created.", "example": "2025-04-30T14:00:00Z" }, "excludeFromLastConversationStorage": { "type": "boolean", "description": "Exclude from last conversation storage." }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "messages": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Message" }, "description": "The conversation messages." }, "namespace": { "type": "string", "description": "Kibana space", "example": "default" }, "replacements": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Replacements" }, "summary": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationSummary" }, "timestamp": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp" }, "title": { "type": "string", "description": "The conversation title.", "example": "Security AI Assistant Setup" }, "updatedAt": { "type": "string", "description": "The last time conversation was updated.", "example": "2025-04-30T16:30:00Z" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" } } } }, "Security_AI_Assistant_API_ConversationSummary": { "type": "object", "properties": { "confidence": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationConfidence" }, "content": { "type": "string", "description": "Summary text of the conversation over time.", "example": "This conversation covered how to configure the Security AI Assistant." }, "public": { "type": "boolean", "description": "Define if summary is marked as publicly available.", "example": true }, "timestamp": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp" } } }, "Security_AI_Assistant_API_ConversationUpdateProps": { "required": [ "id" ], "type": "object", "properties": { "apiConfig": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ApiConfig" }, "category": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationCategory" }, "excludeFromLastConversationStorage": { "type": "boolean", "description": "Exclude from last conversation storage." }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "messages": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Message" }, "description": "The conversation messages." }, "replacements": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Replacements" }, "summary": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ConversationSummary" }, "title": { "type": "string", "description": "The conversation title.", "example": "Updated Security AI Assistant Setup" } } }, "Security_AI_Assistant_API_DeleteResponseFields": { "required": [ "id" ], "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" } } }, "Security_AI_Assistant_API_DocumentEntry": { "allOf": [ { "required": [ "name", "namespace", "global", "users" ], "type": "object", "properties": { "global": { "type": "boolean", "description": "Whether this Knowledge Base Entry is global, defaults to false.", "example": false }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry.", "example": "Example Entry" }, "namespace": { "type": "string", "description": "Kibana Space, defaults to 'default' space.", "example": "default" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users." } } }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields" } ] }, "Security_AI_Assistant_API_DocumentEntryCreateFields": { "allOf": [ { "required": [ "name" ], "type": "object", "properties": { "global": { "type": "boolean", "description": "Whether this Knowledge Base Entry is global, defaults to false.", "example": false }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry.", "example": "Example Entry" }, "namespace": { "type": "string", "description": "Kibana Space, defaults to 'default' space.", "example": "default" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users." } } }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields" } ] }, "Security_AI_Assistant_API_DocumentEntryOptionalFields": { "type": "object", "properties": { "required": { "type": "boolean", "description": "Whether this resource should always be included, defaults to false.", "example": false }, "vector": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Vector" } } }, "Security_AI_Assistant_API_DocumentEntryRequiredFields": { "required": [ "type", "kbResource", "source", "text" ], "type": "object", "properties": { "kbResource": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResource" }, "source": { "type": "string", "description": "Source document name or filepath.", "example": "/documents/example.txt" }, "text": { "type": "string", "description": "Knowledge Base Entry content.", "example": "This is the content of the document." }, "type": { "enum": [ "document" ], "type": "string", "description": "Entry type.", "example": "document" } } }, "Security_AI_Assistant_API_DocumentEntryResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields" } ] }, "Security_AI_Assistant_API_DocumentEntryUpdateFields": { "allOf": [ { "required": [ "id" ], "type": "object", "properties": { "global": { "type": "boolean", "description": "Whether this Knowledge Base Entry is global, defaults to false.", "example": false }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry.", "example": "Example Entry" }, "namespace": { "type": "string", "description": "Kibana Space, defaults to 'default' space.", "example": "default" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users." } } }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields" } ] }, "Security_AI_Assistant_API_EsqlContentReference": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference" }, { "required": [ "type", "query", "label" ], "type": "object", "properties": { "label": { "type": "string", "description": "Label of the query", "example": "High Severity Alerts" }, "query": { "type": "string", "description": "An ESQL query", "example": "SELECT * FROM alerts WHERE severity = \"high\"" }, "timerange": { "required": [ "from", "to" ], "type": "object", "properties": { "from": { "type": "string", "example": "2025-04-01T00:00:00Z" }, "to": { "type": "string", "example": "2025-04-30T23:59:59Z" } }, "description": "Time range to select in the time picker." }, "type": { "enum": [ "EsqlQuery" ], "type": "string", "example": "EsqlQuery" } } } ], "description": "References an ESQL query" }, "Security_AI_Assistant_API_FindAnonymizationFieldsSortField": { "enum": [ "created_at", "anonymized", "allowed", "field", "updated_at" ], "type": "string" }, "Security_AI_Assistant_API_FindConversationsSortField": { "enum": [ "created_at", "title", "updated_at" ], "type": "string", "description": "The field by which to sort the conversations. Possible values are `created_at`, `title`, and `updated_at`.", "example": "created_at" }, "Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField": { "enum": [ "created_at", "is_default", "title", "updated_at" ], "type": "string", "description": "Fields available for sorting Knowledge Base Entries.", "example": "title" }, "Security_AI_Assistant_API_FindPromptsSortField": { "enum": [ "created_at", "is_default", "name", "updated_at" ], "type": "string", "description": "Field by which to sort the prompts.", "example": "created_at" }, "Security_AI_Assistant_API_HrefContentReference": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference" }, { "required": [ "type", "href" ], "type": "object", "properties": { "href": { "type": "string", "description": "URL to the external resource" }, "label": { "type": "string", "description": "Label of the query" }, "type": { "enum": [ "Href" ], "type": "string" } } } ], "description": "References an external URL" }, "Security_AI_Assistant_API_IndexEntry": { "allOf": [ { "required": [ "name", "namespace", "global", "users" ], "type": "object", "properties": { "global": { "type": "boolean", "description": "Whether this Knowledge Base Entry is global, defaults to false.", "example": false }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry.", "example": "Example Entry" }, "namespace": { "type": "string", "description": "Kibana Space, defaults to 'default' space.", "example": "default" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users." } } }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields" } ] }, "Security_AI_Assistant_API_IndexEntryCreateFields": { "allOf": [ { "required": [ "name" ], "type": "object", "properties": { "global": { "type": "boolean", "description": "Whether this Knowledge Base Entry is global, defaults to false.", "example": false }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry.", "example": "Example Entry" }, "namespace": { "type": "string", "description": "Kibana Space, defaults to 'default' space.", "example": "default" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users." } } }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields" } ] }, "Security_AI_Assistant_API_IndexEntryOptionalFields": { "type": "object", "properties": { "inputSchema": { "$ref": "#/components/schemas/Security_AI_Assistant_API_InputSchema" }, "outputFields": { "type": "array", "items": { "type": "string" }, "description": "Fields to extract from the query result, defaults to all fields if not provided or empty.", "example": [ "title", "author" ] } } }, "Security_AI_Assistant_API_IndexEntryRequiredFields": { "required": [ "type", "index", "field", "description", "queryDescription" ], "type": "object", "properties": { "description": { "type": "string", "description": "Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.", "example": "Query this index for general knowledge base content." }, "field": { "type": "string", "description": "Field to query for Knowledge Base content.", "example": "content" }, "index": { "type": "string", "description": "Index or Data Stream to query for Knowledge Base content.", "example": "knowledge_base_index" }, "queryDescription": { "type": "string", "description": "Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.", "example": "Search for documents containing the specified keywords." }, "type": { "enum": [ "index" ], "type": "string", "description": "Entry type.", "example": "index" } } }, "Security_AI_Assistant_API_IndexEntryResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields" } ] }, "Security_AI_Assistant_API_IndexEntryUpdateFields": { "allOf": [ { "required": [ "id" ], "type": "object", "properties": { "global": { "type": "boolean", "description": "Whether this Knowledge Base Entry is global, defaults to false.", "example": false }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry.", "example": "Example Entry" }, "namespace": { "type": "string", "description": "Kibana Space, defaults to 'default' space.", "example": "default" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users." } } }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields" } ] }, "Security_AI_Assistant_API_InputSchema": { "type": "array", "items": { "required": [ "fieldName", "fieldType", "description" ], "type": "object", "properties": { "description": { "type": "string", "description": "Description of the field.", "example": "The title of the document." }, "fieldName": { "type": "string", "description": "Name of the field.", "example": "title" }, "fieldType": { "type": "string", "description": "Type of the field.", "example": "string" } } }, "description": "Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval." }, "Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason": { "enum": [ "KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED" ], "type": "string", "description": "Reason why a Knowledge Base Entry was skipped during the bulk action." }, "Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult": { "required": [ "id", "skip_reason" ], "type": "object", "properties": { "id": { "type": "string", "description": "ID of the skipped Knowledge Base Entry.", "example": "123" }, "name": { "type": "string", "description": "Name of the skipped Knowledge Base Entry.", "example": "Skipped Entry" }, "skip_reason": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason" } } }, "Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse": { "required": [ "attributes" ], "type": "object", "properties": { "attributes": { "required": [ "results", "summary" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError" }, "description": "List of errors encountered during the bulk action.", "example": [ { "err_code": "UPDATE_FAILED", "knowledgeBaseEntries": [ { "id": "456", "name": "Error Entry" } ], "message": "Failed to update entry.", "statusCode": 400 } ] }, "results": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults" }, "summary": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary" } } }, "knowledgeBaseEntriesCount": { "type": "integer", "description": "Total number of Knowledge Base Entries processed.", "example": 8 }, "message": { "type": "string", "description": "Message describing the result of the bulk action.", "example": "Bulk action completed successfully." }, "statusCode": { "type": "integer", "description": "HTTP status code of the response.", "example": 200 }, "success": { "type": "boolean", "description": "Indicates whether the bulk action was successful.", "example": true } } }, "Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults": { "required": [ "updated", "created", "deleted", "skipped" ], "type": "object", "properties": { "created": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse" }, "description": "List of Knowledge Base Entries that were successfully created.", "example": [ { "content": "This is the content of the new entry.", "id": "456", "title": "New Entry" } ] }, "deleted": { "type": "array", "items": { "type": "string" }, "description": "List of IDs of Knowledge Base Entries that were successfully deleted.", "example": [ "789" ] }, "skipped": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult" }, "description": "List of Knowledge Base Entries that were skipped during the bulk action.", "example": [ { "id": "123", "name": "Skipped Entry", "skip_reason": "KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED" } ] }, "updated": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse" }, "description": "List of Knowledge Base Entries that were successfully updated.", "example": [ { "content": "Updated content.", "id": "123", "title": "Updated Entry" } ] } } }, "Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary": { "required": [ "failed", "skipped", "succeeded", "total" ], "type": "object", "properties": { "failed": { "type": "integer", "description": "Number of Knowledge Base Entries that failed during the bulk action.", "example": 2 }, "skipped": { "type": "integer", "description": "Number of Knowledge Base Entries that were skipped during the bulk action.", "example": 1 }, "succeeded": { "type": "integer", "description": "Number of Knowledge Base Entries that were successfully processed during the bulk action.", "example": 5 }, "total": { "type": "integer", "description": "Total number of Knowledge Base Entries involved in the bulk action.", "example": 8 } } }, "Security_AI_Assistant_API_KnowledgeBaseEntryContentReference": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference" }, { "required": [ "type", "knowledgeBaseEntryId", "knowledgeBaseEntryName" ], "type": "object", "properties": { "knowledgeBaseEntryId": { "type": "string", "description": "Id of the Knowledge Base Entry", "example": "kbentry456" }, "knowledgeBaseEntryName": { "type": "string", "description": "Name of the knowledge base entry", "example": "Network Security Best Practices" }, "type": { "enum": [ "KnowledgeBaseEntry" ], "type": "string", "example": "KnowledgeBaseEntry" } } } ], "description": "References a knowledge base entry" }, "Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps": { "anyOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields" } ], "discriminator": { "propertyName": "type" } }, "Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "ID of the Knowledge Base Entry that encountered an error.", "example": "456" }, "name": { "type": "string", "description": "Name of the Knowledge Base Entry that encountered an error.", "example": "Error Entry" } } }, "Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema": { "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "description": "Error type or category.", "example": "Not Found" }, "message": { "type": "string", "description": "Detailed error message.", "example": "The requested Knowledge Base Entry was not found." }, "statusCode": { "type": "number", "description": "HTTP status code of the error.", "example": 404 } }, "additionalProperties": false }, "Security_AI_Assistant_API_KnowledgeBaseEntryResponse": { "anyOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntry" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntry" } ], "discriminator": { "propertyName": "type" } }, "Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps": { "anyOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields" } ], "discriminator": { "propertyName": "type" } }, "Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps": { "anyOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields" }, { "$ref": "#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields" } ], "discriminator": { "propertyName": "type" } }, "Security_AI_Assistant_API_KnowledgeBaseResource": { "enum": [ "security_labs", "user" ], "type": "string", "description": "Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.", "example": "security_labs" }, "Security_AI_Assistant_API_KnowledgeBaseResponse": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Identify the success of the method execution.", "example": true } }, "description": "AI assistant KnowledgeBase." }, "Security_AI_Assistant_API_Message": { "required": [ "timestamp", "content", "role" ], "type": "object", "properties": { "content": { "type": "string", "description": "Message content.", "example": "Hello, how can I assist you today?" }, "isError": { "type": "boolean", "description": "Is error message.", "example": false }, "metadata": { "$ref": "#/components/schemas/Security_AI_Assistant_API_MessageMetadata" }, "reader": { "$ref": "#/components/schemas/Security_AI_Assistant_API_Reader" }, "refusal": { "type": "string", "description": "Refusal reason returned by the model when content is filtered." }, "role": { "$ref": "#/components/schemas/Security_AI_Assistant_API_MessageRole" }, "timestamp": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp" }, "traceData": { "$ref": "#/components/schemas/Security_AI_Assistant_API_TraceData" } }, "description": "AI assistant conversation message." }, "Security_AI_Assistant_API_MessageData": { "type": "object", "description": "ECS-style metadata attached to the message.", "example": { "alert_id": "alert-456", "user_id": "abc123" } }, "Security_AI_Assistant_API_MessageMetadata": { "type": "object", "properties": { "contentReferences": { "$ref": "#/components/schemas/Security_AI_Assistant_API_ContentReferences" } }, "description": "Message metadata" }, "Security_AI_Assistant_API_MessageRole": { "enum": [ "system", "user", "assistant" ], "type": "string", "description": "Message role.", "example": "assistant" }, "Security_AI_Assistant_API_NonEmptyString": { "minLength": 1, "type": "string", "description": "A string that does not contain only whitespace characters.", "format": "nonempty", "example": "I am a string" }, "Security_AI_Assistant_API_NonEmptyTimestamp": { "minLength": 1, "type": "string", "description": "A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.", "format": "nonempty", "example": "2023-10-31T12:00:00Z" }, "Security_AI_Assistant_API_NormalizedAnonymizationFieldError": { "required": [ "message", "status_code", "anonymization_fields" ], "type": "object", "properties": { "anonymization_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldDetailsInError" }, "description": "Array of anonymization fields that caused the error." }, "err_code": { "type": "string", "description": "Error code indicating the type of failure.", "example": "UPDATE_FAILED" }, "message": { "type": "string", "description": "Error message.", "example": "Failed to update anonymization field." }, "status_code": { "type": "integer", "description": "Status code of the response.", "example": 400 } } }, "Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError": { "required": [ "message", "statusCode", "knowledgeBaseEntries" ], "type": "object", "properties": { "err_code": { "type": "string", "description": "Specific error code for the issue.", "example": "UPDATE_FAILED" }, "knowledgeBaseEntries": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError" }, "description": "List of Knowledge Base Entries that encountered the error." }, "message": { "type": "string", "description": "Error message describing the issue.", "example": "Failed to update entry." }, "statusCode": { "type": "integer", "description": "HTTP status code associated with the error.", "example": 400 } } }, "Security_AI_Assistant_API_NormalizedPromptError": { "required": [ "message", "status_code", "prompts" ], "type": "object", "properties": { "err_code": { "type": "string", "description": "A code representing the error type." }, "message": { "type": "string", "description": "A message describing the error encountered." }, "prompts": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptDetailsInError" }, "description": "List of prompts that encountered errors." }, "status_code": { "type": "integer", "description": "The HTTP status code associated with the error." } } }, "Security_AI_Assistant_API_ProductDocumentationContentReference": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference" }, { "required": [ "type", "title", "url" ], "type": "object", "properties": { "title": { "type": "string", "description": "Title of the documentation", "example": "Getting Started with Security AI Assistant" }, "type": { "enum": [ "ProductDocumentation" ], "type": "string", "example": "ProductDocumentation" }, "url": { "type": "string", "description": "URL to the documentation", "example": "https://docs.example.com/security-ai-assistant" } } } ], "description": "References the product documentation" }, "Security_AI_Assistant_API_PromptCreateProps": { "required": [ "name", "content", "promptType" ], "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" }, "description": "List of categories for the prompt.", "example": [ "security", "verification" ] }, "color": { "type": "string", "description": "The color associated with the prompt.", "example": "blue" }, "consumer": { "type": "string", "description": "The consumer associated with the prompt.", "example": "admin" }, "content": { "type": "string", "description": "The content of the prompt.", "example": "Please verify the security settings." }, "isDefault": { "type": "boolean", "description": "Whether this prompt should be the default.", "example": false }, "isNewConversationDefault": { "type": "boolean", "description": "Whether this prompt should be the default for new conversations.", "example": true }, "name": { "type": "string", "description": "The name of the prompt.", "example": "New Security Prompt" }, "promptType": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptType" } } }, "Security_AI_Assistant_API_PromptDetailsInError": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the prompt that encountered an error." }, "name": { "type": "string", "description": "The name of the prompt that encountered an error." } } }, "Security_AI_Assistant_API_PromptResponse": { "required": [ "id", "name", "promptType", "content" ], "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" }, "description": "Categories associated with the prompt." }, "color": { "type": "string", "description": "The color associated with the prompt." }, "consumer": { "type": "string", "description": "The consumer that the prompt is associated with." }, "content": { "type": "string", "description": "The content of the prompt." }, "createdAt": { "type": "string", "description": "The timestamp of when the prompt was created." }, "createdBy": { "type": "string", "description": "The user who created the prompt." }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "isDefault": { "type": "boolean", "description": "Whether this prompt is the default." }, "isNewConversationDefault": { "type": "boolean", "description": "Whether this prompt is the default for new conversations." }, "name": { "type": "string", "description": "The name of the prompt." }, "namespace": { "type": "string", "description": "Kibana space where the prompt is located." }, "promptType": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptType" }, "timestamp": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp" }, "updatedAt": { "type": "string", "description": "The timestamp of when the prompt was last updated." }, "updatedBy": { "type": "string", "description": "The user who last updated the prompt." }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_User" }, "description": "List of users associated with the prompt." } } }, "Security_AI_Assistant_API_PromptsBulkActionSkipReason": { "enum": [ "PROMPT_FIELD_NOT_MODIFIED" ], "type": "string", "description": "Reason why a prompt was skipped during the bulk action." }, "Security_AI_Assistant_API_PromptsBulkActionSkipResult": { "required": [ "id", "skip_reason" ], "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the prompt that was skipped." }, "name": { "type": "string", "description": "The name of the prompt that was skipped." }, "skip_reason": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipReason" } } }, "Security_AI_Assistant_API_PromptsBulkCrudActionResponse": { "required": [ "attributes" ], "type": "object", "properties": { "attributes": { "required": [ "results", "summary" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NormalizedPromptError" } }, "results": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResults" }, "summary": { "$ref": "#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary" } } }, "message": { "type": "string", "description": "A message describing the result of the bulk action.", "example": "Bulk action completed successfully." }, "prompts_count": { "type": "integer", "description": "The number of prompts processed in the bulk action.", "example": 6 }, "status_code": { "type": "integer", "description": "The HTTP status code of the response.", "example": 200 }, "success": { "type": "boolean", "description": "Indicates if the bulk action was successful.", "example": true } } }, "Security_AI_Assistant_API_PromptsBulkCrudActionResults": { "required": [ "updated", "created", "deleted", "skipped" ], "type": "object", "properties": { "created": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptResponse" }, "description": "List of prompts that were created." }, "deleted": { "type": "array", "items": { "type": "string" }, "description": "List of IDs of prompts that were deleted." }, "skipped": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipResult" }, "description": "List of prompts that were skipped." }, "updated": { "type": "array", "items": { "$ref": "#/components/schemas/Security_AI_Assistant_API_PromptResponse" }, "description": "List of prompts that were updated." } } }, "Security_AI_Assistant_API_PromptType": { "enum": [ "system", "quick" ], "type": "string", "description": "Type of the prompt (either system or quick)." }, "Security_AI_Assistant_API_PromptUpdateProps": { "required": [ "id" ], "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" }, "description": "The updated categories for the prompt.", "example": [ "security", "alert" ] }, "color": { "type": "string", "description": "The updated color associated with the prompt.", "example": "green" }, "consumer": { "type": "string", "description": "The updated consumer for the prompt.", "example": "user123" }, "content": { "type": "string", "description": "The updated content for the prompt.", "example": "Updated content for security prompt." }, "id": { "type": "string", "description": "The ID of the prompt to update.", "example": "prompt123" }, "isDefault": { "type": "boolean", "description": "Whether this prompt should be the default.", "example": true }, "isNewConversationDefault": { "type": "boolean", "description": "Whether the prompt should be the default for new conversations.", "example": false } } }, "Security_AI_Assistant_API_Provider": { "enum": [ "OpenAI", "Azure OpenAI", "Other" ], "type": "string", "description": "Provider", "example": "OpenAI" }, "Security_AI_Assistant_API_Reader": { "type": "object" }, "Security_AI_Assistant_API_Replacements": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Replacements object used to anonymize/deanonymize messages" }, "Security_AI_Assistant_API_ResponseFields": { "required": [ "id", "createdAt", "createdBy", "updatedAt", "updatedBy" ], "type": "object", "properties": { "createdAt": { "type": "string", "description": "Time the Knowledge Base Entry was created.", "example": "2023-01-01T12:00:00Z" }, "createdBy": { "type": "string", "description": "User who created the Knowledge Base Entry.", "example": "admin" }, "id": { "$ref": "#/components/schemas/Security_AI_Assistant_API_NonEmptyString" }, "updatedAt": { "type": "string", "description": "Time the Knowledge Base Entry was last updated.", "example": "2023-01-02T12:00:00Z" }, "updatedBy": { "type": "string", "description": "User who last updated the Knowledge Base Entry.", "example": "editor" } } }, "Security_AI_Assistant_API_SecurityAlertContentReference": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference" }, { "required": [ "type", "alertId" ], "type": "object", "properties": { "alertId": { "type": "string", "description": "ID of the Alert", "example": "alert789" }, "type": { "enum": [ "SecurityAlert" ], "type": "string", "example": "SecurityAlert" } } } ], "description": "References a security alert" }, "Security_AI_Assistant_API_SecurityAlertsPageContentReference": { "allOf": [ { "$ref": "#/components/schemas/Security_AI_Assistant_API_BaseContentReference" }, { "required": [ "type" ], "type": "object", "properties": { "type": { "enum": [ "SecurityAlertsPage" ], "type": "string", "example": "SecurityAlertsPage" } } } ], "description": "References the security alerts page" }, "Security_AI_Assistant_API_SortOrder": { "enum": [ "asc", "desc" ], "type": "string", "description": "The order in which results are sorted.", "example": "asc" }, "Security_AI_Assistant_API_TraceData": { "type": "object", "properties": { "traceId": { "type": "string", "description": "Could be any string, not necessarily a UUID", "example": "d9876543-f0a1-2345-6789-abcdef123456" }, "transactionId": { "type": "string", "description": "Could be any string, not necessarily a UUID", "example": "a1234567-bc89-0def-1234-56789abcdef0" } }, "description": "Trace Data" }, "Security_AI_Assistant_API_User": { "type": "object", "properties": { "id": { "type": "string", "description": "User id.", "example": "user123" }, "name": { "type": "string", "description": "User name.", "example": "John Doe" } }, "description": "Could be any string, not necessarily a UUID." }, "Security_AI_Assistant_API_Vector": { "required": [ "modelId", "tokens" ], "type": "object", "properties": { "modelId": { "type": "string", "description": "ID of the model used to create the embeddings.", "example": "bert-base-uncased" }, "tokens": { "type": "object", "additionalProperties": { "type": "number" }, "description": "Tokens with their corresponding values.", "example": { "token1": 0.123, "token2": 0.456 } } }, "description": "Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings." }, "Security_Detections_API_AlertAssignees": { "required": [ "add", "remove" ], "type": "object", "properties": { "add": { "type": "array", "items": { "minLength": 1, "type": "string", "description": "A list of user profile `uid`s to assign. Users need to activate their user profile by logging into Kibana at least once.", "format": "nonempty" } }, "remove": { "type": "array", "items": { "minLength": 1, "type": "string", "description": "A list of user profile `uid`s to unassign. Users need to activate their user profile by logging into Kibana at least once.", "format": "nonempty" } } } }, "Security_Detections_API_AlertIds": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "description": "A list of alerts ids." }, "Security_Detections_API_AlertsIndex": { "type": "string", "description": "(deprecated) Has no effect.", "deprecated": true }, "Security_Detections_API_AlertsIndexMigrationError": { "required": [ "index", "error" ], "type": "object", "properties": { "error": { "required": [ "message", "status_code" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "string" } } }, "index": { "type": "string" } } }, "Security_Detections_API_AlertsIndexMigrationSuccess": { "required": [ "index", "migration_id", "migration_index" ], "type": "object", "properties": { "index": { "type": "string" }, "migration_id": { "type": "string" }, "migration_index": { "type": "string" } } }, "Security_Detections_API_AlertsIndexNamespace": { "type": "string", "description": "Has no effect." }, "Security_Detections_API_AlertsReindexOptions": { "type": "object", "properties": { "requests_per_second": { "minimum": 1, "type": "integer" }, "size": { "minimum": 1, "type": "integer" }, "slices": { "minimum": 1, "type": "integer" } } }, "Security_Detections_API_AlertsSort": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_AlertsSortCombinations" }, { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_AlertsSortCombinations" } } ] }, "Security_Detections_API_AlertsSortCombinations": { "type": [ "string", "object" ] }, "Security_Detections_API_AlertStatus": { "enum": [ "open", "closed", "acknowledged", "in-progress" ], "type": "string" }, "Security_Detections_API_AlertSuppression": { "required": [ "group_by" ], "type": "object", "properties": { "duration": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionDuration" }, "group_by": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionGroupBy" }, "missing_fields_strategy": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionMissingFieldsStrategy" } }, "description": "Defines alert suppression configuration." }, "Security_Detections_API_AlertSuppressionDuration": { "required": [ "value", "unit" ], "type": "object", "properties": { "unit": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionDurationUnit" }, "value": { "minimum": 1, "type": "integer" } } }, "Security_Detections_API_AlertSuppressionDurationUnit": { "enum": [ "s", "m", "h" ], "type": "string", "description": "Time unit" }, "Security_Detections_API_AlertSuppressionGroupBy": { "maxItems": 3, "minItems": 1, "type": "array", "items": { "type": "string" } }, "Security_Detections_API_AlertSuppressionMissingFieldsStrategy": { "enum": [ "doNotSuppress", "suppress" ], "type": "string", "description": "Describes how alerts will be generated for documents with missing suppress by fields:\ndoNotSuppress - per each document a separate alert will be created\nsuppress - only alert will be created per suppress by bucket" }, "Security_Detections_API_AlertTag": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "Security_Detections_API_AlertTags": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } }, "Security_Detections_API_AlertVersion": { "required": [ "version", "count" ], "type": "object", "properties": { "count": { "type": "integer" }, "version": { "type": "integer" } } }, "Security_Detections_API_AnomalyThreshold": { "minimum": 0, "type": "integer", "description": "Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100." }, "Security_Detections_API_BuildingBlockType": { "type": "string", "description": "Determines if the rule acts as a building block. If yes, the value must be `default`.\nBy default, building-block alerts are not displayed in the UI. These rules are used as a foundation for other rules that do generate alerts.\nFor more information, refer to [About building block rules](https://www.elastic.co/guide/en/security/current/building-block-rule.html).\n" }, "Security_Detections_API_BulkActionEditPayload": { "anyOf": [ { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadTags" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadIndexPatterns" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadInvestigationFields" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadTimeline" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadRuleActions" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadSchedule" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadAlertSuppression" } ] }, "Security_Detections_API_BulkActionEditPayloadAlertSuppression": { "anyOf": [ { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppression" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression" } ] }, "Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression": { "required": [ "type" ], "type": "object", "properties": { "type": { "enum": [ "delete_alert_suppression" ], "type": "string" } } }, "Security_Detections_API_BulkActionEditPayloadIndexPatterns": { "required": [ "type", "value" ], "type": "object", "properties": { "overwrite_data_views": { "type": "boolean", "description": "Resets the data view for the rule." }, "type": { "enum": [ "add_index_patterns", "delete_index_patterns", "set_index_patterns" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" } }, "description": "Edits index patterns of rulesClient.\n\n- `add_index_patterns` adds index patterns to rules. If an index pattern already exists for a rule, no changes are made.\n- `delete_index_patterns` removes index patterns from rules. If an index pattern does not exist for a rule, no changes are made.\n- `set_index_patterns` sets index patterns for rules, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.\n" }, "Security_Detections_API_BulkActionEditPayloadInvestigationFields": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "add_investigation_fields", "delete_investigation_fields", "set_investigation_fields" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" } }, "description": "Edits investigation fields of rules.\n\n- `add_investigation_fields` adds investigation fields to rules. If an investigation field already exists for a rule, no changes are made.\n- `delete_investigation_fields` removes investigation fields from rules. If an investigation field does not exist for a rule, no changes are made.\n- `set_investigation_fields` sets investigation fields for rules. If the set of investigation fields is the same as the existing investigation fields, no changes are made.\n" }, "Security_Detections_API_BulkActionEditPayloadRuleActions": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "add_rule_actions", "set_rule_actions" ], "type": "string" }, "value": { "required": [ "actions" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NormalizedRuleAction" } }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_ThrottleForBulkActions" } } } }, "description": "Edits rule actions of rules.\n\n- `add_rule_actions` adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exists for a rule, it will be added again with a new unique ID.\n- `set_rule_actions` sets rule actions for rules. This action is non-idempotent, meaning that even if the same set of rule actions already exists for a rule, it will be set again and the actions will receive new unique IDs.\n" }, "Security_Detections_API_BulkActionEditPayloadSchedule": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "set_schedule" ], "type": "string" }, "value": { "required": [ "interval", "lookback" ], "type": "object", "properties": { "interval": { "pattern": "^[1-9]\\d*[smh]$", "type": "string", "description": "Interval in which the rule runs. For example, `\"1h\"` means the rule runs every hour.", "example": "1h" }, "lookback": { "pattern": "^[1-9]\\d*[smh]$", "type": "string", "description": "Lookback time for the rules.\n\nAdditional look-back time that the rule analyzes. For example, \"10m\" means the rule analyzes the last 10 minutes of data in addition to the frequency interval.\n", "example": "1h" } } } }, "description": "Overwrites schedule of rules. \n\n- `set_schedule` sets a schedule for rules. If the same schedule already exists for a rule, no changes are made.\n\nBoth `interval` and `lookback` have a format of \"{integer}{time_unit}\", where accepted time units are `s` for seconds, `m` for minutes, and `h` for hours. The integer must be positive and larger than 0. Examples: \"45s\", \"30m\", \"6h\"\n" }, "Security_Detections_API_BulkActionEditPayloadSetAlertSuppression": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "set_alert_suppression" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" } } }, "Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "set_alert_suppression_for_threshold" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_ThresholdAlertSuppression" } } }, "Security_Detections_API_BulkActionEditPayloadTags": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "add_tags", "delete_tags", "set_tags" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" } }, "description": "Edits tags of rules.\n\n- `add_tags` adds tags to rules. If a tag already exists for a rule, no changes are made.\n- `delete_tags` removes tags from rules. If a tag does not exist for a rule, no changes are made.\n- `set_tags` sets tags for rules, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.\n" }, "Security_Detections_API_BulkActionEditPayloadTimeline": { "required": [ "type", "value" ], "type": "object", "properties": { "type": { "enum": [ "set_timeline" ], "type": "string" }, "value": { "required": [ "timeline_id", "timeline_title" ], "type": "object", "properties": { "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" } } } }, "description": "Edits timeline of rules.\n\n- `set_timeline` sets a timeline for rules. If the same timeline already exists for a rule, no changes are made.\n" }, "Security_Detections_API_BulkActionsDryRunErrCode": { "enum": [ "IMMUTABLE", "PREBUILT_CUSTOMIZATION_LICENSE", "MACHINE_LEARNING_AUTH", "MACHINE_LEARNING_INDEX_PATTERN", "ESQL_INDEX_PATTERN", "MANUAL_RULE_RUN_FEATURE", "MANUAL_RULE_RUN_DISABLED_RULE", "THRESHOLD_RULE_TYPE_IN_SUPPRESSION", "UNSUPPORTED_RULE_IN_SUPPRESSION_FOR_THRESHOLD", "RULE_FILL_GAPS_DISABLED_RULE" ], "type": "string" }, "Security_Detections_API_BulkActionSkipResult": { "required": [ "id", "skip_reason" ], "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "skip_reason": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_BulkEditSkipReason" }, { "$ref": "#/components/schemas/Security_Detections_API_BulkGapsFillingSkipReason" } ] } } }, "Security_Detections_API_BulkCrudRulesResponse": { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" }, { "$ref": "#/components/schemas/Security_Detections_API_ErrorSchema" } ] } }, "Security_Detections_API_BulkDeleteRules": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "delete" ], "type": "string" }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkDisableRules": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "disable" ], "type": "string" }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkDuplicateRules": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "duplicate" ], "type": "string" }, "duplicate": { "required": [ "include_exceptions", "include_expired_exceptions" ], "type": "object", "properties": { "include_exceptions": { "type": "boolean", "description": "Whether to copy exceptions from the original rule" }, "include_expired_exceptions": { "type": "boolean", "description": "Whether to copy expired exceptions from the original rule" } }, "description": "Duplicate object that describes applying an update action." }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkEditActionResponse": { "required": [ "attributes" ], "type": "object", "properties": { "attributes": { "required": [ "results", "summary" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NormalizedRuleError" } }, "results": { "$ref": "#/components/schemas/Security_Detections_API_BulkEditActionResults" }, "summary": { "$ref": "#/components/schemas/Security_Detections_API_BulkEditActionSummary" } } }, "message": { "type": "string" }, "rules_count": { "type": "integer" }, "status_code": { "type": "integer" }, "success": { "type": "boolean" } } }, "Security_Detections_API_BulkEditActionResults": { "required": [ "updated", "created", "deleted", "skipped" ], "type": "object", "properties": { "created": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" } }, "deleted": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" } }, "skipped": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_BulkActionSkipResult" } }, "updated": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleResponse" } } } }, "Security_Detections_API_BulkEditActionSummary": { "required": [ "failed", "skipped", "succeeded", "total" ], "type": "object", "properties": { "failed": { "type": "integer" }, "skipped": { "type": "integer" }, "succeeded": { "type": "integer" }, "total": { "type": "integer" } }, "description": "A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the `edit` action is used to add a tag to a rule that already has that tag, or to delete an index pattern that is not specified in a rule. Objects returned in `attributes.results.skipped` will only include rules' `id`, `name`, and `skip_reason`." }, "Security_Detections_API_BulkEditRules": { "required": [ "action", "edit" ], "type": "object", "properties": { "action": { "enum": [ "edit" ], "type": "string" }, "edit": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_BulkActionEditPayload" }, "description": "Array of objects containing the edit operations" }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkEditSkipReason": { "enum": [ "RULE_NOT_MODIFIED" ], "type": "string" }, "Security_Detections_API_BulkEnableRules": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "enable" ], "type": "string" }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkExportActionResponse": { "type": "string" }, "Security_Detections_API_BulkExportRules": { "required": [ "action" ], "type": "object", "properties": { "action": { "enum": [ "export" ], "type": "string" }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkGapsFillingSkipReason": { "enum": [ "NO_GAPS_TO_FILL" ], "type": "string" }, "Security_Detections_API_BulkManualRuleFillGaps": { "required": [ "action", "fill_gaps" ], "type": "object", "properties": { "action": { "enum": [ "fill_gaps" ], "type": "string" }, "fill_gaps": { "required": [ "start_date", "end_date" ], "type": "object", "properties": { "end_date": { "type": "string", "description": "End date of the manual gap fill" }, "start_date": { "type": "string", "description": "Start date of the manual gap fill" } }, "description": "Object that describes applying a manual gap fill action for the specified time range." }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." } } }, "Security_Detections_API_BulkManualRuleRun": { "required": [ "action", "run" ], "type": "object", "properties": { "action": { "enum": [ "run" ], "type": "string" }, "gaps_range_end": { "type": "string", "description": "Gaps range end, valid only when query is provided" }, "gaps_range_start": { "type": "string", "description": "Gaps range start, valid only when query is provided" }, "ids": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n" }, "query": { "type": "string", "description": "Query to filter rules." }, "run": { "required": [ "start_date", "end_date" ], "type": "object", "properties": { "end_date": { "type": "string", "description": "End date of the manual rule run" }, "start_date": { "type": "string", "description": "Start date of the manual rule run" } }, "description": "Object that describes applying a manual rule run action." } } }, "Security_Detections_API_ConcurrentSearches": { "minimum": 1, "type": "integer" }, "Security_Detections_API_DataViewId": { "type": "string" }, "Security_Detections_API_DefaultParams": { "required": [ "command" ], "type": "object", "properties": { "command": { "enum": [ "isolate" ], "type": "string" }, "comment": { "type": "string" } } }, "Security_Detections_API_EcsMapping": { "type": "object", "additionalProperties": { "type": "object", "properties": { "field": { "type": "string" }, "value": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] } } }, "description": "Map Osquery results columns or static values to Elastic Common Schema (ECS) fields. Example: \"ecs_mapping\": {\"process.pid\": {\"field\": \"pid\"}}" }, "Security_Detections_API_EndpointResponseAction": { "required": [ "action_type_id", "params" ], "type": "object", "properties": { "action_type_id": { "enum": [ ".endpoint" ], "type": "string" }, "params": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_DefaultParams" }, { "$ref": "#/components/schemas/Security_Detections_API_ProcessesParams" } ] } } }, "Security_Detections_API_EqlOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" }, "data_view_id": { "$ref": "#/components/schemas/Security_Detections_API_DataViewId" }, "event_category_override": { "$ref": "#/components/schemas/Security_Detections_API_EventCategoryOverride" }, "filters": { "$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray" }, "index": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" }, "tiebreaker_field": { "$ref": "#/components/schemas/Security_Detections_API_TiebreakerField" }, "timestamp_field": { "$ref": "#/components/schemas/Security_Detections_API_TimestampField" } } }, "Security_Detections_API_EqlQueryLanguage": { "enum": [ "eql" ], "type": "string" }, "Security_Detections_API_EqlRequiredFields": { "required": [ "type", "query", "language" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_EqlQueryLanguage" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "type": { "enum": [ "eql" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_EqlRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_EqlRuleResponseFields" } ] }, "Security_Detections_API_EqlRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_EqlOptionalFields" } ] }, "Security_Detections_API_EqlRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateFields" } ] }, "Security_Detections_API_EqlRulePatchFields": { "allOf": [ { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_EqlQueryLanguage" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "type": { "enum": [ "eql" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EqlOptionalFields" } ] }, "Security_Detections_API_EqlRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EqlRulePatchFields" } ] }, "Security_Detections_API_EqlRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_EqlOptionalFields" } ] }, "Security_Detections_API_EqlRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateFields" } ] }, "Security_Detections_API_ErrorSchema": { "required": [ "error" ], "type": "object", "properties": { "error": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "minimum": 400, "type": "integer" } } }, "id": { "type": "string" }, "item_id": { "minLength": 1, "type": "string" }, "list_id": { "minLength": 1, "type": "string" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" } }, "additionalProperties": false }, "Security_Detections_API_EsqlQueryLanguage": { "enum": [ "esql" ], "type": "string" }, "Security_Detections_API_EsqlRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleResponseFields" } ] }, "Security_Detections_API_EsqlRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields" } ] }, "Security_Detections_API_EsqlRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateFields" } ] }, "Security_Detections_API_EsqlRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" } } }, "Security_Detections_API_EsqlRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "language": { "$ref": "#/components/schemas/Security_Detections_API_EsqlQueryLanguage" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "type": { "enum": [ "esql" ], "type": "string", "description": "Rule type" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields" } ] }, "Security_Detections_API_EsqlRuleRequiredFields": { "required": [ "type", "language", "query" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_EsqlQueryLanguage" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "type": { "enum": [ "esql" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_EsqlRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields" } ] }, "Security_Detections_API_EsqlRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateFields" } ] }, "Security_Detections_API_EventCategoryOverride": { "type": "string" }, "Security_Detections_API_ExceptionListType": { "enum": [ "detection", "rule_default", "endpoint", "endpoint_trusted_apps", "endpoint_events", "endpoint_host_isolation_exceptions", "endpoint_blocklists" ], "type": "string", "description": "The exception type" }, "Security_Detections_API_ExternalRuleSource": { "required": [ "type", "is_customized" ], "type": "object", "properties": { "is_customized": { "$ref": "#/components/schemas/Security_Detections_API_IsExternalRuleCustomized" }, "type": { "enum": [ "external" ], "type": "string" } }, "description": "Type of rule source for externally sourced rules, i.e. rules that have an external source, such as the Elastic Prebuilt rules repo." }, "Security_Detections_API_FindRulesSortField": { "enum": [ "created_at", "createdAt", "enabled", "execution_summary.last_execution.date", "execution_summary.last_execution.metrics.execution_gap_duration_s", "execution_summary.last_execution.metrics.total_indexing_duration_ms", "execution_summary.last_execution.metrics.total_search_duration_ms", "execution_summary.last_execution.status", "name", "risk_score", "riskScore", "severity", "updated_at", "updatedAt" ], "type": "string" }, "Security_Detections_API_HistoryWindowStart": { "minLength": 1, "type": "string", "description": "Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.", "format": "nonempty" }, "Security_Detections_API_IndexMigrationStatus": { "required": [ "index", "version", "signal_versions", "migrations", "is_outdated" ], "type": "object", "properties": { "index": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "is_outdated": { "type": "boolean" }, "migrations": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_MigrationStatus" } }, "signal_versions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_AlertVersion" } }, "version": { "type": "integer" } } }, "Security_Detections_API_IndexPatternArray": { "type": "array", "items": { "type": "string" }, "description": "Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanced Settings → `securitySolution:defaultIndex`).\n> info\n> This field is not supported for ES|QL rules.\n" }, "Security_Detections_API_InternalRuleSource": { "required": [ "type" ], "type": "object", "properties": { "type": { "enum": [ "internal" ], "type": "string" } }, "description": "Type of rule source for internally sourced rules, i.e. created within the Kibana apps." }, "Security_Detections_API_InvestigationFields": { "required": [ "field_names" ], "type": "object", "properties": { "field_names": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } }, "description": "Schema for fields relating to investigation fields. These are user defined fields we use to highlight\nin various features in the UI such as alert details flyout and exceptions auto-population from alert.\n" }, "Security_Detections_API_InvestigationGuide": { "type": "string", "description": "Notes to help investigate alerts produced by the rule." }, "Security_Detections_API_IsExternalRuleCustomized": { "type": "boolean", "description": "Determines whether an external/prebuilt rule has been customized by the user (i.e. any of its fields have been modified and diverged from the base value)." }, "Security_Detections_API_IsRuleEnabled": { "type": "boolean", "description": "Determines whether the rule is enabled. Defaults to true." }, "Security_Detections_API_IsRuleImmutable": { "type": "boolean", "description": "This field determines whether the rule is a prebuilt Elastic rule. It will be replaced with the `rule_source` field.", "deprecated": true }, "Security_Detections_API_ItemsPerSearch": { "minimum": 1, "type": "integer" }, "Security_Detections_API_KqlQueryLanguage": { "enum": [ "kuery", "lucene" ], "type": "string" }, "Security_Detections_API_MachineLearningJobId": { "oneOf": [ { "type": "string" }, { "minItems": 1, "type": "array", "items": { "type": "string" } } ], "description": "Machine learning job ID(s) the rule monitors for anomaly scores." }, "Security_Detections_API_MachineLearningRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleResponseFields" } ] }, "Security_Detections_API_MachineLearningRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields" } ] }, "Security_Detections_API_MachineLearningRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields" } ] }, "Security_Detections_API_MachineLearningRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" } } }, "Security_Detections_API_MachineLearningRulePatchFields": { "allOf": [ { "type": "object", "properties": { "anomaly_threshold": { "$ref": "#/components/schemas/Security_Detections_API_AnomalyThreshold" }, "machine_learning_job_id": { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningJobId" }, "type": { "enum": [ "machine_learning" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields" } ] }, "Security_Detections_API_MachineLearningRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRulePatchFields" } ] }, "Security_Detections_API_MachineLearningRuleRequiredFields": { "required": [ "type", "machine_learning_job_id", "anomaly_threshold" ], "type": "object", "properties": { "anomaly_threshold": { "$ref": "#/components/schemas/Security_Detections_API_AnomalyThreshold" }, "machine_learning_job_id": { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningJobId" }, "type": { "enum": [ "machine_learning" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_MachineLearningRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields" } ] }, "Security_Detections_API_MachineLearningRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields" } ] }, "Security_Detections_API_MaxSignals": { "minimum": 1, "type": "integer", "description": "Maximum number of alerts the rule can create during a single run (the rule’s Max alerts per run [advanced setting](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-advanced-params) value).\n> info\n> This setting can be superseded by the [Kibana configuration setting](https://www.elastic.co/guide/en/kibana/current/alert-action-settings-kb.html#alert-settings) `xpack.alerting.rules.run.alerts.max`, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, the rule can generate no more than 1000 alerts even if `max_signals` is set higher.\n", "default": 100 }, "Security_Detections_API_MigrationCleanupResult": { "required": [ "id", "destinationIndex", "status", "sourceIndex", "version", "updated" ], "type": "object", "properties": { "destinationIndex": { "type": "string" }, "error": { "required": [ "message", "status_code" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "id": { "type": "string" }, "sourceIndex": { "type": "string" }, "status": { "enum": [ "success", "failure", "pending" ], "type": "string" }, "updated": { "type": "string", "format": "date-time" }, "version": { "type": "string" } } }, "Security_Detections_API_MigrationFinalizationResult": { "required": [ "id", "completed", "destinationIndex", "status", "sourceIndex", "version", "updated" ], "type": "object", "properties": { "completed": { "type": "boolean" }, "destinationIndex": { "type": "string" }, "error": { "required": [ "message", "status_code" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "id": { "type": "string" }, "sourceIndex": { "type": "string" }, "status": { "enum": [ "success", "failure", "pending" ], "type": "string" }, "updated": { "type": "string", "format": "date-time" }, "version": { "type": "string" } } }, "Security_Detections_API_MigrationStatus": { "required": [ "id", "status", "version", "updated" ], "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "status": { "enum": [ "success", "failure", "pending" ], "type": "string" }, "updated": { "type": "string", "format": "date-time" }, "version": { "type": "integer" } } }, "Security_Detections_API_NewTermsFields": { "maxItems": 3, "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Fields to monitor for new values." }, "Security_Detections_API_NewTermsRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleResponseFields" } ] }, "Security_Detections_API_NewTermsRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields" } ] }, "Security_Detections_API_NewTermsRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields" } ] }, "Security_Detections_API_NewTermsRuleDefaultableFields": { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } }, "Security_Detections_API_NewTermsRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" }, "data_view_id": { "$ref": "#/components/schemas/Security_Detections_API_DataViewId" }, "filters": { "$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray" }, "index": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" } } }, "Security_Detections_API_NewTermsRulePatchFields": { "allOf": [ { "type": "object", "properties": { "history_window_start": { "$ref": "#/components/schemas/Security_Detections_API_HistoryWindowStart" }, "new_terms_fields": { "$ref": "#/components/schemas/Security_Detections_API_NewTermsFields" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "type": { "enum": [ "new_terms" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields" } ] }, "Security_Detections_API_NewTermsRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRulePatchFields" } ] }, "Security_Detections_API_NewTermsRuleRequiredFields": { "required": [ "type", "query", "new_terms_fields", "history_window_start" ], "type": "object", "properties": { "history_window_start": { "$ref": "#/components/schemas/Security_Detections_API_HistoryWindowStart" }, "new_terms_fields": { "$ref": "#/components/schemas/Security_Detections_API_NewTermsFields" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "type": { "enum": [ "new_terms" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_NewTermsRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields" }, { "required": [ "language" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } } ] }, "Security_Detections_API_NewTermsRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields" } ] }, "Security_Detections_API_NonEmptyString": { "minLength": 1, "type": "string", "description": "A string that does not contain only whitespace characters", "format": "nonempty" }, "Security_Detections_API_NormalizedRuleAction": { "required": [ "id", "params" ], "type": "object", "properties": { "alerts_filter": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionAlertsFilter" }, "frequency": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionFrequency" }, "group": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionGroup" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionId" }, "params": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionParams" } }, "additionalProperties": false }, "Security_Detections_API_NormalizedRuleError": { "required": [ "message", "status_code", "rules" ], "type": "object", "properties": { "err_code": { "$ref": "#/components/schemas/Security_Detections_API_BulkActionsDryRunErrCode" }, "message": { "type": "string" }, "rules": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleDetailsInError" } }, "status_code": { "type": "integer" } } }, "Security_Detections_API_OsqueryParams": { "type": "object", "properties": { "ecs_mapping": { "$ref": "#/components/schemas/Security_Detections_API_EcsMapping" }, "pack_id": { "type": "string", "description": "To specify a query pack, use the packId field. Example: \"packId\": \"processes_elastic\"" }, "queries": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_OsqueryQuery" } }, "query": { "type": "string", "description": "To run a single query, use the query field and enter a SQL query. Example: \"query\": \"SELECT * FROM processes;\"" }, "saved_query_id": { "type": "string", "description": "To run a saved query, use the saved_query_id field and specify the saved query ID. Example: \"saved_query_id\": \"processes_elastic\"" }, "timeout": { "type": "number", "description": "A timeout period, in seconds, after which the query will stop running. Overwriting the default timeout allows you to support queries that require more time to complete. The default and minimum supported value is 60. The maximum supported value is 900. Example: \"timeout\": 120." } } }, "Security_Detections_API_OsqueryQuery": { "required": [ "id", "query" ], "type": "object", "properties": { "ecs_mapping": { "$ref": "#/components/schemas/Security_Detections_API_EcsMapping" }, "id": { "type": "string", "description": "Query ID" }, "platform": { "type": "string" }, "query": { "type": "string", "description": "Query to run" }, "removed": { "type": "boolean" }, "snapshot": { "type": "boolean" }, "version": { "type": "string", "description": "Query version" } } }, "Security_Detections_API_OsqueryResponseAction": { "required": [ "action_type_id", "params" ], "type": "object", "properties": { "action_type_id": { "enum": [ ".osquery" ], "type": "string" }, "params": { "$ref": "#/components/schemas/Security_Detections_API_OsqueryParams" } } }, "Security_Detections_API_PlatformErrorResponse": { "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "type": "integer" } } }, "Security_Detections_API_ProcessesParams": { "required": [ "command", "config" ], "type": "object", "properties": { "command": { "enum": [ "kill-process", "suspend-process" ], "type": "string", "description": "To run an endpoint response action, specify a value for the command field. Example: \"command\": \"isolate\"" }, "comment": { "type": "string", "description": "Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: \"comment\": \"Check processes\"" }, "config": { "required": [ "field" ], "type": "object", "properties": { "field": { "type": "string", "description": "Field to use instead of process.pid" }, "overwrite": { "type": "boolean", "description": "Whether to overwrite field with process.pid", "default": true } } } } }, "Security_Detections_API_QueryRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleResponseFields" } ] }, "Security_Detections_API_QueryRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields" } ] }, "Security_Detections_API_QueryRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateFields" } ] }, "Security_Detections_API_QueryRuleDefaultableFields": { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" } } }, "Security_Detections_API_QueryRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" }, "data_view_id": { "$ref": "#/components/schemas/Security_Detections_API_DataViewId" }, "filters": { "$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray" }, "index": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" }, "saved_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryId" } } }, "Security_Detections_API_QueryRulePatchFields": { "allOf": [ { "type": "object", "properties": { "type": { "enum": [ "query" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields" } ] }, "Security_Detections_API_QueryRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRulePatchFields" } ] }, "Security_Detections_API_QueryRuleRequiredFields": { "required": [ "type" ], "type": "object", "properties": { "type": { "enum": [ "query" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_QueryRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleOptionalFields" }, { "required": [ "query", "language" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" } } } ] }, "Security_Detections_API_QueryRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateFields" } ] }, "Security_Detections_API_RelatedIntegration": { "required": [ "package", "version" ], "type": "object", "properties": { "integration": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "package": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } }, "description": "Related integration is a potential dependency of a rule. It's assumed that if the user installs\none of the related integrations of a rule, the rule might start to work properly because it will\nhave source events (generated by this integration) potentially matching the rule's query.\n\nNOTE: Proper work is not guaranteed, because a related integration, if installed, can be\nconfigured differently or generate data that is not necessarily relevant for this rule.\n\nRelated integration is a combination of a Fleet package and (optionally) one of the\npackage's \"integrations\" that this package contains. It is represented by 3 properties:\n\n- `package`: name of the package (required, unique id)\n- `version`: version of the package (required, semver-compatible)\n- `integration`: name of the integration of this package (optional, id within the package)\n\nThere are Fleet packages like `windows` that contain only one integration; in this case,\n`integration` should be unspecified. There are also packages like `aws` and `azure` that contain\nseveral integrations; in this case, `integration` should be specified.\n", "example": { "integration": "activitylogs", "package": "azure", "version": "~1.1.6" } }, "Security_Detections_API_RelatedIntegrationArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegration" } }, "Security_Detections_API_RequiredField": { "required": [ "name", "type", "ecs" ], "type": "object", "properties": { "ecs": { "type": "boolean", "description": "Indicates whether the field is ECS-compliant. This property is only present in responses. Its value is computed based on field’s name and type." }, "name": { "minLength": 1, "type": "string", "description": "Name of an Elasticsearch field", "format": "nonempty" }, "type": { "minLength": 1, "type": "string", "description": "Type of the Elasticsearch field", "format": "nonempty" } }, "description": "Describes an Elasticsearch field that is needed for the rule to function.\n\nAlmost all types of Security rules check source event documents for a match to some kind of\nquery or filter. If a document has certain field with certain values, then it's a match and\nthe rule will generate an alert.\n\nRequired field is an event field that must be present in the source indices of a given rule.\n\n@example\nconst standardEcsField: RequiredField = {\n name: 'event.action',\n type: 'keyword',\n ecs: true,\n};\n\n@example\nconst nonEcsField: RequiredField = {\n name: 'winlog.event_data.AttributeLDAPDisplayName',\n type: 'keyword',\n ecs: false,\n};\n" }, "Security_Detections_API_RequiredFieldArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredField" } }, "Security_Detections_API_RequiredFieldInput": { "required": [ "name", "type" ], "type": "object", "properties": { "name": { "minLength": 1, "type": "string", "description": "Name of an Elasticsearch field", "format": "nonempty" }, "type": { "minLength": 1, "type": "string", "description": "Type of the Elasticsearch field", "format": "nonempty" } }, "description": "Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type." }, "Security_Detections_API_ResponseAction": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_OsqueryResponseAction" }, { "$ref": "#/components/schemas/Security_Detections_API_EndpointResponseAction" } ] }, "Security_Detections_API_ResponseFields": { "required": [ "id", "rule_id", "immutable", "rule_source", "updated_at", "updated_by", "created_at", "created_by", "revision", "related_integrations", "required_fields" ], "type": "object", "properties": { "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "execution_summary": { "$ref": "#/components/schemas/Security_Detections_API_RuleExecutionSummary" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "immutable": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleImmutable" }, "required_fields": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldArray" }, "revision": { "$ref": "#/components/schemas/Security_Detections_API_RuleRevision" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_source": { "$ref": "#/components/schemas/Security_Detections_API_RuleSource" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" } } }, "Security_Detections_API_RiskScore": { "maximum": 100, "minimum": 0, "type": "integer", "description": "A numerical representation of the alert's severity from 0 to 100, where:\n* `0` - `21` represents low severity\n* `22` - `47` represents medium severity\n* `48` - `73` represents high severity\n* `74` - `100` represents critical severity\n" }, "Security_Detections_API_RiskScoreMapping": { "type": "array", "items": { "required": [ "field", "operator", "value" ], "type": "object", "properties": { "field": { "type": "string", "description": "Source event field used to override the default `risk_score`." }, "operator": { "enum": [ "equals" ], "type": "string" }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "value": { "type": "string" } } }, "description": "Overrides generated alerts' risk_score with a value from the source event" }, "Security_Detections_API_RuleAction": { "required": [ "action_type_id", "id", "params" ], "type": "object", "properties": { "action_type_id": { "type": "string", "description": "The action type used for sending notifications, can be:\n\n - `.slack`\n - `.slack_api`\n - `.email`\n - `.index`\n - `.pagerduty`\n - `.swimlane`\n - `.webhook`\n - `.servicenow`\n - `.servicenow-itom`\n - `.servicenow-sir`\n - `.jira`\n - `.resilient`\n - `.opsgenie`\n - `.teams`\n - `.torq`\n - `.tines`\n - `.d3security`\n" }, "alerts_filter": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionAlertsFilter" }, "frequency": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionFrequency" }, "group": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionGroup" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionId" }, "params": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionParams" }, "uuid": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } }, "Security_Detections_API_RuleActionAlertsFilter": { "type": "object", "description": "Object containing an action’s conditional filters.\n\n- `timeframe` (object, optional): Object containing the time frame for when this action can be run.\n - `days` (array of integers, required): List of days of the week on which this action will be run. Days of the week are expressed as numbers between `1-7`, where `1` is Monday and `7` is Sunday. To select all days of the week, enter an empty array.\n - `hours` (object, required): The hours of the day during which this action will run. Hours of the day are expressed as two strings in the format `hh:mm` in `24` hour time. A start of `00:00` and an end of `24:00` means the action can run all day.\n - start (string, required): Start time in `hh:mm` format.\n - end (string, required): End time in `hh:mm` format.\n - `timezone` (string, required): An ISO timezone name, such as `Europe/Madrid` or `America/New_York`. Specific offsets such as `UTC` or `UTC+1` will also work, but lack built-in DST.\n- `query` (object, optional): Object containing a query filter which gets applied to an action and determines whether the action should run.\n - `kql` (string, required): A KQL string.\n - `filters` (array of objects, required): Array of filter objects, as defined in the `kbn-es-query` package.\n \n" }, "Security_Detections_API_RuleActionFrequency": { "required": [ "summary", "notifyWhen", "throttle" ], "type": "object", "properties": { "notifyWhen": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionNotifyWhen" }, "summary": { "type": "boolean", "description": "Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" } }, "description": "The action frequency defines when the action runs (for example, only on rule execution or at specific time intervals)." }, "Security_Detections_API_RuleActionGroup": { "type": "string", "description": "Optionally groups actions by use cases. Use `default` for alert notifications." }, "Security_Detections_API_RuleActionId": { "type": "string", "description": "The connector ID." }, "Security_Detections_API_RuleActionNotifyWhen": { "enum": [ "onActiveAlert", "onThrottleInterval", "onActionGroupChange" ], "type": "string", "description": "Defines how often rules run actions." }, "Security_Detections_API_RuleActionParams": { "type": "object", "description": "Object containing the allowed connector fields, which varies according to the connector type.\n\nFor Slack:\n\n - `message` (string, required): The notification message.\n\nFor email:\n\n - `to`, `cc`, `bcc` (string): Email addresses to which the notifications are sent. At least one field must have a value.\n - `subject` (string, optional): Email subject line.\n - `message` (string, required): Email body text.\n\nFor Webhook:\n\n - `body` (string, required): JSON payload.\n\nFor PagerDuty:\n\n - `severity` (string, required): Severity of on the alert notification, can be: `Critical`, `Error`, `Warning` or `Info`.\n - `eventAction` (string, required): Event [action type](https://v2.developer.pagerduty.com/docs/events-api-v2#event-action), which can be `trigger`, `resolve`, or `acknowledge`.\n - `dedupKey` (string, optional): Groups alert notifications with the same PagerDuty alert.\n - `timestamp` (DateTime, optional): ISO-8601 format [timestamp](https://v2.developer.pagerduty.com/docs/types#datetime).\n - `component` (string, optional): Source machine component responsible for the event, for example `security-solution`.\n - `group` (string, optional): Enables logical grouping of service components.\n - `source` (string, optional): The affected system. Defaults to the Kibana saved object ID of the action.\n - `summary` (string, options): Summary of the event. Defaults to `No summary provided`. Maximum length is 1024 characters.\n - `class` (string, optional): Value indicating the class/type of the event.\n" }, "Security_Detections_API_RuleActionThrottle": { "oneOf": [ { "enum": [ "no_actions", "rule" ], "type": "string" }, { "pattern": "^[1-9]\\d*[smhd]$", "type": "string", "description": "Time interval in seconds, minutes, hours, or days.", "example": "1h" } ], "description": "Defines how often rule actions are taken." }, "Security_Detections_API_RuleAuthorArray": { "type": "array", "items": { "type": "string" }, "description": "The rule’s author." }, "Security_Detections_API_RuleCreateProps": { "anyOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleCreateProps" } ], "discriminator": { "propertyName": "type" } }, "Security_Detections_API_RuleDescription": { "minLength": 1, "type": "string", "description": "The rule’s description.", "example": "Detects anomalous Windows process creation events." }, "Security_Detections_API_RuleDetailsInError": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "Security_Detections_API_RuleExceptionList": { "required": [ "id", "list_id", "type", "namespace_type" ], "type": "object", "properties": { "id": { "minLength": 1, "type": "string", "description": "ID of the exception container", "format": "nonempty" }, "list_id": { "minLength": 1, "type": "string", "description": "List ID of the exception container", "format": "nonempty" }, "namespace_type": { "enum": [ "agnostic", "single" ], "type": "string", "description": "Determines the exceptions validity in rule's Kibana space" }, "type": { "$ref": "#/components/schemas/Security_Detections_API_ExceptionListType" } }, "description": "Array of [exception containers](https://www.elastic.co/guide/en/security/current/exceptions-api-overview.html), which define exceptions that prevent the rule from generating alerts even when its other criteria are met.\n" }, "Security_Detections_API_RuleExecutionMetrics": { "type": "object", "properties": { "execution_gap_duration_s": { "minimum": 0, "type": "integer", "description": "Duration in seconds of execution gap" }, "frozen_indices_queried_count": { "minimum": 0, "type": "integer", "description": "Count of frozen indices queried during the rule execution. These indices could not be entirely excluded after applying the time range filter." }, "gap_range": { "required": [ "gte", "lte" ], "type": "object", "properties": { "gte": { "type": "string", "description": "Start date of the execution gap" }, "lte": { "type": "string", "description": "End date of the execution gap" } }, "description": "Range of the execution gap" }, "total_enrichment_duration_ms": { "minimum": 0, "type": "integer", "description": "Total time spent enriching documents during current rule execution cycle" }, "total_indexing_duration_ms": { "minimum": 0, "type": "integer", "description": "Total time spent indexing documents during current rule execution cycle" }, "total_search_duration_ms": { "minimum": 0, "type": "integer", "description": "Total time spent performing ES searches as measured by Kibana; includes network latency and time spent serializing/deserializing request/response" } } }, "Security_Detections_API_RuleExecutionStatus": { "enum": [ "going to run", "running", "partial failure", "failed", "succeeded" ], "type": "string", "description": "Custom execution status of Security rules that is different from the status used in the Alerting Framework. We merge our custom status with the Framework's status to determine the resulting status of a rule.\n- going to run - @deprecated Replaced by the 'running' status but left for backwards compatibility with rule execution events already written to Event Log in the prior versions of Kibana. Don't use when writing rule status changes.\n- running - Rule execution started but not reached any intermediate or final status.\n- partial failure - Rule can partially fail for various reasons either in the middle of an execution (in this case we update its status right away) or in the end of it. So currently this status can be both intermediate and final at the same time. A typical reason for a partial failure: not all the indices that the rule searches over actually exist.\n- failed - Rule failed to execute due to unhandled exception or a reason defined in the business logic of its executor function.\n- succeeded - Rule executed successfully without any issues. Note: this status is just an indication of a rule's \"health\". The rule might or might not generate any alerts despite of it." }, "Security_Detections_API_RuleExecutionStatusOrder": { "type": "integer" }, "Security_Detections_API_RuleExecutionSummary": { "required": [ "last_execution" ], "type": "object", "properties": { "last_execution": { "required": [ "date", "status", "status_order", "message", "metrics" ], "type": "object", "properties": { "date": { "type": "string", "description": "Date of the last execution", "format": "date-time" }, "message": { "type": "string" }, "metrics": { "$ref": "#/components/schemas/Security_Detections_API_RuleExecutionMetrics" }, "status": { "$ref": "#/components/schemas/Security_Detections_API_RuleExecutionStatus" }, "status_order": { "$ref": "#/components/schemas/Security_Detections_API_RuleExecutionStatusOrder" } } } }, "description": "Summary of the last execution of a rule.\n> info\n> This field is under development and its usage or schema may change\n" }, "Security_Detections_API_RuleFalsePositiveArray": { "type": "array", "items": { "type": "string" }, "description": "String array used to describe common reasons why the rule may issue false-positive alerts. Defaults to an empty array." }, "Security_Detections_API_RuleFilterArray": { "type": "array", "items": { }, "description": "The query and filter context array used to define the conditions for when alerts are created from events. Defaults to an empty array.\n> info\n> This field is not supported for ES|QL rules.\n" }, "Security_Detections_API_RuleInterval": { "type": "string", "description": "Frequency of rule execution, using a date math range. For example, \"1h\" means the rule runs every hour. Defaults to 5m (5 minutes)." }, "Security_Detections_API_RuleIntervalFrom": { "type": "string", "description": "Time from which data is analyzed each time the rule runs, using a date math range. For example, now-4200s means the rule analyzes data from 70 minutes before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).", "format": "date-math" }, "Security_Detections_API_RuleIntervalTo": { "type": "string" }, "Security_Detections_API_RuleLicense": { "type": "string", "description": "The rule's license." }, "Security_Detections_API_RuleMetadata": { "type": "object", "description": "Placeholder for metadata about the rule.\n> info\n> This field is overwritten when you save changes to the rule’s settings.\n" }, "Security_Detections_API_RuleName": { "minLength": 1, "type": "string", "description": "A human-readable name for the rule.", "example": "Anomalous Windows Process Creation" }, "Security_Detections_API_RuleNameOverride": { "type": "string", "description": "Sets which field in the source event is used to populate the alert's `signal.rule.name` value (in the UI, this value is displayed on the Rules page in the Rule column). When unspecified, the rule’s `name` value is used. The source field must be a string data type." }, "Security_Detections_API_RuleObjectId": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "Security_Detections_API_RulePatchProps": { "anyOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRulePatchProps" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRulePatchProps" } ] }, "Security_Detections_API_RulePreviewLoggedRequest": { "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "duration": { "type": "integer" }, "request": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "request_type": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } }, "Security_Detections_API_RulePreviewLogs": { "required": [ "errors", "warnings", "duration" ], "type": "object", "properties": { "duration": { "type": "integer", "description": "Execution duration in milliseconds" }, "errors": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } }, "requests": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RulePreviewLoggedRequest" } }, "startedAt": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "warnings": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } } }, "Security_Detections_API_RulePreviewParams": { "required": [ "invocationCount", "timeframeEnd" ], "type": "object", "properties": { "invocationCount": { "type": "integer" }, "timeframeEnd": { "type": "string", "format": "date-time" } } }, "Security_Detections_API_RuleQuery": { "type": "string", "description": "[Query](https://www.elastic.co/guide/en/kibana/8.17/search.html) used by the rule to create alerts.\n\n- For indicator match rules, only the query’s results are used to determine whether an alert is generated.\n- ES|QL rules have additional query requirements. Refer to [Create ES|QL](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-esql-rule) rules for more information.\n" }, "Security_Detections_API_RuleReferenceArray": { "type": "array", "items": { "type": "string" }, "description": "Array containing notes about or references to relevant information about the rule. Defaults to an empty array." }, "Security_Detections_API_RuleResponse": { "anyOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRule" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRule" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRule" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRule" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRule" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRule" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRule" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRule" } ], "discriminator": { "propertyName": "type" } }, "Security_Detections_API_RuleRevision": { "minimum": 0, "type": "integer", "description": "The rule's revision number.\n\nIt represents the version of rule's object in Kibana. It is set to `0` when the rule is installed or created and then gets incremented on each update.\n> info\n> Not all updates to any rule fields will increment the revision. Only those fields that are considered static `rule parameters` can trigger revision increments. For example, an update to a rule's query or index fields will increment the rule's revision by `1`. However, changes to dynamic or technical fields like enabled or execution_summary will not cause revision increments.\n" }, "Security_Detections_API_RuleSignatureId": { "type": "string", "description": "A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s." }, "Security_Detections_API_RuleSource": { "oneOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ExternalRuleSource" }, { "$ref": "#/components/schemas/Security_Detections_API_InternalRuleSource" } ], "description": "Discriminated union that determines whether the rule is internally sourced (created within the Kibana app) or has an external source, such as the Elastic Prebuilt rules repo.", "discriminator": { "propertyName": "type" } }, "Security_Detections_API_RuleTagArray": { "type": "array", "items": { "type": "string" }, "description": "String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array." }, "Security_Detections_API_RuleUpdateProps": { "anyOf": [ { "$ref": "#/components/schemas/Security_Detections_API_EqlRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_QueryRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps" }, { "$ref": "#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps" } ], "discriminator": { "propertyName": "type" } }, "Security_Detections_API_RuleVersion": { "minimum": 1, "type": "integer", "description": "The rule's version number.\n\n- For prebuilt rules it represents the version of the rule's content in the source [detection-rules](https://github.com/elastic/detection-rules) repository (and the corresponding `security_detection_engine` Fleet package that is used for distributing prebuilt rules). \n- For custom rules it is set to `1` when the rule is created. \n> info\n> It is not incremented on each update. Compare this to the `revision` field.\n" }, "Security_Detections_API_RuntimeFieldMapping": { "required": [ "type" ], "type": "object", "properties": { "format": { "maxLength": 100, "type": "string", "description": "Format string for date runtime fields, for example `strict_date_optional_time`." }, "script": { "required": [ "source" ], "type": "object", "properties": { "source": { "maxLength": 10000, "type": "string", "description": "Painless script source to execute." } }, "additionalProperties": false, "description": "Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics." }, "type": { "$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldType" } }, "description": "A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time." }, "Security_Detections_API_RuntimeFieldType": { "enum": [ "keyword", "long", "double", "date", "ip", "boolean", "geo_point" ], "type": "string", "description": "The data type for the runtime field type. Determines how the field value is indexed and queried." }, "Security_Detections_API_SavedObjectResolveAliasPurpose": { "enum": [ "savedObjectConversion", "savedObjectImport" ], "type": "string" }, "Security_Detections_API_SavedObjectResolveAliasTargetId": { "type": "string" }, "Security_Detections_API_SavedObjectResolveOutcome": { "enum": [ "exactMatch", "aliasMatch", "conflict" ], "type": "string" }, "Security_Detections_API_SavedQueryId": { "type": "string", "description": "Kibana [saved search](https://www.elastic.co/guide/en/kibana/current/save-open-search.html) used by the rule to create alerts." }, "Security_Detections_API_SavedQueryRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleResponseFields" } ] }, "Security_Detections_API_SavedQueryRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields" } ] }, "Security_Detections_API_SavedQueryRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields" } ] }, "Security_Detections_API_SavedQueryRuleDefaultableFields": { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } }, "Security_Detections_API_SavedQueryRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" }, "data_view_id": { "$ref": "#/components/schemas/Security_Detections_API_DataViewId" }, "filters": { "$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray" }, "index": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" }, "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" } } }, "Security_Detections_API_SavedQueryRulePatchFields": { "allOf": [ { "type": "object", "properties": { "saved_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryId" }, "type": { "enum": [ "saved_query" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields" } ] }, "Security_Detections_API_SavedQueryRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRulePatchFields" } ] }, "Security_Detections_API_SavedQueryRuleRequiredFields": { "required": [ "type", "saved_id" ], "type": "object", "properties": { "saved_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryId" }, "type": { "enum": [ "saved_query" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_SavedQueryRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields" }, { "required": [ "language" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } } ] }, "Security_Detections_API_SavedQueryRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields" } ] }, "Security_Detections_API_SetAlertsStatusByIds": { "required": [ "signal_ids", "status" ], "type": "object", "properties": { "signal_ids": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "description": "List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts." }, "status": { "$ref": "#/components/schemas/Security_Detections_API_AlertStatus" } } }, "Security_Detections_API_SetAlertsStatusByQuery": { "required": [ "query", "status" ], "type": "object", "properties": { "conflicts": { "enum": [ "abort", "proceed" ], "type": "string", "default": "abort" }, "query": { "type": "object" }, "runtime_fields": { "maxProperties": 100, "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldType" }, "description": "Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the alerts index mapping, for example, custom fields added via data view runtime fields. The combined number of unique field names across `runtime_fields` and `runtime_mappings` must not exceed 100." }, "runtime_mappings": { "maxProperties": 100, "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Security_Detections_API_RuntimeFieldMapping" }, "description": "Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. The combined number of unique field names across `runtime_fields` and `runtime_mappings` must not exceed 100." }, "status": { "$ref": "#/components/schemas/Security_Detections_API_AlertStatus" } } }, "Security_Detections_API_SetAlertTags": { "required": [ "tags_to_add", "tags_to_remove" ], "type": "object", "properties": { "tags_to_add": { "$ref": "#/components/schemas/Security_Detections_API_AlertTags" }, "tags_to_remove": { "$ref": "#/components/schemas/Security_Detections_API_AlertTags" } } }, "Security_Detections_API_SetupGuide": { "type": "string", "description": "Populates the rule’s setup guide with instructions on rule prerequisites such as required integrations, configuration steps, and anything else needed for the rule to work correctly." }, "Security_Detections_API_Severity": { "enum": [ "low", "medium", "high", "critical" ], "type": "string", "description": "Severity level of alerts produced by the rule, which must be one of the following:\n* `low`: Alerts that are of interest but generally not considered to be security incidents\n* `medium`: Alerts that require investigation\n* `high`: Alerts that require immediate investigation\n* `critical`: Alerts that indicate it is highly likely a security incident has occurred\n" }, "Security_Detections_API_SeverityMapping": { "type": "array", "items": { "required": [ "field", "operator", "severity", "value" ], "type": "object", "properties": { "field": { "type": "string", "description": "Source event field used to override the default `severity`." }, "operator": { "enum": [ "equals" ], "type": "string" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "value": { "type": "string" } } }, "description": "Overrides generated alerts' severity with values from the source event" }, "Security_Detections_API_SiemErrorResponse": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "Security_Detections_API_SkippedAlertsIndexMigration": { "required": [ "index" ], "type": "object", "properties": { "index": { "type": "string" } } }, "Security_Detections_API_SortOrder": { "enum": [ "asc", "desc" ], "type": "string" }, "Security_Detections_API_Threat": { "required": [ "framework", "tactic" ], "type": "object", "properties": { "framework": { "type": "string", "description": "Relevant attack framework" }, "tactic": { "$ref": "#/components/schemas/Security_Detections_API_ThreatTactic" }, "technique": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ThreatTechnique" }, "description": "Array containing information on the attack techniques (optional)" } }, "description": "> info\n> Currently, only threats described using the MITRE ATT&CK™ framework are supported.\n" }, "Security_Detections_API_ThreatArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_Threat" } }, "Security_Detections_API_ThreatFilters": { "type": "array", "items": { "description": "Query and filter context array used to filter documents from the Elasticsearch index containing the threat values" } }, "Security_Detections_API_ThreatIndex": { "type": "array", "items": { "type": "string" }, "description": "Elasticsearch indices used to check which field values generate alerts." }, "Security_Detections_API_ThreatIndicatorPath": { "type": "string", "description": "Defines the path to the threat indicator in the indicator documents (optional)" }, "Security_Detections_API_ThreatMapping": { "minItems": 1, "type": "array", "items": { "required": [ "entries" ], "type": "object", "properties": { "entries": { "type": "array", "items": { "required": [ "field", "type", "value" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" }, "type": { "enum": [ "mapping" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_NonEmptyString" } } } } } }, "description": "Array of entries objects that define mappings between the source event fields and the values in the Elasticsearch threat index. Each entries object must contain these fields:\n\n- field: field from the event indices on which the rule runs\n- type: must be mapping\n- value: field from the Elasticsearch threat index\n \nYou can use Boolean and and or logic to define the conditions for when matching fields and values generate alerts. Sibling entries objects are evaluated using or logic, whereas multiple entries in a single entries object use and logic. See Example of Threat Match rule which uses both `and` and `or` logic.\n" }, "Security_Detections_API_ThreatMatchRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleResponseFields" } ] }, "Security_Detections_API_ThreatMatchRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields" } ] }, "Security_Detections_API_ThreatMatchRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields" } ] }, "Security_Detections_API_ThreatMatchRuleDefaultableFields": { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } }, "Security_Detections_API_ThreatMatchRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppression" }, "concurrent_searches": { "$ref": "#/components/schemas/Security_Detections_API_ConcurrentSearches" }, "data_view_id": { "$ref": "#/components/schemas/Security_Detections_API_DataViewId" }, "filters": { "$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray" }, "index": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" }, "items_per_search": { "$ref": "#/components/schemas/Security_Detections_API_ItemsPerSearch" }, "saved_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryId" }, "threat_filters": { "$ref": "#/components/schemas/Security_Detections_API_ThreatFilters" }, "threat_indicator_path": { "$ref": "#/components/schemas/Security_Detections_API_ThreatIndicatorPath" }, "threat_language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } }, "Security_Detections_API_ThreatMatchRulePatchFields": { "allOf": [ { "type": "object", "properties": { "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "threat_index": { "$ref": "#/components/schemas/Security_Detections_API_ThreatIndex" }, "threat_mapping": { "$ref": "#/components/schemas/Security_Detections_API_ThreatMapping" }, "threat_query": { "$ref": "#/components/schemas/Security_Detections_API_ThreatQuery" }, "type": { "enum": [ "threat_match" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields" } ] }, "Security_Detections_API_ThreatMatchRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRulePatchFields" } ] }, "Security_Detections_API_ThreatMatchRuleRequiredFields": { "required": [ "type", "query", "threat_query", "threat_mapping", "threat_index" ], "type": "object", "properties": { "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "threat_index": { "$ref": "#/components/schemas/Security_Detections_API_ThreatIndex" }, "threat_mapping": { "$ref": "#/components/schemas/Security_Detections_API_ThreatMapping" }, "threat_query": { "$ref": "#/components/schemas/Security_Detections_API_ThreatQuery" }, "type": { "enum": [ "threat_match" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_ThreatMatchRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields" }, { "required": [ "language" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } } ] }, "Security_Detections_API_ThreatMatchRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields" } ] }, "Security_Detections_API_ThreatQuery": { "type": "string", "description": "Query used to determine which fields in the Elasticsearch index are used for generating alerts." }, "Security_Detections_API_ThreatSubtechnique": { "required": [ "id", "name", "reference" ], "type": "object", "properties": { "id": { "type": "string", "description": "Subtechnique ID" }, "name": { "type": "string", "description": "Subtechnique name" }, "reference": { "type": "string", "description": "Subtechnique reference" } } }, "Security_Detections_API_ThreatTactic": { "required": [ "id", "name", "reference" ], "type": "object", "properties": { "id": { "type": "string", "description": "Tactic ID" }, "name": { "type": "string", "description": "Tactic name" }, "reference": { "type": "string", "description": "Tactic reference" } }, "description": "Object containing information on the attack type\n" }, "Security_Detections_API_ThreatTechnique": { "required": [ "id", "name", "reference" ], "type": "object", "properties": { "id": { "type": "string", "description": "Technique ID" }, "name": { "type": "string", "description": "Technique name" }, "reference": { "type": "string", "description": "Technique reference" }, "subtechnique": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ThreatSubtechnique" }, "description": "Array containing more specific information on the attack technique.\n" } } }, "Security_Detections_API_Threshold": { "required": [ "field", "value" ], "type": "object", "properties": { "cardinality": { "$ref": "#/components/schemas/Security_Detections_API_ThresholdCardinality" }, "field": { "$ref": "#/components/schemas/Security_Detections_API_ThresholdField" }, "value": { "$ref": "#/components/schemas/Security_Detections_API_ThresholdValue" } } }, "Security_Detections_API_ThresholdAlertSuppression": { "required": [ "duration" ], "type": "object", "properties": { "duration": { "$ref": "#/components/schemas/Security_Detections_API_AlertSuppressionDuration" } }, "description": "Defines alert suppression configuration." }, "Security_Detections_API_ThresholdCardinality": { "type": "array", "items": { "required": [ "field", "value" ], "type": "object", "properties": { "field": { "type": "string", "description": "The field on which to calculate and compare the cardinality." }, "value": { "minimum": 0, "type": "integer", "description": "The threshold value from which an alert is generated based on unique number of values of cardinality.field." } } }, "description": "The field on which the cardinality is applied." }, "Security_Detections_API_ThresholdField": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "The field on which the threshold is applied. If you specify an empty array ([]), alerts are generated when the query returns at least the number of results specified in the value field." }, "Security_Detections_API_ThresholdRule": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity", "version", "tags", "enabled", "risk_score_mapping", "severity_mapping", "interval", "from", "to", "actions", "exceptions_list", "author", "false_positives", "references", "max_signals", "threat", "setup", "related_integrations", "required_fields" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ResponseFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleResponseFields" } ] }, "Security_Detections_API_ThresholdRuleCreateFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields" } ] }, "Security_Detections_API_ThresholdRuleCreateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields" } ] }, "Security_Detections_API_ThresholdRuleDefaultableFields": { "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } }, "Security_Detections_API_ThresholdRuleOptionalFields": { "type": "object", "properties": { "alert_suppression": { "$ref": "#/components/schemas/Security_Detections_API_ThresholdAlertSuppression" }, "data_view_id": { "$ref": "#/components/schemas/Security_Detections_API_DataViewId" }, "filters": { "$ref": "#/components/schemas/Security_Detections_API_RuleFilterArray" }, "index": { "$ref": "#/components/schemas/Security_Detections_API_IndexPatternArray" }, "saved_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedQueryId" } } }, "Security_Detections_API_ThresholdRulePatchFields": { "allOf": [ { "type": "object", "properties": { "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "threshold": { "$ref": "#/components/schemas/Security_Detections_API_Threshold" }, "type": { "enum": [ "threshold" ], "type": "string", "description": "Rule type" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields" } ] }, "Security_Detections_API_ThresholdRulePatchProps": { "allOf": [ { "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRulePatchFields" } ] }, "Security_Detections_API_ThresholdRuleRequiredFields": { "required": [ "type", "query", "threshold" ], "type": "object", "properties": { "query": { "$ref": "#/components/schemas/Security_Detections_API_RuleQuery" }, "threshold": { "$ref": "#/components/schemas/Security_Detections_API_Threshold" }, "type": { "enum": [ "threshold" ], "type": "string", "description": "Rule type" } } }, "Security_Detections_API_ThresholdRuleResponseFields": { "allOf": [ { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields" }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields" }, { "required": [ "language" ], "type": "object", "properties": { "language": { "$ref": "#/components/schemas/Security_Detections_API_KqlQueryLanguage" } } } ] }, "Security_Detections_API_ThresholdRuleUpdateProps": { "allOf": [ { "required": [ "name", "description", "risk_score", "severity" ], "type": "object", "properties": { "actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleAction" }, "description": "Array defining the automated actions (notifications) taken when alerts are generated." }, "alias_purpose": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId" }, "author": { "$ref": "#/components/schemas/Security_Detections_API_RuleAuthorArray" }, "building_block_type": { "$ref": "#/components/schemas/Security_Detections_API_BuildingBlockType" }, "description": { "$ref": "#/components/schemas/Security_Detections_API_RuleDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Detections_API_IsRuleEnabled" }, "exceptions_list": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RuleExceptionList" } }, "false_positives": { "$ref": "#/components/schemas/Security_Detections_API_RuleFalsePositiveArray" }, "from": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalFrom" }, "id": { "$ref": "#/components/schemas/Security_Detections_API_UUID" }, "interval": { "$ref": "#/components/schemas/Security_Detections_API_RuleInterval" }, "investigation_fields": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationFields" }, "license": { "$ref": "#/components/schemas/Security_Detections_API_RuleLicense" }, "max_signals": { "$ref": "#/components/schemas/Security_Detections_API_MaxSignals" }, "meta": { "$ref": "#/components/schemas/Security_Detections_API_RuleMetadata" }, "name": { "$ref": "#/components/schemas/Security_Detections_API_RuleName" }, "namespace": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndexNamespace" }, "note": { "$ref": "#/components/schemas/Security_Detections_API_InvestigationGuide" }, "outcome": { "$ref": "#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome" }, "output_index": { "$ref": "#/components/schemas/Security_Detections_API_AlertsIndex" }, "references": { "$ref": "#/components/schemas/Security_Detections_API_RuleReferenceArray" }, "related_integrations": { "$ref": "#/components/schemas/Security_Detections_API_RelatedIntegrationArray" }, "required_fields": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_RequiredFieldInput" }, "description": "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n" }, "response_actions": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Detections_API_ResponseAction" } }, "risk_score": { "$ref": "#/components/schemas/Security_Detections_API_RiskScore" }, "risk_score_mapping": { "$ref": "#/components/schemas/Security_Detections_API_RiskScoreMapping" }, "rule_id": { "$ref": "#/components/schemas/Security_Detections_API_RuleSignatureId" }, "rule_name_override": { "$ref": "#/components/schemas/Security_Detections_API_RuleNameOverride" }, "setup": { "$ref": "#/components/schemas/Security_Detections_API_SetupGuide" }, "severity": { "$ref": "#/components/schemas/Security_Detections_API_Severity" }, "severity_mapping": { "$ref": "#/components/schemas/Security_Detections_API_SeverityMapping" }, "tags": { "$ref": "#/components/schemas/Security_Detections_API_RuleTagArray" }, "threat": { "$ref": "#/components/schemas/Security_Detections_API_ThreatArray" }, "throttle": { "$ref": "#/components/schemas/Security_Detections_API_RuleActionThrottle" }, "timeline_id": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateId" }, "timeline_title": { "$ref": "#/components/schemas/Security_Detections_API_TimelineTemplateTitle" }, "timestamp_override": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverride" }, "timestamp_override_fallback_disabled": { "$ref": "#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled" }, "to": { "$ref": "#/components/schemas/Security_Detections_API_RuleIntervalTo" }, "version": { "$ref": "#/components/schemas/Security_Detections_API_RuleVersion" } } }, { "$ref": "#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields" } ] }, "Security_Detections_API_ThresholdValue": { "minimum": 1, "type": "integer", "description": "The threshold value from which an alert is generated." }, "Security_Detections_API_ThrottleForBulkActions": { "enum": [ "rule", "1h", "1d", "7d" ], "type": "string", "description": "Defines the maximum interval in which a rule’s actions are executed.\n> info\n> The rule level `throttle` field is deprecated in Elastic Security 8.8 and will remain active for at least the next 12 months.\n> In Elastic Security 8.8 and later, you can use the `frequency` field to define frequencies for individual actions. Actions without frequencies will acquire a converted version of the rule’s `throttle` field. In the response, the converted `throttle` setting appears in the individual actions' `frequency` field.\n" }, "Security_Detections_API_TiebreakerField": { "type": "string", "description": "Sets a secondary field for sorting events" }, "Security_Detections_API_TimelineTemplateId": { "type": "string", "description": "Timeline template ID" }, "Security_Detections_API_TimelineTemplateTitle": { "type": "string", "description": "Timeline template title" }, "Security_Detections_API_TimestampField": { "type": "string", "description": "Specifies the name of the event timestamp field used for sorting a sequence of events. Not to be confused with `timestamp_override`, which specifies the more general field used for querying events within a range. Defaults to the @timestamp ECS field." }, "Security_Detections_API_TimestampOverride": { "type": "string", "description": "Sets the time field used to query indices. When unspecified, rules query the `@timestamp` field. The source field must be an Elasticsearch date data type." }, "Security_Detections_API_TimestampOverrideFallbackDisabled": { "type": "boolean", "description": "Disables the fallback to the event's @timestamp field" }, "Security_Detections_API_UUID": { "type": "string", "description": "A universally unique identifier", "format": "uuid" }, "Security_Detections_API_WarningSchema": { "required": [ "type", "message", "actionPath" ], "type": "object", "properties": { "actionPath": { "type": "string" }, "buttonLabel": { "type": "string" }, "message": { "type": "string" }, "type": { "type": "string" } } }, "Security_Endpoint_Exceptions_API_EndpointList": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionList" }, { "type": "object", "additionalProperties": false } ] }, "Security_Endpoint_Exceptions_API_EndpointListItem": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem" }, "Security_Endpoint_Exceptions_API_ExceptionList": { "required": [ "id", "list_id", "type", "name", "description", "immutable", "namespace_type", "version", "tie_breaker_id", "created_at", "created_by", "updated_at", "updated_by" ], "type": "object", "properties": { "_version": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListDescription" }, "id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "immutable": { "type": "boolean" }, "list_id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListMeta" }, "name": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListName" }, "namespace_type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListTags" }, "tie_breaker_id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListType" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" }, "version": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListVersion" } } }, "Security_Endpoint_Exceptions_API_ExceptionListDescription": { "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListHumanId": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ExceptionListId": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ExceptionListItem": { "required": [ "id", "item_id", "list_id", "type", "name", "description", "entries", "namespace_type", "comments", "tie_breaker_id", "created_at", "created_by", "updated_at", "updated_by" ], "type": "object", "properties": { "_version": { "type": "string" }, "comments": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray" }, "expire_time": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "item_id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "namespace_type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags" }, "tie_breaker_id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemComment": { "required": [ "id", "comment", "created_at", "created_by" ], "type": "object", "properties": { "comment": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemComment" } }, "Security_Endpoint_Exceptions_API_ExceptionListItemDescription": { "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntry": { "anyOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryList" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard" } ], "discriminator": { "propertyName": "type" } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntry" } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists": { "required": [ "type", "field", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "exists" ], "type": "string" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryList": { "required": [ "type", "field", "list", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "list": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "type": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ListType" } } }, "operator": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "list" ], "type": "string" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch": { "required": [ "type", "field", "value", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "match" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny": { "required": [ "type", "field", "value", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "match_any" ], "type": "string" }, "value": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard": { "required": [ "type", "field", "value", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "wildcard" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested": { "required": [ "type", "field", "entries" ], "type": "object", "properties": { "entries": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem" } }, "field": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "type": { "enum": [ "nested" ], "type": "string" } } }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny" }, { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists" } ] }, "Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator": { "enum": [ "excluded", "included" ], "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListItemHumanId": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ExceptionListItemId": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ExceptionListItemMeta": { "type": "object" }, "Security_Endpoint_Exceptions_API_ExceptionListItemName": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType" } }, "Security_Endpoint_Exceptions_API_ExceptionListItemTags": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" } }, "Security_Endpoint_Exceptions_API_ExceptionListItemType": { "enum": [ "simple" ], "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListMeta": { "type": "object" }, "Security_Endpoint_Exceptions_API_ExceptionListName": { "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListOsType": { "enum": [ "linux", "macos", "windows" ], "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType" } }, "Security_Endpoint_Exceptions_API_ExceptionListTags": { "type": "array", "items": { "type": "string" } }, "Security_Endpoint_Exceptions_API_ExceptionListType": { "enum": [ "detection", "rule_default", "endpoint", "endpoint_trusted_apps", "endpoint_events", "endpoint_host_isolation_exceptions", "endpoint_blocklists" ], "type": "string" }, "Security_Endpoint_Exceptions_API_ExceptionListVersion": { "minimum": 1, "type": "integer" }, "Security_Endpoint_Exceptions_API_ExceptionNamespaceType": { "enum": [ "agnostic", "single" ], "type": "string", "description": "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n" }, "Security_Endpoint_Exceptions_API_FindEndpointListItemsFilter": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ListId": { "$ref": "#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString" }, "Security_Endpoint_Exceptions_API_ListType": { "enum": [ "binary", "boolean", "byte", "date", "date_nanos", "date_range", "double", "double_range", "float", "float_range", "geo_point", "geo_shape", "half_float", "integer", "integer_range", "ip", "ip_range", "keyword", "long", "long_range", "shape", "short", "text" ], "type": "string" }, "Security_Endpoint_Exceptions_API_NonEmptyString": { "minLength": 1, "type": "string", "description": "A string that does not contain only whitespace characters", "format": "nonempty" }, "Security_Endpoint_Exceptions_API_PlatformErrorResponse": { "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "type": "integer" } } }, "Security_Endpoint_Exceptions_API_SiemErrorResponse": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "Security_Endpoint_Management_API_ActionLogRequestQuery": { "type": "object", "properties": { "end_date": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndDate" }, "page": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Page" }, "page_size": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PageSize" }, "start_date": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_StartDate" } } }, "Security_Endpoint_Management_API_ActionStateSuccessResponse": { "required": [ "body" ], "type": "object", "properties": { "body": { "required": [ "data" ], "type": "object", "properties": { "data": { "type": "object", "properties": { "canEncrypt": { "type": "boolean" } } } } } } }, "Security_Endpoint_Management_API_ActionStatusSuccessResponse": { "required": [ "body" ], "type": "object", "properties": { "body": { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "agent_id", "pending_actions" ], "type": "object", "properties": { "agent_id": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentId" }, "pending_actions": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionsSchema" } } } } } } }, "Security_Endpoint_Management_API_AgentId": { "type": "string", "description": "Agent ID" }, "Security_Endpoint_Management_API_AgentIds": { "minLength": 1, "oneOf": [ { "maxItems": 50, "minItems": 1, "type": "array", "items": { "minLength": 1, "type": "string" } }, { "minLength": 1, "type": "string" } ], "description": "A list of agent IDs. Max of 50.", "example": [ "agent-id-1", "agent-id-2" ] }, "Security_Endpoint_Management_API_AgentTypes": { "enum": [ "endpoint", "sentinel_one", "crowdstrike", "microsoft_defender_endpoint" ], "type": "string", "description": "List of agent types to retrieve. Defaults to `endpoint`.", "example": "endpoint" }, "Security_Endpoint_Management_API_AlertIds": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_NonEmptyString" }, "description": "A list of alerts ids." }, "Security_Endpoint_Management_API_CaseIds": { "minItems": 1, "type": "array", "items": { "minLength": 1, "type": "string" }, "description": "Case IDs to be updated (cannot contain empty strings)", "example": [ "case-id-1", "case-id-2" ] }, "Security_Endpoint_Management_API_CloudFileScriptParameters": { "required": [ "cloudFile" ], "type": "object", "properties": { "cloudFile": { "minLength": 1, "type": "string", "description": "Script name in cloud storage." }, "commandLine": { "minLength": 1, "type": "string", "description": "Command line arguments." }, "timeout": { "minimum": 1, "type": "integer", "description": "Timeout in seconds." } } }, "Security_Endpoint_Management_API_Command": { "minLength": 1, "enum": [ "isolate", "unisolate", "kill-process", "suspend-process", "running-processes", "get-file", "execute", "upload", "scan" ], "type": "string", "description": "The command to be executed (cannot be an empty string)" }, "Security_Endpoint_Management_API_Commands": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Command" }, "description": "A list of response action command names.", "example": [ "isolate", "unisolate" ] }, "Security_Endpoint_Management_API_Comment": { "type": "string", "description": "Optional comment", "example": "This is a comment" }, "Security_Endpoint_Management_API_EndDate": { "type": "string", "description": "An end date in ISO format or Date Math format.", "example": "2023-10-31T23:59:59.999Z" }, "Security_Endpoint_Management_API_EndpointIds": { "minItems": 1, "type": "array", "items": { "minLength": 1, "type": "string" }, "description": "List of endpoint IDs (cannot contain empty strings)", "example": [ "endpoint-id-1", "endpoint-id-2" ] }, "Security_Endpoint_Management_API_EndpointMetadataResponse": { "type": "object", "example": { "host_status": "healthy", "last_checkin": "2023-07-04T15:48:57.360Z", "metadata": { "@timestamp": "2023-07-04T15:48:57.3609346Z", "agent": { "build": { "original": "version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab" }, "id": "abb8a826-6812-448c-a571-6d8269b51449", "type": "endpoint", "version": "7.16.0" }, "data_stream": { "dataset": "endpoint.metadata", "namespace": "default", "type": "metrics" }, "ecs": { "version": "1.11.0" }, "elastic": { "agent": { "id": "abb8a826-6812-448c-a571-6d8269b51449" } }, "Endpoint": { "capabilities": [ "isolation" ], "configuration": { "isolation": false }, "policy": { "applied": { "endpoint_policy_version": "2", "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "name": "test", "status": "success", "version": "3" } }, "state": { "isolation": false }, "status": "enrolled" }, "event": { "action": "endpoint_metadata", "agent_id_status": "verified", "category": [ "host" ], "created": "2023-07-04T15:48:57.3609346Z", "dataset": "endpoint.metadata", "id": "MNtRc++KoKHXXwlj+++++OhZ", "ingested": "2023-07-04T15:48:58Z", "kind": "metric", "module": "endpoint", "sequence": 43757, "type": [ "info" ] }, "host": { "architecture": "x86_64", "hostname": "WinDev2104Eval", "id": "17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5", "ip": [ "10.0.2.15", "fe80::21a6:63d3:d70e:e3ad", "127.0.0.1", "::1" ], "mac": [ "08:00:27:b1:1d:5a" ], "name": "WinDev2104Eval", "os": { "Ext": { "variant": "Windows 10 Enterprise Evaluation" }, "family": "windows", "full": "Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)", "kernel": "20H2 (10.0.19042.906)", "name": "Windows", "platform": "windows", "type": "windows", "version": "20H2 (10.0.19042.906)" } }, "message": "Endpoint metadata", "policy_info": { "agent": { "applied": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 3 }, "configured": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 3 } }, "endpoint": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "revision": 2 } } } } }, "Security_Endpoint_Management_API_ExecuteRouteRequestBody": { "allOf": [ { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, { "required": [ "parameters" ], "type": "object", "properties": { "parameters": { "required": [ "command" ], "type": "object", "properties": { "command": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Command" }, "timeout": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Timeout" } } } } } ], "example": { "comment": "Get list of all files", "endpoint_ids": [ "b3d6de74-36b0-4fa8-be46-c375bf1771bf" ], "parameters": { "command": "ls -al", "timeout": 600 } } }, "Security_Endpoint_Management_API_ExecuteRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentState": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "isCompleted": false, "wasSuccessful": false } }, "agentType": "endpoint", "command": "execute", "comment": "Get list of all files", "createdBy": "myuser", "hosts": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "name": "gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r" } }, "id": "9f934028-2300-4927-b531-b26376793dc4", "isCompleted": false, "isExpired": false, "outputs": { }, "parameters": { "command": "ls -al", "timeout": 600 }, "startedAt": "2023-07-28T18:43:27.362Z", "status": "pending", "wasSuccessful": false } } }, "Security_Endpoint_Management_API_GetEndpointActionListResponse": { "type": "object", "example": { "data": [ { "agents": [ "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0" ], "agentType": "endpoint", "command": "running-processes", "completedAt": "2022-08-08T09:50:47.672Z", "createdBy": "elastic", "id": "b3d6de74-36b0-4fa8-be46-c375bf1771bf", "isCompleted": true, "isExpired": false, "startedAt": "2022-08-08T15:24:57.402Z", "wasSuccessful": true }, { "agents": [ "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0" ], "agentType": "endpoint", "command": "isolate", "completedAt": "2022-08-08T10:41:57.352Z", "createdBy": "elastic", "id": "43b4098b-8752-4fbb-a7a7-6df7c74d0ee3", "isCompleted": true, "isExpired": false, "startedAt": "2022-08-08T15:23:37.359Z", "wasSuccessful": true }, { "agents": [ "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0" ], "agentType": "endpoint", "command": "kill-process", "comment": "bad process - taking up too much cpu", "completedAt": "2022-08-08T09:44:50.952Z", "createdBy": "elastic", "id": "5bc92c86-b8e6-42dd-837f-12ad29e09caa", "isCompleted": true, "isExpired": false, "startedAt": "2022-08-08T14:38:44.125Z", "wasSuccessful": true }, { "agents": [ "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0" ], "agentType": "endpoint", "command": "unisolate", "comment": "Not a threat to the network", "completedAt": "2022-08-08T09:40:47.398Z", "createdBy": "elastic", "id": "790d54e0-3aa3-4e5b-8255-3ce9d851246a", "isCompleted": true, "isExpired": false, "startedAt": "2022-08-08T14:38:15.391Z", "wasSuccessful": true } ], "elasticAgentIds": [ "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0" ], "endDate": "now", "page": 1, "pageSize": 10, "startDate": "now-24h/h", "total": 4 } }, "Security_Endpoint_Management_API_GetEndpointActionResponse": { "type": "object", "example": { "data": { "agents": [ "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0" ], "agentType": "endpoint", "command": "running-processes", "completedAt": "2022-08-08T09:50:47.672Z", "createdBy": "elastic", "id": "b3d6de74-36b0-4fa8-be46-c375bf1771bf", "isCompleted": true, "isExpired": false, "outputs": { "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0": { "content": { "entries": [ { "command": "/opt/cmd1", "entity_id": "fk2ym7bl3oiu3okjcik0xosc0i0m75x3eh49nu3uaqt4dqanjt", "pid": "822", "user": "Dexter" }, { "command": "/opt/cmd3/opt/cmd3/opt/cmd3/opt/cmd3", "entity_id": "pwvz91m48wpj9j7ov9gtw8fp7u2rat4eu5ipte37hnhdcbi2pt", "pid": "984", "user": "Jada" } ] }, "type": "json" } }, "startedAt": "2022-08-08T15:24:57.402Z", "wasSuccessful": true } } }, "Security_Endpoint_Management_API_GetFileRouteRequestBody": { "allOf": [ { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, { "required": [ "parameters" ], "type": "object", "properties": { "parameters": { "required": [ "path" ], "type": "object", "properties": { "path": { "type": "string" } } } } } ], "example": { "comment": "Get my file", "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "parameters": { "path": "/usr/my-file.txt" } } }, "Security_Endpoint_Management_API_GetFileRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentState": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "isCompleted": false, "wasSuccessful": false } }, "agentType": "endpoint", "command": "get-file", "createdBy": "myuser", "hosts": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "name": "gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r" } }, "id": "27ba1b42-7cc6-4e53-86ce-675c876092b2", "isCompleted": false, "isExpired": false, "outputs": { }, "parameters": { "path": "/usr/my-file.txt" }, "startedAt": "2023-07-28T19:00:03.911Z", "status": "pending", "wasSuccessful": false } } }, "Security_Endpoint_Management_API_GetProcessesRouteRequestBody": { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } }, "example": { "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ] } }, "Security_Endpoint_Management_API_GetProcessesRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentType": "endpoint", "command": "running-processes", "comment": "", "completedAt": "2022-07-29T19:09:44.961Z", "createdBy": "myuser", "errors": [ ], "id": "233db9ea-6733-4849-9226-5a7039c7161d", "isCompleted": true, "isExpired": false, "outputs": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "content": { "key": "value" }, "type": "json" } }, "parameters": { }, "startedAt": "2022-07-29T19:08:49.126Z", "wasSuccessful": true } } }, "Security_Endpoint_Management_API_HostPathScriptParameters": { "required": [ "hostPath" ], "type": "object", "properties": { "commandLine": { "minLength": 1, "type": "string", "description": "Command line arguments." }, "hostPath": { "minLength": 1, "type": "string", "description": "Absolute or relative path of script on host machine." }, "timeout": { "minimum": 1, "type": "integer", "description": "Timeout in seconds." } } }, "Security_Endpoint_Management_API_HostStatuses": { "type": "array", "items": { "enum": [ "healthy", "offline", "updating", "inactive", "unenrolled" ], "type": "string" }, "description": "A set of agent health statuses to filter by.", "example": [ "healthy", "updating" ] }, "Security_Endpoint_Management_API_IsolateRouteResponse": { "type": "object", "example": { "action": "233db9ea-6733-4849-9226-5a7039c7161d", "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentType": "endpoint", "command": "suspend-process", "comment": "suspend the process", "completedAt": "2022-07-29T19:09:44.961Z", "createdBy": "myuser", "errors": [ ], "id": "233db9ea-6733-4849-9226-5a7039c7161d", "isCompleted": true, "isExpired": false, "outputs": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "content": { "key": "value" }, "type": "json" } }, "parameters": { "entity_id": "abc123" }, "startedAt": "2022-07-29T19:08:49.126Z", "wasSuccessful": true } } }, "Security_Endpoint_Management_API_KillProcessRouteRequestBody": { "allOf": [ { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, { "required": [ "parameters" ], "type": "object", "properties": { "parameters": { "oneOf": [ { "type": "object", "properties": { "pid": { "minimum": 1, "type": "integer", "description": "The process ID (PID) of the process to terminate.", "example": 123 } } }, { "type": "object", "properties": { "entity_id": { "minLength": 1, "type": "string", "description": "The entity ID of the process to terminate.", "example": "abc123" } } }, { "type": "object", "properties": { "process_name": { "minLength": 1, "type": "string", "description": "The name of the process to terminate. Valid for SentinelOne agent type only.", "example": "Elastic" } } } ] } } } ], "example": { "comment": "terminate the process", "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "parameters": { "entity_id": "abc123" } } }, "Security_Endpoint_Management_API_KillProcessRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentType": "endpoint", "command": "kill-process", "comment": "terminate the process", "completedAt": "2022-07-29T19:09:44.961Z", "createdBy": "myuser", "errors": [ ], "id": "233db9ea-6733-4849-9226-5a7039c7161d", "isCompleted": true, "isExpired": false, "outputs": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "content": { "key": "value" }, "type": "json" } }, "parameters": { "entity_id": "abc123" }, "startedAt": "2022-07-29T19:08:49.126Z", "wasSuccessful": true } } }, "Security_Endpoint_Management_API_Kuery": { "type": "string", "description": "A KQL string.", "example": "united.endpoint.host.os.name : 'Windows'" }, "Security_Endpoint_Management_API_MetadataListResponse": { "type": "object", "example": { "data": [ { "host_status": "healthy", "last_checkin": "2023-07-04T15:47:57.432Z", "metadata": { "@timestamp": "2023-07-04T15:47:57.432173535Z", "agent": { "build": { "original": "version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab" }, "id": "285297c6-3bff-4b83-9a07-f3e749801123", "type": "endpoint", "version": "7.16.0" }, "data_stream": { "dataset": "endpoint.metadata", "namespace": "default", "type": "metrics" }, "ecs": { "version": "1.11.0" }, "elastic": { "agent": { "id": "285297c6-3bff-4b83-9a07-f3e749801123" } }, "Endpoint": { "capabilities": [ "isolation" ], "configuration": { "isolation": false }, "policy": { "applied": { "endpoint_policy_version": "2", "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "name": "test", "status": "success", "version": "3" } }, "state": { "isolation": false }, "status": "enrolled" }, "event": { "action": "endpoint_metadata", "agent_id_status": "verified", "category": [ "host" ], "created": "2023-07-04T15:47:57.432173535Z", "dataset": "endpoint.metadata", "id": "MNtSXK/SkhEBnmgt++++++7S", "ingested": "2023-07-04T15:47:58Z", "kind": "metric", "module": "endpoint", "sequence": 400, "type": [ "info" ] }, "host": { "architecture": "x86_64", "hostname": "david-Xubuntu", "id": "0cfead88e2024bd8a27476352b5ab264", "ip": [ "127.0.0.1", "::1", "10.0.2.15", "fe80::2ac7:8e15:b957:2fa1" ], "mac": [ "08:00:27:e6:78:8b" ], "name": "david-Xubuntu", "os": { "Ext": { "variant": "Ubuntu" }, "family": "ubuntu", "full": "Ubuntu 20.04.2", "kernel": "5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021", "name": "Linux", "platform": "ubuntu", "type": "linux", "version": "20.04.2" } }, "message": "Endpoint metadata" }, "policy_info": { "agent": { "applied": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 0 }, "configured": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 3 } }, "endpoint": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "revision": 2 } } }, { "host_status": "healthy", "last_checkin": "2023-07-04T15:44:31.491Z", "metadata": { "@timestamp": "2023-07-04T15:44:31.4917849Z", "agent": { "build": { "original": "version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab" }, "id": "abb8a826-6812-448c-a571-6d8269b51449", "type": "endpoint", "version": "7.16.0" }, "data_stream": { "dataset": "endpoint.metadata", "namespace": "default", "type": "metrics" }, "ecs": { "version": "1.11.0" }, "elastic": { "agent": { "id": "abb8a826-6812-448c-a571-6d8269b51449" } }, "Endpoint": { "capabilities": [ "isolation" ], "configuration": { "isolation": false }, "policy": { "applied": { "endpoint_policy_version": "2", "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "name": "test", "status": "success", "version": "3" } }, "state": { "isolation": false }, "status": "enrolled" }, "event": { "action": "endpoint_metadata", "agent_id_status": "verified", "category": [ "host" ], "created": "2023-07-04T15:44:31.4917849Z", "dataset": "endpoint.metadata", "id": "MNtRc++KoKHXXwlj+++++/N9", "ingested": "2023-07-04T15:44:33Z", "kind": "metric", "module": "endpoint", "sequence": 5159, "type": [ "info" ] }, "host": { "architecture": "x86_64", "hostname": "WinDev2104Eval", "id": "17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5", "ip": [ "10.0.2.15", "fe80::21a6:63d3:d70e:e3ad", "127.0.0.1", "::1" ], "mac": [ "08:00:27:b1:1d:5a" ], "name": "WinDev2104Eval", "os": { "Ext": { "variant": "Windows 10 Enterprise Evaluation" }, "family": "windows", "full": "Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)", "kernel": "20H2 (10.0.19042.906)", "name": "Windows", "platform": "windows", "type": "windows", "version": "20H2 (10.0.19042.906)" } }, "message": "Endpoint metadata" }, "policy_info": { "agent": { "applied": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 0 }, "configured": { "id": "ed7e3720-4bad-11ec-a2a8-fb22e62a5753", "revision": 3 } }, "endpoint": { "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e", "revision": 2 } } } ], "page": 0, "pageSize": 10, "sortDirection": "desc", "sortField": "enrolled_at", "total": 2 } }, "Security_Endpoint_Management_API_NonEmptyString": { "minLength": 1, "type": "string", "description": "A string that does not contain only whitespace characters", "format": "nonempty" }, "Security_Endpoint_Management_API_Page": { "minimum": 1, "type": "integer", "description": "Page number", "default": 1, "example": 1 }, "Security_Endpoint_Management_API_PageSize": { "maximum": 100, "minimum": 1, "type": "integer", "description": "Number of items per page", "default": 10, "example": 10 }, "Security_Endpoint_Management_API_Parameters": { "type": "object", "description": "Optional parameters object" }, "Security_Endpoint_Management_API_PendingActionDataType": { "type": "integer" }, "Security_Endpoint_Management_API_PendingActionsSchema": { "oneOf": [ { "type": "object", "properties": { "execute": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "get-file": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "isolate": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "kill-process": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "running-processes": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "scan": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "suspend-process": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "unisolate": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" }, "upload": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType" } } }, { "type": "object" } ] }, "Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse": { "type": "object", "properties": { "note": { "type": "string" } } }, "Security_Endpoint_Management_API_RawScriptParameters": { "required": [ "raw" ], "type": "object", "properties": { "commandLine": { "minLength": 1, "type": "string", "description": "Command line arguments." }, "raw": { "minLength": 1, "type": "string", "description": "Raw script content." }, "timeout": { "minimum": 1, "type": "integer", "description": "Timeout in seconds." } } }, "Security_Endpoint_Management_API_RunScriptRouteRequestBody": { "required": [ "parameters" ], "type": "object", "properties": { "parameters": { "oneOf": [ { "$ref": "#/components/schemas/Security_Endpoint_Management_API_RawScriptParameters" }, { "$ref": "#/components/schemas/Security_Endpoint_Management_API_HostPathScriptParameters" }, { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CloudFileScriptParameters" } ], "description": "Exactly one of 'Raw', 'HostPath', or 'CloudFile' must be provided. CommandLine and Timeout are optional for all." } } }, "Security_Endpoint_Management_API_ScanRouteRequestBody": { "allOf": [ { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, { "required": [ "parameters" ], "type": "object", "properties": { "parameters": { "required": [ "path" ], "type": "object", "properties": { "path": { "type": "string", "description": "The folder or file’s full path (including the file name).", "example": "/usr/my-file.txt" } } } } } ], "example": { "comment": "Scan the file for malware", "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "parameters": { "path": "/usr/my-file.txt" } } }, "Security_Endpoint_Management_API_ScanRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentState": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "isCompleted": false, "wasSuccessful": false } }, "agentType": "endpoint", "command": "scan", "createdBy": "myuser", "hosts": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "name": "gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r" } }, "id": "27ba1b42-7cc6-4e53-86ce-675c876092b2", "isCompleted": false, "isExpired": false, "outputs": { }, "parameters": { "path": "/usr/my-file.txt" }, "startedAt": "2023-07-28T19:00:03.911Z", "status": "pending", "wasSuccessful": false } } }, "Security_Endpoint_Management_API_SortDirection": { "enum": [ "asc", "desc" ], "type": "string", "description": "Determines the sort order.", "example": "desc" }, "Security_Endpoint_Management_API_SortField": { "enum": [ "enrolled_at", "metadata.host.hostname", "host_status", "metadata.Endpoint.policy.applied.name", "metadata.Endpoint.policy.applied.status", "metadata.host.os.name", "metadata.host.ip", "metadata.agent.version", "last_checkin" ], "type": "string", "description": "Determines which field is used to sort the results.", "example": "enrolled_at" }, "Security_Endpoint_Management_API_StartDate": { "type": "string", "description": "A start date in ISO 8601 format or Date Math format.", "example": "2023-10-31T00:00:00.000Z" }, "Security_Endpoint_Management_API_SuccessResponse": { "type": "object" }, "Security_Endpoint_Management_API_SuspendProcessRouteRequestBody": { "allOf": [ { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, { "required": [ "parameters" ], "type": "object", "properties": { "parameters": { "oneOf": [ { "type": "object", "properties": { "pid": { "minimum": 1, "type": "integer", "description": "The process ID (PID) of the process to suspend.", "example": 123 } } }, { "type": "object", "properties": { "entity_id": { "minLength": 1, "type": "string", "description": "The entity ID of the process to suspend.", "example": "abc123" } } } ] } } } ], "example": { "comment": "suspend the process", "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "parameters": { "entity_id": "abc123" } } }, "Security_Endpoint_Management_API_SuspendProcessRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentType": "endpoint", "command": "suspend-process", "comment": "suspend the process", "completedAt": "2022-07-29T19:09:44.961Z", "createdBy": "myuser", "errors": [ ], "id": "233db9ea-6733-4849-9226-5a7039c7161d", "isCompleted": true, "isExpired": false, "outputs": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "content": { "key": "value" }, "type": "json" } }, "parameters": { "entity_id": "abc123" }, "startedAt": "2022-07-29T19:08:49.126Z", "wasSuccessful": true } } }, "Security_Endpoint_Management_API_Timeout": { "minimum": 1, "type": "integer", "description": "The maximum timeout value in milliseconds (optional)" }, "Security_Endpoint_Management_API_Type": { "enum": [ "automated", "manual" ], "type": "string", "description": "Type of response action" }, "Security_Endpoint_Management_API_Types": { "maxLength": 2, "minLength": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Type" }, "description": "List of types of response actions", "example": [ "automated", "manual" ] }, "Security_Endpoint_Management_API_UnisolateRouteResponse": { "type": "object", "example": { "action": "233db9ea-6733-4849-9226-5a7039c7161d", "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentType": "endpoint", "command": "suspend-process", "comment": "suspend the process", "completedAt": "2022-07-29T19:09:44.961Z", "createdBy": "myuser", "errors": [ ], "id": "233db9ea-6733-4849-9226-5a7039c7161d", "isCompleted": true, "isExpired": false, "outputs": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "content": { "key": "value" }, "type": "json" } }, "parameters": { "entity_id": "abc123" }, "startedAt": "2022-07-29T19:08:49.126Z", "wasSuccessful": true } } }, "Security_Endpoint_Management_API_UploadRouteRequestBody": { "allOf": [ { "required": [ "endpoint_ids" ], "type": "object", "properties": { "agent_type": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AgentTypes" }, "alert_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_AlertIds" }, "case_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_CaseIds" }, "comment": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Comment" }, "endpoint_ids": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_EndpointIds" }, "parameters": { "$ref": "#/components/schemas/Security_Endpoint_Management_API_Parameters" } } }, { "required": [ "parameters", "file" ], "type": "object", "properties": { "file": { "type": "string", "description": "The binary content of the file.", "format": "binary", "example": "RWxhc3RpYw==" }, "parameters": { "type": "object", "properties": { "overwrite": { "type": "boolean", "description": "Overwrite the file on the host if it already exists.", "default": false, "example": false } } } } } ], "example": { "endpoint_ids": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "file": "RWxhc3RpYw==", "parameters": { } } }, "Security_Endpoint_Management_API_UploadRouteResponse": { "type": "object", "example": { "data": { "agents": [ "ed518850-681a-4d60-bb98-e22640cae2a8" ], "agentState": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "isCompleted": false, "wasSuccessful": false } }, "agentType": "endpoint", "command": "upload", "createdBy": "elastic", "hosts": { "ed518850-681a-4d60-bb98-e22640cae2a8": { "name": "Host-5i6cuc8kdv" } }, "id": "9ff6aebc-2cb6-481e-8869-9b30036c9731", "isCompleted": false, "isExpired": false, "outputs": { }, "parameters": { "file_id": "10e4ce3d-4abb-4f93-a0cd-eaf63a489280", "file_name": "fix-malware.sh", "file_sha256": "a0bed94220193ba4895c0aa5b4e7e293381d15765cb164ddf7be5cdd010ae42a", "file_size": 69 }, "startedAt": "2023-07-03T15:07:22.837Z", "status": "pending", "wasSuccessful": false } } }, "Security_Endpoint_Management_API_UserIds": { "oneOf": [ { "minItems": 1, "type": "array", "items": { "minLength": 1, "type": "string" } }, { "minLength": 1, "type": "string" } ], "description": "A list of user IDs.", "example": [ "user-id-1", "user-id-2" ] }, "Security_Endpoint_Management_API_WithOutputs": { "oneOf": [ { "minItems": 1, "type": "array", "items": { "minLength": 1, "type": "string" } }, { "minLength": 1, "type": "string" } ], "description": "A list of action IDs that should include the complete output of the action.", "example": [ "action-id-1", "action-id-2" ] }, "Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem": { "required": [ "message", "index" ], "type": "object", "properties": { "index": { "type": "integer" }, "message": { "type": "string" } } }, "Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats": { "required": [ "successful", "failed", "total" ], "type": "object", "properties": { "failed": { "type": "integer" }, "successful": { "type": "integer" }, "total": { "type": "integer" } } }, "Security_Entity_Analytics_API_AssetCriticalityLevel": { "enum": [ "low_impact", "medium_impact", "high_impact", "extreme_impact" ], "type": "string", "description": "The criticality level of the asset." }, "Security_Entity_Analytics_API_AssetCriticalityRecord": { "allOf": [ { "$ref": "#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord" }, { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts" }, { "required": [ "@timestamp" ], "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the record was created or updated.", "format": "date-time", "example": "2017-07-21T17:32:28Z" } } } ], "example": { "@timestamp": "2024-08-02T11:15:34.290Z", "asset": { "criticality": "high_impact" }, "criticality_level": "high_impact", "host": { "asset": { "criticality": "high_impact" }, "name": "my_host" }, "id_field": "host.name", "id_value": "my_host" } }, "Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts": { "required": [ "asset" ], "type": "object", "properties": { "asset": { "required": [ "asset" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "host": { "required": [ "name" ], "type": "object", "properties": { "asset": { "required": [ "criticality" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "name": { "type": "string" } } }, "service": { "required": [ "name" ], "type": "object", "properties": { "asset": { "required": [ "criticality" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "name": { "type": "string" } } }, "user": { "required": [ "name" ], "type": "object", "properties": { "asset": { "required": [ "criticality" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "name": { "type": "string" } } } } }, "Security_Entity_Analytics_API_AssetCriticalityRecordIdParts": { "required": [ "id_value", "id_field" ], "type": "object", "properties": { "id_field": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_IdField" }, "id_value": { "type": "string", "description": "The ID value of the asset." } } }, "Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse": { "required": [ "cleanup_successful", "errors" ], "type": "object", "properties": { "cleanup_successful": { "type": "boolean", "example": false }, "errors": { "type": "array", "items": { "required": [ "seq", "error" ], "type": "object", "properties": { "error": { "type": "string" }, "seq": { "type": "integer" } } } } } }, "Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse": { "required": [ "risk_engine_saved_object_configured", "errors" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "required": [ "seq", "error" ], "type": "object", "properties": { "error": { "type": "string" }, "seq": { "type": "integer" } } } }, "risk_engine_saved_object_configured": { "type": "boolean", "example": false } } }, "Security_Entity_Analytics_API_CreateAssetCriticalityRecord": { "allOf": [ { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts" }, { "required": [ "criticality_level" ], "type": "object", "properties": { "criticality_level": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } } ] }, "Security_Entity_Analytics_API_EngineComponentResource": { "enum": [ "entity_engine", "entity_definition", "index", "component_template", "index_template", "ingest_pipeline", "enrich_policy", "task", "transform" ], "type": "string", "description": "The type of Elasticsearch or Kibana resource backing an engine component." }, "Security_Entity_Analytics_API_EngineComponentStatus": { "required": [ "id", "installed", "resource" ], "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object", "properties": { "message": { "type": "string", "description": "Detailed error message." }, "title": { "type": "string", "description": "Short error title." } } }, "description": "Errors reported by this component, if any." }, "health": { "enum": [ "green", "yellow", "red", "unavailable", "unknown" ], "type": "string", "description": "The health status of the component." }, "id": { "type": "string", "description": "Unique identifier for the component." }, "installed": { "type": "boolean", "description": "Whether the component is currently installed." }, "resource": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineComponentResource" } }, "description": "Status of an individual Elasticsearch or Kibana resource backing an engine." }, "Security_Entity_Analytics_API_EngineDataviewUpdateResult": { "required": [ "type" ], "type": "object", "properties": { "changes": { "type": "object", "properties": { "indexPatterns": { "type": "array", "items": { "type": "string" }, "description": "The updated list of index patterns now used by the engine." } }, "description": "The changes applied to the engine." }, "type": { "type": "string", "description": "The entity type of the engine that was updated." } }, "description": "The result of applying data view index changes to a single engine." }, "Security_Entity_Analytics_API_EngineDescriptor": { "required": [ "type", "indexPattern", "status", "fieldHistoryLength" ], "type": "object", "properties": { "delay": { "pattern": "[smdh]$", "type": "string", "description": "The delay before the transform processes new data, allowing late-arriving documents to be included.", "default": "1m", "example": "1m" }, "docsPerSecond": { "type": "integer", "description": "Throttle value for the number of documents processed per second. Use -1 for no throttle." }, "error": { "required": [ "message", "action" ], "type": "object", "properties": { "action": { "enum": [ "init" ], "type": "string", "description": "The lifecycle action that caused the error." }, "message": { "type": "string", "description": "A human-readable error message." } }, "description": "Present when the engine status is `error`. Describes the failure." }, "fieldHistoryLength": { "type": "integer", "description": "The number of historical values retained per field.", "example": 10 }, "filter": { "type": "string", "description": "An optional Kibana Query Language (KQL) filter applied to source documents before aggregation.", "example": "host.name: \"my-host\"" }, "frequency": { "pattern": "[smdh]$", "type": "string", "description": "How often the transform runs.", "default": "1m", "example": "1m" }, "indexPattern": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_IndexPattern" }, "lookbackPeriod": { "pattern": "[smdh]$", "type": "string", "description": "How far back the transform looks when calculating aggregations.", "default": "24h", "example": "24h" }, "status": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EngineStatus" }, "timeout": { "pattern": "[smdh]$", "type": "string", "description": "The timeout for initializing the aggregating transform.", "default": "180s", "example": "180s" }, "timestampField": { "type": "string", "description": "The field used as the timestamp for source documents.", "example": "@timestamp" }, "type": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityType" } }, "description": "Describes a single entity engine, including its configuration and current status." }, "Security_Entity_Analytics_API_EngineStatus": { "enum": [ "installing", "started", "stopped", "updating", "error" ], "type": "string", "description": "The current operational status of an entity engine." }, "Security_Entity_Analytics_API_Entity": { "oneOf": [ { "$ref": "#/components/schemas/Security_Entity_Analytics_API_UserEntity" }, { "$ref": "#/components/schemas/Security_Entity_Analytics_API_HostEntity" }, { "$ref": "#/components/schemas/Security_Entity_Analytics_API_ServiceEntity" } ], "description": "An entity record from the Entity Store. The `entity` namespace is a root-level field in the latest index, unlike source logs where it is nested under `host`, `user`, or `service`." }, "Security_Entity_Analytics_API_EntityRiskLevels": { "enum": [ "Unknown", "Low", "Moderate", "High", "Critical" ], "type": "string" }, "Security_Entity_Analytics_API_EntityRiskScoreRecord": { "required": [ "@timestamp", "id_field", "id_value", "calculated_level", "calculated_score", "calculated_score_norm", "category_1_score", "category_1_count", "inputs", "notes" ], "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time at which the risk score was calculated.", "format": "date-time", "example": "2017-07-21T17:32:28Z" }, "calculated_level": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityRiskLevels" }, "calculated_score": { "type": "number", "description": "The raw numeric value of the given entity's risk score.", "format": "double" }, "calculated_score_norm": { "maximum": 100, "minimum": 0, "type": "number", "description": "The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.", "format": "double" }, "category_1_count": { "type": "integer", "description": "The number of risk input documents that contributed to the Category 1 score (`category_1_score`)." }, "category_1_score": { "type": "number", "description": "The contribution of Category 1 to the overall risk score (`calculated_score`). Category 1 contains Detection Engine Alerts.", "format": "double" }, "category_2_count": { "type": "integer" }, "category_2_score": { "type": "number", "format": "double" }, "criticality_level": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" }, "criticality_modifier": { "type": "number", "format": "double" }, "id_field": { "type": "string", "description": "The identifier field defining this risk score. Coupled with `id_value`, uniquely identifies the entity being scored.", "example": "host.name" }, "id_value": { "type": "string", "description": "The identifier value defining this risk score. Coupled with `id_field`, uniquely identifies the entity being scored.", "example": "example.host" }, "inputs": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_RiskScoreInput" }, "description": "A list of the highest-risk documents contributing to this risk score. Useful for investigative purposes." }, "notes": { "type": "array", "items": { "type": "string" } } } }, "Security_Entity_Analytics_API_EntityType": { "enum": [ "user", "host", "service" ], "type": "string", "description": "The type of entity." }, "Security_Entity_Analytics_API_HostEntity": { "required": [ "host", "entity" ], "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated.", "format": "date-time" }, "asset": { "required": [ "criticality" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "entity": { "required": [ "name", "source" ], "type": "object", "properties": { "name": { "type": "string" }, "source": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string", "description": "When the event was ingested into Elasticsearch.", "format": "date-time" } } }, "host": { "required": [ "name" ], "type": "object", "properties": { "architecture": { "type": "array", "items": { "type": "string" }, "description": "Observed CPU architectures." }, "domain": { "type": "array", "items": { "type": "string" }, "description": "Observed host domains." }, "hostname": { "type": "array", "items": { "type": "string" }, "description": "Observed hostnames." }, "id": { "type": "array", "items": { "type": "string" }, "description": "Observed host IDs." }, "ip": { "type": "array", "items": { "type": "string" }, "description": "Observed IP addresses." }, "mac": { "type": "array", "items": { "type": "string" }, "description": "Observed MAC addresses." }, "name": { "type": "string", "description": "Primary host name." }, "risk": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityRiskScoreRecord" }, "type": { "type": "array", "items": { "type": "string" }, "description": "Observed host types." } }, "description": "Elastic Common Schema (ECS) host fields collected on the entity." } }, "description": "An entity record representing a host, stored in the Entity Store latest index." }, "Security_Entity_Analytics_API_IdField": { "enum": [ "host.name", "user.name", "service.name" ], "type": "string" }, "Security_Entity_Analytics_API_IndexPattern": { "type": "string", "description": "An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.", "example": "logs-*" }, "Security_Entity_Analytics_API_InspectQuery": { "required": [ "dsl", "response" ], "type": "object", "properties": { "dsl": { "type": "array", "items": { "type": "string" }, "description": "Elasticsearch query DSL that was executed." }, "response": { "type": "array", "items": { "type": "string" }, "description": "Raw Elasticsearch responses." } }, "description": "Debug information about the Elasticsearch query executed." }, "Security_Entity_Analytics_API_Interval": { "pattern": "^[1-9]\\d*[smh]$", "type": "string", "description": "Interval in which enrich policy runs. For example, `\"1h\"` means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,", "example": "1h" }, "Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse": { "required": [ "message", "full_error" ], "type": "object", "properties": { "full_error": { "type": "string" }, "message": { "type": "string" } } }, "Security_Entity_Analytics_API_RiskEngineScheduleNowResponse": { "type": "object", "properties": { "success": { "type": "boolean" } } }, "Security_Entity_Analytics_API_RiskScoreInput": { "required": [ "id", "index", "description", "category" ], "type": "object", "properties": { "category": { "type": "string", "description": "The risk category of the risk input document.", "example": "category_1" }, "contribution_score": { "type": "number", "format": "double" }, "description": { "type": "string", "description": "A human-readable description of the risk input document.", "example": "Generated from Detection Engine Rule: Malware Prevention Alert" }, "id": { "type": "string", "description": "The unique identifier (`_id`) of the original source document", "example": "91a93376a507e86cfbf282166275b89f9dbdb1f0be6c8103c6ff2909ca8e1a1c" }, "index": { "type": "string", "description": "The unique index (`_index`) of the original source document", "example": ".internal.alerts-security.alerts-default-000001" }, "risk_score": { "maximum": 100, "minimum": 0, "type": "number", "description": "The weighted risk score of the risk input document.", "format": "double" }, "timestamp": { "type": "string", "description": "The @timestamp of the risk input document.", "example": "2017-07-21T17:32:28Z" } }, "description": "A generic representation of a document contributing to a Risk Score." }, "Security_Entity_Analytics_API_ServiceEntity": { "required": [ "service", "entity" ], "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated.", "format": "date-time" }, "asset": { "required": [ "criticality" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "entity": { "required": [ "name", "source" ], "type": "object", "properties": { "name": { "type": "string" }, "source": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string", "description": "When the event was ingested into Elasticsearch.", "format": "date-time" } } }, "service": { "required": [ "name" ], "type": "object", "properties": { "name": { "type": "string", "description": "Primary service name." }, "risk": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityRiskScoreRecord" } }, "description": "Elastic Common Schema (ECS) service fields collected on the entity." } }, "description": "An entity record representing a service, stored in the Entity Store latest index." }, "Security_Entity_Analytics_API_StoreStatus": { "enum": [ "not_installed", "installing", "running", "stopped", "error" ], "type": "string", "description": "The overall operational status of the Entity Store." }, "Security_Entity_Analytics_API_TaskManagerUnavailableResponse": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "minimum": 400, "type": "integer" } }, "description": "Task manager is unavailable" }, "Security_Entity_Analytics_API_UserEntity": { "required": [ "user", "entity" ], "type": "object", "properties": { "@timestamp": { "type": "string", "description": "The time the entity record was last updated.", "format": "date-time" }, "asset": { "required": [ "criticality" ], "type": "object", "properties": { "criticality": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel" } } }, "entity": { "required": [ "name", "source" ], "type": "object", "properties": { "name": { "type": "string" }, "source": { "type": "string" } } }, "event": { "type": "object", "properties": { "ingested": { "type": "string", "description": "When the event was ingested into Elasticsearch.", "format": "date-time" } } }, "user": { "required": [ "name" ], "type": "object", "properties": { "domain": { "type": "array", "items": { "type": "string" }, "description": "Observed user domains." }, "email": { "type": "array", "items": { "type": "string" }, "description": "Observed email addresses." }, "full_name": { "type": "array", "items": { "type": "string" }, "description": "Observed full names of the user." }, "hash": { "type": "array", "items": { "type": "string" }, "description": "Observed user hashes." }, "id": { "type": "array", "items": { "type": "string" }, "description": "Observed user IDs." }, "name": { "type": "string", "description": "Primary user name." }, "risk": { "$ref": "#/components/schemas/Security_Entity_Analytics_API_EntityRiskScoreRecord" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "Observed roles assigned to the user." } }, "description": "Elastic Common Schema (ECS) user fields collected on the entity." } }, "description": "An entity record representing a user, stored in the Entity Store latest index." }, "Security_Exceptions_API_CreateExceptionListItemComment": { "required": [ "comment" ], "type": "object", "properties": { "comment": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_CreateExceptionListItemCommentArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_CreateExceptionListItemComment" } }, "Security_Exceptions_API_CreateRuleExceptionListItemComment": { "required": [ "comment" ], "type": "object", "properties": { "comment": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_CreateRuleExceptionListItemCommentArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemComment" } }, "Security_Exceptions_API_CreateRuleExceptionListItemProps": { "required": [ "type", "name", "description", "entries" ], "type": "object", "properties": { "comments": { "$ref": "#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemCommentArray" }, "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray" }, "expire_time": { "type": "string", "format": "date-time" }, "item_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType" } } }, "Security_Exceptions_API_ExceptionList": { "required": [ "id", "list_id", "type", "name", "description", "immutable", "namespace_type", "version", "tie_breaker_id", "created_at", "created_by", "updated_at", "updated_by" ], "type": "object", "properties": { "_version": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListDescription" }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "immutable": { "type": "boolean" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListName" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListTags" }, "tie_breaker_id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListType" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" }, "version": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListVersion" } } }, "Security_Exceptions_API_ExceptionListDescription": { "type": "string" }, "Security_Exceptions_API_ExceptionListHumanId": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_ExceptionListId": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_ExceptionListItem": { "required": [ "id", "item_id", "list_id", "type", "name", "description", "entries", "namespace_type", "comments", "tie_breaker_id", "created_at", "created_by", "updated_at", "updated_by" ], "type": "object", "properties": { "_version": { "type": "string" }, "comments": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemCommentArray" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription" }, "entries": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray" }, "expire_time": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "item_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta" }, "name": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "namespace_type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType" }, "os_types": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray" }, "tags": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemTags" }, "tie_breaker_id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemType" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" } } }, "Security_Exceptions_API_ExceptionListItemComment": { "required": [ "id", "comment", "created_at", "created_by" ], "type": "object", "properties": { "comment": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_ExceptionListItemCommentArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemComment" } }, "Security_Exceptions_API_ExceptionListItemDescription": { "type": "string" }, "Security_Exceptions_API_ExceptionListItemEntry": { "anyOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryList" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNested" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchWildcard" } ], "discriminator": { "propertyName": "type" } }, "Security_Exceptions_API_ExceptionListItemEntryArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntry" } }, "Security_Exceptions_API_ExceptionListItemEntryExists": { "required": [ "type", "field", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "exists" ], "type": "string" } } }, "Security_Exceptions_API_ExceptionListItemEntryList": { "required": [ "type", "field", "list", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "list": { "required": [ "id", "type" ], "type": "object", "properties": { "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "type": { "$ref": "#/components/schemas/Security_Exceptions_API_ListType" } } }, "operator": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "list" ], "type": "string" } } }, "Security_Exceptions_API_ExceptionListItemEntryMatch": { "required": [ "type", "field", "value", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "match" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_ExceptionListItemEntryMatchAny": { "required": [ "type", "field", "value", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "match_any" ], "type": "string" }, "value": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } } }, "Security_Exceptions_API_ExceptionListItemEntryMatchWildcard": { "required": [ "type", "field", "value", "operator" ], "type": "object", "properties": { "field": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "operator": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator" }, "type": { "enum": [ "wildcard" ], "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_ExceptionListItemEntryNested": { "required": [ "type", "field", "entries" ], "type": "object", "properties": { "entries": { "minItems": 1, "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem" } }, "field": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "type": { "enum": [ "nested" ], "type": "string" } } }, "Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem": { "oneOf": [ { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny" }, { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists" } ] }, "Security_Exceptions_API_ExceptionListItemEntryOperator": { "enum": [ "excluded", "included" ], "type": "string" }, "Security_Exceptions_API_ExceptionListItemHumanId": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_ExceptionListItemId": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_ExceptionListItemMeta": { "type": "object" }, "Security_Exceptions_API_ExceptionListItemName": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_ExceptionListItemOsTypeArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsType" } }, "Security_Exceptions_API_ExceptionListItemTags": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } }, "Security_Exceptions_API_ExceptionListItemType": { "enum": [ "simple" ], "type": "string" }, "Security_Exceptions_API_ExceptionListMeta": { "type": "object" }, "Security_Exceptions_API_ExceptionListName": { "type": "string" }, "Security_Exceptions_API_ExceptionListOsType": { "enum": [ "linux", "macos", "windows" ], "type": "string" }, "Security_Exceptions_API_ExceptionListOsTypeArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListOsType" } }, "Security_Exceptions_API_ExceptionListsImportBulkError": { "required": [ "error" ], "type": "object", "properties": { "error": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "item_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_ExceptionListsImportBulkErrorArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkError" } }, "Security_Exceptions_API_ExceptionListTags": { "type": "array", "items": { "type": "string" } }, "Security_Exceptions_API_ExceptionListType": { "enum": [ "detection", "rule_default", "endpoint", "endpoint_trusted_apps", "endpoint_events", "endpoint_host_isolation_exceptions", "endpoint_blocklists" ], "type": "string" }, "Security_Exceptions_API_ExceptionListVersion": { "minimum": 1, "type": "integer" }, "Security_Exceptions_API_ExceptionNamespaceType": { "enum": [ "agnostic", "single" ], "type": "string", "description": "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n" }, "Security_Exceptions_API_FindExceptionListItemsFilter": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_FindExceptionListsFilter": { "type": "string" }, "Security_Exceptions_API_ListId": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "Security_Exceptions_API_ListType": { "enum": [ "binary", "boolean", "byte", "date", "date_nanos", "date_range", "double", "double_range", "float", "float_range", "geo_point", "geo_shape", "half_float", "integer", "integer_range", "ip", "ip_range", "keyword", "long", "long_range", "shape", "short", "text" ], "type": "string" }, "Security_Exceptions_API_NonEmptyString": { "minLength": 1, "type": "string", "description": "A string that does not contain only whitespace characters", "format": "nonempty" }, "Security_Exceptions_API_PlatformErrorResponse": { "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "type": "integer" } } }, "Security_Exceptions_API_RuleId": { "$ref": "#/components/schemas/Security_Exceptions_API_UUID" }, "Security_Exceptions_API_SiemErrorResponse": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "Security_Exceptions_API_UpdateExceptionListItemComment": { "required": [ "comment" ], "type": "object", "properties": { "comment": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Exceptions_API_NonEmptyString" } } }, "Security_Exceptions_API_UpdateExceptionListItemCommentArray": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemComment" } }, "Security_Exceptions_API_UUID": { "type": "string", "description": "A universally unique identifier", "format": "uuid" }, "Security_Lists_API_FindListItemsCursor": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_FindListItemsFilter": { "type": "string" }, "Security_Lists_API_FindListsCursor": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_FindListsFilter": { "type": "string" }, "Security_Lists_API_List": { "required": [ "id", "type", "name", "description", "immutable", "version", "tie_breaker_id", "created_at", "created_by", "updated_at", "updated_by" ], "type": "object", "properties": { "_version": { "type": "string" }, "@timestamp": { "type": "string", "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "description": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "immutable": { "type": "boolean" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListMetadata" }, "name": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "tie_breaker_id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Security_Lists_API_ListType" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" }, "version": { "minimum": 1, "type": "integer" } } }, "Security_Lists_API_ListDescription": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_ListId": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_ListItem": { "required": [ "id", "type", "list_id", "value", "tie_breaker_id", "created_at", "created_by", "updated_at", "updated_by" ], "type": "object", "properties": { "_version": { "type": "string" }, "@timestamp": { "type": "string", "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string" }, "id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "list_id": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "meta": { "$ref": "#/components/schemas/Security_Lists_API_ListItemMetadata" }, "tie_breaker_id": { "type": "string" }, "type": { "$ref": "#/components/schemas/Security_Lists_API_ListType" }, "updated_at": { "type": "string", "format": "date-time" }, "updated_by": { "type": "string" }, "value": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" } } }, "Security_Lists_API_ListItemId": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_ListItemMetadata": { "type": "object" }, "Security_Lists_API_ListItemPrivileges": { "required": [ "username", "has_all_requested", "cluster", "index", "application" ], "type": "object", "properties": { "application": { "type": "object", "additionalProperties": { "type": "boolean" } }, "cluster": { "type": "object", "additionalProperties": { "type": "boolean" } }, "has_all_requested": { "type": "boolean" }, "index": { "type": "object", "additionalProperties": { "type": "object", "additionalProperties": { "type": "boolean" } } }, "username": { "type": "string" } } }, "Security_Lists_API_ListItemValue": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_ListMetadata": { "type": "object" }, "Security_Lists_API_ListName": { "$ref": "#/components/schemas/Security_Lists_API_NonEmptyString" }, "Security_Lists_API_ListPrivileges": { "required": [ "username", "has_all_requested", "cluster", "index", "application" ], "type": "object", "properties": { "application": { "type": "object", "additionalProperties": { "type": "boolean" } }, "cluster": { "type": "object", "additionalProperties": { "type": "boolean" } }, "has_all_requested": { "type": "boolean" }, "index": { "type": "object", "additionalProperties": { "type": "object", "additionalProperties": { "type": "boolean" } } }, "username": { "type": "string" } } }, "Security_Lists_API_ListType": { "enum": [ "binary", "boolean", "byte", "date", "date_nanos", "date_range", "double", "double_range", "float", "float_range", "geo_point", "geo_shape", "half_float", "integer", "integer_range", "ip", "ip_range", "keyword", "long", "long_range", "shape", "short", "text" ], "type": "string" }, "Security_Lists_API_NonEmptyString": { "minLength": 1, "type": "string", "description": "A string that does not contain only whitespace characters", "format": "nonempty" }, "Security_Lists_API_PlatformErrorResponse": { "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "type": "integer" } } }, "Security_Lists_API_SiemErrorResponse": { "required": [ "status_code", "message" ], "type": "object", "properties": { "message": { "type": "string" }, "status_code": { "type": "integer" } } }, "Security_Osquery_API_ArrayQueries": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Osquery_API_ArrayQueriesItem" }, "description": "An array of queries to run." }, "Security_Osquery_API_ArrayQueriesItem": { "type": "object", "properties": { "ecs_mapping": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMapping" }, "id": { "$ref": "#/components/schemas/Security_Osquery_API_QueryId" }, "platform": { "$ref": "#/components/schemas/Security_Osquery_API_Platform" }, "query": { "$ref": "#/components/schemas/Security_Osquery_API_Query" }, "removed": { "$ref": "#/components/schemas/Security_Osquery_API_Removed" }, "snapshot": { "$ref": "#/components/schemas/Security_Osquery_API_Snapshot" }, "version": { "$ref": "#/components/schemas/Security_Osquery_API_Version" } } }, "Security_Osquery_API_CreateLiveQueryRequestBody": { "type": "object", "properties": { "agent_all": { "type": "boolean", "description": "When `true`, the query runs on all agents." }, "agent_ids": { "type": "array", "items": { "type": "string" }, "description": "A list of agent IDs to run the query on." }, "agent_platforms": { "type": "array", "items": { "type": "string" }, "description": "A list of agent platforms to run the query on." }, "agent_policy_ids": { "type": "array", "items": { "type": "string" }, "description": "A list of agent policy IDs to run the query on." }, "alert_ids": { "type": "array", "items": { "type": "string" }, "description": "A list of alert IDs associated with the live query." }, "case_ids": { "type": "array", "items": { "type": "string" }, "description": "A list of case IDs associated with the live query." }, "ecs_mapping": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMapping" }, "event_ids": { "type": "array", "items": { "type": "string" }, "description": "A list of event IDs associated with the live query." }, "metadata": { "type": [ "null", "object" ], "description": "Custom metadata object associated with the live query." }, "pack_id": { "$ref": "#/components/schemas/Security_Osquery_API_PackId" }, "queries": { "$ref": "#/components/schemas/Security_Osquery_API_ArrayQueries" }, "query": { "$ref": "#/components/schemas/Security_Osquery_API_Query" }, "saved_query_id": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" } }, "example": { "agent_all": true, "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "query": "select * from uptime;" } }, "Security_Osquery_API_CreateLiveQueryResponse": { "type": "object", "example": { "data": { "@timestamp": "2022-07-26T09:59:32.220Z", "action_id": "3c42c847-eb30-4452-80e0-728584042334", "agent_all": true, "agent_ids": [ ], "agent_platforms": [ ], "agent_policy_ids": [ ], "agents": [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ], "expiration": "2022-07-26T10:04:32.220Z", "input_type": "osquery", "metadata": { "execution_context": { "name": "osquery", "url": "/app/osquery/live_queries/new" } }, "queries": [ { "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0", "agents": [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ], "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2", "query": "select * from uptime;", "timeout": 120 } ], "type": "INPUT_ACTION", "user_id": "elastic" } } }, "Security_Osquery_API_CreatePacksRequestBody": { "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Osquery_API_PackDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Osquery_API_Enabled" }, "name": { "$ref": "#/components/schemas/Security_Osquery_API_PackName" }, "policy_ids": { "$ref": "#/components/schemas/Security_Osquery_API_PolicyIds" }, "queries": { "$ref": "#/components/schemas/Security_Osquery_API_ObjectQueries" }, "shards": { "$ref": "#/components/schemas/Security_Osquery_API_Shards" } }, "example": { "description": "My pack", "enabled": true, "name": "my_pack", "policy_ids": [ "my_policy_id", "fleet-server-policy" ], "queries": { "my_query": { "ecs_mapping": { "client.port": { "field": "port" }, "tags": { "value": [ "tag1", "tag2" ] } }, "interval": 60, "query": "SELECT * FROM listening_ports;", "timeout": 120 } }, "shards": { "fleet-server-policy": 58, "my_policy_id": 35 } } }, "Security_Osquery_API_CreatePacksResponse": { "type": "object", "example": { "data": { "created_at": "2025-02-26T13:37:30.452Z", "created_by": "elastic", "description": "My pack", "enabled": true, "name": "my_pack", "queries": { "ports": { "ecs_mapping": { "client.port": { "field": "port" } }, "interval": 60, "query": "SELECT * FROM listening_ports;", "removed": false, "snapshot": true, "timeout": 120 } }, "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856", "shards": [ { "key": "47638692-7c4c-4053-aa3e-7186f28df349", "value": 35 }, { "key": "5e267651-fe50-443e-8d3f-3bbc9171b618", "value": 58 } ], "updated_at": "2025-02-26T13:37:30.452Z", "updated_by": "elastic" } } }, "Security_Osquery_API_CreateSavedQueryRequestBody": { "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription" }, "ecs_mapping": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMapping" }, "id": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" }, "interval": { "$ref": "#/components/schemas/Security_Osquery_API_Interval" }, "platform": { "$ref": "#/components/schemas/Security_Osquery_API_Platform" }, "query": { "$ref": "#/components/schemas/Security_Osquery_API_Query" }, "removed": { "$ref": "#/components/schemas/Security_Osquery_API_Removed" }, "snapshot": { "$ref": "#/components/schemas/Security_Osquery_API_Snapshot" }, "version": { "$ref": "#/components/schemas/Security_Osquery_API_Version" } }, "example": { "description": "Saved query description", "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "id": "saved_query_id", "interval": "60", "platform": "linux,darwin", "query": "select * from uptime;", "timeout": 120, "version": "2.8.0" } }, "Security_Osquery_API_CreateSavedQueryResponse": { "type": "object", "example": { "data": { } } }, "Security_Osquery_API_DefaultSuccessResponse": { "type": "object" }, "Security_Osquery_API_ECSMapping": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMappingItem" }, "description": "Map osquery results columns or static values to Elastic Common Schema (ECS) fields", "example": { "host.uptime": { "field": "total_seconds" } } }, "Security_Osquery_API_ECSMappingItem": { "type": "object", "properties": { "field": { "type": "string", "description": "The ECS field to map to.", "example": "host.uptime" }, "value": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "The value to map to the ECS field.", "example": "total_seconds" } } }, "Security_Osquery_API_ECSMappingOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMapping" }, "Security_Osquery_API_Enabled": { "type": "boolean", "description": "Enables the pack.", "example": true }, "Security_Osquery_API_EnabledOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Enabled" }, "Security_Osquery_API_FindLiveQueryDetailsResponse": { "type": "object", "example": { "data": { "@timestamp": "2022-07-26T09:59:32.220Z", "action_id": "3c42c847-eb30-4452-80e0-728584042334", "agents": [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ], "expiration": "2022-07-26T10:04:32.220Z", "queries": [ { "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0", "agents": [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ], "docs": 0, "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "failed": 1, "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2", "pending": 0, "query": "select * from uptime;", "responded": 1, "saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d", "status": "completed", "successful": 0 } ], "status": "completed", "user_id": "elastic" } } }, "Security_Osquery_API_FindLiveQueryResponse": { "type": "object", "example": { "data": { "items": [ { "fields": { "@timestamp": "2023-10-31T00:00:00Z", "action_id": "3c42c847-eb30-4452-80e0-728584042334", "agents": [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ], "expiration": "2023-10-31T00:00:00Z", "queries": [ { "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0", "agents": [ "16d7caf5-efd2-4212-9b62-73dafc91fa13" ], "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2", "query": "select * from uptime;", "saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d" } ], "user_id": "elastic" } } ] } } }, "Security_Osquery_API_FindPackResponse": { "type": "object", "example": { "data": { "created_at": "2022-07-25T19:41:10.263Z", "created_by": "elastic", "description": "", "enabled": true, "id": "3c42c847-eb30-4452-80e0-728584042334", "name": "test_pack", "namespaces": [ "default" ], "policy_ids": [ ], "queries": { "uptime": { "ecs_mapping": { "message": { "field": "days" } }, "interval": 3600, "query": "select * from uptime" } }, "read_only": false, "type": "osquery-pack", "updated_at": "2022-07-25T20:12:01.455Z", "updated_by": "elastic" } } }, "Security_Osquery_API_FindPacksResponse": { "type": "object", "example": { "data": [ { "attributes": { "created_at": "2023-10-31T00:00:00Z", "created_by": "elastic", "description": "My pack description", "enabled": true, "name": "My Pack", "queries": [ { "ecs_mapping": [ { "host.uptime": { "field": "total_seconds" } } ], "id": "uptime", "interval": "3600", "query": "select * from uptime;" } ], "updated_at": "2023-10-31T00:00:00Z", "updated_by": "elastic" }, "id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d", "namespaces": [ "default" ], "type": "osquery-pack" } ], "page": 1, "pageSize": 10, "policy_ids": [ ], "total": 1 } }, "Security_Osquery_API_FindSavedQueryDetailResponse": { "type": "object", "example": { "data": { "attributes": { "created_at": "2022-07-26T09:28:08.597Z", "created_by": "elastic", "description": "Saved query description", "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "id": "saved_query_id", "interval": "60", "platform": "linux,darwin", "prebuilt": false, "query": "select * from uptime;", "updated_at": "2022-07-26T09:28:08.597Z", "updated_by": "elastic", "version": "2.8.0" }, "coreMigrationVersion": "8.4.0", "id": "3c42c847-eb30-4452-80e0-728584042334", "namespaces": [ "default" ], "references": [ ], "type": "osquery-saved-query", "updated_at": "2022-07-26T09:28:08.600Z", "version": "WzQzMTcsMV0=" } } }, "Security_Osquery_API_FindSavedQueryResponse": { "type": "object", "example": { "data": [ { "attributes": { "created_at": "2022-07-26T09:28:08.597Z", "created_by": "elastic", "description": "Saved query description", "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "id": "saved_query_id", "interval": "60", "platform": "linux,darwin", "prebuilt": false, "query": "select * from uptime;", "updated_at": "2022-07-26T09:28:08.597Z", "updated_by": "elastic", "version": "2.8.0" }, "id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d", "namespaces": [ "default" ], "type": "osquery-saved-query" } ], "page": 1, "per_page": 100, "total": 11 } }, "Security_Osquery_API_GetLiveQueryResultsResponse": { "type": "object", "description": "The response for getting live query results.", "example": { "data": { "edges": [ { }, { } ], "total": 2 } } }, "Security_Osquery_API_Interval": { "type": "string", "description": "An interval, in seconds, on which to run the query.", "example": "60" }, "Security_Osquery_API_IntervalOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Interval" }, "Security_Osquery_API_KueryOrUndefined": { "type": [ "null", "string" ], "description": "The kuery to filter the results by.", "example": "agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13" }, "Security_Osquery_API_ObjectQueries": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/Security_Osquery_API_ObjectQueriesItem" }, "description": "An object of queries." }, "Security_Osquery_API_ObjectQueriesItem": { "type": "object", "properties": { "ecs_mapping": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMapping" }, "id": { "$ref": "#/components/schemas/Security_Osquery_API_QueryId" }, "platform": { "$ref": "#/components/schemas/Security_Osquery_API_Platform" }, "query": { "$ref": "#/components/schemas/Security_Osquery_API_Query" }, "removed": { "$ref": "#/components/schemas/Security_Osquery_API_Removed" }, "saved_query_id": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" }, "snapshot": { "$ref": "#/components/schemas/Security_Osquery_API_Snapshot" }, "version": { "$ref": "#/components/schemas/Security_Osquery_API_Version" } } }, "Security_Osquery_API_PackDescription": { "type": "string", "description": "The pack description.", "example": "Pack description" }, "Security_Osquery_API_PackDescriptionOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_PackDescription" }, "Security_Osquery_API_PackId": { "type": "string", "description": "The ID of the pack you want to run, retrieve, update, or delete.", "example": "3c42c847-eb30-4452-80e0-728584042334" }, "Security_Osquery_API_PackIdOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_PackId" }, "Security_Osquery_API_PackName": { "type": "string", "description": "The pack name." }, "Security_Osquery_API_PageOrUndefined": { "type": [ "null", "integer" ], "description": "The page number to return. The default is 1.", "example": 1 }, "Security_Osquery_API_PageSizeOrUndefined": { "type": [ "null", "integer" ], "description": "The number of results to return per page. The default is 20.", "example": 20 }, "Security_Osquery_API_Platform": { "type": "string", "description": "Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.", "example": "linux,darwin" }, "Security_Osquery_API_PlatformOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Platform" }, "Security_Osquery_API_PolicyIds": { "type": "array", "items": { "type": "string" }, "description": "A list of agents policy IDs.", "example": [ "policyId1", "policyId2" ] }, "Security_Osquery_API_PolicyIdsOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_PolicyIds" }, "Security_Osquery_API_Query": { "type": "string", "description": "The SQL query you want to run.", "example": "select * from uptime;" }, "Security_Osquery_API_QueryId": { "type": "string", "description": "The ID of the query.", "example": "3c42c847-eb30-4452-80e0-728584042334" }, "Security_Osquery_API_QueryOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Query" }, "Security_Osquery_API_Removed": { "type": "boolean", "description": "Indicates whether the query is removed.", "example": false }, "Security_Osquery_API_RemovedOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Removed" }, "Security_Osquery_API_SavedQueryDescription": { "type": "string", "description": "The saved query description.", "example": "Saved query description" }, "Security_Osquery_API_SavedQueryDescriptionOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription" }, "Security_Osquery_API_SavedQueryId": { "type": "string", "description": "The ID of a saved query.", "example": "3c42c847-eb30-4452-80e0-728584042334" }, "Security_Osquery_API_SavedQueryIdOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" }, "Security_Osquery_API_Shards": { "type": "object", "additionalProperties": { "type": "number" }, "description": "An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.", "example": { "policy_id": 50 } }, "Security_Osquery_API_Snapshot": { "type": "boolean", "description": "Indicates whether the query is a snapshot.", "example": true }, "Security_Osquery_API_SnapshotOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Snapshot" }, "Security_Osquery_API_SortOrderOrUndefined": { "enum": [ "asc", "desc" ], "type": "string", "description": "Specifies the sort order.", "example": "desc" }, "Security_Osquery_API_SortOrUndefined": { "type": [ "null", "string" ], "description": "The field that is used to sort the results.", "default": "createdAt", "example": "createdAt" }, "Security_Osquery_API_UpdatePacksRequestBody": { "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Osquery_API_PackDescription" }, "enabled": { "$ref": "#/components/schemas/Security_Osquery_API_Enabled" }, "name": { "$ref": "#/components/schemas/Security_Osquery_API_PackName" }, "policy_ids": { "$ref": "#/components/schemas/Security_Osquery_API_PolicyIds" }, "queries": { "$ref": "#/components/schemas/Security_Osquery_API_ObjectQueries" }, "shards": { "$ref": "#/components/schemas/Security_Osquery_API_Shards" } }, "example": { "name": "updated_my_pack_name" } }, "Security_Osquery_API_UpdatePacksResponse": { "type": "object", "example": { "data": { "created_at": "2025-02-26T13:37:30.452Z", "created_by": "elastic", "description": "My pack", "enabled": true, "name": "updated_my_pack_name", "queries": { "ports": { "ecs_mapping": { "client.port": { "field": "port" } }, "interval": 60, "query": "SELECT * FROM listening_ports;", "removed": false, "snapshot": true, "timeout": 120 } }, "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856", "shards": [ { "key": "47638692-7c4c-4053-aa3e-7186f28df349", "value": 35 }, { "key": "5e267651-fe50-443e-8d3f-3bbc9171b618", "value": 58 } ], "updated_at": "2025-02-26T13:40:16.297Z", "updated_by": "elastic" } } }, "Security_Osquery_API_UpdateSavedQueryRequestBody": { "type": "object", "properties": { "description": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryDescription" }, "ecs_mapping": { "$ref": "#/components/schemas/Security_Osquery_API_ECSMapping" }, "id": { "$ref": "#/components/schemas/Security_Osquery_API_SavedQueryId" }, "interval": { "$ref": "#/components/schemas/Security_Osquery_API_Interval" }, "platform": { "$ref": "#/components/schemas/Security_Osquery_API_Platform" }, "query": { "$ref": "#/components/schemas/Security_Osquery_API_Query" }, "removed": { "$ref": "#/components/schemas/Security_Osquery_API_Removed" }, "snapshot": { "$ref": "#/components/schemas/Security_Osquery_API_Snapshot" }, "version": { "$ref": "#/components/schemas/Security_Osquery_API_Version" } }, "example": { "id": "updated_my_saved_query_name" } }, "Security_Osquery_API_UpdateSavedQueryResponse": { "type": "object", "example": { "data": { } } }, "Security_Osquery_API_Version": { "type": "string", "description": "Uses the Osquery versions greater than or equal to the specified version string.", "example": "1.0.0" }, "Security_Osquery_API_VersionOrUndefined": { "$ref": "#/components/schemas/Security_Osquery_API_Version" }, "Security_Timeline_API_AssociatedFilterType": { "enum": [ "all", "document_only", "saved_object_only", "document_and_saved_object", "orphan" ], "type": "string", "description": "Filter notes based on their association with a document or saved object." }, "Security_Timeline_API_BareNote": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_NoteCreatedAndUpdatedMetadata" }, { "required": [ "timelineId" ], "type": "object", "properties": { "eventId": { "type": [ "null", "string" ], "description": "The `_id` of the associated event for this note.", "example": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc" }, "note": { "type": [ "null", "string" ], "description": "The text of the note", "example": "This is an example text" }, "timelineId": { "type": "string", "description": "The `savedObjectId` of the Timeline that this note is associated with", "example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e" } } } ] }, "Security_Timeline_API_BarePinnedEvent": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata" }, { "required": [ "eventId", "timelineId" ], "type": "object", "properties": { "eventId": { "type": "string", "description": "The `_id` of the associated event for this pinned event.", "example": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc" }, "timelineId": { "type": "string", "description": "The `savedObjectId` of the timeline that this pinned event is associated with", "example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e" } } } ] }, "Security_Timeline_API_ColumnHeaderResult": { "type": "object", "properties": { "aggregatable": { "type": [ "null", "boolean" ] }, "category": { "type": [ "null", "string" ] }, "columnHeaderType": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "example": { "type": [ "null", "string" ] }, "id": { "type": [ "null", "string" ] }, "indexes": { "type": [ "null", "array" ], "items": { "type": "string" } }, "name": { "type": [ "null", "string" ] }, "placeholder": { "type": [ "null", "string" ] }, "searchable": { "type": [ "null", "boolean" ] }, "type": { "type": [ "null", "string" ] } } }, "Security_Timeline_API_DataProviderQueryMatch": { "type": "object", "properties": { "enabled": { "type": [ "null", "boolean" ] }, "excluded": { "type": [ "null", "boolean" ] }, "id": { "type": [ "null", "string" ] }, "kqlQuery": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "queryMatch": { "$ref": "#/components/schemas/Security_Timeline_API_QueryMatchResult" }, "type": { "$ref": "#/components/schemas/Security_Timeline_API_DataProviderType" } } }, "Security_Timeline_API_DataProviderResult": { "type": "object", "properties": { "and": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_DataProviderQueryMatch" } }, "enabled": { "type": [ "null", "boolean" ] }, "excluded": { "type": [ "null", "boolean" ] }, "id": { "type": [ "null", "string" ] }, "kqlQuery": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "queryMatch": { "$ref": "#/components/schemas/Security_Timeline_API_QueryMatchResult" }, "type": { "$ref": "#/components/schemas/Security_Timeline_API_DataProviderType" } } }, "Security_Timeline_API_DataProviderType": { "enum": [ "default", "template" ], "type": "string", "description": "The type of data provider." }, "Security_Timeline_API_DocumentIds": { "oneOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ] }, "Security_Timeline_API_FavoriteTimelineResponse": { "required": [ "savedObjectId", "version" ], "type": "object", "properties": { "code": { "type": [ "null", "number" ] }, "favorite": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_FavoriteTimelineResult" } }, "message": { "type": [ "null", "string" ] }, "savedObjectId": { "type": "string" }, "templateTimelineId": { "type": [ "null", "string" ] }, "templateTimelineVersion": { "type": [ "null", "number" ] }, "timelineType": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" }, "version": { "type": "string" } } }, "Security_Timeline_API_FavoriteTimelineResult": { "type": "object", "properties": { "favoriteDate": { "type": [ "null", "number" ] }, "fullName": { "type": [ "null", "string" ] }, "userName": { "type": [ "null", "string" ] } }, "description": "Indicates when and who marked a Timeline as a favorite.", "example": { "favoriteDate": 1741337636741, "userName": "elastic" } }, "Security_Timeline_API_FilterTimelineResult": { "type": "object", "properties": { "exists": { "type": [ "null", "string" ] }, "match_all": { "type": [ "null", "string" ] }, "meta": { "type": [ "null", "object" ], "properties": { "alias": { "type": [ "null", "string" ] }, "controlledBy": { "type": [ "null", "string" ] }, "disabled": { "type": [ "null", "boolean" ] }, "field": { "type": [ "null", "string" ] }, "formattedValue": { "type": [ "null", "string" ] }, "index": { "type": [ "null", "string" ] }, "key": { "type": [ "null", "string" ] }, "negate": { "type": [ "null", "boolean" ] }, "params": { "type": [ "null", "string" ] }, "type": { "type": [ "null", "string" ] }, "value": { "type": [ "null", "string" ] } } }, "missing": { "type": [ "null", "string" ] }, "query": { "type": [ "null", "string" ] }, "range": { "type": [ "null", "string" ] }, "script": { "type": [ "null", "string" ] } }, "example": { "meta": { "alias": "Custom filter name", "disabled": false, "index": ".alerts-security.alerts-default,logs-*", "key": "@timestamp", "negate": "false,", "type": "exists", "value": "exists" }, "query": "{\"exists\":{\"field\":\"@timestamp\"}}" } }, "Security_Timeline_API_GetNotesResult": { "required": [ "totalCount", "notes" ], "type": "object", "properties": { "notes": { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_Note" } }, "totalCount": { "type": "number" } } }, "Security_Timeline_API_ImportTimelineResult": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object", "properties": { "error": { "type": "object", "properties": { "message": { "type": "string", "description": "The reason why the timeline could not be imported", "example": "Malformed JSON" }, "status_code": { "type": "number", "description": "The HTTP status code of the error", "example": 400 } }, "description": "The error containing the reason why the timeline could not be imported" }, "id": { "type": "string", "description": "The ID of the timeline that failed to import", "example": "6ce1b592-84e3-4b4a-9552-f189d4b82075" } } }, "description": "The list of failed Timeline imports" }, "success": { "type": "boolean", "description": "Indicates whether any of the Timelines were successfully imports" }, "success_count": { "type": "number", "description": "The amount of successfully imported/updated Timelines", "example": 99 }, "timelines_installed": { "type": "number", "description": "The amount of successfully installed Timelines", "example": 80 }, "timelines_updated": { "type": "number", "description": "The amount of successfully updated Timelines", "example": 19 } } }, "Security_Timeline_API_ImportTimelines": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, { "required": [ "savedObjectId", "version", "pinnedEventIds", "eventNotes", "globalNotes" ], "type": "object", "properties": { "eventNotes": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_BareNote" } }, "globalNotes": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_BareNote" } }, "pinnedEventIds": { "type": [ "null", "array" ], "items": { "type": "string" } }, "savedObjectId": { "type": [ "null", "string" ] }, "version": { "type": [ "null", "string" ] } } } ] }, "Security_Timeline_API_Note": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_BareNote" }, { "required": [ "noteId", "version" ], "type": "object", "properties": { "noteId": { "type": "string", "description": "The `savedObjectId` of the note", "example": "709f99c6-89b6-4953-9160-35945c8e174e" }, "version": { "type": "string", "description": "The version of the note", "example": "WzQ2LDFd" } } } ] }, "Security_Timeline_API_NoteCreatedAndUpdatedMetadata": { "type": "object", "properties": { "created": { "type": [ "null", "number" ], "description": "The time the note was created, using a 13-digit Epoch timestamp.", "example": 1587468588922 }, "createdBy": { "type": [ "null", "string" ], "description": "The user who created the note.", "example": "casetester" }, "updated": { "type": [ "null", "number" ], "description": "The last time the note was updated, using a 13-digit Epoch timestamp", "example": 1741344876825 }, "updatedBy": { "type": [ "null", "string" ], "description": "The user who last updated the note", "example": "casetester" } } }, "Security_Timeline_API_PersistPinnedEventResponse": { "oneOf": [ { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_PinnedEvent" }, { "$ref": "#/components/schemas/Security_Timeline_API_PinnedEventBaseResponseBody" } ] }, { "type": [ "null", "object" ] } ] }, "Security_Timeline_API_PersistTimelineResponse": { "required": [ "data" ], "type": "object", "properties": { "data": { "required": [ "persistTimeline" ], "type": "object", "properties": { "persistTimeline": { "required": [ "timeline" ], "type": "object", "properties": { "timeline": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineResponse" } } } } } } }, "Security_Timeline_API_PinnedEvent": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_BarePinnedEvent" }, { "required": [ "pinnedEventId", "version" ], "type": "object", "properties": { "pinnedEventId": { "type": "string", "description": "The `savedObjectId` of this pinned event", "example": "10r1929b-0af7-42bd-85a8-56e234f98h2f3" }, "version": { "type": "string", "description": "The version of this pinned event", "example": "WzQ2LDFe" } } } ] }, "Security_Timeline_API_PinnedEventBaseResponseBody": { "required": [ "code" ], "type": "object", "properties": { "code": { "type": "number" }, "message": { "type": "string" } } }, "Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata": { "type": "object", "properties": { "created": { "type": [ "null", "number" ], "description": "The time the pinned event was created, using a 13-digit Epoch timestamp.", "example": 1587468588922 }, "createdBy": { "type": [ "null", "string" ], "description": "The user who created the pinned event.", "example": "casetester" }, "updated": { "type": [ "null", "number" ], "description": "The last time the pinned event was updated, using a 13-digit Epoch timestamp", "example": 1741344876825 }, "updatedBy": { "type": [ "null", "string" ], "description": "The user who last updated the pinned event", "example": "casetester" } } }, "Security_Timeline_API_QueryMatchResult": { "type": "object", "properties": { "displayField": { "type": [ "null", "string" ] }, "displayValue": { "type": [ "null", "string" ] }, "field": { "type": [ "null", "string" ] }, "operator": { "type": [ "null", "string" ] }, "value": { "oneOf": [ { "type": [ "null", "string" ] }, { "type": [ "null", "array" ], "items": { "type": "string" } } ] } } }, "Security_Timeline_API_ResolvedTimeline": { "required": [ "timeline", "outcome" ], "type": "object", "properties": { "alias_purpose": { "$ref": "#/components/schemas/Security_Timeline_API_SavedObjectResolveAliasPurpose" }, "alias_target_id": { "type": "string" }, "outcome": { "$ref": "#/components/schemas/Security_Timeline_API_SavedObjectResolveOutcome" }, "timeline": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject" } } }, "Security_Timeline_API_ResponseNote": { "required": [ "code", "message", "note" ], "type": "object", "properties": { "code": { "type": "number" }, "message": { "type": "string" }, "note": { "$ref": "#/components/schemas/Security_Timeline_API_Note" } } }, "Security_Timeline_API_RowRendererId": { "enum": [ "alert", "alerts", "auditd", "auditd_file", "library", "netflow", "plain", "registry", "suricata", "system", "system_dns", "system_endgame_process", "system_file", "system_fim", "system_security_event", "system_socket", "threat_match", "zeek" ], "type": "string", "description": "Identifies the available row renderers" }, "Security_Timeline_API_SavedObjectIds": { "oneOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ] }, "Security_Timeline_API_SavedObjectResolveAliasPurpose": { "enum": [ "savedObjectConversion", "savedObjectImport" ], "type": "string" }, "Security_Timeline_API_SavedObjectResolveOutcome": { "enum": [ "exactMatch", "aliasMatch", "conflict" ], "type": "string" }, "Security_Timeline_API_SavedTimeline": { "type": "object", "properties": { "columns": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_ColumnHeaderResult" }, "description": "The Timeline's columns", "example": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "event.category" } ] }, "created": { "type": [ "null", "number" ], "description": "The time the Timeline was created, using a 13-digit Epoch timestamp.", "example": 1587468588922 }, "createdBy": { "type": [ "null", "string" ], "description": "The user who created the Timeline.", "example": "casetester" }, "dataProviders": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_DataProviderResult" }, "description": "Object containing query clauses", "example": [ { "enabled": true, "excluded": false, "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b", "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b", "queryMatch": { "field": "_id,", "operator": ":", "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b," } } ] }, "dataViewId": { "type": [ "null", "string" ], "description": "ID of the Timeline's Data View", "example": "security-solution-default" }, "dateRange": { "type": [ "null", "object" ], "properties": { "end": { "oneOf": [ { "type": [ "null", "string" ] }, { "type": [ "null", "number" ] } ] }, "start": { "oneOf": [ { "type": [ "null", "string" ] }, { "type": [ "null", "number" ] } ] } }, "description": "The Timeline's search period.", "example": { "end": 1587456479201, "start": 1587370079200 } }, "description": { "type": [ "null", "string" ], "description": "The Timeline's description", "example": "Investigating exposure of CVE XYZ" }, "eqlOptions": { "type": [ "null", "object" ], "properties": { "eventCategoryField": { "type": [ "null", "string" ] }, "query": { "type": [ "null", "string" ] }, "size": { "oneOf": [ { "type": [ "null", "string" ] }, { "type": [ "null", "number" ] } ] }, "tiebreakerField": { "type": [ "null", "string" ] }, "timestampField": { "type": [ "null", "string" ] } }, "description": "EQL query that is used in the correlation tab", "example": { "eventCategoryField": "event.category", "query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]", "size": 100, "timestampField": "@timestamp" } }, "eventType": { "type": [ "null", "string" ], "description": "Event types displayed in the Timeline", "example": "all", "deprecated": true }, "excludedRowRendererIds": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_RowRendererId" }, "description": "A list of row renderers that should not be used when in `Event renderers` mode" }, "favorite": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_FavoriteTimelineResult" } }, "filters": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_FilterTimelineResult" }, "description": "A list of filters that should be applied to the query" }, "indexNames": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "A list of index names to use in the query (e.g. when the default data view has been modified)", "example": [ ".logs*" ] }, "kqlMode": { "type": [ "null", "string" ], "description": "Indicates whether the KQL bar filters the query results or searches for additional results, where:\n * `filter`: filters query results\n * `search`: displays additional search results", "example": "search" }, "kqlQuery": { "$ref": "#/components/schemas/Security_Timeline_API_SerializedFilterQueryResult" }, "savedQueryId": { "type": [ "null", "string" ], "description": "The ID of the saved query that might be used in the Query tab", "example": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e" }, "savedSearchId": { "type": [ "null", "string" ], "description": "The ID of the saved search that is used in the ES|QL tab", "example": "6ce1b592-84e3-4b4a-9552-f189d4b82075" }, "sort": { "$ref": "#/components/schemas/Security_Timeline_API_Sort" }, "status": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineStatus" }, "templateTimelineId": { "type": [ "null", "string" ], "description": "A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.", "example": "6ce1b592-84e3-4b4a-9552-f189d4b82075" }, "templateTimelineVersion": { "type": [ "null", "number" ], "description": "Timeline template version number. For Timelines, the value is `null`.", "example": 12 }, "timelineType": { "$ref": "#/components/schemas/Security_Timeline_API_TimelineType" }, "title": { "type": [ "null", "string" ], "description": "The Timeline's title.", "example": "CVE XYZ investigation" }, "updated": { "type": [ "null", "number" ], "description": "The last time the Timeline was updated, using a 13-digit Epoch timestamp", "example": 1741344876825 }, "updatedBy": { "type": [ "null", "string" ], "description": "The user who last updated the Timeline", "example": "casetester" } } }, "Security_Timeline_API_SavedTimelineWithSavedObjectId": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, { "required": [ "savedObjectId", "version" ], "type": "object", "properties": { "savedObjectId": { "type": "string", "description": "The `savedObjectId` of the Timeline or Timeline template", "example": "15c1929b-0af7-42bd-85a8-56e234cc7c4e" }, "version": { "type": "string", "description": "The version of the Timeline or Timeline template", "example": "WzE0LDFd" } } } ] }, "Security_Timeline_API_SerializedFilterQueryResult": { "type": "object", "properties": { "filterQuery": { "type": [ "null", "object" ], "properties": { "kuery": { "type": [ "null", "object" ], "properties": { "expression": { "type": [ "null", "string" ] }, "kind": { "type": [ "null", "string" ] } } }, "serializedQuery": { "type": [ "null", "string" ] } } } }, "description": "KQL bar query.", "example": { "filterQuery": "null", "kuery": { "expression": "_id : *", "kind": "kuery" }, "serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}" } }, "Security_Timeline_API_Sort": { "oneOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_SortObject" }, { "type": "array", "items": { "$ref": "#/components/schemas/Security_Timeline_API_SortObject" } } ] }, "Security_Timeline_API_SortFieldTimeline": { "enum": [ "title", "description", "updated", "created" ], "type": "string", "description": "The field to sort the timelines by." }, "Security_Timeline_API_SortObject": { "type": "object", "properties": { "columnId": { "type": [ "null", "string" ] }, "columnType": { "type": [ "null", "string" ] }, "sortDirection": { "type": [ "null", "string" ] } }, "description": "Object indicating how rows are sorted in the Timeline's grid", "example": { "columnId": "@timestamp", "sortDirection": "desc" } }, "Security_Timeline_API_TimelineResponse": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimelineWithSavedObjectId" }, { "type": "object", "properties": { "eventIdToNoteIds": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_Note" }, "description": "A list of all the notes that are associated to this Timeline." }, "noteIds": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "A list of all the ids of notes that are associated to this Timeline.", "example": [ "709f99c6-89b6-4953-9160-35945c8e174e" ] }, "notes": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_Note" }, "description": "A list of all the notes that are associated to this Timeline." }, "pinnedEventIds": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "A list of all the ids of pinned events that are associated to this Timeline.", "example": [ "983f99c6-89b6-4953-9160-35945c8a194f" ] }, "pinnedEventsSaveObject": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_PinnedEvent" }, "description": "A list of all the pinned events that are associated to this Timeline." } } } ] }, "Security_Timeline_API_TimelineSavedToReturnObject": { "allOf": [ { "$ref": "#/components/schemas/Security_Timeline_API_SavedTimeline" }, { "required": [ "savedObjectId", "version" ], "type": "object", "properties": { "eventIdToNoteIds": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_Note" } }, "noteIds": { "type": [ "null", "array" ], "items": { "type": "string" } }, "notes": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_Note" } }, "pinnedEventIds": { "type": [ "null", "array" ], "items": { "type": "string" } }, "pinnedEventsSaveObject": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Security_Timeline_API_PinnedEvent" } }, "savedObjectId": { "type": "string" }, "version": { "type": "string" } } } ] }, "Security_Timeline_API_TimelineStatus": { "enum": [ "active", "draft", "immutable" ], "type": "string", "description": "The status of the Timeline." }, "Security_Timeline_API_TimelineType": { "enum": [ "default", "template" ], "type": "string", "description": "The type of Timeline." }, "Short_URL_APIs_urlResponse": { "type": "object", "properties": { "accessCount": { "type": "integer" }, "accessDate": { "type": "string" }, "createDate": { "type": "string" }, "id": { "type": "string", "description": "The identifier for the short URL." }, "locator": { "type": "object", "properties": { "id": { "type": "string", "description": "The identifier for the locator." }, "state": { "type": "object", "description": "The locator parameters." }, "version": { "type": "string", "description": "The version of Kibana when the short URL was created." } } }, "slug": { "type": "string", "description": "A random human-readable slug is automatically generated if the `humanReadableSlug` parameter is set to `true`. If it is set to `false`, a random short string is generated.\n" } } }, "SLOs_400_response": { "title": "Bad request", "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "example": "Bad Request" }, "message": { "type": "string", "example": "Invalid value 'foo' supplied to: [...]" }, "statusCode": { "type": "number", "example": 400 } } }, "SLOs_401_response": { "title": "Unauthorized", "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "example": "Unauthorized" }, "message": { "type": "string", "example": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]" }, "statusCode": { "type": "number", "example": 401 } } }, "SLOs_403_response": { "title": "Unauthorized", "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "example": "Unauthorized" }, "message": { "type": "string", "example": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]" }, "statusCode": { "type": "number", "example": 403 } } }, "SLOs_404_response": { "title": "Not found", "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "example": "Not Found" }, "message": { "type": "string", "example": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found" }, "statusCode": { "type": "number", "example": 404 } } }, "SLOs_409_response": { "title": "Conflict", "required": [ "statusCode", "error", "message" ], "type": "object", "properties": { "error": { "type": "string", "example": "Conflict" }, "message": { "type": "string", "example": "SLO [d077e940-1515-11ee-9c50-9d096392f520] already exists" }, "statusCode": { "type": "number", "example": 409 } } }, "SLOs_budgeting_method": { "title": "Budgeting method", "enum": [ "occurrences", "timeslices" ], "type": "string", "description": "The budgeting method to use when computing the rollup data.", "example": "occurrences" }, "SLOs_bulk_delete_request": { "title": "Bulk delete SLO request", "required": [ "list" ], "type": "object", "properties": { "list": { "type": "array", "items": { "type": "string", "description": "The SLO Definition id", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" }, "description": "An array of SLO Definition id" } }, "description": "The bulk delete SLO request takes a list of SLOs Definition id to delete.\n" }, "SLOs_bulk_delete_response": { "title": "Bulk delete SLO response", "type": "object", "properties": { "taskId": { "type": "string", "description": "The taskId of the bulk delete operation", "example": "d08506b7-f0e8-4f8b-a06a-a83940f4db91" } }, "description": "The bulk delete SLO response returns a taskId that can be used to poll for its status\n" }, "SLOs_bulk_delete_status_response": { "title": "The status of the bulk deletion", "type": "object", "properties": { "error": { "type": "string", "description": "The error message if the bulk deletion operation failed", "example": "Task not found" }, "isDone": { "type": "boolean", "description": "Indicates if the bulk deletion operation is completed", "example": true }, "results": { "type": "array", "items": { "type": "object", "properties": { "error": { "type": "string", "description": "The error message if the deletion operation failed for this SLO", "example": "SLO [d08506b7-f0e8-4f8b-a06a-a83940f4db91] not found" }, "id": { "type": "string", "description": "The ID of the SLO that was deleted", "example": "d08506b7-f0e8-4f8b-a06a-a83940f4db91" }, "success": { "type": "boolean", "description": "The result of the deletion operation for this SLO", "example": true } } }, "description": "The results of the bulk deletion operation, including the success status and any errors for each SLO" } }, "description": "Indicates if the bulk deletion is completed, with the detailed results of the operation." }, "SLOs_bulk_purge_rollup_request": { "title": "Bulk Purge Rollup data request", "required": [ "list", "purgePolicy" ], "type": "object", "properties": { "list": { "type": "array", "items": { "type": "string", "description": "The SLO Definition id", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" }, "description": "An array of slo ids" }, "purgePolicy": { "type": "object", "oneOf": [ { "type": "object", "properties": { "age": { "type": "string", "description": "The duration to determine which documents to purge, formatted as {duration}{unit}. This value should be greater than or equal to the time window of every SLO provided.", "example": "7d" }, "purgeType": { "enum": [ "fixed-age" ], "type": "string", "description": "Specifies whether documents will be purged based on a specific age or on a timestamp" } } }, { "type": "object", "properties": { "purgeType": { "enum": [ "fixed-time" ], "type": "string", "description": "Specifies whether documents will be purged based on a specific age or on a timestamp" }, "timestamp": { "type": "string", "description": "The timestamp to determine which documents to purge, formatted in ISO. This value should be older than the applicable time window of every SLO provided.", "example": "2024-12-31T00:00:00.000Z" } } } ], "description": "Policy that dictates which SLI documents to purge based on age" } }, "description": "The bulk purge rollup data request takes a list of SLO ids and a purge policy, then deletes the rollup data according to the purge policy. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n" }, "SLOs_bulk_purge_rollup_response": { "title": "Bulk Purge Rollup data response", "type": "object", "properties": { "taskId": { "type": "string", "description": "The task id of the purge operation", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" } }, "description": "The bulk purge rollup data response returns a task id from the elasticsearch deleteByQuery response.\n" }, "SLOs_create_slo_request": { "title": "Create SLO request", "required": [ "name", "description", "indicator", "timeWindow", "budgetingMethod", "objective" ], "type": "object", "properties": { "budgetingMethod": { "$ref": "#/components/schemas/SLOs_budgeting_method" }, "description": { "type": "string", "description": "A description for the SLO." }, "groupBy": { "$ref": "#/components/schemas/SLOs_group_by" }, "id": { "type": "string", "description": "A optional and unique identifier for the SLO. Must be between 8 and 36 chars", "example": "my-super-slo-id" }, "indicator": { "oneOf": [ { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_histogram" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric" } ] }, "name": { "type": "string", "description": "A name for the SLO." }, "objective": { "$ref": "#/components/schemas/SLOs_objective" }, "settings": { "$ref": "#/components/schemas/SLOs_settings" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "List of tags" }, "timeWindow": { "$ref": "#/components/schemas/SLOs_time_window" } }, "description": "The create SLO API request body varies depending on the type of indicator, time window and budgeting method.\n" }, "SLOs_create_slo_response": { "title": "Create SLO response", "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" } } }, "SLOs_delete_slo_instances_request": { "title": "Delete SLO instances request", "required": [ "list" ], "type": "object", "properties": { "list": { "type": "array", "items": { "required": [ "sloId", "instanceId" ], "type": "object", "properties": { "instanceId": { "type": "string", "description": "The SLO instance identifier", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" }, "sloId": { "type": "string", "description": "The SLO unique identifier", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" } } }, "description": "An array of slo id and instance id" } }, "description": "The delete SLO instances request takes a list of SLO id and instance id, then delete the rollup and summary data. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n" }, "SLOs_error_budget": { "title": "Error budget", "required": [ "initial", "consumed", "remaining", "isEstimated" ], "type": "object", "properties": { "consumed": { "type": "number", "description": "The error budget consummed, as a percentage of the initial value.", "example": 0.8 }, "initial": { "type": "number", "description": "The initial error budget, as 1 - objective", "example": 0.02 }, "isEstimated": { "type": "boolean", "description": "Only for SLO defined with occurrences budgeting method and calendar aligned time window.", "example": true }, "remaining": { "type": "number", "description": "The error budget remaining, as a percentage of the initial value.", "example": 0.2 } } }, "SLOs_filter": { "title": "Filter", "type": "object", "properties": { "meta": { "$ref": "#/components/schemas/SLOs_filter_meta" }, "query": { "type": "object" } }, "description": "Defines properties for a filter" }, "SLOs_filter_meta": { "title": "FilterMeta", "type": "object", "properties": { "alias": { "type": [ "null", "string" ] }, "controlledBy": { "type": "string" }, "disabled": { "type": "boolean" }, "field": { "type": "string" }, "group": { "type": "string" }, "index": { "type": "string" }, "isMultiIndex": { "type": "boolean" }, "key": { "type": "string" }, "negate": { "type": "boolean" }, "params": { "type": "object" }, "type": { "type": "string" }, "value": { "type": "string" } }, "description": "Defines properties for a filter" }, "SLOs_find_slo_definitions_response": { "title": "Find SLO definitions response", "type": "object", "oneOf": [ { "type": "object", "properties": { "page": { "type": "number", "example": 1 }, "perPage": { "type": "number", "example": 25 }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/SLOs_slo_with_summary_response" } }, "total": { "type": "number", "example": 34 } } }, { "type": "object", "properties": { "page": { "type": "number", "description": "for backward compability", "default": 1 }, "perPage": { "type": "number", "description": "for backward compability", "example": 25 }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/SLOs_slo_with_summary_response" } }, "searchAfter": { "type": "array", "items": { "type": "string" }, "description": "the cursor to provide to get the next paged results", "example": [ "some-slo-id", "other-cursor-id" ] }, "size": { "type": "number", "example": 25 }, "total": { "type": "number", "example": 34 } } } ], "description": "A paginated response of SLO definitions matching the query.\n" }, "SLOs_find_slo_response": { "title": "Find SLO response", "type": "object", "properties": { "page": { "type": "number", "example": 1 }, "perPage": { "type": "number", "example": 25 }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/SLOs_slo_with_summary_response" } }, "searchAfter": { "type": "string" }, "size": { "type": "number", "description": "Size provided for cursor based pagination", "example": 25 }, "total": { "type": "number", "example": 34 } }, "description": "A paginated response of SLOs matching the query.\n" }, "SLOs_group_by": { "title": "Group by", "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "optional group by field or fields to use to generate an SLO per distinct value", "example": [ [ "service.name" ], "service.name", [ "service.name", "service.environment" ] ] }, "SLOs_indicator_properties_apm_availability": { "title": "APM availability", "required": [ "type", "params" ], "type": "object", "properties": { "params": { "required": [ "service", "environment", "transactionType", "transactionName", "index" ], "type": "object", "properties": { "environment": { "type": "string", "description": "The APM service environment or \"*\"", "example": "production" }, "filter": { "type": "string", "description": "KQL query used for filtering the data", "example": "service.foo : \"bar\"" }, "index": { "type": "string", "description": "The index used by APM metrics", "example": "metrics-apm*,apm*" }, "service": { "type": "string", "description": "The APM service name", "example": "o11y-app" }, "transactionName": { "type": "string", "description": "The APM transaction name or \"*\"", "example": "GET /my/api" }, "transactionType": { "type": "string", "description": "The APM transaction type or \"*\"", "example": "request" } }, "description": "An object containing the indicator parameters." }, "type": { "type": "string", "description": "The type of indicator.", "example": "sli.apm.transactionDuration" } }, "description": "Defines properties for the APM availability indicator type" }, "SLOs_indicator_properties_apm_latency": { "title": "APM latency", "required": [ "type", "params" ], "type": "object", "properties": { "params": { "required": [ "service", "environment", "transactionType", "transactionName", "index", "threshold" ], "type": "object", "properties": { "environment": { "type": "string", "description": "The APM service environment or \"*\"", "example": "production" }, "filter": { "type": "string", "description": "KQL query used for filtering the data", "example": "service.foo : \"bar\"" }, "index": { "type": "string", "description": "The index used by APM metrics", "example": "metrics-apm*,apm*" }, "service": { "type": "string", "description": "The APM service name", "example": "o11y-app" }, "threshold": { "type": "number", "description": "The latency threshold in milliseconds", "example": 250 }, "transactionName": { "type": "string", "description": "The APM transaction name or \"*\"", "example": "GET /my/api" }, "transactionType": { "type": "string", "description": "The APM transaction type or \"*\"", "example": "request" } }, "description": "An object containing the indicator parameters." }, "type": { "type": "string", "description": "The type of indicator.", "example": "sli.apm.transactionDuration" } }, "description": "Defines properties for the APM latency indicator type" }, "SLOs_indicator_properties_custom_kql": { "title": "Custom Query", "required": [ "type", "params" ], "type": "object", "properties": { "params": { "required": [ "index", "timestampField", "good", "total" ], "type": "object", "properties": { "dataViewId": { "type": "string", "description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.", "example": "03b80ab3-003d-498b-881c-3beedbaf1162" }, "filter": { "$ref": "#/components/schemas/SLOs_kql_with_filters" }, "good": { "$ref": "#/components/schemas/SLOs_kql_with_filters_good" }, "index": { "type": "string", "description": "The index or index pattern to use", "example": "my-service-*" }, "timestampField": { "type": "string", "description": "The timestamp field used in the source indice.\n", "example": "timestamp" }, "total": { "$ref": "#/components/schemas/SLOs_kql_with_filters_total" } }, "description": "An object containing the indicator parameters." }, "type": { "type": "string", "description": "The type of indicator.", "example": "sli.kql.custom" } }, "description": "Defines properties for a custom query indicator type" }, "SLOs_indicator_properties_custom_metric": { "title": "Custom metric", "required": [ "type", "params" ], "type": "object", "properties": { "params": { "required": [ "index", "timestampField", "good", "total" ], "type": "object", "properties": { "dataViewId": { "type": "string", "description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.", "example": "03b80ab3-003d-498b-881c-3beedbaf1162" }, "filter": { "type": "string", "description": "the KQL query to filter the documents with.", "example": "field.environment : \"production\" and service.name : \"my-service\"" }, "good": { "required": [ "metrics", "equation" ], "type": "object", "properties": { "equation": { "type": "string", "description": "The equation to calculate the \"good\" metric.", "example": "A" }, "metrics": { "type": "array", "items": { "required": [ "name", "aggregation", "field" ], "type": "object", "properties": { "aggregation": { "enum": [ "sum" ], "type": "string", "description": "The aggregation type of the metric. Only valid option is \"sum\"", "example": "sum" }, "field": { "type": "string", "description": "The field of the metric.", "example": "processor.processed" }, "filter": { "type": "string", "description": "The filter to apply to the metric.", "example": "processor.outcome: \"success\"" }, "name": { "pattern": "^[A-Z]$", "type": "string", "description": "The name of the metric. Only valid options are A-Z", "example": "A" } } }, "description": "List of metrics with their name, aggregation type, and field." } }, "description": "An object defining the \"good\" metrics and equation\n" }, "index": { "type": "string", "description": "The index or index pattern to use", "example": "my-service-*" }, "timestampField": { "type": "string", "description": "The timestamp field used in the source indice.\n", "example": "timestamp" }, "total": { "required": [ "metrics", "equation" ], "type": "object", "properties": { "equation": { "type": "string", "description": "The equation to calculate the \"total\" metric.", "example": "A" }, "metrics": { "type": "array", "items": { "required": [ "name", "aggregation", "field" ], "type": "object", "properties": { "aggregation": { "enum": [ "sum" ], "type": "string", "description": "The aggregation type of the metric. Only valid option is \"sum\"", "example": "sum" }, "field": { "type": "string", "description": "The field of the metric.", "example": "processor.processed" }, "filter": { "type": "string", "description": "The filter to apply to the metric.", "example": "processor.outcome: *" }, "name": { "pattern": "^[A-Z]$", "type": "string", "description": "The name of the metric. Only valid options are A-Z", "example": "A" } } }, "description": "List of metrics with their name, aggregation type, and field." } }, "description": "An object defining the \"total\" metrics and equation\n" } }, "description": "An object containing the indicator parameters." }, "type": { "type": "string", "description": "The type of indicator.", "example": "sli.metric.custom" } }, "description": "Defines properties for a custom metric indicator type" }, "SLOs_indicator_properties_histogram": { "title": "Histogram indicator", "required": [ "type", "params" ], "type": "object", "properties": { "params": { "required": [ "index", "timestampField", "good", "total" ], "type": "object", "properties": { "dataViewId": { "type": "string", "description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.", "example": "03b80ab3-003d-498b-881c-3beedbaf1162" }, "filter": { "type": "string", "description": "the KQL query to filter the documents with.", "example": "field.environment : \"production\" and service.name : \"my-service\"" }, "good": { "required": [ "aggregation", "field" ], "type": "object", "properties": { "aggregation": { "enum": [ "value_count", "range" ], "type": "string", "description": "The type of aggregation to use.", "example": "value_count" }, "field": { "type": "string", "description": "The field use to aggregate the good events.", "example": "processor.latency" }, "filter": { "type": "string", "description": "The filter for good events.", "example": "processor.outcome: \"success\"" }, "from": { "type": "number", "description": "The starting value of the range. Only required for \"range\" aggregations.", "example": 0 }, "to": { "type": "number", "description": "The ending value of the range. Only required for \"range\" aggregations.", "example": 100 } }, "description": "An object defining the \"good\" events\n" }, "index": { "type": "string", "description": "The index or index pattern to use", "example": "my-service-*" }, "timestampField": { "type": "string", "description": "The timestamp field used in the source indice.\n", "example": "timestamp" }, "total": { "required": [ "aggregation", "field" ], "type": "object", "properties": { "aggregation": { "enum": [ "value_count", "range" ], "type": "string", "description": "The type of aggregation to use.", "example": "value_count" }, "field": { "type": "string", "description": "The field use to aggregate the good events.", "example": "processor.latency" }, "filter": { "type": "string", "description": "The filter for total events.", "example": "processor.outcome : *" }, "from": { "type": "number", "description": "The starting value of the range. Only required for \"range\" aggregations.", "example": 0 }, "to": { "type": "number", "description": "The ending value of the range. Only required for \"range\" aggregations.", "example": 100 } }, "description": "An object defining the \"total\" events\n" } }, "description": "An object containing the indicator parameters." }, "type": { "type": "string", "description": "The type of indicator.", "example": "sli.histogram.custom" } }, "description": "Defines properties for a histogram indicator type" }, "SLOs_indicator_properties_timeslice_metric": { "title": "Timeslice metric", "required": [ "type", "params" ], "type": "object", "properties": { "params": { "required": [ "index", "timestampField", "metric" ], "type": "object", "properties": { "dataViewId": { "type": "string", "description": "The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.", "example": "03b80ab3-003d-498b-881c-3beedbaf1162" }, "filter": { "type": "string", "description": "the KQL query to filter the documents with.", "example": "field.environment : \"production\" and service.name : \"my-service\"" }, "index": { "type": "string", "description": "The index or index pattern to use", "example": "my-service-*" }, "metric": { "required": [ "metrics", "equation", "comparator", "threshold" ], "type": "object", "properties": { "comparator": { "enum": [ "GT", "GTE", "LT", "LTE" ], "type": "string", "description": "The comparator to use to compare the equation to the threshold.", "example": "GT" }, "equation": { "type": "string", "description": "The equation to calculate the metric.", "example": "A" }, "metrics": { "type": "array", "items": { "anyOf": [ { "$ref": "#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field" }, { "$ref": "#/components/schemas/SLOs_timeslice_metric_percentile_metric" }, { "$ref": "#/components/schemas/SLOs_timeslice_metric_doc_count_metric" } ] }, "description": "List of metrics with their name, aggregation type, and field." }, "threshold": { "type": "number", "description": "The threshold used to determine if the metric is a good slice or not.", "example": 100 } }, "description": "An object defining the metrics, equation, and threshold to determine if it's a good slice or not\n" }, "timestampField": { "type": "string", "description": "The timestamp field used in the source indice.\n", "example": "timestamp" } }, "description": "An object containing the indicator parameters." }, "type": { "type": "string", "description": "The type of indicator.", "example": "sli.metric.timeslice" } }, "description": "Defines properties for a timeslice metric indicator type" }, "SLOs_kql_with_filters": { "title": "KQL with filters", "oneOf": [ { "type": "string", "description": "the KQL query to filter the documents with.", "example": "field.environment : \"production\" and service.name : \"my-service\"" }, { "type": "object", "properties": { "filters": { "type": "array", "items": { "$ref": "#/components/schemas/SLOs_filter" } }, "kqlQuery": { "type": "string" } } } ], "description": "Defines properties for a filter" }, "SLOs_kql_with_filters_good": { "title": "KQL query for good events", "oneOf": [ { "type": "string", "description": "the KQL query to filter the documents with.", "example": "request.latency <= 150 and request.status_code : \"2xx\"" }, { "type": "object", "properties": { "filters": { "type": "array", "items": { "$ref": "#/components/schemas/SLOs_filter" } }, "kqlQuery": { "type": "string" } } } ], "description": "The KQL query used to define the good events." }, "SLOs_kql_with_filters_total": { "title": "KQL query for all events", "oneOf": [ { "type": "string", "description": "the KQL query to filter the documents with.", "example": "field.environment : \"production\" and service.name : \"my-service\"" }, { "type": "object", "properties": { "filters": { "type": "array", "items": { "$ref": "#/components/schemas/SLOs_filter" } }, "kqlQuery": { "type": "string" } } } ], "description": "The KQL query used to define all events." }, "SLOs_objective": { "title": "Objective", "required": [ "target" ], "type": "object", "properties": { "target": { "exclusiveMaximum": 100, "exclusiveMinimum": 0, "type": "number", "description": "the target objective between 0 and 1 excluded", "example": 0.99 }, "timesliceTarget": { "maximum": 100, "minimum": 0, "type": "number", "description": "the target objective for each slice when using a timeslices budgeting method", "example": 0.995 }, "timesliceWindow": { "type": "string", "description": "the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}", "example": "5m" } }, "description": "Defines properties for the SLO objective" }, "SLOs_settings": { "title": "Settings", "type": "object", "properties": { "frequency": { "type": "string", "description": "The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.", "default": "1m", "example": "5m" }, "preventInitialBackfill": { "type": "boolean", "description": "Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.", "default": false, "example": true }, "syncDelay": { "type": "string", "description": "The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.", "default": "1m", "example": "5m" }, "syncField": { "type": "string", "description": "The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.", "example": "event.ingested" } }, "description": "Defines properties for SLO settings." }, "SLOs_slo_definition_response": { "title": "SLO definition response", "required": [ "id", "name", "description", "indicator", "timeWindow", "budgetingMethod", "objective", "settings", "revision", "enabled", "groupBy", "tags", "createdAt", "updatedAt", "version" ], "type": "object", "properties": { "budgetingMethod": { "$ref": "#/components/schemas/SLOs_budgeting_method" }, "createdAt": { "type": "string", "description": "The creation date", "example": "2023-01-12T10:03:19.000Z" }, "description": { "type": "string", "description": "The description of the SLO.", "example": "My SLO description" }, "enabled": { "type": "boolean", "description": "Indicate if the SLO is enabled", "example": true }, "groupBy": { "$ref": "#/components/schemas/SLOs_group_by" }, "id": { "type": "string", "description": "The identifier of the SLO.", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" }, "indicator": { "oneOf": [ { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_histogram" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric" } ], "discriminator": { "propertyName": "type", "mapping": { "sli.apm.transactionDuration": "#/components/schemas/SLOs_indicator_properties_apm_latency", "sli.apm.transactionErrorRate": "#/components/schemas/SLOs_indicator_properties_apm_availability", "sli.histogram.custom": "#/components/schemas/SLOs_indicator_properties_histogram", "sli.kql.custom": "#/components/schemas/SLOs_indicator_properties_custom_kql", "sli.metric.custom": "#/components/schemas/SLOs_indicator_properties_custom_metric", "sli.metric.timeslice": "#/components/schemas/SLOs_indicator_properties_timeslice_metric" } } }, "name": { "type": "string", "description": "The name of the SLO.", "example": "My Service SLO" }, "objective": { "$ref": "#/components/schemas/SLOs_objective" }, "revision": { "type": "number", "description": "The SLO revision", "example": 2 }, "settings": { "$ref": "#/components/schemas/SLOs_settings" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "List of tags" }, "timeWindow": { "$ref": "#/components/schemas/SLOs_time_window" }, "updatedAt": { "type": "string", "description": "The last update date", "example": "2023-01-12T10:03:19.000Z" }, "version": { "type": "number", "description": "The internal SLO version", "example": 2 } } }, "SLOs_slo_with_summary_response": { "title": "SLO response", "required": [ "id", "name", "description", "indicator", "timeWindow", "budgetingMethod", "objective", "settings", "revision", "summary", "enabled", "groupBy", "instanceId", "tags", "createdAt", "updatedAt", "version" ], "type": "object", "properties": { "budgetingMethod": { "$ref": "#/components/schemas/SLOs_budgeting_method" }, "createdAt": { "type": "string", "description": "The creation date", "example": "2023-01-12T10:03:19.000Z" }, "description": { "type": "string", "description": "The description of the SLO.", "example": "My SLO description" }, "enabled": { "type": "boolean", "description": "Indicate if the SLO is enabled", "example": true }, "groupBy": { "$ref": "#/components/schemas/SLOs_group_by" }, "id": { "type": "string", "description": "The identifier of the SLO.", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" }, "indicator": { "oneOf": [ { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_histogram" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric" } ], "discriminator": { "propertyName": "type", "mapping": { "sli.apm.transactionDuration": "#/components/schemas/SLOs_indicator_properties_apm_latency", "sli.apm.transactionErrorRate": "#/components/schemas/SLOs_indicator_properties_apm_availability", "sli.histogram.custom": "#/components/schemas/SLOs_indicator_properties_histogram", "sli.kql.custom": "#/components/schemas/SLOs_indicator_properties_custom_kql", "sli.metric.custom": "#/components/schemas/SLOs_indicator_properties_custom_metric", "sli.metric.timeslice": "#/components/schemas/SLOs_indicator_properties_timeslice_metric" } } }, "instanceId": { "type": "string", "description": "the value derived from the groupBy field, if present, otherwise '*'", "example": "host-abcde" }, "name": { "type": "string", "description": "The name of the SLO.", "example": "My Service SLO" }, "objective": { "$ref": "#/components/schemas/SLOs_objective" }, "revision": { "type": "number", "description": "The SLO revision", "example": 2 }, "settings": { "$ref": "#/components/schemas/SLOs_settings" }, "summary": { "$ref": "#/components/schemas/SLOs_summary" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "List of tags" }, "timeWindow": { "$ref": "#/components/schemas/SLOs_time_window" }, "updatedAt": { "type": "string", "description": "The last update date", "example": "2023-01-12T10:03:19.000Z" }, "version": { "type": "number", "description": "The internal SLO version", "example": 2 } } }, "SLOs_summary": { "title": "Summary", "required": [ "status", "sliValue", "errorBudget" ], "type": "object", "properties": { "errorBudget": { "$ref": "#/components/schemas/SLOs_error_budget" }, "sliValue": { "type": "number", "example": 0.9836 }, "status": { "$ref": "#/components/schemas/SLOs_summary_status" } }, "description": "The SLO computed data" }, "SLOs_summary_status": { "title": "summary status", "enum": [ "NO_DATA", "HEALTHY", "DEGRADING", "VIOLATED" ], "type": "string", "example": "HEALTHY" }, "SLOs_time_window": { "title": "Time window", "required": [ "duration", "type" ], "type": "object", "properties": { "duration": { "type": "string", "description": "the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)", "example": "30d" }, "type": { "enum": [ "rolling", "calendarAligned" ], "type": "string", "description": "Indicates weither the time window is a rolling or a calendar aligned time window.", "example": "rolling" } }, "description": "Defines properties for the SLO time window" }, "SLOs_timeslice_metric_basic_metric_with_field": { "title": "Timeslice Metric Basic Metric with Field", "required": [ "name", "aggregation", "field" ], "type": "object", "properties": { "aggregation": { "enum": [ "sum", "avg", "min", "max", "std_deviation", "last_value", "cardinality" ], "type": "string", "description": "The aggregation type of the metric.", "example": "sum" }, "field": { "type": "string", "description": "The field of the metric.", "example": "processor.processed" }, "filter": { "type": "string", "description": "The filter to apply to the metric.", "example": "processor.outcome: \"success\"" }, "name": { "pattern": "^[A-Z]$", "type": "string", "description": "The name of the metric. Only valid options are A-Z", "example": "A" } } }, "SLOs_timeslice_metric_doc_count_metric": { "title": "Timeslice Metric Doc Count Metric", "required": [ "name", "aggregation" ], "type": "object", "properties": { "aggregation": { "enum": [ "doc_count" ], "type": "string", "description": "The aggregation type of the metric. Only valid option is \"doc_count\"", "example": "doc_count" }, "filter": { "type": "string", "description": "The filter to apply to the metric.", "example": "processor.outcome: \"success\"" }, "name": { "pattern": "^[A-Z]$", "type": "string", "description": "The name of the metric. Only valid options are A-Z", "example": "A" } } }, "SLOs_timeslice_metric_percentile_metric": { "title": "Timeslice Metric Percentile Metric", "required": [ "name", "aggregation", "field", "percentile" ], "type": "object", "properties": { "aggregation": { "enum": [ "percentile" ], "type": "string", "description": "The aggregation type of the metric. Only valid option is \"percentile\"", "example": "percentile" }, "field": { "type": "string", "description": "The field of the metric.", "example": "processor.processed" }, "filter": { "type": "string", "description": "The filter to apply to the metric.", "example": "processor.outcome: \"success\"" }, "name": { "pattern": "^[A-Z]$", "type": "string", "description": "The name of the metric. Only valid options are A-Z", "example": "A" }, "percentile": { "type": "number", "description": "The percentile value.", "example": 95 } } }, "SLOs_update_slo_request": { "title": "Update SLO request", "type": "object", "properties": { "budgetingMethod": { "$ref": "#/components/schemas/SLOs_budgeting_method" }, "description": { "type": "string", "description": "A description for the SLO." }, "groupBy": { "$ref": "#/components/schemas/SLOs_group_by" }, "indicator": { "oneOf": [ { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_kql" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_availability" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_apm_latency" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_custom_metric" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_histogram" }, { "$ref": "#/components/schemas/SLOs_indicator_properties_timeslice_metric" } ] }, "name": { "type": "string", "description": "A name for the SLO." }, "objective": { "$ref": "#/components/schemas/SLOs_objective" }, "settings": { "$ref": "#/components/schemas/SLOs_settings" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "List of tags" }, "timeWindow": { "$ref": "#/components/schemas/SLOs_time_window" } }, "description": "The update SLO API request body varies depending on the type of indicator, time window and budgeting method. Partial update is handled.\n" }, "Synthetics_browserMonitorFields": { "title": "Browser monitor fields", "allOf": [ { "$ref": "#/components/schemas/Synthetics_commonMonitorFields" }, { "required": [ "inline_script", "type" ], "type": "object", "properties": { "ignore_https_errors": { "type": "boolean", "description": "Ignore HTTPS errors.", "default": false }, "inline_script": { "type": "string", "description": "The inline script." }, "playwright_options": { "type": "object", "description": "Playwright options." }, "screenshots": { "enum": [ "on", "off", "only-on-failure" ], "type": "string", "description": "The screenshot option.", "default": "on" }, "synthetics_args": { "type": "array", "items": { "type": "string" }, "description": "Synthetics agent CLI arguments." }, "type": { "enum": [ "browser" ], "type": "string", "description": "The monitor type." } } } ] }, "Synthetics_commonMonitorFields": { "title": "Common monitor fields", "required": [ "name" ], "type": "object", "properties": { "alert": { "type": "object", "description": "The alert configuration. The default is `{ status: { enabled: true }, tls: { enabled: true } }`.\n" }, "enabled": { "type": "boolean", "description": "Specify whether the monitor is enabled.", "default": true }, "labels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Key-value pairs of labels to associate with the monitor. Labels can be used for filtering and grouping monitors.\n" }, "locations": { "type": "array", "items": { "type": "string" }, "description": "The location to deploy the monitor.\nMonitors can be deployed in multiple locations so that you can detect differences in availability and response times across those locations.\nTo list available locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Management* and click *Create monitor*. Locations will be listed in *Locations*.\n", "externalDocs": { "url": "https://github.com/elastic/synthetics/blob/main/src/locations/public-locations.ts" } }, "name": { "type": "string", "description": "The monitor name." }, "namespace": { "type": "string", "description": "The namespace field should be lowercase and not contain spaces. The namespace must not include any of the following characters: `*`, `\\`, `/`, `?`, `\"`, `<`, `>`, `|`, whitespace, `,`, `#`, `:`, or `-`.\n", "default": "default" }, "params": { "type": "string", "description": "The monitor parameters." }, "private_locations": { "type": "array", "items": { "type": "string" }, "description": "The private locations to which the monitors will be deployed.\nThese private locations refer to locations hosted and managed by you, whereas `locations` are hosted by Elastic.\nYou can specify a private location using the location's name.\nTo list available private locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Settings* and click *Private locationsr*. Private locations will be listed in the table.\n\n> info\n> You can provide `locations` or `private_locations` or both. At least one is required.\n" }, "retest_on_failure": { "type": "boolean", "description": "Turn retesting for when a monitor fails on or off. By default, monitors are automatically retested if the monitor goes from \"up\" to \"down\". If the result of the retest is also \"down\", an error will be created and if configured, an alert sent. The monitor will then resume running according to the defined schedule. Using `retest_on_failure` can reduce noise related to transient problems.\n", "default": true }, "schedule": { "type": "number", "description": "The monitor's schedule in minutes. Supported values are `1`, `3`, `5`, `10`, `15`, `30`, `60`, `120`, and `240`. The default value is `3` minutes for HTTP, TCP, and ICMP monitors. The default value is `10` minutes for Browser monitors.\n" }, "service.name": { "type": "string", "description": "The APM service name." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of tags." }, "timeout": { "type": "number", "description": "The monitor timeout in seconds. The monitor will fail if it doesn't complete within this time.\n", "default": 16 } } }, "Synthetics_getParameterResponse": { "title": "Get parameter response", "type": "object", "properties": { "description": { "type": "string", "description": "The description of the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n" }, "id": { "type": "string", "description": "The unique identifier of the parameter." }, "key": { "type": "string", "description": "The key of the parameter." }, "namespaces": { "type": "array", "items": { "type": "string" }, "description": "The namespaces associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of tags associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n" }, "value": { "type": "string", "description": "The value associated with the parameter. It will be included in the response if the user has write permissions. \n" } } }, "Synthetics_getPrivateLocation": { "title": "Post a private location", "type": "object", "properties": { "agentPolicyId": { "type": "string", "description": "The ID of the agent policy associated with the private location." }, "geo": { "required": [ "lat", "lon" ], "type": "object", "properties": { "lat": { "type": "number", "description": "The latitude of the location." }, "lon": { "type": "number", "description": "The longitude of the location." } }, "description": "Geographic coordinates (WGS84) for the location." }, "id": { "type": "string", "description": "The unique identifier of the private location." }, "isInvalid": { "type": "boolean", "description": "Indicates whether the location is invalid. If `true`, the location is invalid, which means the agent policy associated with the location is deleted.\n" }, "label": { "type": "string", "description": "A label for the private location." }, "namespace": { "type": "string", "description": "The namespace of the location, which is the same as the namespace of the agent policy associated with the location." } } }, "Synthetics_httpMonitorFields": { "title": "HTTP monitor fields", "allOf": [ { "$ref": "#/components/schemas/Synthetics_commonMonitorFields" }, { "required": [ "type", "url" ], "type": "object", "properties": { "check": { "type": "object", "properties": { "request": { "type": "object", "properties": { "body": { "type": "string", "description": "Optional request body content." }, "headers": { "type": "object", "description": "A dictionary of additional HTTP headers to send. By default, Synthetics will set the User-Agent header to identify itself.\n" }, "method": { "enum": [ "HEAD", "GET", "POST", "OPTIONS" ], "type": "string", "description": "The HTTP method to use." } }, "description": "An optional request to send to the remote host." }, "response": { "type": "object", "properties": { "body": { "type": "object" }, "headers": { "type": "object", "description": "A dictionary of expected HTTP headers. If the header is not found, the check fails." } }, "description": "The expected response." } }, "description": "The check request settings." }, "ipv4": { "type": "boolean", "description": "If `true`, ping using the ipv4 protocol.", "default": true }, "ipv6": { "type": "boolean", "description": "If `true`, ping using the ipv6 protocol.", "default": true }, "max_redirects": { "type": "number", "description": "The maximum number of redirects to follow.", "default": 0 }, "mode": { "enum": [ "all", "any" ], "type": "string", "description": "The mode of the monitor. If it is `all`, the monitor pings all resolvable IPs for a hostname. If it is `any`, the monitor pings only one IP address for a hostname. If you're using a DNS-load balancer and want to ping every IP address for the specified hostname, you should use `all`.\n", "default": "any" }, "password": { "type": "string", "description": "The password for authenticating with the server. The credentials are passed with the request.\n" }, "proxy_headers": { "type": "object", "description": "Additional headers to send to proxies during CONNECT requests." }, "proxy_url": { "type": "string", "description": "The URL of the proxy to use for this monitor." }, "response": { "type": "object", "description": "Controls the indexing of the HTTP response body contents to the `http.response.body.contents field`." }, "ssl": { "type": "object", "description": "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n" }, "type": { "enum": [ "http" ], "type": "string", "description": "The monitor type." }, "url": { "type": "string", "description": "The URL to monitor." }, "username": { "type": "string", "description": "The username for authenticating with the server. The credentials are passed with the request.\n" } } } ] }, "Synthetics_icmpMonitorFields": { "title": "ICMP monitor fields", "allOf": [ { "$ref": "#/components/schemas/Synthetics_commonMonitorFields" }, { "required": [ "host", "type" ], "type": "object", "properties": { "host": { "type": "string", "description": "The host to ping." }, "type": { "enum": [ "icmp" ], "type": "string", "description": "The monitor type." }, "wait": { "type": "number", "description": "The wait time in seconds.", "default": 1 } } } ] }, "Synthetics_parameterRequest": { "title": "Parameter request", "required": [ "key", "value" ], "type": "object", "properties": { "description": { "type": "string", "description": "A description of the parameter." }, "key": { "type": "string", "description": "The key of the parameter." }, "share_across_spaces": { "type": "boolean", "description": "Specify whether the parameter should be shared across spaces." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of tags to categorize the parameter." }, "value": { "type": "string", "description": "The value associated with the parameter." } } }, "Synthetics_postParameterResponse": { "title": "Post parameter response", "type": "object", "properties": { "description": { "type": "string", "description": "A description of the parameter." }, "id": { "type": "string", "description": "The unique identifier for the parameter." }, "key": { "type": "string", "description": "The parameter key." }, "share_across_spaces": { "type": "boolean", "description": "Indicates whether the parameter is shared across spaces." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of tags associated with the parameter." }, "value": { "type": "string", "description": "The value associated with the parameter." } } }, "Synthetics_tcpMonitorFields": { "title": "TCP monitor fields", "allOf": [ { "$ref": "#/components/schemas/Synthetics_commonMonitorFields" }, { "required": [ "host", "type" ], "type": "object", "properties": { "host": { "type": "string", "description": "The host to monitor; it can be an IP address or a hostname. The host can include the port using a colon, for example \"example.com:9200\".\n" }, "proxy_url": { "type": "string", "description": "The URL of the SOCKS5 proxy to use when connecting to the server. The value must be a URL with a scheme of `socks5://`. If the SOCKS5 proxy server requires client authentication, then a username and password can be embedded in the URL. When using a proxy, hostnames are resolved on the proxy server instead of on the client. You can change this behavior by setting the `proxy_use_local_resolver` option.\n" }, "proxy_use_local_resolver": { "type": "boolean", "description": "Specify that hostnames are resolved locally instead of being resolved on the proxy server. If `false`, name resolution occurs on the proxy server.\n", "default": false }, "ssl": { "type": "object", "description": "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n" }, "type": { "enum": [ "tcp" ], "type": "string", "description": "The monitor type." } } } ] }, "Task_manager_health_APIs_configuration": { "type": "object", "description": "This object summarizes the current configuration of Task Manager. This includes dynamic configurations that change over time, such as `poll_interval` and `max_workers`, which can adjust in reaction to changing load on the system.\n" }, "Task_manager_health_APIs_health_response": { "title": "Task health response properties", "type": "object", "properties": { "id": { "type": "string" }, "last_update": { "type": "string" }, "stats": { "type": "object", "properties": { "capacity_estimation": { "type": "object", "description": "This object provides a rough estimate about the sufficiency of its capacity. These are estimates based on historical data and should not be used as predictions.\n" }, "configuration": { "$ref": "#/components/schemas/Task_manager_health_APIs_configuration" }, "runtime": { "type": "object", "description": "This object tracks runtime performance of Task Manager, tracking task drift, worker load, and stats broken down by type, including duration and run results.\n" }, "workload": { "$ref": "#/components/schemas/Task_manager_health_APIs_workload" } } }, "status": { "type": "string" }, "timestamp": { "type": "string" } } }, "Task_manager_health_APIs_workload": { "type": "object", "description": "This object summarizes the work load across the cluster, including the tasks in the system, their types, and current status.\n" }, "Upgrade_assistant_APIs_errorMessage": { "type": "string", "description": "The error that caused the reindex to fail, if it failed." }, "Upgrade_assistant_APIs_indexName": { "type": "string", "description": "The name of the old index." }, "Upgrade_assistant_APIs_lastCompletedStep": { "type": "integer", "description": "The last successfully completed step of the reindex. For example:\n- `0`: The reindex task has been created in Kibana. - `10`: The index group services stopped. Only applies to some system indices. - `20`: The index is set to readonly. - `30`: The new destination index has been created. - `40`: The reindex task in Elasticsearch has started. - `50`: The reindex task in Elasticsearch has completed. - `60`: Aliases were created to point to the new index, and the old index has been deleted. - `70`: The index group services have resumed. Only applies to some system indices.\n" }, "Upgrade_assistant_APIs_locked": { "type": "string" }, "Upgrade_assistant_APIs_newIndexName": { "type": "string", "description": "The name of the new index." }, "Upgrade_assistant_APIs_reindexOptions": { "type": "object", "properties": { "queueSettings": { "type": "object", "properties": { "queuedAt": { "type": "number", "description": "A Unix timestamp of when the reindex task was placed in the queue." } } } }, "description": "The presence of this key indicates that the reindex job will occur in the batch." }, "Upgrade_assistant_APIs_reindexTaskId": { "type": "string", "description": "The task ID of the reindex task in Elasticsearch. This value appears when the reindexing starts.\n" }, "Upgrade_assistant_APIs_reindexTaskPercComplete": { "type": "number", "description": "The progress of the reindexing task in Elasticsearch. It appears in decimal form, from 0 to 1.\n" }, "Upgrade_assistant_APIs_runningReindexCount": { "type": "number" }, "Upgrade_assistant_APIs_status": { "type": "integer", "description": "The reindex status. For example:\n- `0`: In progress - `1`: Completed - `2`: Failed - `3`: Paused\n" }, "bedrock_config": { "title": "Connector request properties for an Amazon Bedrock connector", "required": [ "apiUrl" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The Amazon Bedrock request URL." }, "region": { "type": "string", "description": "Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, `us-west-1`).\n" }, "defaultModel": { "type": "string", "description": "The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.\n", "default": "us.anthropic.claude-3-7-sonnet-20250219-v1:0" } }, "description": "Defines properties for connectors when type is `.bedrock`." }, "crowdstrike_config": { "title": "Connector request config properties for a Crowdstrike connector", "required": [ "url" ], "type": "object", "properties": { "url": { "type": "string", "description": "The CrowdStrike tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" } }, "description": "Defines config properties for connectors when type is `.crowdstrike`." }, "d3security_config": { "title": "Connector request properties for a D3 Security connector", "required": [ "url" ], "type": "object", "properties": { "url": { "type": "string", "description": "The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" } }, "description": "Defines properties for connectors when type is `.d3security`." }, "email_config": { "title": "Connector request properties for an email connector", "required": [ "from" ], "type": "object", "properties": { "clientId": { "type": [ "null", "string" ], "description": "The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n" }, "from": { "type": "string", "description": "The from address for all emails sent by the connector. It must be specified in `user@host-name` format.\n" }, "hasAuth": { "type": "boolean", "description": "Specifies whether a user and password are required inside the secrets configuration.\n", "default": true }, "host": { "type": "string", "description": "The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n" }, "oauthTokenUrl": { "type": [ "null", "string" ] }, "port": { "type": "integer", "description": "The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n" }, "secure": { "type": "boolean", "description": "Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.\n" }, "service": { "enum": [ "elastic_cloud", "exchange_server", "gmail", "other", "outlook365", "ses" ], "type": "string", "description": "The name of the email service.\n" }, "tenantId": { "type": [ "null", "string" ], "description": "The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n" } }, "description": "Defines properties for connectors when type is `.email`." }, "gemini_config": { "title": "Connector request properties for an Google Gemini connector", "required": [ "apiUrl", "gcpRegion", "gcpProjectID" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The Google Gemini request URL." }, "defaultModel": { "type": "string", "description": "The generative artificial intelligence model for Google Gemini to use.", "default": "gemini-2.5-pro" }, "gcpRegion": { "type": "string", "description": "The GCP region where the Vertex AI endpoint enabled." }, "gcpProjectID": { "type": "string", "description": "The Google ProjectID that has Vertex AI endpoint enabled." } }, "description": "Defines properties for connectors when type is `.gemini`." }, "resilient_config": { "title": "Connector request properties for a IBM Resilient connector", "required": [ "apiUrl", "orgId" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The IBM Resilient instance URL." }, "orgId": { "type": "string", "description": "The IBM Resilient organization ID." } }, "description": "Defines properties for connectors when type is `.resilient`." }, "index_config": { "title": "Connector request properties for an index connector", "required": [ "index" ], "type": "object", "properties": { "executionTimeField": { "type": [ "null", "string" ], "description": "A field that indicates when the document was indexed.", "default": "null" }, "index": { "type": "string", "description": "The Elasticsearch index to be written to." }, "refresh": { "type": "boolean", "description": "The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.\n", "default": false } }, "description": "Defines properties for connectors when type is `.index`." }, "jira_config": { "title": "Connector request properties for a Jira connector", "required": [ "apiUrl", "projectKey" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The Jira instance URL." }, "projectKey": { "type": "string", "description": "The Jira project key." } }, "description": "Defines properties for connectors when type is `.jira`." }, "defender_config": { "title": "Connector request properties for a Microsoft Defender for Endpoint connector", "required": [ "apiUrl", "projectKey" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The URL of the Microsoft Defender for Endpoint API. If you are using the `xpack.actions.allowedHosts` setting, make sure the hostname is added to the allowed hosts.\n" }, "clientId": { "type": "string", "description": "The application (client) identifier for your app in the Azure portal." }, "oAuthScope": { "type": "string", "description": "The OAuth scopes or permission sets for the Microsoft Defender for Endpoint API." }, "oAuthServerUrl": { "type": "string", "description": "The OAuth server URL where authentication is sent and received for the Microsoft Defender for Endpoint API." }, "tenantId": { "type": "string", "description": "The tenant identifier for your app in the Azure portal." } }, "description": "Defines properties for connectors when type is `.microsoft_defender_endpoint`." }, "genai_azure_config": { "title": "Connector request properties for an OpenAI connector that uses Azure OpenAI", "required": [ "apiProvider", "apiUrl" ], "type": "object", "properties": { "apiProvider": { "enum": [ "Azure OpenAI" ], "type": "string", "description": "The OpenAI API provider." }, "apiUrl": { "type": "string", "description": "The OpenAI API endpoint." } }, "description": "Defines properties for connectors when type is `.gen-ai` and the API provider is `Azure OpenAI`.\n" }, "genai_openai_config": { "title": "Connector request properties for an OpenAI connector", "required": [ "apiProvider", "apiUrl" ], "type": "object", "properties": { "apiProvider": { "enum": [ "OpenAI" ], "type": "string", "description": "The OpenAI API provider." }, "apiUrl": { "type": "string", "description": "The OpenAI API endpoint." }, "defaultModel": { "type": "string", "description": "The default model to use for requests." } }, "description": "Defines properties for connectors when type is `.gen-ai` and the API provider is `OpenAI`.\n" }, "opsgenie_config": { "title": "Connector request properties for an Opsgenie connector", "required": [ "apiUrl" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" } }, "description": "Defines properties for connectors when type is `.opsgenie`." }, "pagerduty_config": { "title": "Connector request properties for a PagerDuty connector", "type": "object", "properties": { "apiUrl": { "type": [ "null", "string" ], "description": "The PagerDuty event URL.", "example": "https://events.pagerduty.com/v2/enqueue" } }, "description": "Defines properties for connectors when type is `.pagerduty`." }, "sentinelone_config": { "title": "Connector request properties for a SentinelOne connector", "required": [ "url" ], "type": "object", "properties": { "url": { "type": "string", "description": "The SentinelOne tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" } }, "description": "Defines properties for connectors when type is `.sentinelone`." }, "servicenow_config": { "title": "Connector request properties for a ServiceNow ITSM connector", "required": [ "apiUrl" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The ServiceNow instance URL." }, "clientId": { "type": "string", "description": "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n" }, "isOAuth": { "type": "boolean", "description": "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n", "default": false }, "jwtKeyId": { "type": "string", "description": "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n" }, "userIdentifierValue": { "type": "string", "description": "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n" }, "usesTableApi": { "type": "boolean", "description": "Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow.\n", "default": true } }, "description": "Defines properties for connectors when type is `.servicenow`." }, "servicenow_itom_config": { "title": "Connector request properties for a ServiceNow ITOM connector", "required": [ "apiUrl" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The ServiceNow instance URL." }, "clientId": { "type": "string", "description": "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n" }, "isOAuth": { "type": "boolean", "description": "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n", "default": false }, "jwtKeyId": { "type": "string", "description": "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n" }, "userIdentifierValue": { "type": "string", "description": "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n" } }, "description": "Defines properties for connectors when type is `.servicenow-itom`." }, "slack_api_config": { "title": "Connector request properties for a Slack connector", "type": "object", "properties": { "allowedChannels": { "type": "array", "items": { "maxItems": 25, "required": [ "id", "name" ], "type": "object", "properties": { "id": { "minLength": 1, "type": "string", "description": "The Slack channel ID.", "example": "C123ABC456" }, "name": { "minLength": 1, "type": "string", "description": "The Slack channel name." } } }, "description": "A list of valid Slack channels." } }, "description": "Defines properties for connectors when type is `.slack_api`." }, "swimlane_config": { "title": "Connector request properties for a Swimlane connector", "required": [ "apiUrl", "appId", "connectorType" ], "type": "object", "properties": { "apiUrl": { "type": "string", "description": "The Swimlane instance URL." }, "appId": { "type": "string", "description": "The Swimlane application ID." }, "connectorType": { "enum": [ "all", "alerts", "cases" ], "type": "string", "description": "The type of connector. Valid values are `all`, `alerts`, and `cases`." }, "mappings": { "title": "Connector mappings properties for a Swimlane connector", "type": "object", "properties": { "alertIdConfig": { "title": "Alert identifier mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the alert ID." }, "caseIdConfig": { "title": "Case identifier mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the case ID." }, "caseNameConfig": { "title": "Case name mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the case name." }, "commentsConfig": { "title": "Case comment mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the case comments." }, "descriptionConfig": { "title": "Case description mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the case description." }, "ruleNameConfig": { "title": "Rule name mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the name of the alert's rule." }, "severityConfig": { "title": "Severity mapping", "required": [ "fieldType", "id", "key", "name" ], "type": "object", "properties": { "fieldType": { "type": "string", "description": "The type of field in Swimlane." }, "id": { "type": "string", "description": "The identifier for the field in Swimlane." }, "key": { "type": "string", "description": "The key for the field in Swimlane." }, "name": { "type": "string", "description": "The name of the field in Swimlane." } }, "description": "Mapping for the severity." } }, "description": "The field mapping." } }, "description": "Defines properties for connectors when type is `.swimlane`." }, "thehive_config": { "title": "Connector request properties for a TheHive connector", "required": [ "url" ], "type": "object", "properties": { "organisation": { "type": "string", "description": "The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.\n" }, "url": { "type": "string", "description": "The instance URL in TheHive. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" } }, "description": "Defines configuration properties for connectors when type is `.thehive`." }, "tines_config": { "title": "Connector request properties for a Tines connector", "required": [ "url" ], "type": "object", "properties": { "url": { "type": "string", "description": "The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.\n" } }, "description": "Defines properties for connectors when type is `.tines`." }, "torq_config": { "title": "Connector request properties for a Torq connector", "required": [ "webhookIntegrationUrl" ], "type": "object", "properties": { "webhookIntegrationUrl": { "type": "string", "description": "The endpoint URL of the Elastic Security integration in Torq." } }, "description": "Defines properties for connectors when type is `.torq`." }, "auth_type": { "title": "Authentication type", "enum": [ "webhook-authentication-basic", "webhook-authentication-ssl" ], "type": [ "null", "string" ], "description": "The type of authentication to use: basic, SSL, or none.\n" }, "ca": { "title": "Certificate authority", "type": "string", "description": "A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.\n" }, "cert_type": { "title": "Certificate type", "enum": [ "ssl-crt-key", "ssl-pfx" ], "type": "string", "description": "If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.\n" }, "has_auth": { "title": "Has authentication", "type": "boolean", "description": "If true, a username and password for login type authentication must be provided.", "default": true }, "verification_mode": { "title": "Verification mode", "enum": [ "certificate", "full", "none" ], "type": "string", "description": "Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.\n", "default": "full" }, "webhook_config": { "title": "Connector request properties for a Webhook connector", "type": "object", "properties": { "authType": { "$ref": "#/components/schemas/auth_type" }, "ca": { "$ref": "#/components/schemas/ca" }, "certType": { "$ref": "#/components/schemas/cert_type" }, "hasAuth": { "$ref": "#/components/schemas/has_auth" }, "headers": { "type": [ "null", "object" ], "description": "A set of key-value pairs sent as headers with the request." }, "method": { "enum": [ "post", "put" ], "type": "string", "description": "The HTTP request method, either `post` or `put`.\n", "default": "post" }, "url": { "type": "string", "description": "The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" }, "verificationMode": { "$ref": "#/components/schemas/verification_mode" } }, "description": "Defines properties for connectors when type is `.webhook`." }, "cases_webhook_config": { "title": "Connector request properties for Webhook - Case Management connector", "required": [ "createIncidentJson", "createIncidentResponseKey", "createIncidentUrl", "getIncidentResponseExternalTitleKey", "getIncidentUrl", "updateIncidentJson", "updateIncidentUrl", "viewIncidentUrl" ], "type": "object", "properties": { "authType": { "$ref": "#/components/schemas/auth_type" }, "ca": { "$ref": "#/components/schemas/ca" }, "certType": { "$ref": "#/components/schemas/cert_type" }, "createCommentJson": { "type": "string", "description": "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n", "example": "{\"body\": {{{case.comment}}}}" }, "createCommentMethod": { "enum": [ "patch", "post", "put" ], "type": "string", "description": "The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.\n", "default": "put" }, "createCommentUrl": { "type": "string", "description": "The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.\n", "example": "https://example.com/issue/{{{external.system.id}}}/comment" }, "createIncidentJson": { "type": "string", "description": "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n", "example": "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}" }, "createIncidentMethod": { "enum": [ "patch", "post", "put" ], "type": "string", "description": "The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.\n", "default": "post" }, "createIncidentResponseKey": { "type": "string", "description": "The JSON key in the create external case response that contains the case ID." }, "createIncidentUrl": { "type": "string", "description": "The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" }, "getIncidentResponseExternalTitleKey": { "type": "string", "description": "The JSON key in get external case response that contains the case title." }, "getIncidentUrl": { "type": "string", "description": "The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n", "example": "https://example.com/issue/{{{external.system.id}}}" }, "hasAuth": { "$ref": "#/components/schemas/has_auth" }, "headers": { "type": "string", "description": "A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.\n" }, "updateIncidentJson": { "type": "string", "description": "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n", "example": "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}" }, "updateIncidentMethod": { "enum": [ "patch", "post", "put" ], "type": "string", "description": "The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`.\n", "default": "put" }, "updateIncidentUrl": { "type": "string", "description": "The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n", "example": "https://example.com/issue/{{{external.system.ID}}}" }, "verificationMode": { "$ref": "#/components/schemas/verification_mode" }, "viewIncidentUrl": { "type": "string", "description": "The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.\n", "example": "https://testing-jira.atlassian.net/browse/{{{external.system.title}}}" } }, "description": "Defines properties for connectors when type is `.cases-webhook`." }, "xmatters_config": { "title": "Connector request properties for an xMatters connector", "type": "object", "properties": { "configUrl": { "type": [ "null", "string" ], "description": "The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`.\n" }, "usesBasic": { "type": "boolean", "description": "Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`).", "default": true } }, "description": "Defines properties for connectors when type is `.xmatters`." }, "bedrock_secrets": { "title": "Connector secrets properties for an Amazon Bedrock connector", "required": [ "accessKey", "secret" ], "type": "object", "properties": { "accessKey": { "type": "string", "description": "The AWS access key for authentication." }, "secret": { "type": "string", "description": "The AWS secret for authentication." } }, "description": "Defines secrets for connectors when type is `.bedrock`." }, "crowdstrike_secrets": { "title": "Connector secrets properties for a Crowdstrike connector", "required": [ "clientId", "clientSecret" ], "type": "object", "properties": { "clientId": { "type": "string", "description": "The CrowdStrike API client identifier." }, "clientSecret": { "type": "string", "description": "The CrowdStrike API client secret to authenticate the `clientId`." } }, "description": "Defines secrets for connectors when type is `.crowdstrike`." }, "d3security_secrets": { "title": "Connector secrets properties for a D3 Security connector", "required": [ "token" ], "type": "object", "properties": { "token": { "type": "string", "description": "The D3 Security token." } }, "description": "Defines secrets for connectors when type is `.d3security`." }, "email_secrets": { "title": "Connector secrets properties for an email connector", "type": "object", "properties": { "clientSecret": { "type": "string", "description": "The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required.\n" }, "password": { "type": "string", "description": "The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n" }, "user": { "type": "string", "description": "The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n" } }, "description": "Defines secrets for connectors when type is `.email`." }, "gemini_secrets": { "title": "Connector secrets properties for a Google Gemini connector", "required": [ "credentialsJson" ], "type": "object", "properties": { "credentialsJson": { "type": "string", "description": "The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it." } }, "description": "Defines secrets for connectors when type is `.gemini`." }, "resilient_secrets": { "title": "Connector secrets properties for IBM Resilient connector", "required": [ "apiKeyId", "apiKeySecret" ], "type": "object", "properties": { "apiKeyId": { "type": "string", "description": "The authentication key ID for HTTP Basic authentication." }, "apiKeySecret": { "type": "string", "description": "The authentication key secret for HTTP Basic authentication." } }, "description": "Defines secrets for connectors when type is `.resilient`." }, "jira_secrets": { "title": "Connector secrets properties for a Jira connector", "required": [ "apiToken", "email" ], "type": "object", "properties": { "apiToken": { "type": "string", "description": "The Jira API authentication token for HTTP basic authentication." }, "email": { "type": "string", "description": "The account email for HTTP Basic authentication." } }, "description": "Defines secrets for connectors when type is `.jira`." }, "teams_secrets": { "title": "Connector secrets properties for a Microsoft Teams connector", "required": [ "webhookUrl" ], "type": "object", "properties": { "webhookUrl": { "type": "string", "description": "The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n" } }, "description": "Defines secrets for connectors when type is `.teams`." }, "genai_secrets": { "title": "Connector secrets properties for an OpenAI connector", "type": "object", "properties": { "apiKey": { "type": "string", "description": "The API key for authentication. For OpenAI and Azure OpenAI providers, it is required. For the `Other` provider, it is required if you do not use PKI authentication. With PKI, you can also optionally include an API key if the OpenAI-compatible service supports or requires one.\n" }, "certificateData": { "minLength": 1, "type": "string", "description": "Base64-encoded PEM certificate content for PKI authentication (Other provider only). Required for PKI.\n" }, "privateKeyData": { "minLength": 1, "type": "string", "description": "Base64-encoded PEM private key content for PKI authentication (Other provider only). Required for PKI.\n" }, "caData": { "minLength": 1, "type": "string", "description": "Base64-encoded PEM CA certificate content for PKI authentication (Other provider only). Optional.\n" } }, "description": "Defines secrets for connectors when type is `.gen-ai`. Supports both API key authentication (OpenAI, Azure OpenAI, and `Other`) and PKI authentication (`Other` provider only). PKI fields must be base64-encoded PEM content.\n" }, "opsgenie_secrets": { "title": "Connector secrets properties for an Opsgenie connector", "required": [ "apiKey" ], "type": "object", "properties": { "apiKey": { "type": "string", "description": "The Opsgenie API authentication key for HTTP Basic authentication." } }, "description": "Defines secrets for connectors when type is `.opsgenie`." }, "pagerduty_secrets": { "title": "Connector secrets properties for a PagerDuty connector", "required": [ "routingKey" ], "type": "object", "properties": { "routingKey": { "type": "string", "description": "A 32 character PagerDuty Integration Key for an integration on a service.\n" } }, "description": "Defines secrets for connectors when type is `.pagerduty`." }, "sentinelone_secrets": { "title": "Connector secrets properties for a SentinelOne connector", "required": [ "token" ], "type": "object", "properties": { "token": { "type": "string", "description": "The A SentinelOne API token." } }, "description": "Defines secrets for connectors when type is `.sentinelone`." }, "servicenow_secrets": { "title": "Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors", "type": "object", "properties": { "clientSecret": { "type": "string", "description": "The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`." }, "password": { "type": "string", "description": "The password for HTTP basic authentication. This property is required when `isOAuth` is `false`." }, "privateKey": { "type": "string", "description": "The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`." }, "privateKeyPassword": { "type": "string", "description": "The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key." }, "username": { "type": "string", "description": "The username for HTTP basic authentication. This property is required when `isOAuth` is `false`." } }, "description": "Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`." }, "slack_api_secrets": { "title": "Connector secrets properties for a Web API Slack connector", "required": [ "token" ], "type": "object", "properties": { "token": { "type": "string", "description": "Slack bot user OAuth token." } }, "description": "Defines secrets for connectors when type is `.slack`." }, "swimlane_secrets": { "title": "Connector secrets properties for a Swimlane connector", "type": "object", "properties": { "apiToken": { "type": "string", "description": "Swimlane API authentication token." } }, "description": "Defines secrets for connectors when type is `.swimlane`." }, "thehive_secrets": { "title": "Connector secrets properties for a TheHive connector", "required": [ "apiKey" ], "type": "object", "properties": { "apiKey": { "type": "string", "description": "The API key for authentication in TheHive." } }, "description": "Defines secrets for connectors when type is `.thehive`." }, "tines_secrets": { "title": "Connector secrets properties for a Tines connector", "required": [ "email", "token" ], "type": "object", "properties": { "email": { "type": "string", "description": "The email used to sign in to Tines." }, "token": { "type": "string", "description": "The Tines API token." } }, "description": "Defines secrets for connectors when type is `.tines`." }, "torq_secrets": { "title": "Connector secrets properties for a Torq connector", "required": [ "token" ], "type": "object", "properties": { "token": { "type": "string", "description": "The secret of the webhook authentication header." } }, "description": "Defines secrets for connectors when type is `.torq`." }, "crt": { "title": "Certificate", "type": "string", "description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file." }, "key": { "title": "Certificate key", "type": "string", "description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file." }, "pfx": { "title": "Personal information exchange", "type": "string", "description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file." }, "webhook_secrets": { "title": "Connector secrets properties for a Webhook connector", "type": "object", "properties": { "crt": { "$ref": "#/components/schemas/crt" }, "key": { "$ref": "#/components/schemas/key" }, "pfx": { "$ref": "#/components/schemas/pfx" }, "password": { "type": "string", "description": "The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n" }, "user": { "type": "string", "description": "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n" } }, "description": "Defines secrets for connectors when type is `.webhook`." }, "cases_webhook_secrets": { "title": "Connector secrets properties for Webhook - Case Management connector", "type": "object", "properties": { "crt": { "$ref": "#/components/schemas/crt" }, "key": { "$ref": "#/components/schemas/key" }, "pfx": { "$ref": "#/components/schemas/pfx" }, "password": { "type": "string", "description": "The password for HTTP basic authentication. If `hasAuth` is set to `true` and and `authType` is `webhook-authentication-basic`, this property is required.\n" }, "user": { "type": "string", "description": "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n" } } }, "xmatters_secrets": { "title": "Connector secrets properties for an xMatters connector", "type": "object", "properties": { "password": { "type": "string", "description": "A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n" }, "secretsUrl": { "type": "string", "description": "The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`.\n" }, "user": { "type": "string", "description": "A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n" } }, "description": "Defines secrets for connectors when type is `.xmatters`." }, "genai_openai_other_config": { "title": "Connector request properties for an OpenAI connector with Other provider", "required": [ "apiProvider", "apiUrl", "defaultModel" ], "type": "object", "properties": { "apiProvider": { "enum": [ "Other" ], "type": "string", "description": "The OpenAI API provider." }, "apiUrl": { "type": "string", "description": "The OpenAI-compatible API endpoint." }, "defaultModel": { "type": "string", "description": "The default model to use for requests." }, "certificateData": { "minLength": 1, "type": "string", "description": "PEM-encoded certificate content." }, "privateKeyData": { "minLength": 1, "type": "string", "description": "PEM-encoded private key content." }, "caData": { "minLength": 1, "type": "string", "description": "PEM-encoded CA certificate content." }, "verificationMode": { "enum": [ "full", "certificate", "none" ], "type": "string", "description": "SSL verification mode for PKI authentication.", "default": "full" }, "headers": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom headers to include in requests." } }, "description": "Defines properties for connectors when type is `.gen-ai` and the API provider is `Other` (OpenAI-compatible service), including optional PKI authentication.\n" }, "defender_secrets": { "title": "Connector secrets properties for a Microsoft Defender for Endpoint connector", "required": [ "clientSecret" ], "type": "object", "properties": { "clientSecret": { "type": "string", "description": "The client secret for your app in the Azure portal." } }, "description": "Defines secrets for connectors when type is `..microsoft_defender_endpoint`." }, "run_acknowledge_resolve_pagerduty": { "title": "PagerDuty connector parameters", "required": [ "dedupKey", "eventAction" ], "type": "object", "properties": { "dedupKey": { "maxLength": 255, "type": "string", "description": "The deduplication key for the PagerDuty alert." }, "eventAction": { "enum": [ "acknowledge", "resolve" ], "type": "string", "description": "The type of event." } }, "description": "Test an action that acknowledges or resolves a PagerDuty alert." }, "run_documents": { "title": "Index connector parameters", "required": [ "documents" ], "type": "object", "properties": { "documents": { "type": "array", "items": { "type": "object" }, "description": "The documents in JSON format for index connectors." } }, "description": "Test an action that indexes a document into Elasticsearch." }, "run_message_email": { "title": "Email connector parameters", "required": [ "message", "subject" ], "type": "object", "anyOf": [ { "required": [ "to" ] }, { "required": [ "cc" ] }, { "required": [ "bcc" ] } ], "properties": { "bcc": { "type": "array", "items": { "type": "string" }, "description": "A list of \"blind carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `` format\n" }, "cc": { "type": "array", "items": { "type": "string" }, "description": "A list of \"carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `` format \n" }, "message": { "type": "string", "description": "The email message text. Markdown format is supported." }, "subject": { "type": "string", "description": "The subject line of the email." }, "to": { "type": "array", "items": { "type": "string" }, "description": "A list of email addresses. Addresses can be specified in `user@host-name` format or in name `` format.\n" } }, "description": "Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.\n" }, "run_message_serverlog": { "title": "Server log connector parameters", "required": [ "message" ], "type": "object", "properties": { "level": { "enum": [ "debug", "error", "fatal", "info", "trace", "warn" ], "type": "string", "description": "The log level of the message for server log connectors.", "default": "info" }, "message": { "type": "string", "description": "The message for server log connectors." } }, "description": "Test an action that writes an entry to the Kibana server log." }, "run_message_slack": { "title": "Slack connector parameters", "required": [ "message" ], "type": "object", "properties": { "message": { "type": "string", "description": "The Slack message text, which cannot contain Markdown, images, or other advanced formatting." } }, "description": "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack`.\n" }, "run_trigger_pagerduty": { "title": "PagerDuty connector parameters", "required": [ "eventAction" ], "type": "object", "properties": { "class": { "type": "string", "description": "The class or type of the event.", "example": "cpu load" }, "component": { "type": "string", "description": "The component of the source machine that is responsible for the event.", "example": "eth0" }, "customDetails": { "type": "object", "description": "Additional details to add to the event." }, "dedupKey": { "maxLength": 255, "type": "string", "description": "All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.\n" }, "eventAction": { "enum": [ "trigger" ], "type": "string", "description": "The type of event." }, "group": { "type": "string", "description": "The logical grouping of components of a service.", "example": "app-stack" }, "links": { "type": "array", "items": { "type": "object", "properties": { "href": { "type": "string", "description": "The URL for the link." }, "text": { "type": "string", "description": "A plain text description of the purpose of the link." } } }, "description": "A list of links to add to the event." }, "severity": { "enum": [ "critical", "error", "info", "warning" ], "type": "string", "description": "The severity of the event on the affected system.", "default": "info" }, "source": { "type": "string", "description": "The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.\n" }, "summary": { "maxLength": 1024, "type": "string", "description": "A summery of the event." }, "timestamp": { "type": "string", "description": "An ISO-8601 timestamp that indicates when the event was detected or generated.", "format": "date-time" } }, "description": "Test an action that triggers a PagerDuty alert." }, "run_addevent": { "title": "The addEvent subaction", "required": [ "subAction" ], "type": "object", "properties": { "subAction": { "enum": [ "addEvent" ], "type": "string", "description": "The action to test." }, "subActionParams": { "type": "object", "properties": { "additional_info": { "type": "string", "description": "Additional information about the event." }, "description": { "type": "string", "description": "The details about the event." }, "event_class": { "type": "string", "description": "A specific instance of the source." }, "message_key": { "type": "string", "description": "All actions sharing this key are associated with the same ServiceNow alert. The default value is `:`." }, "metric_name": { "type": "string", "description": "The name of the metric." }, "node": { "type": "string", "description": "The host that the event was triggered for." }, "resource": { "type": "string", "description": "The name of the resource." }, "severity": { "type": "string", "description": "The severity of the event." }, "source": { "type": "string", "description": "The name of the event source type." }, "time_of_event": { "type": "string", "description": "The time of the event." }, "type": { "type": "string", "description": "The type of event." } }, "description": "The set of configuration properties for the action." } }, "description": "The `addEvent` subaction for ServiceNow ITOM connectors." }, "run_closealert": { "title": "The closeAlert subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "closeAlert" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "alias" ], "type": "object", "properties": { "alias": { "type": "string", "description": "The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert." }, "note": { "type": "string", "description": "Additional information for the alert." }, "source": { "type": "string", "description": "The display name for the source of the alert." }, "user": { "type": "string", "description": "The display name for the owner." } } } }, "description": "The `closeAlert` subaction for Opsgenie connectors." }, "run_closeincident": { "title": "The closeIncident subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "closeIncident" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "incident" ], "type": "object", "properties": { "incident": { "type": "object", "anyOf": [ { "required": [ "correlation_id" ] }, { "required": [ "externalId" ] } ], "properties": { "correlation_id": { "maxLength": 100, "type": [ "null", "string" ], "description": "An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.\n", "default": "{{rule.id}}:{{alert.id}}" }, "externalId": { "type": [ "null", "string" ], "description": "The unique identifier (`incidentId`) for the incident in ServiceNow." } } } } } }, "description": "The `closeIncident` subaction for ServiceNow ITSM connectors." }, "run_createalert": { "title": "The createAlert subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "createAlert" ], "type": "string", "description": "The action to test." }, "subActionParams": { "type": "object", "properties": { "actions": { "type": "array", "items": { "type": "string" }, "description": "The custom actions available to the alert in Opsgenie connectors." }, "alias": { "type": "string", "description": "The unique identifier used for alert deduplication in Opsgenie." }, "description": { "type": "string", "description": "A description that provides detailed information about the alert." }, "details": { "type": "object", "description": "The custom properties of the alert in Opsgenie connectors.", "example": { "key1": "value1", "key2": "value2" } }, "entity": { "type": "string", "description": "The domain of the alert in Opsgenie connectors. For example, the application or server name." }, "message": { "type": "string", "description": "The alert message in Opsgenie connectors." }, "note": { "type": "string", "description": "Additional information for the alert in Opsgenie connectors." }, "priority": { "enum": [ "P1", "P2", "P3", "P4", "P5" ], "type": "string", "description": "The priority level for the alert in Opsgenie connectors." }, "responders": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "The identifier for the entity." }, "name": { "type": "string", "description": "The name of the entity." }, "type": { "enum": [ "escalation", "schedule", "team", "user" ], "type": "string", "description": "The type of responders, in this case `escalation`." }, "username": { "type": "string", "description": "A valid email address for the user." } } }, "description": "The entities to receive notifications about the alert in Opsgenie connectors. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.\n" }, "severity": { "maximum": 4, "minimum": 1, "type": "integer", "description": "The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n" }, "source": { "type": "string", "description": "The display name for the source of the alert in Opsgenie and TheHive connectors." }, "sourceRef": { "type": "string", "description": "A source reference for the alert in TheHive connectors." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "The tags for the alert in Opsgenie and TheHive connectors." }, "title": { "type": "string", "description": "A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.\n" }, "tlp": { "maximum": 4, "minimum": 0, "type": "integer", "description": "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n", "default": 2 }, "type": { "type": "string", "description": "The type of alert in TheHive connectors." }, "user": { "type": "string", "description": "The display name for the owner." }, "visibleTo": { "type": "array", "items": { "required": [ "type" ], "type": "object", "properties": { "id": { "type": "string", "description": "The identifier for the entity." }, "name": { "type": "string", "description": "The name of the entity." }, "type": { "enum": [ "team", "user" ], "type": "string", "description": "Valid values are `team` and `user`." }, "username": { "type": "string", "description": "The user name. This property is required only when the `type` is `user`." } } }, "description": "The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required." } } } }, "description": "The `createAlert` subaction for Opsgenie and TheHive connectors." }, "run_fieldsbyissuetype": { "title": "The fieldsByIssueType subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "fieldsByIssueType" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The Jira issue type identifier.", "example": 10024 } } } }, "description": "The `fieldsByIssueType` subaction for Jira connectors." }, "run_getagentdetails": { "title": "The getAgentDetails subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "getAgentDetails" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "ids" ], "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" }, "description": "An array of CrowdStrike agent identifiers." } }, "description": "The set of configuration properties for the action." } }, "description": "The `getAgentDetails` subaction for CrowdStrike connectors." }, "run_getagents": { "title": "The getAgents subaction", "required": [ "subAction" ], "type": "object", "properties": { "subAction": { "enum": [ "getAgents" ], "type": "string", "description": "The action to test." } }, "description": "The `getAgents` subaction for SentinelOne connectors." }, "run_getchoices": { "title": "The getChoices subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "getChoices" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "fields" ], "type": "object", "properties": { "fields": { "type": "array", "items": { "type": "string" }, "description": "An array of fields." } }, "description": "The set of configuration properties for the action." } }, "description": "The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors." }, "run_getfields": { "title": "The getFields subaction", "required": [ "subAction" ], "type": "object", "properties": { "subAction": { "enum": [ "getFields" ], "type": "string", "description": "The action to test." } }, "description": "The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors." }, "run_getincident": { "title": "The getIncident subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "getIncident" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "externalId" ], "type": "object", "properties": { "externalId": { "type": "string", "description": "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.", "example": 71778 } } } }, "description": "The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors." }, "run_issue": { "title": "The issue subaction", "required": [ "subAction" ], "type": "object", "properties": { "subAction": { "enum": [ "issue" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": "string", "description": "The Jira issue identifier.", "example": 71778 } } } }, "description": "The `issue` subaction for Jira connectors." }, "run_issues": { "title": "The issues subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "issues" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "title" ], "type": "object", "properties": { "title": { "type": "string", "description": "The title of the Jira issue." } } } }, "description": "The `issues` subaction for Jira connectors." }, "run_issuetypes": { "title": "The issueTypes subaction", "required": [ "subAction" ], "type": "object", "properties": { "subAction": { "enum": [ "issueTypes" ], "type": "string", "description": "The action to test." } }, "description": "The `issueTypes` subaction for Jira connectors." }, "run_postmessage": { "title": "The postMessage subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "postMessage" ], "type": "string", "description": "The action to test." }, "subActionParams": { "type": "object", "properties": { "channelIds": { "maxItems": 1, "type": "array", "items": { "type": "string" }, "description": "The Slack channel identifier, which must be one of the `allowedChannels` in the connector configuration.\n" }, "channels": { "maxItems": 1, "type": "array", "items": { "type": "string" }, "description": "The name of a channel that your Slack app has access to.\n", "deprecated": true }, "text": { "minLength": 1, "type": "string", "description": "The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.\n" } }, "description": "The set of configuration properties for the action." } }, "description": "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack_api`.\n" }, "run_pushtoservice": { "title": "The pushToService subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "pushToService" ], "type": "string", "description": "The action to test." }, "subActionParams": { "type": "object", "properties": { "comments": { "type": "array", "items": { "type": "object", "properties": { "comment": { "type": "string", "description": "A comment related to the incident. For example, describe how to troubleshoot the issue." }, "commentId": { "type": "integer", "description": "A unique identifier for the comment." } } }, "description": "Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive." }, "incident": { "type": "object", "properties": { "additional_fields": { "maxLength": 20, "type": [ "null", "string" ], "description": "Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.\n" }, "alertId": { "type": "string", "description": "The alert identifier for Swimlane connectors." }, "caseId": { "type": "string", "description": "The case identifier for the incident for Swimlane connectors." }, "caseName": { "type": "string", "description": "The case name for the incident for Swimlane connectors." }, "category": { "type": "string", "description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors." }, "correlation_display": { "type": "string", "description": "A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors." }, "correlation_id": { "type": "string", "description": "The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.\n" }, "description": { "type": "string", "description": "The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors." }, "dest_ip": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.\n" }, "externalId": { "type": "string", "description": "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.\n" }, "id": { "type": "string", "description": "The external case identifier for Webhook - Case Management connectors." }, "impact": { "type": "string", "description": "The impact of the incident for ServiceNow ITSM connectors." }, "issueType": { "type": "integer", "description": "The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`." }, "labels": { "type": "array", "items": { "type": "string" }, "description": "The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.\n" }, "malware_hash": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident." }, "malware_url": { "type": "string", "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident." }, "otherFields": { "maxProperties": 20, "type": "object", "description": "Custom field identifiers and their values for Jira connectors.\n" }, "parent": { "type": "string", "description": "The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues." }, "priority": { "type": "string", "description": "The priority of the incident in Jira and ServiceNow SecOps connectors." }, "ruleName": { "type": "string", "description": "The rule name for Swimlane connectors." }, "severity": { "type": "integer", "description": "The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n" }, "short_description": { "type": "string", "description": "A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.\n" }, "source_ip": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident." }, "status": { "type": "string", "description": "The status of the incident for Webhook - Case Management connectors." }, "subcategory": { "type": "string", "description": "The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors." }, "summary": { "type": "string", "description": "A summary of the incident for Jira connectors." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "A list of tags for TheHive and Webhook - Case Management connectors." }, "title": { "type": "string", "description": "A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.\n" }, "tlp": { "maximum": 4, "minimum": 0, "type": "integer", "description": "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n", "default": 2 }, "urgency": { "type": "string", "description": "The urgency of the incident for ServiceNow ITSM connectors." } }, "description": "Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident." } }, "description": "The set of configuration properties for the action." } }, "description": "The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors." }, "run_validchannelid": { "title": "The validChannelId subaction", "required": [ "subAction", "subActionParams" ], "type": "object", "properties": { "subAction": { "enum": [ "validChannelId" ], "type": "string", "description": "The action to test." }, "subActionParams": { "required": [ "channelId" ], "type": "object", "properties": { "channelId": { "type": "string", "description": "The Slack channel identifier.", "example": "C123ABC456" } } } }, "description": "Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is `.slack_api`.\n" }, "params_property_apm_anomaly": { "title": "APM anomaly", "required": [ "windowSize", "windowUnit", "environment", "anomalySeverityType" ], "type": "object", "properties": { "serviceName": { "type": "string", "description": "The service name from APM" }, "transactionType": { "type": "string", "description": "The transaction type from APM" }, "windowSize": { "type": "number", "description": "The window size", "example": 6 }, "windowUnit": { "enum": [ "m", "h", "d" ], "type": "string", "description": "The window size unit" }, "environment": { "type": "string", "description": "The environment from APM" }, "anomalySeverityType": { "enum": [ "critical", "major", "minor", "warning" ], "type": "string", "description": "The anomaly threshold value" } }, "description": "The parameters for the APM anomaly rule. These parameters are appropriate when `rule_type_id` is `apm.rules.anomaly`.\n" }, "params_property_apm_error_count": { "title": "APM error count", "required": [ "windowSize", "windowUnit", "threshold", "environment" ], "type": "object", "properties": { "serviceName": { "type": "string", "description": "The service name from APM" }, "windowSize": { "type": "number", "description": "The window size", "example": 6 }, "windowUnit": { "enum": [ "m", "h", "d" ], "type": "string", "description": "The window size unit" }, "environment": { "type": "string", "description": "The environment from APM" }, "threshold": { "type": "number", "description": "The error count threshold value" }, "groupBy": { "uniqueItems": true, "type": "array", "items": { "enum": [ "service.name", "service.environment", "transaction.name", "error.grouping_key" ], "type": "string" }, "default": [ "service.name", "service.environment" ] }, "errorGroupingKey": { "type": "string" } }, "description": "The parameters for the APM error count rule. These parameters are appropriate when `rule_type_id` is `apm.error_rate`.\n" }, "params_property_apm_transaction_duration": { "title": "APM transaction duration", "required": [ "windowSize", "windowUnit", "threshold", "environment", "aggregationType" ], "type": "object", "properties": { "serviceName": { "type": "string", "description": "The service name from APM" }, "transactionType": { "type": "string", "description": "The transaction type from APM" }, "transactionName": { "type": "string", "description": "The transaction name from APM" }, "windowSize": { "type": "number", "description": "The window size", "example": 6 }, "windowUnit": { "enum": [ "m", "h", "d" ], "type": "string", "description": "ç" }, "environment": { "type": "string" }, "threshold": { "type": "number", "description": "The latency threshold value" }, "groupBy": { "uniqueItems": true, "type": "array", "items": { "enum": [ "service.name", "service.environment", "transaction.type", "transaction.name" ], "type": "string" }, "default": [ "service.name", "service.environment", "transaction.type" ] }, "aggregationType": { "enum": [ "avg", "95th", "99th" ], "type": "string" } }, "description": "The parameters for the APM transaction duration rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_duration`.\n" }, "params_property_apm_transaction_error_rate": { "title": "APM transaction error rate", "required": [ "windowSize", "windowUnit", "threshold", "environment" ], "type": "object", "properties": { "serviceName": { "type": "string", "description": "The service name from APM" }, "transactionType": { "type": "string", "description": "The transaction type from APM" }, "transactionName": { "type": "string", "description": "The transaction name from APM" }, "windowSize": { "type": "number", "description": "The window size", "example": 6 }, "windowUnit": { "enum": [ "m", "h", "d" ], "type": "string", "description": "The window size unit" }, "environment": { "type": "string", "description": "The environment from APM" }, "threshold": { "type": "number", "description": "The error rate threshold value" }, "groupBy": { "uniqueItems": true, "type": "array", "items": { "enum": [ "service.name", "service.environment", "transaction.type", "transaction.name" ], "type": "string" }, "default": [ "service.name", "service.environment", "transaction.type" ] } }, "description": "The parameters for the APM transaction error rate rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_error_rate`.\n" }, "aggfield": { "type": "string", "description": "The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.\n" }, "aggtype": { "enum": [ "avg", "count", "max", "min", "sum" ], "type": "string", "description": "The type of aggregation to perform.", "default": "count" }, "excludehitsfrompreviousrun": { "type": "boolean", "description": "Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.\n" }, "groupby": { "enum": [ "all", "top" ], "type": "string", "description": "Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.\n", "default": "all" }, "size": { "type": "integer", "description": "The number of documents to pass to the configured actions when the threshold condition is met.\n" }, "termfield": { "oneOf": [ { "type": "string" }, { "maxItems": 4, "type": "array", "items": { "type": "string" } } ], "description": "The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.\n" }, "termsize": { "type": "integer", "description": "This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.\n" }, "threshold": { "type": "array", "items": { "type": "integer", "example": 4000 }, "description": "The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values.\n" }, "thresholdcomparator": { "enum": [ ">", ">=", "<", "<=", "between", "notBetween" ], "type": "string", "description": "The comparison function for the threshold. For example, \"is above\", \"is above or equals\", \"is below\", \"is below or equals\", \"is between\", and \"is not between\".", "example": ">" }, "timefield": { "type": "string", "description": "The field that is used to calculate the time window." }, "timewindowsize": { "type": "integer", "description": "The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n", "example": 5 }, "timewindowunit": { "enum": [ "s", "m", "h", "d" ], "type": "string", "description": "The type of units for the time window: seconds, minutes, hours, or days.\n", "example": "m" }, "params_es_query_dsl_rule": { "title": "Elasticsearch DSL query rule params", "required": [ "esQuery", "index", "threshold", "thresholdComparator", "timeField", "timeWindowSize", "timeWindowUnit" ], "type": "object", "properties": { "aggField": { "$ref": "#/components/schemas/aggfield" }, "aggType": { "$ref": "#/components/schemas/aggtype" }, "esQuery": { "type": "string", "description": "The query definition, which uses Elasticsearch Query DSL." }, "excludeHitsFromPreviousRun": { "$ref": "#/components/schemas/excludehitsfrompreviousrun" }, "groupBy": { "$ref": "#/components/schemas/groupby" }, "index": { "oneOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "description": "The indices to query." }, "searchType": { "enum": [ "esQuery" ], "type": "string", "description": "The type of query, in this case a query that uses Elasticsearch Query DSL.", "default": "esQuery", "example": "esQuery" }, "size": { "$ref": "#/components/schemas/size" }, "termField": { "$ref": "#/components/schemas/termfield" }, "termSize": { "$ref": "#/components/schemas/termsize" }, "threshold": { "$ref": "#/components/schemas/threshold" }, "thresholdComparator": { "$ref": "#/components/schemas/thresholdcomparator" }, "timeField": { "$ref": "#/components/schemas/timefield" }, "timeWindowSize": { "$ref": "#/components/schemas/timewindowsize" }, "timeWindowUnit": { "$ref": "#/components/schemas/timewindowunit" } }, "description": "An Elasticsearch query rule can run a query defined in Elasticsearch Query DSL and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.\n" }, "params_es_query_esql_rule": { "title": "Elasticsearch ES|QL query rule params", "required": [ "esqlQuery", "searchType", "size", "threshold", "thresholdComparator", "timeWindowSize", "timeWindowUnit" ], "type": "object", "properties": { "aggField": { "$ref": "#/components/schemas/aggfield" }, "aggType": { "$ref": "#/components/schemas/aggtype" }, "esqlQuery": { "required": [ "esql" ], "type": "object", "properties": { "esql": { "type": "string", "description": "The query definition, which uses Elasticsearch Query Language." } } }, "excludeHitsFromPreviousRun": { "$ref": "#/components/schemas/excludehitsfrompreviousrun" }, "groupBy": { "$ref": "#/components/schemas/groupby" }, "searchType": { "enum": [ "esqlQuery" ], "type": "string", "description": "The type of query, in this case a query that uses Elasticsearch Query Language (ES|QL).", "example": "esqlQuery" }, "size": { "type": "integer", "description": "When `searchType` is `esqlQuery`, this property is required but it does not affect the rule behavior.\n", "example": 0 }, "termSize": { "$ref": "#/components/schemas/termsize" }, "threshold": { "type": "array", "items": { "maximum": 0, "minimum": 0, "type": "integer" }, "description": "The threshold value that is used with the `thresholdComparator`. When `searchType` is `esqlQuery`, this property is required and must be set to zero.\n" }, "thresholdComparator": { "enum": [ ">" ], "type": "string", "description": "The comparison function for the threshold. When `searchType` is `esqlQuery`, this property is required and must be set to \">\". Since the `threshold` value must be `0`, the result is that an alert occurs whenever the query returns results.\n", "example": ">" }, "timeField": { "$ref": "#/components/schemas/timefield" }, "timeWindowSize": { "$ref": "#/components/schemas/timewindowsize" }, "timeWindowUnit": { "$ref": "#/components/schemas/timewindowunit" } }, "description": "An Elasticsearch query rule can run an ES|QL query and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.\n" }, "filter": { "type": "object", "properties": { "meta": { "type": "object", "properties": { "alias": { "type": [ "null", "string" ] }, "controlledBy": { "type": "string" }, "disabled": { "type": "boolean" }, "field": { "type": "string" }, "group": { "type": "string" }, "index": { "type": "string" }, "isMultiIndex": { "type": "boolean" }, "key": { "type": "string" }, "negate": { "type": "boolean" }, "params": { "type": "object" }, "type": { "type": "string" }, "value": { "type": "string" } } }, "query": { "type": "object" }, "$state": { "type": "object" } }, "description": "A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package." }, "params_es_query_kql_rule": { "title": "Elasticsearch KQL query rule params", "required": [ "searchType", "size", "threshold", "thresholdComparator", "timeWindowSize", "timeWindowUnit" ], "type": "object", "properties": { "aggField": { "$ref": "#/components/schemas/aggfield" }, "aggType": { "$ref": "#/components/schemas/aggtype" }, "excludeHitsFromPreviousRun": { "$ref": "#/components/schemas/excludehitsfrompreviousrun" }, "groupBy": { "$ref": "#/components/schemas/groupby" }, "searchConfiguration": { "type": "object", "properties": { "filter": { "type": "array", "items": { "$ref": "#/components/schemas/filter" } }, "index": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "The indices to query." }, "query": { "type": "object", "properties": { "language": { "type": "string", "example": "kuery" }, "query": { "type": "string" } } } }, "description": "The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch." }, "searchType": { "enum": [ "searchSource" ], "type": "string", "description": "The type of query, in this case a text-based query that uses KQL or Lucene.", "example": "searchSource" }, "size": { "$ref": "#/components/schemas/size" }, "termField": { "$ref": "#/components/schemas/termfield" }, "termSize": { "$ref": "#/components/schemas/termsize" }, "threshold": { "$ref": "#/components/schemas/threshold" }, "thresholdComparator": { "$ref": "#/components/schemas/thresholdcomparator" }, "timeField": { "$ref": "#/components/schemas/timefield" }, "timeWindowSize": { "$ref": "#/components/schemas/timewindowsize" }, "timeWindowUnit": { "$ref": "#/components/schemas/timewindowunit" } }, "description": "An Elasticsearch query rule can run a query defined in KQL or Lucene and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.\n" }, "params_index_threshold_rule": { "title": "Index threshold rule params", "required": [ "index", "threshold", "thresholdComparator", "timeField", "timeWindowSize", "timeWindowUnit" ], "type": "object", "properties": { "aggField": { "$ref": "#/components/schemas/aggfield" }, "aggType": { "$ref": "#/components/schemas/aggtype" }, "filterKuery": { "type": "string", "description": "A KQL expression thats limits the scope of alerts." }, "groupBy": { "$ref": "#/components/schemas/groupby" }, "index": { "type": "array", "items": { "type": "string" }, "description": "The indices to query." }, "termField": { "$ref": "#/components/schemas/termfield" }, "termSize": { "$ref": "#/components/schemas/termsize" }, "threshold": { "$ref": "#/components/schemas/threshold" }, "thresholdComparator": { "$ref": "#/components/schemas/thresholdcomparator" }, "timeField": { "$ref": "#/components/schemas/timefield" }, "timeWindowSize": { "$ref": "#/components/schemas/timewindowsize" }, "timeWindowUnit": { "$ref": "#/components/schemas/timewindowunit" } }, "description": "An index threshold rule runs an Elasticsearch query, aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met. These parameters are appropriate when `rule_type_id` is `.index-threshold`." }, "params_property_infra_inventory": { "title": "Inventory", "type": "object", "properties": { "criteria": { "type": "array", "items": { "type": "object", "properties": { "metric": { "enum": [ "count", "cpu", "diskLatency", "load", "memory", "memoryTotal", "tx", "rx", "logRate", "diskIOReadBytes", "diskIOWriteBytes", "s3TotalRequests", "s3NumberOfObjects", "s3BucketSize", "s3DownloadBytes", "s3UploadBytes", "rdsConnections", "rdsQueriesExecuted", "rdsActiveTransactions", "rdsLatency", "sqsMessagesVisible", "sqsMessagesDelayed", "sqsMessagesSent", "sqsMessagesEmpty", "sqsOldestMessage", "custom" ], "type": "string" }, "timeSize": { "type": "number" }, "timeUnit": { "enum": [ "s", "m", "h", "d" ], "type": "string" }, "sourceId": { "type": "string" }, "threshold": { "type": "array", "items": { "type": "number" } }, "comparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" }, "customMetric": { "type": "object", "properties": { "type": { "enum": [ "custom" ], "type": "string" }, "field": { "type": "string" }, "aggregation": { "enum": [ "avg", "max", "min", "rate" ], "type": "string" }, "id": { "type": "string" }, "label": { "type": "string" } } }, "warningThreshold": { "type": "array", "items": { "type": "number" } }, "warningComparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" } } } }, "filterQuery": { "type": "string" }, "filterQueryText": { "type": "string" }, "nodeType": { "enum": [ "host", "pod", "container", "awsEC2", "awsS3", "awsSQS", "awsRDS" ], "type": "string" }, "sourceId": { "type": "string" }, "alertOnNoData": { "type": "boolean" } }, "description": "The parameters for the infrastructure inventory rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.inventory.threshold`.\n" }, "params_property_log_threshold": { "oneOf": [ { "title": "Log threshold count", "required": [ "count", "timeSize", "timeUnit", "logView" ], "type": "object", "properties": { "criteria": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string", "example": "my.field" }, "comparator": { "enum": [ "more than", "more than or equals", "less than", "less than or equals", "equals", "does not equal", "matches", "does not match", "matches phrase", "does not match phrase" ], "type": "string" }, "value": { "type": [ "number", "string" ] } } } }, "count": { "type": "object", "properties": { "comparator": { "enum": [ "more than", "more than or equals", "less than", "less than or equals", "equals", "does not equal", "matches", "does not match", "matches phrase", "does not match phrase" ], "type": "string" }, "value": { "type": "number", "example": 100 } } }, "timeSize": { "type": "number", "example": 6 }, "timeUnit": { "enum": [ "s", "m", "h", "d" ], "type": "string" }, "logView": { "type": "object", "properties": { "logViewId": { "type": "string" }, "type": { "enum": [ "log-view-reference" ], "type": "string", "example": "log-view-reference" } } }, "groupBy": { "type": "array", "items": { "type": "string" } } }, "description": "The parameters for a log threshold rule that counts the number of log entries that match the criteria. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`.\n" }, { "title": "Log threshold ratio", "required": [ "count", "timeSize", "timeUnit", "logView" ], "type": "object", "properties": { "criteria": { "type": "array", "items": { "maxItems": 2, "minItems": 2, "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string", "example": "my.field" }, "comparator": { "enum": [ "more than", "more than or equals", "less than", "less than or equals", "equals", "does not equal", "matches", "does not match", "matches phrase", "does not match phrase" ], "type": "string" }, "value": { "type": [ "number", "string" ] } } } } }, "count": { "type": "object", "properties": { "comparator": { "enum": [ "more than", "more than or equals", "less than", "less than or equals", "equals", "does not equal", "matches", "does not match", "matches phrase", "does not match phrase" ], "type": "string" }, "value": { "type": "number", "example": 100 } } }, "timeSize": { "type": "number", "example": 6 }, "timeUnit": { "enum": [ "s", "m", "h", "d" ], "type": "string" }, "logView": { "type": "object", "properties": { "logViewId": { "type": "string" }, "type": { "enum": [ "log-view-reference" ], "type": "string", "example": "log-view-reference" } } }, "groupBy": { "type": "array", "items": { "type": "string" } } }, "description": "The parameters for a log threshold rule that calculates the ratio of log entries that match the criteria. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`.\n" } ] }, "params_property_infra_metric_threshold": { "title": "Metric threshold", "type": "object", "properties": { "criteria": { "type": "array", "items": { "oneOf": [ { "title": "non count criterion", "type": "object", "properties": { "threshold": { "type": "array", "items": { "type": "number" }, "description": "The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.\n" }, "comparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string", "description": "The comparison function for the threshold. For example, \"is above\", \"is above or equals\", \"is below\", \"is below or equals\", \"is between\", and \"outside\".\n" }, "timeUnit": { "enum": [ "s", "m", "h", "d" ], "type": "string", "description": "The type of units for the time window: seconds, minutes, hours, or days.\n" }, "timeSize": { "type": "number", "description": "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n" }, "warningThreshold": { "type": "array", "items": { "type": "number" }, "description": "The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.\n" }, "warningComparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" }, "metric": { "type": "string" }, "aggType": { "enum": [ "avg", "max", "min", "cardinality", "rate", "count", "sum", "p95", "p99", "custom" ], "type": "string" } } }, { "title": "count criterion", "type": "object", "properties": { "threshold": { "type": "array", "items": { "type": "number" } }, "comparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" }, "timeUnit": { "enum": [ "s", "m", "h", "d" ], "type": "string", "description": "The type of units for the time window: seconds, minutes, hours, or days.\n" }, "timeSize": { "type": "number", "description": "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n" }, "warningThreshold": { "type": "array", "items": { "type": "number" } }, "warningComparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" }, "aggType": { "enum": [ "count" ], "type": "string" } } }, { "title": "custom criterion", "type": "object", "properties": { "threshold": { "type": "array", "items": { "type": "number" } }, "comparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" }, "timeUnit": { "enum": [ "s", "m", "h", "d" ], "type": "string", "description": "The type of units for the time window: seconds, minutes, hours, or days.\n" }, "timeSize": { "type": "number", "description": "The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.\n" }, "warningThreshold": { "type": "array", "items": { "type": "number" } }, "warningComparator": { "enum": [ "<", "<=", ">", ">=", "between", "outside" ], "type": "string" }, "aggType": { "enum": [ "custom" ], "type": "string" }, "customMetric": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "aggType": { "enum": [ "avg", "sum", "max", "min", "cardinality" ], "type": "string", "description": "An aggregation to gather data for the rule. For example, find the average, highest or lowest value of a numeric field. Or use a cardinality aggregation to find the approximate number of unique values in a field. \n" }, "field": { "type": "string" } } }, { "type": "object", "properties": { "name": { "type": "string" }, "aggType": { "enum": [ "count" ], "type": "string" }, "filter": { "type": "string" } } } ] } }, "equation": { "type": "string" }, "label": { "type": "string" } } } ] } }, "groupBy": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host.\nIMPORTANT: If you include the same field in both the `filterQuery` and `groupBy`, you might receive fewer results than you expect. For example, if you filter by `cloud.region: us-east`, grouping by `cloud.region` will have no effect because the filter query can match only one region.\n" }, "filterQuery": { "type": "string", "description": "A query that limits the scope of the rule. The rule evaluates only metric data that matches the query.\n" }, "sourceId": { "type": "string" }, "alertOnNoData": { "type": "boolean", "description": "If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails." }, "alertOnGroupDisappear": { "type": "boolean", "description": "If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically.\n" } }, "description": "The parameters for the metric threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.threshold`.\n" }, "params_property_slo_burn_rate": { "title": "SLO burn rate", "type": "object", "properties": { "sloId": { "type": "string", "description": "The SLO identifier used by the rule", "example": "8853df00-ae2e-11ed-90af-09bb6422b258" }, "burnRateThreshold": { "type": "number", "description": "The burn rate threshold used to trigger the alert", "example": 14.4 }, "maxBurnRateThreshold": { "type": "number", "description": "The maximum burn rate threshold value defined by the SLO error budget", "example": 168 }, "longWindow": { "type": "object", "properties": { "value": { "type": "number", "description": "The duration value", "example": 6 }, "unit": { "type": "string", "description": "The duration unit", "example": "h" } }, "description": "The duration of the long window used to compute the burn rate" }, "shortWindow": { "type": "object", "properties": { "value": { "type": "number", "description": "The duration value", "example": 30 }, "unit": { "type": "string", "description": "The duration unit", "example": "m" } }, "description": "The duration of the short window used to compute the burn rate" } }, "description": "The parameters for the SLO burn rate rule. These parameters are appropriate when `rule_type_id` is `slo.rules.burnRate`.\n" }, "params_property_synthetics_uptime_tls": { "title": "Synthetics TLS certificate", "type": "object", "properties": { "search": { "type": "string" }, "certExpirationThreshold": { "type": "number" }, "certAgeThreshold": { "type": "number" } }, "description": "The parameters for the synthetics TLS certificate rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.tls`.\n" }, "params_property_synthetics_monitor_status": { "title": "Synthetics monitor status", "required": [ "numTimes", "shouldCheckStatus", "shouldCheckAvailability" ], "type": "object", "properties": { "availability": { "type": "object", "properties": { "range": { "type": "number" }, "rangeUnit": { "type": "string" }, "threshold": { "type": "string" } } }, "filters": { "oneOf": [ { "type": "string" }, { "type": "object", "properties": { "monitor.type": { "type": "array", "items": { "type": "string" } }, "observer.geo.name": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" } }, "url.port": { "type": "array", "items": { "type": "string" } } }, "deprecated": true } ] }, "locations": { "type": "array", "items": { "type": "string" }, "deprecated": true }, "numTimes": { "type": "number" }, "search": { "type": "string" }, "shouldCheckStatus": { "type": "boolean" }, "shouldCheckAvailability": { "type": "boolean" }, "timerangeCount": { "type": "number" }, "timerangeUnit": { "type": "string" }, "timerange": { "type": "object", "properties": { "from": { "type": "string" }, "to": { "type": "string" } }, "deprecated": true }, "version": { "type": "number" }, "isAutoGenerated": { "type": "boolean" } }, "description": "The parameters for the Synthetics monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.monitorStatus`.\n" } }, "responses": { "Fleet_error": { "description": "Generic Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "statusCode": { "type": "number" } } } } } } }, "parameters": { "Alerting_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "Cross-site request forgery protection", "required": true, "schema": { "type": "string" } }, "APM_UI_elastic_api_version": { "name": "elastic-api-version", "in": "header", "description": "The version of the API to use", "required": true, "schema": { "enum": [ "2023-10-31" ], "type": "string", "default": "2023-10-31" } }, "APM_UI_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "A required header to protect against CSRF attacks", "required": true, "schema": { "type": "string", "example": "true" } }, "Cases_alert_id": { "name": "alertId", "in": "path", "description": "An identifier for the alert.", "required": true, "schema": { "type": "string", "example": "09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540" } }, "Cases_assignees_filter": { "name": "assignees", "in": "query", "description": "Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.\n", "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_string" }, { "$ref": "#/components/schemas/Cases_string_array" } ] } }, "Cases_case_id": { "name": "caseId", "in": "path", "description": "The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.", "required": true, "schema": { "type": "string", "example": "9c235210-6834-11ea-a78c-6ffb38a34414" } }, "Cases_category": { "name": "category", "in": "query", "description": "Filters the returned cases by category.", "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_case_category" }, { "$ref": "#/components/schemas/Cases_case_categories" } ] } }, "Cases_comment_id": { "name": "commentId", "in": "path", "description": "The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs.\n", "required": true, "schema": { "type": "string", "example": "71ec1870-725b-11ea-a0b2-c51ea50a58e2" } }, "Cases_configuration_id": { "name": "configurationId", "in": "path", "description": "An identifier for the configuration.", "required": true, "schema": { "type": "string", "example": "3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9" } }, "Cases_connector_id": { "name": "connectorId", "in": "path", "description": "An identifier for the connector. To retrieve connector IDs, use the find connectors API.", "required": true, "schema": { "type": "string", "example": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2" } }, "Cases_defaultSearchOperator": { "name": "defaultSearchOperator", "in": "query", "description": "he default operator to use for the simple_query_string.", "schema": { "type": "string", "default": "OR" }, "example": "OR" }, "Cases_from": { "name": "from", "in": "query", "description": "Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.\n", "schema": { "type": "string", "example": "now-1d" } }, "Cases_ids": { "name": "ids", "in": "query", "description": "The cases that you want to removed. All non-ASCII characters must be URL encoded.\n", "required": true, "schema": { "type": "array", "items": { "maxItems": 100, "minItems": 1, "type": "string" } }, "example": [ "d4e7abb0-b462-11ec-9a8d-698504725a43" ] }, "Cases_includeComments": { "name": "includeComments", "in": "query", "description": "Deprecated in 8.1.0. This parameter is deprecated and will be removed in a future release. It determines whether case comments are returned.", "deprecated": true, "schema": { "type": "boolean", "default": true } }, "Cases_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "Cross-site request forgery protection", "required": true, "schema": { "type": "string" } }, "Cases_owner_filter": { "name": "owner", "in": "query", "description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.\n", "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_owner" }, { "$ref": "#/components/schemas/Cases_owners" } ] }, "example": "cases" }, "Cases_page_index": { "name": "page", "in": "query", "description": "The page number to return.", "schema": { "type": "integer", "default": 1 } }, "Cases_page_size": { "name": "perPage", "in": "query", "description": "The number of items to return. Limited to 100 items.", "schema": { "maximum": 100, "type": "integer", "default": 20 } }, "Cases_reporters": { "name": "reporters", "in": "query", "description": "Filters the returned cases by the user name of the reporter.", "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_string" }, { "$ref": "#/components/schemas/Cases_string_array" } ] }, "example": "elastic" }, "Cases_search": { "name": "search", "in": "query", "description": "An Elasticsearch simple_query_string query that filters the objects in the response.", "schema": { "type": "string" } }, "Cases_searchFields": { "name": "searchFields", "in": "query", "description": "The fields to perform the simple_query_string parsed query against.", "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_searchFieldsType" }, { "$ref": "#/components/schemas/Cases_searchFieldsTypeArray" } ] } }, "Cases_severity": { "name": "severity", "in": "query", "description": "The severity of the case.", "schema": { "enum": [ "critical", "high", "low", "medium" ], "type": "string" } }, "Cases_sort_order": { "name": "sortOrder", "in": "query", "description": "Determines the sort order.", "schema": { "enum": [ "asc", "desc" ], "type": "string", "default": "desc" } }, "Cases_sortField": { "name": "sortField", "in": "query", "description": "Determines which field is used to sort the results.", "schema": { "enum": [ "createdAt", "updatedAt", "closedAt", "title", "category", "status", "severity" ], "type": "string", "default": "createdAt" }, "example": "updatedAt" }, "Cases_status": { "name": "status", "in": "query", "description": "Filters the returned cases by state.", "schema": { "enum": [ "closed", "in-progress", "open" ], "type": "string" }, "example": "open" }, "Cases_tags": { "name": "tags", "in": "query", "description": "Filters the returned cases by tags.", "schema": { "oneOf": [ { "$ref": "#/components/schemas/Cases_string" }, { "$ref": "#/components/schemas/Cases_string_array" } ] }, "example": "tag-1" }, "Cases_to": { "name": "to", "in": "query", "description": "Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.\n", "schema": { "type": "string" }, "example": "now+1d" }, "Cases_user_action_types": { "name": "types", "in": "query", "description": "Determines the types of user actions to return.", "schema": { "type": "array", "items": { "enum": [ "action", "alert", "assignees", "attachment", "comment", "connector", "create_case", "description", "pushed", "settings", "severity", "status", "tags", "title", "user" ], "type": "string" } }, "example": "create_case" }, "Data_views_field_name": { "name": "fieldName", "in": "path", "description": "The name of the runtime field.", "required": true, "schema": { "type": "string", "example": "hour_of_day" } }, "Data_views_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "Cross-site request forgery protection", "required": true, "schema": { "type": "string" } }, "Data_views_view_id": { "name": "viewId", "in": "path", "description": "An identifier for the data view.", "required": true, "schema": { "type": "string", "example": "ff959d40-b880-11e8-a6d9-e546fe2bba5f" } }, "Fleet_format": { "name": "format", "in": "query", "description": "Simplified or legacy format for package inputs", "schema": { "enum": [ "simplified", "legacy" ], "type": "string" } }, "Fleet_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "Kibana's anti Cross-Site Request Forgery token. Can be any string value.", "required": true, "schema": { "type": "string" } }, "Fleet_kuery": { "name": "kuery", "in": "query", "schema": { "type": "string" } }, "Fleet_page_index": { "name": "page", "in": "query", "schema": { "type": "integer", "default": 1 } }, "Fleet_page_size": { "name": "perPage", "in": "query", "description": "The number of items to return", "schema": { "type": "integer", "default": 20 } }, "Fleet_show_inactive": { "name": "showInactive", "in": "query", "schema": { "type": "boolean" } }, "Fleet_show_upgradeable": { "name": "showUpgradeable", "in": "query", "schema": { "type": "boolean" } }, "Fleet_sort_field": { "name": "sortField", "in": "query", "schema": { "type": "string", "deprecated": true } }, "Fleet_sort_order": { "name": "sortOrder", "in": "query", "schema": { "enum": [ "asc", "desc" ], "type": "string" } }, "Fleet_with_metrics": { "name": "withMetrics", "in": "query", "description": "Return agent metrics, false by default", "schema": { "type": "boolean" } }, "Machine_learning_APIs_simulateParam": { "name": "simulate", "in": "query", "description": "When true, simulates the synchronization by returning only the list of actions that would be performed.", "schema": { "type": "boolean" }, "example": "true" }, "Saved_objects_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "Cross-site request forgery protection", "required": true, "schema": { "type": "string" } }, "Saved_objects_saved_object_id": { "name": "id", "in": "path", "description": "An identifier for the saved object.", "required": true, "schema": { "type": "string" } }, "Saved_objects_saved_object_type": { "name": "type", "in": "path", "description": "Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`.", "required": true, "schema": { "type": "string" } }, "Short_URL_APIs_idParam": { "name": "id", "in": "path", "description": "The identifier for the short URL.", "required": true, "schema": { "type": "string" } }, "SLOs_kbn_xsrf": { "name": "kbn-xsrf", "in": "header", "description": "Cross-site request forgery protection", "required": true, "schema": { "type": "string" } }, "SLOs_slo_id": { "name": "sloId", "in": "path", "description": "An identifier for the slo.", "required": true, "schema": { "type": "string", "example": "9c235211-6834-11ea-a78c-6feb38a34414" } }, "SLOs_space_id": { "name": "spaceId", "in": "path", "description": "An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.", "required": true, "schema": { "type": "string", "example": "default" } } }, "examples": { "Alerting_get_health_response": { "summary": "Retrieve information about the health of the alerting framework.", "value": { "alerting_framework_health": { "decryption_health": { "status": "ok", "timestamp": "2023-01-13T01:28:00.280Z" }, "execution_health": { "status": "ok", "timestamp": "2023-01-13T01:28:00.280Z" }, "read_health": { "status": "ok", "timestamp": "2023-01-13T01:28:00.280Z" } }, "has_permanent_encryption_key": true, "is_sufficiently_secure": true } }, "Alerting_get_rule_types_response": { "summary": "Retrieve rule types associated with Kibana machine learning features", "value": [ { "action_groups": [ { "id": "anomaly_score_match", "name": "Anomaly score matched the condition" }, { "id": "recovered", "name": "Recovered" } ], "action_variables": { "context": [ { "description": "The bucket timestamp of the anomaly", "name": "timestamp" }, { "description": "The bucket time of the anomaly in ISO8601 format", "name": "timestampIso8601" }, { "description": "List of job IDs that triggered the alert", "name": "jobIds" }, { "description": "Alert info message", "name": "message" }, { "description": "Indicate if top hits contain interim results", "name": "isInterim" }, { "description": "Anomaly score at the time of the notification action", "name": "score" }, { "description": "Top records", "name": "topRecords" }, { "description": "Top influencers", "name": "topInfluencers" }, { "description": "URL to open in the Anomaly Explorer", "name": "anomalyExplorerUrl", "useWithTripleBracesInTemplates": true } ], "params": [ ], "state": [ ] }, "alerts": { "context": "ml.anomaly-detection", "mappings": { "fieldMap": { "kibana.alert.anomaly_score": { "array": false, "type": "double", "required": false }, "kibana.alert.anomaly_timestamp": { "array": false, "type": "date", "required": false }, "kibana.alert.is_interim": { "array": false, "type": "boolean", "required": false }, "kibana.alert.job_id": { "array": false, "type": "keyword", "required": true }, "kibana.alert.top_influencers": { "array": true, "dynamic": false, "type": "object", "properties": { "influencer_field_name": { "type": "keyword" }, "influencer_field_value": { "type": "keyword" }, "influencer_score": { "type": "double" }, "initial_influencer_score": { "type": "double" }, "is_interim": { "type": "boolean" }, "job_id": { "type": "keyword" }, "timestamp": { "type": "date" } }, "required": false }, "kibana.alert.top_records": { "array": true, "dynamic": false, "type": "object", "properties": { "actual": { "type": "double" }, "by_field_name": { "type": "keyword" }, "by_field_value": { "type": "keyword" }, "detector_index": { "type": "integer" }, "field_name": { "type": "keyword" }, "function": { "type": "keyword" }, "initial_record_score": { "type": "double" }, "is_interim": { "type": "boolean" }, "job_id": { "type": "keyword" }, "over_field_name": { "type": "keyword" }, "over_field_value": { "type": "keyword" }, "partition_field_name": { "type": "keyword" }, "partition_field_value": { "type": "keyword" }, "record_score": { "type": "double" }, "timestamp": { "type": "date" }, "typical": { "type": "double" } }, "required": false } } }, "shouldWrite": true }, "authorized_consumers": { "alerts": { "all": true, "read": true }, "apm": { "all": true, "read": true }, "discover": { "all": true, "read": true }, "infrastructure": { "all": true, "read": true }, "logs": { "all": true, "read": true }, "ml": { "all": true, "read": true }, "monitoring": { "all": true, "read": true }, "siem": { "all": true, "read": true }, "slo": { "all": true, "read": true }, "stackAlerts": { "all": true, "read": true }, "uptime": { "all": true, "read": true } }, "category": "management", "default_action_group_id": "anomaly_score_match", "does_set_recovery_context": true, "enabled_in_license": true, "has_alerts_mappings": true, "has_fields_for_a_a_d": true, "id": "xpack.ml.anomaly_detection_alert", "is_exportable": true, "minimum_license_required": "platinum", "name": "Anomaly detection alert", "producer": "ml", "recovery_action_group": { "id": "recovered", "name": "Recovered" }, "rule_task_timeout": "5m" }, { "action_groups": [ { "id": "anomaly_detection_realtime_issue", "name": "Issue detected" }, { "id": "recovered", "name": "Recovered" } ], "action_variables": { "context": [ { "description": "Results of the rule execution", "name": "results" }, { "description": "Alert info message", "name": "message" } ], "params": [ ], "state": [ ] }, "authorized_consumers": { "alerts": { "all": true, "read": true }, "apm": { "all": true, "read": true }, "discover": { "all": true, "read": true }, "infrastructure": { "all": true, "read": true }, "logs": { "all": true, "read": true }, "ml": { "all": true, "read": true }, "monitoring": { "all": true, "read": true }, "siem": { "all": true, "read": true }, "slo": { "all": true, "read": true }, "stackAlerts": { "all": true, "read": true }, "uptime": { "all": true, "read": true } }, "category": "management", "default_action_group_id": "anomaly_detection_realtime_issue", "does_set_recovery_context": true, "enabled_in_license": true, "has_alerts_mappings": false, "has_fields_for_a_a_d": false, "id": "xpack.ml.anomaly_detection_jobs_health", "is_exportable": true, "minimum_license_required": "platinum", "name": "Anomaly detection jobs health", "producer": "ml", "recovery_action_group": { "id": "recovered", "name": "Recovered" }, "rule_task_timeout": "5m" } ] }, "Cases_add_comment_request": { "summary": "Adds a comment to a case.", "value": { "comment": "A new comment.", "owner": "cases", "type": "user" } }, "Cases_add_comment_response": { "summary": "The add comment to case API returns a JSON object that contains details about the case and its comments.", "value": { "assignees": [ ], "category": "null", "closed_at": "null", "closed_by": "null", "comments": [ { "comment": "A new comment.", "created_at": "2022-10-02T00:49:47.716Z", "created_by": { "email": "null", "full_name": "null", "username": "elastic" }, "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6", "owner": "cases", "type": "user", "version": "WzIwNDMxLDFd" } ], "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "created_at": "2022-03-24T00:37:03.906Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "Field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": true } ], "description": "A case description.", "duration": "null", "external_service": "null", "id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6", "owner": "cases", "settings": { "syncAlerts": false }, "severity": "low", "status": "open", "tags": [ "tag 1" ], "title": "Case title 1", "totalAlerts": 0, "totalComment": 1, "updated_at": "2022-06-03T00:49:47.716Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzIzMzgsMV0=" } }, "Cases_create_case_request": { "summary": "Create a security case that uses a Jira connector.", "value": { "connector": { "fields": { "issueType": "10006", "parent": "null", "priority": "High" }, "id": "131d4448-abe0-4789-939d-8ef60680b498", "name": "My connector", "type": ".jira" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My field value" } ], "description": "A case description.", "owner": "cases", "settings": { "syncAlerts": true }, "tags": [ "tag-1" ], "title": "Case title 1" } }, "Cases_create_case_response": { "summary": "The create case API returns a JSON object that contains details about the case.", "value": { "assignees": [ ], "closed_at": "null", "closed_by": "null", "comments": [ ], "connector": { "fields": { "issueType": "10006", "parent": "null", "priority": "High" }, "id": "131d4448-abe0-4789-939d-8ef60680b498", "name": "My connector", "type": ".jira" }, "created_at": "2022-10-13T15:33:50.604Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": "null" } ], "description": "A case description.", "duration": "null", "external_service": "null", "id": "66b9aa00-94fa-11ea-9f74-e7e108796192", "owner": "cases", "settings": { "syncAlerts": true }, "severity": "low", "status": "open", "tags": [ "tag 1" ], "title": "Case title 1", "totalAlerts": 0, "totalComment": 0, "updated_at": "null", "updated_by": "null", "version": "WzUzMiwxXQ==" } }, "Cases_find_case_activity_response": { "summary": "Retrieves all activity for a case", "value": { "page": 1, "perPage": 20, "total": 3, "userActions": [ { "action": "create", "comment_id": "null", "created_at": "2023-10-20T01:17:22.150Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "b4cd0770-07c9-11ed-a5fd-47154cb8767e", "owner": "cases", "payload": { "assignees": [ ], "category": "null", "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": "null" } ], "description": "A case description.", "owner": "cases", "settings": { "syncAlerts": false }, "severity": "low", "status": "open", "tags": [ "tag 1" ], "title": "Case title 1" }, "type": "create_case", "version": "WzM1ODg4LDFd" }, { "action": "create", "comment_id": "578608d0-03b1-11ed-920c-974bfa104448", "created_at": "2023-10-14T20:12:53.354Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "57af14a0-03b1-11ed-920c-974bfa104448", "owner": "cases", "payload": { "comment": "A new comment", "owner": "cases", "type": "user" }, "type": "comment", "version": "WzM1ODg4LDFa" }, { "action": "add", "comment_id": "null", "created_at": "2023-10-20T01:10:28.238Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "573c6980-6123-11ed-aa41-81a0a61fe447", "owner": "cases", "payload": { "assignees": { "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } }, "type": "assignees", "version": "WzM1ODg4LDFb" } ] } }, "Cases_find_case_response": { "summary": "Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.", "value": { "cases": [ { "assignees": [ ], "category": "null", "closed_at": "null", "closed_by": "null", "comments": [ ], "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "created_at": "2023-10-12T00:16:36.371Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": "null" } ], "description": "Case description", "duration": "null", "external_service": "null", "id": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2", "owner": "cases", "settings": { "syncAlerts": true }, "severity": "low", "status": "open", "tags": [ "tag-1" ], "title": "Case title", "totalAlerts": 0, "totalComment": 1, "updated_at": "2023-10-12T00:27:58.162Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzExMCwxXQ==" } ], "count_closed_cases": 0, "count_in_progress_cases": 0, "count_open_cases": 1, "page": 1, "per_page": 5, "total": 1 } }, "Cases_find_connector_response": { "summary": "Retrieve information about the connectors and their settings.", "value": [ { "actionTypeId": ".jira", "config": { "apiUrl": "https://elastic.atlassian.net/", "projectKey": "ES" }, "id": "61787f53-4eee-4741-8df6-8fe84fa616f7", "isDeprecated": false, "isMissingSecrets": false, "isPreconfigured": false, "name": "my-Jira", "referencedByCount": 0 } ] }, "Cases_get_case_alerts_response": { "summary": "Retrieves all alerts attached to a case", "value": [ { "attached_at": "2022-07-25T20:09:40.963Z", "id": "f6a7d0c3-d52d-432c-b2e6-447cd7fce04d", "index": ".alerts-observability.logs.alerts-default" } ] }, "Cases_get_case_configuration_response": { "summary": "Get the case configuration.", "value": [ { "closure_type": "close-by-user", "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "created_at": "2024-07-01T17:07:17.767Z", "created_by": { "email": "null", "full_name": "null", "username": "elastic" }, "customFields": [ { "defaultValue": "Custom text field value.", "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "label": "my-text-field", "type": "text", "required": false } ], "error": "null", "id": "856ee650-6c82-11ee-a20a-6164169afa58", "mappings": [ ], "owner": "cases", "templates": [ { "caseFields": { "assignees": [ { "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } ], "category": "Default-category", "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "Default text field value." } ], "description": "A default description for cases.", "settings": { "syncAlerts": false }, "tags": [ "Default case tag" ], "title": "Default case title" }, "description": "A description of the template.", "key": "505932fe-ee3a-4960-a661-c781b5acdb05", "name": "template-1", "tags": [ "Template tag 1" ] } ], "updated_at": "null", "updated_by": "null", "version": "WzEyLDNd" } ] }, "Cases_get_case_observability_response": { "summary": "Retrieves information about an Observability case including its alerts and comments.", "value": { "assignees": [ { "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0" } ], "category": "null", "closed_at": "null", "closed_by": "null", "comments": [ { "alertId": [ "a6e12ac4-7bce-457b-84f6-d7ce8deb8446" ], "created_at": "2023-11-06T19:29:38.424Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "59d438d0-79a9-4864-8d4b-e63adacebf6e", "index": [ ".internal.alerts-observability.logs.alerts-default-000001" ], "owner": "observability", "pushed_at": "null", "pushed_by": "null", "rule": { "id": "03e4eb87-62ca-4e5d-9570-3d7625e9669d", "name": "Observability rule" }, "type": "alert", "updated_at": "null", "updated_by": "null", "version": "WzY3LDJd" }, { "comment": "The first comment.", "created_at": "2023-11-06T19:29:57.812Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "d99342d3-3aa3-4b80-90ec-a702607604f5", "owner": "observability", "pushed_at": "null", "pushed_by": "null", "type": "user", "updated_at": "null", "updated_by": "null", "version": "WzcyLDJd" } ], "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "created_at": "2023-11-06T19:29:04.086Z", "created_by": { "email": "null", "full_name": "null", "username": "elastic" }, "customFields": [ ], "description": "An Observability case description.", "duration": "null", "external_service": "null", "id": "c3ff7550-def1-4e90-b6bc-c9969a4a09b1", "owner": "observability", "settings": { "syncAlerts": false }, "severity": "low", "status": "in-progress", "tags": [ "observability", "tag 1" ], "title": "Observability case title 1", "totalAlerts": 1, "totalComment": 1, "updated_at": "2023-11-06T19:47:55.662Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzI0NywyXQ==" } }, "Cases_get_case_response": { "summary": "Retrieves information about a case including its comments.", "value": { "assignees": [ { "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } ], "category": "null", "closed_at": "null", "closed_by": "null", "comments": [ { "comment": "A new comment", "created_at": "2023-10-13T15:40:32.335Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "2134c1d0-02c2-11ed-85f2-4f7c222ca2fa", "owner": "cases", "pushed_at": "null", "pushed_by": "null", "type": "user", "updated_at": "null", "updated_by": "null", "version": "WzM3LDFd" } ], "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "created_at": "2023-10-13T15:33:50.604Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": "null" } ], "description": "A case description", "duration": "null", "external_service": "null", "id": "31cdada0-02c1-11ed-85f2-4f7c222ca2fa", "owner": "cases", "settings": { "syncAlerts": true }, "severity": "low", "status": "open", "tags": [ "tag 1" ], "title": "Case title 1", "totalAlerts": 0, "totalComment": 1, "updated_at": "2023-10-13T15:40:32.335Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzM2LDFd" } }, "Cases_get_comment_response": { "summary": "A single user comment retrieved from a case", "value": { "comment": "A new comment", "created_at": "2023-10-07T19:32:13.104Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "8048b460-fe2b-11ec-b15d-779a7c8bbcc3", "owner": "cases", "pushed_at": "null", "pushed_by": "null", "type": "user", "updated_at": "null", "updated_by": "null", "version": "WzIzLDFd" } }, "Cases_get_reporters_response": { "summary": "A list of two users that opened cases", "value": [ { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, { "email": "jdoe@example.com", "full_name": "Jane Doe", "profile_uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0", "username": "jdoe" } ] }, "Cases_get_tags_response": { "summary": "A list of tags that are used in cases", "value": [ "observability", "security", "tag 1", "tag 2" ] }, "Cases_push_case_response": { "summary": "The push case API returns a JSON object with details about the case and the external service.", "value": { "closed_at": "null", "closed_by": "null", "comments": [ ], "connector": { "fields": { "issueType": "10006", "parent": "null", "priority": "Low" }, "id": "09f8c0b0-0eda-11ed-bd18-65557fe66949", "name": "My connector", "type": ".jira" }, "created_at": "2022-07-29T00:59:39.444Z", "created_by": { "email": "null", "full_name": "null", "username": "elastic" }, "description": "A case description.", "duration": "null", "external_service": { "connector_id": "09f8c0b0-0eda-11ed-bd18-65557fe66949", "connector_name": "My connector", "external_id": "71926", "external_title": "ES-554", "external_url": "https://cases.jira.com", "pushed_at": "2022-07-29T01:20:58.436Z", "pushed_by": { "email": "null", "full_name": "null", "username": "elastic" } }, "id": "b917f300-0ed9-11ed-bd18-65557fe66949", "owner": "cases", "settings": { "syncAlerts": true }, "severity": "low", "status": "open", "tags": [ "tag 1" ], "title": "Case title 1", "totalAlerts": 0, "totalComment": 0, "updated_at": "2022-07-29T01:20:58.436Z", "updated_by": { "email": "null", "full_name": "null", "username": "elastic" }, "version": "WzE3NjgsM10=" } }, "Cases_set_case_configuration_request": { "summary": "Set the closure type, custom fields, and default connector for Stack Management cases.", "value": { "closure_type": "close-by-user", "connector": { "fields": "null", "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6", "name": "my-jira-connector", "type": ".jira" }, "customFields": [ { "defaultValue": "My custom field default value.", "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "label": "my-text-field", "type": "text", "required": false } ], "owner": "cases", "templates": [ { "caseFields": { "assignees": [ { "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } ], "category": "Default-category", "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "A text field value for the template." } ], "description": "A default description for cases.", "tags": [ "Default case tag" ], "title": "Default case title" }, "description": "A description of the template.", "key": "505932fe-ee3a-4960-a661-c781b5acdb05", "name": "template-1", "tags": [ "Template tag 1" ] } ] } }, "Cases_set_case_configuration_response": { "summary": "This is an example response for case settings.", "value": { "closure_type": "close-by-user", "connector": { "fields": "null", "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6", "name": "my-jira-connector", "type": ".jira" }, "created_at": "2024-07-01T17:07:17.767Z", "created_by": { "email": "null,", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "defaultValue": "My custom field default value.", "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "label": "my-text-field", "type": "text", "required": false } ], "error": "null", "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6", "mappings": [ { "action_type": "overwrite", "source": "title", "target": "summary" }, { "action_type": "overwrite", "source": "description", "target": "description" }, { "action_type": "append", "source": "comments", "target": "comments" }, { "action_type": "overwrite", "source": "tags", "target": "labels" } ], "owner": "cases", "templates": [ { "caseFields": { "assignees": [ { "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } ], "category": "Default-category", "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "A text field value for the template." } ], "description": "A default description for cases.", "tags": [ "Default case tag" ], "title": "Default case title" }, "description": "A description of the template.", "key": "505932fe-ee3a-4960-a661-c781b5acdb05", "name": "template-1", "tags": [ "Template tag 1" ] } ], "updated_at": "null", "updated_by": "null", "version": "WzIwNzMsMV0=" } }, "Cases_update_case_configuration_request": { "summary": "Update the case settings.", "value": { "closure_type": "close-by-user", "connector": { "fields": "null", "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6", "name": "my-jira-connector", "type": ".jira" }, "customFields": [ { "defaultValue": "A new default value.", "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "label": "my-text-field", "type": "text", "required": true }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "label": "my-toggle", "type": "toggle", "required": false } ], "version": "WzExOSw0XQ==" } }, "Cases_update_case_configuration_response": { "summary": "This is an example response when the case configuration was updated.", "value": { "closure_type": "close-by-user", "connector": { "fields": "null", "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6", "name": "my-jira-connector", "type": ".jira" }, "created_at": "2024-07-01T17:07:17.767Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "defaultValue": "A new default value.", "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "label": "my-text-field", "type": "text", "required": true }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "label": "my-toggle", "type": "toggle", "required": false } ], "error": "null", "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6", "mappings": [ { "action_type": "overwrite", "source": "title", "target": "summary" }, { "action_type": "overwrite", "source": "description", "target": "description" }, { "action_type": "overwrite", "source": "tags", "target": "labels" }, { "action_type": "append", "source": "comments", "target": "comments" } ], "owner": "cases", "templates": [ ], "updated_at": "2024-07-19T00:52:42.401Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzI2LDNd" } }, "Cases_update_case_request": { "summary": "Update the case description, tags, and connector.", "value": { "cases": [ { "connector": { "fields": { "issueType": "10006", "parent": "null", "priority": "null" }, "id": "131d4448-abe0-4789-939d-8ef60680b498", "name": "My connector", "type": ".jira" }, "customFields": [ { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": false }, { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My new field value" } ], "description": "A case description.", "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2", "settings": { "syncAlerts": true }, "tags": [ "tag-1" ], "version": "WzIzLDFd" } ] } }, "Cases_update_case_response": { "summary": "This is an example response when the case description, tags, and connector were updated.", "value": [ { "assignees": [ ], "category": "null", "closed_at": "null", "closed_by": "null", "comments": [ ], "connector": { "fields": { "issueType": "10006", "parent": "null", "priority": "null" }, "id": "131d4448-abe0-4789-939d-8ef60680b498", "name": "My connector", "type": ".jira" }, "created_at": "2023-10-13T09:16:17.416Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My new field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": false } ], "description": "A case description.", "duration": "null", "external_service": { "connector_id": "05da469f-1fde-4058-99a3-91e4807e2de8", "connector_name": "Jira", "external_id": "10003", "external_title": "IS-4", "external_url": "https://hms.atlassian.net/browse/IS-4", "pushed_at": "2023-10-13T09:20:40.672Z", "pushed_by": { "email": "null", "full_name": "null", "username": "elastic" } }, "id": "66b9aa00-94fa-11ea-9f74-e7e108796192", "owner": "cases", "settings": { "syncAlerts": true }, "severity": "low", "status": "open", "tags": [ "tag-1" ], "title": "Case title 1", "totalAlerts": 0, "totalComment": 0, "updated_at": "2023-10-13T09:48:33.043Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzU0OCwxXQ==" } ] }, "Cases_update_comment_request": { "summary": "Updates a comment of a case.", "value": { "comment": "An updated comment.", "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6", "owner": "cases", "type": "user", "version": "Wzk1LDFd" } }, "Cases_update_comment_response": { "summary": "The add comment to case API returns a JSON object that contains details about the case and its comments.", "value": { "assignees": [ ], "category": "null", "closed_at": "null", "closed_by": "null", "comments": [ { "comment": "An updated comment.", "created_at": "2023-10-24T00:37:10.832Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6", "owner": "cases", "pushed_at": "null", "pushed_by": "null", "type": "user", "updated_at": "2023-10-24T01:27:06.210Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzIwNjM3LDFd" } ], "connector": { "fields": "null", "id": "none", "name": "none", "type": ".none" }, "created_at": "2023-10-24T00:37:03.906Z", "created_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "customFields": [ { "key": "d312efda-ec2b-42ec-9e2c-84981795c581", "type": "text", "value": "My new field value" }, { "key": "fcc6840d-eb14-42df-8aaf-232201a705ec", "type": "toggle", "value": false } ], "description": "A case description.", "duration": "null", "external_service": "null", "id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6", "owner": "cases", "settings": { "syncAlerts": false }, "severity": "low", "status": "open", "tags": [ "tag 1" ], "title": "Case title 1", "totalAlerts": 0, "totalComment": 1, "updated_at": "2023-10-24T01:27:06.210Z", "updated_by": { "email": "null", "full_name": "null", "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", "username": "elastic" }, "version": "WzIwNjM2LDFd" } }, "Data_views_create_data_view_request": { "summary": "Create a data view with runtime fields.", "value": { "data_view": { "name": "My Logstash data view", "runtimeFieldMap": { "runtime_shape_name": { "script": { "source": "emit(doc['shape_name'].value)" }, "type": "keyword" } }, "title": "logstash-*" } } }, "Data_views_create_runtime_field_request": { "summary": "Create a runtime field.", "value": { "name": "runtimeFoo", "runtimeField": { "script": { "source": "emit(doc[\"foo\"].value)" }, "type": "long" } } }, "Data_views_get_data_view_response": { "summary": "The get data view API returns a JSON object that contains information about the data view.", "value": { "data_view": { "allowNoIndex": false, "fieldAttrs": { "products.manufacturer": { "count": 1 }, "products.price": { "count": 1 }, "products.product_name": { "count": 1 }, "total_quantity": { "count": 1 } }, "fieldFormats": { "products.base_price": { "id": "number", "params": { "pattern": "$0,0.00" } }, "products.base_unit_price": { "id": "number", "params": { "pattern": "$0,0.00" } }, "products.min_price": { "id": "number", "params": { "pattern": "$0,0.00" } }, "products.price": { "id": "number", "params": { "pattern": "$0,0.00" } }, "products.taxful_price": { "id": "number", "params": { "pattern": "$0,0.00" } }, "products.taxless_price": { "id": "number", "params": { "pattern": "$0,0.00" } }, "taxful_total_price": { "id": "number", "params": { "pattern": "$0,0.[00]" } }, "taxless_total_price": { "id": "number", "params": { "pattern": "$0,0.00" } } }, "fields": { "_id": { "aggregatable": false, "count": 0, "esTypes": [ "_id" ], "format": { "id": "string" }, "isMapped": true, "name": "_id", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "_index": { "aggregatable": true, "count": 0, "esTypes": [ "_index" ], "format": { "id": "string" }, "isMapped": true, "name": "_index", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "_score": { "aggregatable": false, "count": 0, "format": { "id": "number" }, "isMapped": true, "name": "_score", "readFromDocValues": false, "scripted": false, "searchable": false, "shortDotsEnable": false, "type": "number" }, "_source": { "aggregatable": false, "count": 0, "esTypes": [ "_source" ], "format": { "id": "_source" }, "isMapped": true, "name": "_source", "readFromDocValues": false, "scripted": false, "searchable": false, "shortDotsEnable": false, "type": "_source" }, "category": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "category", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "category.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "category.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "category" } }, "type": "string" }, "currency": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "currency", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "customer_birth_date": { "aggregatable": true, "count": 0, "esTypes": [ "date" ], "format": { "id": "date" }, "isMapped": true, "name": "customer_birth_date", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "date" }, "customer_first_name": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_first_name", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "customer_first_name.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_first_name.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "customer_first_name" } }, "type": "string" }, "customer_full_name": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_full_name", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "customer_full_name.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_full_name.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "customer_full_name" } }, "type": "string" }, "customer_gender": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_gender", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "customer_id": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_id", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "customer_last_name": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_last_name", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "customer_last_name.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_last_name.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "customer_last_name" } }, "type": "string" }, "customer_phone": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "customer_phone", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "day_of_week": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "day_of_week", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "day_of_week_i": { "aggregatable": true, "count": 0, "esTypes": [ "integer" ], "format": { "id": "number" }, "isMapped": true, "name": "day_of_week_i", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "email": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "email", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "event.dataset": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "event.dataset", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "geoip.city_name": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "geoip.city_name", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "geoip.continent_name": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "geoip.continent_name", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "geoip.country_iso_code": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "geoip.country_iso_code", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "geoip.location": { "aggregatable": true, "count": 0, "esTypes": [ "geo_point" ], "format": { "id": "geo_point", "params": { "transform": "wkt" } }, "isMapped": true, "name": "geoip.location", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "geo_point" }, "geoip.region_name": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "geoip.region_name", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "manufacturer": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "manufacturer", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "manufacturer.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "manufacturer.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "manufacturer" } }, "type": "string" }, "order_date": { "aggregatable": true, "count": 0, "esTypes": [ "date" ], "format": { "id": "date" }, "isMapped": true, "name": "order_date", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "date" }, "order_id": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "order_id", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "products._id": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "products._id", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "products._id.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "products._id.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "products._id" } }, "type": "string" }, "products.base_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "products.base_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.base_unit_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "products.base_unit_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.category": { "aggregatable": false, "count": 0, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "products.category", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "products.category.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "products.category.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "products.category" } }, "type": "string" }, "products.created_on": { "aggregatable": true, "count": 0, "esTypes": [ "date" ], "format": { "id": "date" }, "isMapped": true, "name": "products.created_on", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "date" }, "products.discount_amount": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number" }, "isMapped": true, "name": "products.discount_amount", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.discount_percentage": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number" }, "isMapped": true, "name": "products.discount_percentage", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.manufacturer": { "aggregatable": false, "count": 1, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "products.manufacturer", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "products.manufacturer.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "products.manufacturer.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "products.manufacturer" } }, "type": "string" }, "products.min_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "products.min_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.price": { "aggregatable": true, "count": 1, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "products.price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.product_id": { "aggregatable": true, "count": 0, "esTypes": [ "long" ], "format": { "id": "number" }, "isMapped": true, "name": "products.product_id", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.product_name": { "aggregatable": false, "count": 1, "esTypes": [ "text" ], "format": { "id": "string" }, "isMapped": true, "name": "products.product_name", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "products.product_name.keyword": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "products.product_name.keyword", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "subType": { "multi": { "parent": "products.product_name" } }, "type": "string" }, "products.quantity": { "aggregatable": true, "count": 0, "esTypes": [ "integer" ], "format": { "id": "number" }, "isMapped": true, "name": "products.quantity", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.sku": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "products.sku", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "products.tax_amount": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number" }, "isMapped": true, "name": "products.tax_amount", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.taxful_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "products.taxful_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.taxless_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "products.taxless_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "products.unit_discount_amount": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number" }, "isMapped": true, "name": "products.unit_discount_amount", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "sku": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "sku", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "taxful_total_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.[00]" } }, "isMapped": true, "name": "taxful_total_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "taxless_total_price": { "aggregatable": true, "count": 0, "esTypes": [ "half_float" ], "format": { "id": "number", "params": { "pattern": "$0,0.00" } }, "isMapped": true, "name": "taxless_total_price", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "total_quantity": { "aggregatable": true, "count": 1, "esTypes": [ "integer" ], "format": { "id": "number" }, "isMapped": true, "name": "total_quantity", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "total_unique_products": { "aggregatable": true, "count": 0, "esTypes": [ "integer" ], "format": { "id": "number" }, "isMapped": true, "name": "total_unique_products", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "type": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "type", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "user": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "user", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" } }, "id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f", "name": "Kibana Sample Data eCommerce", "namespaces": [ "default" ], "runtimeFieldMap": { }, "sourceFilters": [ ], "timeFieldName": "order_date", "title": "kibana_sample_data_ecommerce", "typeMeta": { }, "version": "WzUsMV0=" } } }, "Data_views_get_data_views_response": { "summary": "The get all data views API returns a list of data views.", "value": { "data_view": [ { "id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f", "name": "Kibana Sample Data eCommerce", "namespaces": [ "default" ], "title": "kibana_sample_data_ecommerce", "typeMeta": { } }, { "id": "d3d7af60-4c81-11e8-b3d7-01146121b73d", "name": "Kibana Sample Data Flights", "namespaces": [ "default" ], "title": "kibana_sample_data_flights" }, { "id": "90943e30-9a47-11e8-b64d-95841ca0b247", "name": "Kibana Sample Data Logs", "namespaces": [ "default" ], "title": "kibana_sample_data_logs" } ] } }, "Data_views_get_default_data_view_response": { "summary": "The get default data view API returns the default data view identifier.", "value": { "data_view_id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f" } }, "Data_views_get_runtime_field_response": { "summary": "The get runtime field API returns a JSON object that contains information about the runtime field (`hour_of_day`) and the data view (`d3d7af60-4c81-11e8-b3d7-01146121b73d`).", "value": { "data_view": { "allowNoIndex": false, "fieldAttrs": { }, "fieldFormats": { "AvgTicketPrice": { "id": "number", "params": { "pattern": "$0,0.[00]" } }, "hour_of_day": { "id": "number", "params": { "pattern": "00" } } }, "fields": { "_id": { "aggregatable": false, "count": 0, "esTypes": [ "_id" ], "format": { "id": "string" }, "isMapped": true, "name": "_id", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "_index": { "aggregatable": true, "count": 0, "esTypes": [ "_index" ], "format": { "id": "string" }, "isMapped": true, "name": "_index", "readFromDocValues": false, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "_score": { "aggregatable": false, "count": 0, "format": { "id": "number" }, "isMapped": true, "name": "_score", "readFromDocValues": false, "scripted": false, "searchable": false, "shortDotsEnable": false, "type": "number" }, "_source": { "aggregatable": false, "count": 0, "esTypes": [ "_source" ], "format": { "id": "_source" }, "isMapped": true, "name": "_source", "readFromDocValues": false, "scripted": false, "searchable": false, "shortDotsEnable": false, "type": "_source" }, "AvgTicketPrice": { "aggregatable": true, "count": 0, "esTypes": [ "float" ], "format": { "id": "number", "params": { "pattern": "$0,0.[00]" } }, "isMapped": true, "name": "AvgTicketPrice", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "Cancelled": { "aggregatable": true, "count": 0, "esTypes": [ "boolean" ], "format": { "id": "boolean" }, "isMapped": true, "name": "Cancelled", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "boolean" }, "Carrier": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "Carrier", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "dayOfWeek": { "aggregatable": true, "count": 0, "esTypes": [ "integer" ], "format": { "id": "number" }, "isMapped": true, "name": "dayOfWeek", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "Dest": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "Dest", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "DestAirportID": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "DestAirportID", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "DestCityName": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "DestCityName", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "DestCountry": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "DestCountry", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "DestLocation": { "aggregatable": true, "count": 0, "esTypes": [ "geo_point" ], "format": { "id": "geo_point", "params": { "transform": "wkt" } }, "isMapped": true, "name": "DestLocation", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "geo_point" }, "DestRegion": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "DestRegion", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "DestWeather": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "DestWeather", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "DistanceKilometers": { "aggregatable": true, "count": 0, "esTypes": [ "float" ], "format": { "id": "number" }, "isMapped": true, "name": "DistanceKilometers", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "DistanceMiles": { "aggregatable": true, "count": 0, "esTypes": [ "float" ], "format": { "id": "number" }, "isMapped": true, "name": "DistanceMiles", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "FlightDelay": { "aggregatable": true, "count": 0, "esTypes": [ "boolean" ], "format": { "id": "boolean" }, "isMapped": true, "name": "FlightDelay", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "boolean" }, "FlightDelayMin": { "aggregatable": true, "count": 0, "esTypes": [ "integer" ], "format": { "id": "number" }, "isMapped": true, "name": "FlightDelayMin", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "FlightDelayType": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "FlightDelayType", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "FlightNum": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "FlightNum", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "FlightTimeHour": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "FlightTimeHour", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "FlightTimeMin": { "aggregatable": true, "count": 0, "esTypes": [ "float" ], "format": { "id": "number" }, "isMapped": true, "name": "FlightTimeMin", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "hour_of_day": { "aggregatable": true, "count": 0, "esTypes": [ "long" ], "format": { "id": "number", "params": { "pattern": "00" } }, "name": "hour_of_day", "readFromDocValues": false, "runtimeField": { "script": { "source": "emit(doc['timestamp'].value.getHour());" }, "type": "long" }, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" }, "Origin": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "Origin", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "OriginAirportID": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "OriginAirportID", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "OriginCityName": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "OriginCityName", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "OriginCountry": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "OriginCountry", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "OriginLocation": { "aggregatable": true, "count": 0, "esTypes": [ "geo_point" ], "format": { "id": "geo_point", "params": { "transform": "wkt" } }, "isMapped": true, "name": "OriginLocation", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "geo_point" }, "OriginRegion": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "OriginRegion", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "OriginWeather": { "aggregatable": true, "count": 0, "esTypes": [ "keyword" ], "format": { "id": "string" }, "isMapped": true, "name": "OriginWeather", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "string" }, "timestamp": { "aggregatable": true, "count": 0, "esTypes": [ "date" ], "format": { "id": "date" }, "isMapped": true, "name": "timestamp", "readFromDocValues": true, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "date" } }, "id": "d3d7af60-4c81-11e8-b3d7-01146121b73d", "name": "Kibana Sample Data Flights", "runtimeFieldMap": { "hour_of_day": { "script": { "source": "emit(doc['timestamp'].value.getHour());" }, "type": "long" } }, "sourceFilters": [ ], "timeFieldName": "timestamp", "title": "kibana_sample_data_flights", "version": "WzM2LDJd" }, "fields": [ { "aggregatable": true, "count": 0, "esTypes": [ "long" ], "name": "hour_of_day", "readFromDocValues": false, "runtimeField": { "script": { "source": "emit(doc['timestamp'].value.getHour());" }, "type": "long" }, "scripted": false, "searchable": true, "shortDotsEnable": false, "type": "number" } ] } }, "Data_views_preview_swap_data_view_request": { "summary": "Preview swapping references from data view ID \"abcd-efg\" to \"xyz-123\".", "value": { "fromId": "abcd-efg", "toId": "xyz-123" } }, "Data_views_set_default_data_view_request": { "summary": "Set the default data view identifier.", "value": { "data_view_id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f", "force": true } }, "Data_views_swap_data_view_request": { "summary": "Swap references from data view ID \"abcd-efg\" to \"xyz-123\" and remove the data view that is no longer referenced.", "value": { "delete": true, "fromId": "abcd-efg", "toId": "xyz-123" } }, "Data_views_update_data_view_request": { "summary": "Update some properties for a data view.", "value": { "data_view": { "allowNoIndex": false, "name": "Kibana Sample Data eCommerce", "timeFieldName": "order_date", "title": "kibana_sample_data_ecommerce" }, "refresh_fields": true } }, "Data_views_update_field_metadata_request": { "summary": "Update metadata for multiple fields.", "value": { "fields": { "field1": { "count": 123, "customLabel": "Field 1 label" }, "field2": { "customDescription": "Field 2 description", "customLabel": "Field 2 label" } } } }, "Data_views_update_runtime_field_request": { "summary": "Update an existing runtime field on a data view.", "value": { "runtimeField": { "script": { "source": "emit(doc[\"bar\"].value)" } } } }, "Machine_learning_APIs_mlSyncExample": { "summary": "Two anomaly detection jobs required synchronization in this example.", "value": { "datafeedsAdded": { }, "datafeedsRemoved": { }, "savedObjectsCreated": { "anomaly-detector": { "myjob1": { "success": true }, "myjob2": { "success": true } } }, "savedObjectsDeleted": { } } }, "Saved_objects_export_objects_request": { "summary": "Export a specific saved object.", "value": { "excludeExportDetails": true, "includeReferencesDeep": false, "objects": [ { "id": "de71f4f0-1902-11e9-919b-ffe5949a18d2", "type": "map" } ] } }, "Saved_objects_export_objects_response": { "summary": "The export objects API response contains a JSON record for each exported object.", "value": { "attributes": { "description": "", "layerListJSON": "[{\"id\":\"0hmz5\",\"alpha\":1,\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"visible\":true,\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"minZoom\":0,\"maxZoom\":24},{\"id\":\"edh66\",\"label\":\"Total Requests by Destination\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.5,\"sourceDescriptor\":{\"type\":\"EMS_FILE\",\"id\":\"world_countries\",\"tooltipProperties\":[\"name\",\"iso2\"]},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"__kbnjoin__count__673ff994-fc75-4c67-909b-69fcb0e1060e\",\"origin\":\"join\"},\"color\":\"Greys\",\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":10}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\",\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"type\":\"ES_TERM_SOURCE\",\"id\":\"673ff994-fc75-4c67-909b-69fcb0e1060e\",\"indexPatternTitle\":\"kibana_sample_data_logs\",\"term\":\"geo.dest\",\"indexPatternRefName\":\"layer_1_join_0_index_pattern\",\"metrics\":[{\"type\":\"count\",\"label\":\"web logs count\"}],\"applyGlobalQuery\":true}}]},{\"id\":\"gaxya\",\"label\":\"Actual Requests\",\"minZoom\":9,\"maxZoom\":24,\"alpha\":1,\"sourceDescriptor\":{\"id\":\"b7486535-171b-4d3b-bb2e-33c1a0a2854c\",\"type\":\"ES_SEARCH\",\"geoField\":\"geo.coordinates\",\"limit\":2048,\"filterByMapBounds\":true,\"tooltipProperties\":[\"clientip\",\"timestamp\",\"host\",\"request\",\"response\",\"machine.os\",\"agent\",\"bytes\"],\"indexPatternRefName\":\"layer_2_source_index_pattern\",\"applyGlobalQuery\":true,\"scalingType\":\"LIMIT\"},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#2200ff\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"bytes\",\"origin\":\"source\"},\"minSize\":1,\"maxSize\":23,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\"},{\"id\":\"tfi3f\",\"label\":\"Total Requests and Bytes\",\"minZoom\":0,\"maxZoom\":9,\"alpha\":1,\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"resolution\":\"COARSE\",\"id\":\"8aaa65b5-a4e9-448b-9560-c98cb1c5ac5b\",\"geoField\":\"geo.coordinates\",\"requestType\":\"point\",\"metrics\":[{\"type\":\"count\",\"label\":\"web logs count\"},{\"type\":\"sum\",\"field\":\"bytes\"}],\"indexPatternRefName\":\"layer_3_source_index_pattern\",\"applyGlobalQuery\":true},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"color\":\"Blues\",\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#cccccc\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"sum_of_bytes\",\"origin\":\"source\"},\"minSize\":7,\"maxSize\":25,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"labelSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"minSize\":12,\"maxSize\":24,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\"}]", "mapStateJSON": "{\"zoom\":3.64,\"center\":{\"lon\":-88.92107,\"lat\":42.16337},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"settings\":{\"autoFitToDataBounds\":false}}", "title": "[Logs] Total Requests and Bytes", "uiStateJSON": "{\"isDarkMode\":false}" }, "coreMigrationVersion": "8.8.0", "created_at": "2023-08-23T20:03:32.204Z", "id": "de71f4f0-1902-11e9-919b-ffe5949a18d2", "managed": false, "references": [ { "id": "90943e30-9a47-11e8-b64d-95841ca0b247", "name": "layer_1_join_0_index_pattern", "type": "index-pattern" }, { "id": "90943e30-9a47-11e8-b64d-95841ca0b247", "name": "layer_2_source_index_pattern", "type": "index-pattern" }, { "id": "90943e30-9a47-11e8-b64d-95841ca0b247", "name": "layer_3_source_index_pattern", "type": "index-pattern" } ], "type": "map", "typeMigrationVersion": "8.4.0", "updated_at": "2023-08-23T20:03:32.204Z", "version": "WzEzLDFd" } }, "Saved_objects_import_objects_request": { "value": { "file": "file.ndjson" } }, "Saved_objects_import_objects_response": { "summary": "The import objects API response indicates a successful import and the objects are created. Since these objects are created as new copies, each entry in the successResults array includes a destinationId attribute.", "value": { "success": true, "successCount": 1, "successResults": [ { "destinationId": "82d2760c-468f-49cf-83aa-b9a35b6a8943", "id": "90943e30-9a47-11e8-b64d-95841ca0b247", "managed": false, "meta": { "icon": "indexPatternApp", "title": "Kibana Sample Data Logs" }, "type": "index-pattern" } ] } }, "Saved_objects_key_rotation_response": { "summary": "Encryption key rotation using default parameters.", "value": { "failed": 0, "successful": 300, "total": 1000 } }, "Saved_objects_resolve_missing_reference_request": { "value": { "file": "file.ndjson", "retries": [ { "id": "my-pattern", "overwrite": true, "type": "index-pattern" }, { "destinationId": "another-vis", "id": "my-vis", "overwrite": true, "type": "visualization" }, { "destinationId": "yet-another-canvas", "id": "my-canvas", "overwrite": true, "type": "canvas" }, { "id": "my-dashboard", "type": "dashboard" } ] } }, "Saved_objects_resolve_missing_reference_response": { "summary": "Resolve missing reference errors.", "value": { "success": true, "successCount": 3, "successResults": [ { "id": "my-vis", "meta": { "icon": "visualizeApp", "title": "Look at my visualization" }, "type": "visualization" }, { "id": "my-search", "meta": { "icon": "searchApp", "title": "Look at my search" }, "type": "search" }, { "id": "my-dashboard", "meta": { "icon": "dashboardApp", "title": "Look at my dashboard" }, "type": "dashboard" } ] } }, "Task_manager_health_APIs_health_200response": { "description": "A successful response from `GET api/task_manager/_health`.", "value": "{\n \"id\": \"330bbc6a-56cd-44d5-88e3-e3229f14d619\",\n \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n \"status\": \"OK\",\n \"last_update\": \"2025-03-21T21:30:04.455Z\",\n \"stats\": {\n \"configuration\": {\n \"timestamp\": \"2025-03-21T21:26:10.002Z\",\n \"value\": {\n \"request_capacity\": 1000,\n \"monitored_aggregated_stats_refresh_rate\": 60000,\n \"monitored_stats_running_average_window\": 50,\n \"monitored_task_execution_thresholds\": {\n \"custom\": {},\n \"default\": {\n \"error_threshold\": 90,\n \"warn_threshold\": 80\n }\n },\n \"claim_strategy\": \"mget\",\n \"poll_interval\": 500,\n \"capacity\": {\n \"config\": 10,\n \"as_workers\": 10,\n \"as_cost\": 20\n }\n },\n \"status\": \"OK\"\n },\n \"runtime\": {\n \"timestamp\": \"2025-03-21T21:30:04.455Z\",\n \"value\": {\n \"polling\": {\n \"last_successful_poll\": \"2025-03-21T21:30:04.455Z\",\n \"last_polling_delay\": \"2025-03-21T21:26:10.001Z\",\n \"claim_duration\": {\n \"p50\": 17,\n \"p90\": 22,\n \"p95\": 25,\n \"p99\": 27\n },\n \"duration\": {\n \"p50\": 19,\n \"p90\": 25.5,\n \"p95\": 28,\n \"p99\": 28\n },\n \"claim_conflicts\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"claim_mismatches\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"claim_stale_tasks\": {\n \"p50\": 0,\n \"p90\": 0,\n \"p95\": 0,\n \"p99\": 0\n },\n \"result_frequency_percent_as_number\": {\n \"Failed\": 0,\n \"NoAvailableWorkers\": 0,\n \"NoTasksClaimed\": 100,\n \"RanOutOfCapacity\": 0,\n \"RunningAtCapacity\": 0,\n \"PoolFilled\": 0\n },\n \"persistence\": {\n \"recurring\": 88,\n \"non_recurring\": 12\n }\n },\n \"drift\": {\n \"p50\": 2089,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"drift_by_type\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"p50\": 2082,\n \"p90\": 2082,\n \"p95\": 2082,\n \"p99\": 2082\n },\n \"fleet:check-deleted-files-task\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"osquery:telemetry-saved-queries\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"p50\": 2089,\n \"p90\": 2089,\n \"p95\": 2089,\n \"p99\": 2089\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"p50\": 336.5,\n \"p90\": 2089,\n \"p95\": 2089,\n \"p99\": 2089\n },\n \"alerts_invalidate_api_keys\": {\n \"p50\": 2086,\n \"p90\": 2086,\n \"p95\": 2086,\n \"p99\": 2086\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"p50\": 2080,\n \"p90\": 2080,\n \"p95\": 2080,\n \"p99\": 2080\n },\n \"alerting_health_check\": {\n \"p50\": 2086,\n \"p90\": 2086,\n \"p95\": 2086,\n \"p99\": 2086\n },\n \"Fleet-Usage-Sender\": {\n \"p50\": 2079,\n \"p90\": 2079,\n \"p95\": 2079,\n \"p99\": 2079\n },\n \"security:endpoint-diagnostics\": {\n \"p50\": 2525,\n \"p90\": 2525,\n \"p95\": 2525,\n \"p99\": 2525\n },\n \"security:telemetry-lists\": {\n \"p50\": 2525,\n \"p90\": 2525,\n \"p95\": 2525,\n \"p99\": 2525\n },\n \"security:telemetry-timelines\": {\n \"p50\": 2526,\n \"p90\": 2526,\n \"p95\": 2526,\n \"p99\": 2526\n },\n \"cases-telemetry-task\": {\n \"p50\": 2083,\n \"p90\": 2083,\n \"p95\": 2083,\n \"p99\": 2083\n },\n \"osquery:telemetry-packs\": {\n \"p50\": 2530,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"Fleet-Metrics-Task\": {\n \"p50\": 133.5,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"p50\": 2530,\n \"p90\": 2530,\n \"p95\": 2530,\n \"p99\": 2530\n },\n \"osquery:telemetry-configs\": {\n \"p50\": 2529,\n \"p90\": 2529,\n \"p95\": 2529,\n \"p99\": 2529\n },\n \"endpoint:complete-external-response-actions\": {\n \"p50\": 519,\n \"p90\": 2526,\n \"p95\": 2526,\n \"p99\": 2526\n },\n \"security:telemetry-detection-rules\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:endpoint-meta-telemetry\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-filterlist-artifact\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:telemetry-configuration\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"security:indices-metadata-telemetry\": {\n \"p50\": 3037,\n \"p90\": 3037,\n \"p95\": 3037,\n \"p99\": 3037\n },\n \"Fleet-Usage-Logger\": {\n \"p50\": 2190,\n \"p90\": 2190,\n \"p95\": 2190,\n \"p99\": 2190\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"p50\": 2189,\n \"p90\": 2189,\n \"p95\": 2189,\n \"p99\": 2189\n },\n \"dashboard_telemetry\": {\n \"p50\": 2452,\n \"p90\": 2452,\n \"p95\": 2452,\n \"p99\": 2452\n },\n \"session_cleanup\": {\n \"p50\": 2569,\n \"p90\": 2569,\n \"p95\": 2569,\n \"p99\": 2569\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"p50\": 2452,\n \"p90\": 2452,\n \"p95\": 2452,\n \"p99\": 2452\n },\n \"apm-telemetry-task\": {\n \"p50\": 2591,\n \"p90\": 2591,\n \"p95\": 2591,\n \"p99\": 2591\n },\n \"ML:saved-objects-sync\": {\n \"p50\": 2475,\n \"p90\": 2475,\n \"p95\": 2475,\n \"p99\": 2475\n },\n \"apm-source-map-migration-task\": {\n \"p50\": 1603.5,\n \"p90\": 2987,\n \"p95\": 2987,\n \"p99\": 2987\n },\n \"actions_telemetry\": {\n \"p50\": 771,\n \"p90\": 771,\n \"p95\": 771,\n \"p99\": 771\n },\n \"alerting_telemetry\": {\n \"p50\": 768,\n \"p90\": 768,\n \"p95\": 768,\n \"p99\": 768\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"p50\": 834,\n \"p90\": 834,\n \"p95\": 834,\n \"p99\": 834\n },\n \"endpoint:user-artifact-packager\": {\n \"p50\": 529.5,\n \"p90\": 835,\n \"p95\": 835,\n \"p99\": 835\n },\n \"fleet:bump_agent_policies\": {\n \"p50\": 361,\n \"p90\": 361,\n \"p95\": 361,\n \"p99\": 361\n }\n },\n \"load\": {\n \"p50\": 10,\n \"p90\": 100,\n \"p95\": 100,\n \"p99\": 100\n },\n \"execution\": {\n \"duration\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"p50\": 24,\n \"p90\": 24,\n \"p95\": 24,\n \"p99\": 24\n },\n \"fleet:check-deleted-files-task\": {\n \"p50\": 24,\n \"p90\": 24,\n \"p95\": 24,\n \"p99\": 24\n },\n \"osquery:telemetry-saved-queries\": {\n \"p50\": 25,\n \"p90\": 25,\n \"p95\": 25,\n \"p99\": 25\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"p50\": 28,\n \"p90\": 28,\n \"p95\": 28,\n \"p99\": 28\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"p50\": 7.5,\n \"p90\": 29,\n \"p95\": 29,\n \"p99\": 29\n },\n \"alerts_invalidate_api_keys\": {\n \"p50\": 34,\n \"p90\": 34,\n \"p95\": 34,\n \"p99\": 34\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"p50\": 39,\n \"p90\": 39,\n \"p95\": 39,\n \"p99\": 39\n },\n \"alerting_health_check\": {\n \"p50\": 42,\n \"p90\": 42,\n \"p95\": 42,\n \"p99\": 42\n },\n \"Fleet-Usage-Sender\": {\n \"p50\": 78,\n \"p90\": 78,\n \"p95\": 78,\n \"p99\": 78\n },\n \"security:endpoint-diagnostics\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-lists\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-timelines\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"cases-telemetry-task\": {\n \"p50\": 458,\n \"p90\": 458,\n \"p95\": 458,\n \"p99\": 458\n },\n \"osquery:telemetry-packs\": {\n \"p50\": 10,\n \"p90\": 10,\n \"p95\": 10,\n \"p99\": 10\n },\n \"Fleet-Metrics-Task\": {\n \"p50\": 5,\n \"p90\": 10,\n \"p95\": 10,\n \"p99\": 10\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"p50\": 11,\n \"p90\": 11,\n \"p95\": 11,\n \"p99\": 11\n },\n \"osquery:telemetry-configs\": {\n \"p50\": 12,\n \"p90\": 12,\n \"p95\": 12,\n \"p99\": 12\n },\n \"endpoint:complete-external-response-actions\": {\n \"p50\": 7,\n \"p90\": 11,\n \"p95\": 11,\n \"p99\": 11\n },\n \"security:telemetry-detection-rules\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:endpoint-meta-telemetry\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"security:telemetry-filterlist-artifact\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:telemetry-configuration\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"security:indices-metadata-telemetry\": {\n \"p50\": 5,\n \"p90\": 5,\n \"p95\": 5,\n \"p99\": 5\n },\n \"Fleet-Usage-Logger\": {\n \"p50\": 18,\n \"p90\": 18,\n \"p95\": 18,\n \"p99\": 18\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"p50\": 8,\n \"p90\": 8,\n \"p95\": 8,\n \"p99\": 8\n },\n \"dashboard_telemetry\": {\n \"p50\": 12,\n \"p90\": 12,\n \"p95\": 12,\n \"p99\": 12\n },\n \"session_cleanup\": {\n \"p50\": 58,\n \"p90\": 58,\n \"p95\": 58,\n \"p99\": 58\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"p50\": 147,\n \"p90\": 147,\n \"p95\": 147,\n \"p99\": 147\n },\n \"apm-telemetry-task\": {\n \"p50\": 543,\n \"p90\": 543,\n \"p95\": 543,\n \"p99\": 543\n },\n \"ML:saved-objects-sync\": {\n \"p50\": 544,\n \"p90\": 544,\n \"p95\": 544,\n \"p99\": 544\n },\n \"apm-source-map-migration-task\": {\n \"p50\": 1649,\n \"p90\": 3282,\n \"p95\": 3282,\n \"p99\": 3282\n },\n \"actions_telemetry\": {\n \"p50\": 19,\n \"p90\": 19,\n \"p95\": 19,\n \"p99\": 19\n },\n \"alerting_telemetry\": {\n \"p50\": 64,\n \"p90\": 64,\n \"p95\": 64,\n \"p99\": 64\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"p50\": 6,\n \"p90\": 6,\n \"p95\": 6,\n \"p99\": 6\n },\n \"endpoint:user-artifact-packager\": {\n \"p50\": 10,\n \"p90\": 13,\n \"p95\": 13,\n \"p99\": 13\n },\n \"fleet:bump_agent_policies\": {\n \"p50\": 9,\n \"p90\": 9,\n \"p95\": 9,\n \"p99\": 9\n }\n },\n \"duration_by_persistence\": {\n \"recurring\": {\n \"p50\": 9,\n \"p90\": 63.39999999999999,\n \"p95\": 474.99999999999966,\n \"p99\": 544\n },\n \"non_recurring\": {\n \"p50\": 14,\n \"p90\": 2968.500000000001,\n \"p95\": 3282,\n \"p99\": 3282\n }\n },\n \"persistence\": {\n \"recurring\": 88,\n \"non_recurring\": 12\n },\n \"result_frequency_percent_as_number\": {\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:check-deleted-files-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-saved-queries\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerts_invalidate_api_keys\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerting_health_check\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Usage-Sender\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:endpoint-diagnostics\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-lists\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-timelines\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"cases-telemetry-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-packs\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Metrics-Task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"osquery:telemetry-configs\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:complete-external-response-actions\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-detection-rules\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:endpoint-meta-telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-filterlist-artifact\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:telemetry-configuration\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"security:indices-metadata-telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"Fleet-Usage-Logger\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"obs-ai-assistant:knowledge-base-migration\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"dashboard_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"session_cleanup\": {\n \"Success\": 0,\n \"RetryScheduled\": 100,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"ProductDocBase:EnsureUpToDate\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"apm-telemetry-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"ML:saved-objects-sync\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"apm-source-map-migration-task\": {\n \"Success\": 50,\n \"RetryScheduled\": 50,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"actions_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"alerting_telemetry\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"endpoint:user-artifact-packager\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n },\n \"fleet:bump_agent_policies\": {\n \"Success\": 100,\n \"RetryScheduled\": 0,\n \"Failed\": 0,\n \"status\": \"OK\"\n }\n }\n }\n },\n \"status\": \"OK\"\n },\n \"workload\": {\n \"timestamp\": \"2025-03-21T21:29:10.367Z\",\n \"value\": {\n \"count\": 35,\n \"cost\": 70,\n \"task_types\": {\n \"Fleet-Metrics-Task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"Fleet-Usage-Logger\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"Fleet-Usage-Sender\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"ML:saved-objects-sync\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"actions_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerting_health_check\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerting_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"alerts_invalidate_api_keys\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"apm-telemetry-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"cases-telemetry-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"dashboard_telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:complete-external-response-actions\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:metadata-check-transforms-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"endpoint:user-artifact-packager\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:check-deleted-files-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:delete-unenrolled-agents-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"fleet:unenroll-inactive-agents-task\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-configs\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-packs\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"osquery:telemetry-saved-queries\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:endpoint-diagnostics\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:endpoint-meta-telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:indices-metadata-telemetry\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-configuration\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-detection-rules\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-diagnostic-timelines\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-filterlist-artifact\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-lists\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-prebuilt-rule-alerts\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"security:telemetry-timelines\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"session_cleanup\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"task_manager:delete_inactive_background_task_nodes\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n },\n \"task_manager:mark_removed_tasks_as_unrecognized\": {\n \"count\": 1,\n \"cost\": 2,\n \"status\": {\n \"idle\": 1\n }\n }\n },\n \"non_recurring\": 1,\n \"non_recurring_cost\": 2,\n \"schedule\": [\n [\n \"1m\",\n 2\n ],\n [\n \"60s\",\n 2\n ],\n [\n \"5m\",\n 2\n ],\n [\n \"10m\",\n 1\n ],\n [\n \"15m\",\n 1\n ],\n [\n \"45m\",\n 1\n ],\n [\n \"1h\",\n 9\n ],\n [\n \"3600s\",\n 1\n ],\n [\n \"60m\",\n 1\n ],\n [\n \"2h\",\n 1\n ],\n [\n \"720m\",\n 2\n ],\n [\n \"24h\",\n 7\n ],\n [\n \"1d\",\n 3\n ],\n [\n \"1440m\",\n 1\n ]\n ],\n \"overdue\": 0,\n \"overdue_cost\": 0,\n \"overdue_non_recurring\": 0,\n \"estimated_schedule_density\": [\n 0,\n 0,\n 0,\n 1,\n 1,\n 1,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 1,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0,\n 0\n ],\n \"capacity_requirements\": {\n \"per_minute\": 4,\n \"per_hour\": 46,\n \"per_day\": 27\n }\n },\n \"status\": \"OK\"\n },\n \"capacity_estimation\": {\n \"status\": \"OK\",\n \"reason\": \"Task Manager is healthy, the assumedRequiredThroughputPerMinutePerKibana (148.78541666666666) < capacityPerMinutePerKibana (1200)\",\n \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n \"value\": {\n \"observed\": {\n \"observed_kibana_instances\": 1,\n \"max_throughput_per_minute_per_kibana\": 1200,\n \"max_throughput_per_minute\": 1200,\n \"minutes_to_drain_overdue\": 0,\n \"avg_recurring_required_throughput_per_minute\": 5,\n \"avg_recurring_required_throughput_per_minute_per_kibana\": 5,\n \"avg_required_throughput_per_minute\": 149,\n \"avg_required_throughput_per_minute_per_kibana\": 149\n },\n \"proposed\": {\n \"provisioned_kibana\": 2,\n \"min_required_kibana\": 1,\n \"avg_recurring_required_throughput_per_minute_per_kibana\": 3,\n \"avg_required_throughput_per_minute_per_kibana\": 75\n }\n }\n }\n }\n}" }, "get_connector_types_generativeai_response": { "summary": "A list of connector types for the `generativeAI` feature.", "value": [ { "id": ".gen-ai", "name": "OpenAI", "enabled": true, "enabled_in_config": true, "enabled_in_license": true, "minimum_license_required": "enterprise", "supported_feature_ids": [ "generativeAIForSecurity", "generativeAIForObservability", "generativeAIForSearchPlayground" ], "is_system_action_type": false }, { "id": ".bedrock", "name": "AWS Bedrock", "enabled": true, "enabled_in_config": true, "enabled_in_license": true, "minimum_license_required": "enterprise", "supported_feature_ids": [ "generativeAIForSecurity", "generativeAIForObservability", "generativeAIForSearchPlayground" ], "is_system_action_type": false }, { "id": ".gemini", "name": "Google Gemini", "enabled": true, "enabled_in_config": true, "enabled_in_license": true, "minimum_license_required": "enterprise", "supported_feature_ids": [ "generativeAIForSecurity" ], "is_system_action_type": false } ] }, "get_connector_response": { "summary": "Get connector details.", "value": { "id": "df770e30-8b8b-11ed-a780-3b746c987a81", "name": "my_server_log_connector", "config": { }, "connector_type_id": ".server-log", "is_preconfigured": false, "is_deprecated": false, "is_missing_secrets": false, "is_system_action": false } }, "update_index_connector_request": { "summary": "Update an index connector.", "value": { "name": "updated-connector", "config": { "index": "updated-index" } } }, "create_email_connector_request": { "summary": "Create an email connector.", "value": { "name": "email-connector-1", "connector_type_id": ".email", "config": { "from": "tester@example.com", "hasAuth": true, "host": "https://example.com", "port": 1025, "secure": false, "service": "other" }, "secrets": { "user": "username", "password": "password" } } }, "create_index_connector_request": { "summary": "Create an index connector.", "value": { "name": "my-connector", "connector_type_id": ".index", "config": { "index": "test-index" } } }, "create_webhook_connector_request": { "summary": "Create a webhook connector with SSL authentication.", "value": { "name": "my-webhook-connector", "connector_type_id": ".webhook", "config": { "method": "post", "url": "https://example.com", "authType": "webhook-authentication-ssl", "certType": "ssl-crt-key" }, "secrets": { "crt": "QmFnIEF0dH...", "key": "LS0tLS1CRUdJ...", "password": "my-passphrase" } } }, "create_xmatters_connector_request": { "summary": "Create an xMatters connector with URL authentication.", "value": { "name": "my-xmatters-connector", "connector_type_id": ".xmatters", "config": { "usesBasic": false }, "secrets": { "secretsUrl": "https://example.com?apiKey=xxxxx" } } }, "create_email_connector_response": { "summary": "A new email connector.", "value": { "id": "90a82c60-478f-11ee-a343-f98a117c727f", "connector_type_id": ".email", "name": "email-connector-1", "config": { "from": "tester@example.com", "service": "other", "host": "https://example.com", "port": 1025, "secure": false, "hasAuth": true, "tenantId": "null", "clientId": "null", "oauthTokenUrl": "null" }, "is_preconfigured": false, "is_deprecated": false, "is_missing_secrets": false, "is_system_action": false } }, "create_index_connector_response": { "summary": "A new index connector.", "value": { "id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad", "connector_type_id": ".index", "name": "my-connector", "config": { "index": "test-index", "refresh": false, "executionTimeField": "null" }, "is_preconfigured": false, "is_deprecated": false, "is_missing_secrets": false, "is_system_action": false } }, "create_webhook_connector_response": { "summary": "A new webhook connector.", "value": { "id": "900eb010-3b9d-11ee-a642-8ffbb94e38bd", "name": "my-webhook-connector", "config": { "method": "post", "url": "https://example.com", "authType": "webhook-authentication-ssl", "certType": "ssl-crt-key", "verificationMode": "full", "headers": "null", "hasAuth": true }, "connector_type_id": ".webhook", "is_preconfigured": false, "is_deprecated": false, "is_missing_secrets": false, "is_system_action": false } }, "run_index_connector_request": { "summary": "Run an index connector.", "value": { "params": { "documents": [ { "id": "my_doc_id", "name": "my_doc_name", "message": "hello, world" } ] } } }, "run_jira_connector_request": { "summary": "Run a Jira connector to retrieve the list of issue types.", "value": { "params": { "subAction": "issueTypes" } } }, "run_servicenow_itom_connector_request": { "summary": "Run a ServiceNow ITOM connector to retrieve the list of choices.", "value": { "params": { "subAction": "getChoices", "subActionParams": { "fields": [ "severity", "urgency" ] } } } }, "run_slack_api_connector_request": { "summary": "Run a Slack connector that uses the web API method to post a message on a channel.", "value": { "params": { "subAction": "postMessage", "subActionParams": { "channelIds": [ "C123ABC456" ], "text": "A test message." } } } }, "run_swimlane_connector_request": { "summary": "Run a Swimlane connector to create an incident.", "value": { "params": { "subAction": "pushToService", "subActionParams": { "comments": [ { "commentId": 1, "comment": "A comment about the incident." } ], "incident": { "caseId": "1000", "caseName": "Case name", "description": "Description of the incident." } } } } }, "run_index_connector_response": { "summary": "Response from running an index connector.", "value": { "connector_id": "fd38c600-96a5-11ed-bb79-353b74189cba", "data": { "errors": false, "items": [ { "create": { "_id": "4JtvwYUBrcyxt2NnfW3y", "_index": "my-index", "_primary_term": 1, "_seq_no": 0, "_shards": { "failed": 0, "successful": 1, "total": 2 }, "_version": 1, "result": "created", "status": 201 } } ], "took": 135 }, "status": "ok" } }, "run_jira_connector_response": { "summary": "Response from retrieving the list of issue types for a Jira connector.", "value": { "connector_id": "b3aad810-edbe-11ec-82d1-11348ecbf4a6", "data": [ { "id": 10024, "name": "Improvement" }, { "id": 10006, "name": "Task" }, { "id": 10007, "name": "Sub-task" }, { "id": 10025, "name": "New Feature" }, { "id": 10023, "name": "Bug" }, { "id": 10000, "name": "Epic" } ], "status": "ok" } }, "run_server_log_connector_response": { "summary": "Response from running a server log connector.", "value": { "connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907", "status": "ok" } }, "run_servicenow_itom_connector_response": { "summary": "Response from retrieving the list of choices for a ServiceNow ITOM connector.", "value": { "connector_id": "9d9be270-2fd2-11ed-b0e0-87533c532698", "data": [ { "dependent_value": "", "element": "severity", "label": "Critical", "value": 1 }, { "dependent_value": "", "element": "severity", "label": "Major", "value": 2 }, { "dependent_value": "", "element": "severity", "label": "Minor", "value": 3 }, { "dependent_value": "", "element": "severity", "label": "Warning", "value": 4 }, { "dependent_value": "", "element": "severity", "label": "OK", "value": 5 }, { "dependent_value": "", "element": "severity", "label": "Clear", "value": 0 }, { "dependent_value": "", "element": "urgency", "label": "1 - High", "value": 1 }, { "dependent_value": "", "element": "urgency", "label": "2 - Medium", "value": 2 }, { "dependent_value": "", "element": "urgency", "label": "3 - Low", "value": 3 } ], "status": "ok" } }, "run_slack_api_connector_response": { "summary": "Response from posting a message with a Slack connector.", "value": { "status": "ok", "data": { "ok": true, "channel": "C123ABC456", "ts": "1234567890.123456", "message": { "bot_id": "B12BCDEFGHI", "type": "message", "text": "A test message", "user": "U12A345BC6D", "ts": "1234567890.123456", "app_id": "A01BC2D34EF", "blocks": [ { "type": "rich_text", "block_id": "/NXe", "elements": [ { "type": "rich_text_section", "elements": [ { "type": "text", "text": "A test message." } ] } ] } ], "team": "T01ABCDE2F", "bot_profile": { "id": "B12BCDEFGHI", "app_id": "A01BC2D34EF", "name": "test", "icons": { "image_36": "https://a.slack-edge.com/80588/img/plugins/app/bot_36.png" }, "deleted": false, "updated": 1672169705, "team_id": "T01ABCDE2F" } } }, "connector_id": ".slack_api" } }, "run_swimlane_connector_response": { "summary": "Response from creating a Swimlane incident.", "value": { "connector_id": "a4746470-2f94-11ed-b0e0-87533c532698", "data": { "id": "aKPmBHWzmdRQtx6Mx", "title": "TEST-457", "url": "https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx", "pushedDate": "2022-09-08T16:52:27.866Z", "comments": [ { "commentId": 1, "pushedDate": "2022-09-08T16:52:27.865Z" } ] }, "status": "ok" } }, "get_connectors_response": { "summary": "A list of connectors", "value": [ { "id": "preconfigured-email-connector", "name": "my-preconfigured-email-notification", "connector_type_id": ".email", "is_preconfigured": true, "is_deprecated": false, "referenced_by_count": 0, "is_system_action": false }, { "id": "e07d0c80-8b8b-11ed-a780-3b746c987a81", "name": "my-index-connector", "config": { "index": "test-index", "refresh": false, "executionTimeField": "null" }, "connector_type_id": ".index", "is_preconfigured": false, "is_deprecated": false, "referenced_by_count": 2, "is_missing_secrets": false, "is_system_action": false } ] }, "update_rule_request": { "summary": "Index threshold rule", "description": "Update an index threshold rule that uses a server log connector to send notifications when the threshold is met.", "value": { "actions": [ { "frequency": { "summary": false, "notify_when": "onActionGroupChange" }, "group": "threshold met", "id": "96b668d0-a1b6-11ed-afdf-d39a49596974", "params": { "level": "info", "message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}" } } ], "params": { "aggField": "sheet.version", "aggType": "avg", "index": [ ".updated-index" ], "groupBy": "top", "termField": "name.keyword", "termSize": 6, "threshold": [ 1000 ], "thresholdComparator": ">", "timeField": "@timestamp", "timeWindowSize": 5, "timeWindowUnit": "m" }, "name": "new name", "schedule": { "interval": "1m" }, "tags": [ ] } }, "update_rule_response": { "summary": "Index threshold rule", "description": "The response for successfully updating an index threshold rule.", "value": { "id": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74", "consumer": "alerts", "tags": [ ], "name": "new name", "enabled": true, "throttle": "null", "revision": 1, "running": false, "schedule": { "interval": "1m" }, "params": { "index": [ ".updated-index" ], "timeField": "@timestamp", "groupBy": "top", "aggType": "avg", "timeWindowSize": 5, "timeWindowUnit": "m", "thresholdComparator": ">", "threshold": [ 1000 ], "aggField": "sheet.version", "termField": "name.keyword", "termSize": 6 }, "api_key_owner": "elastic", "created_by": "elastic", "updated_by": "elastic", "rule_type_id": ".index-threshold", "scheduled_task_id": "4c5eda00-e74f-11ec-b72f-5b18752ff9ea", "created_at": "2024-03-26T23:13:20.985Z", "updated_at": "2024-03-26T23:22:59.949Z", "mute_all": false, "muted_alert_ids": [ ], "execution_status": { "status": "ok", "last_execution_date": "2024-03-26T23:22:51.390Z", "last_duration": 52 }, "actions": [ { "group": "threshold met", "params": { "level": "info", "message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}" }, "id": "96b668d0-a1b6-11ed-afdf-d39a49596974", "uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d", "connector_type_id": ".server-log", "frequency": { "summary": false, "throttle": "null", "notify_when": "onActionGroupChange" } } ], "last_run": { "alerts_count": { "new": 0, "ignored": 0, "recovered": 0, "active": 0 }, "outcome_msg": "null", "warning": "null", "outcome": "succeeded" }, "next_run": "2024-03-26T23:23:51.316Z", "api_key_created_by_user": false } }, "create_es_query_esql_rule_request": { "summary": "Elasticsearch query rule (ES|QL)", "description": "Create an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL) to define its query and a server log connector to send notifications.\n", "value": { "name": "my Elasticsearch query ESQL rule", "params": { "searchType": "esqlQuery", "esqlQuery": { "esql": "FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \"GB\" | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | SORT sumbytes desc | LIMIT 10" }, "timeField": "@timestamp", "timeWindowSize": 1, "timeWindowUnit": "d", "size": 0, "thresholdComparator": ">", "threshold": [ 0 ] }, "consumer": "stackAlerts", "rule_type_id": ".es-query", "schedule": { "interval": "1d" }, "actions": [ { "group": "query matched", "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945", "params": { "level": "info", "message": "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}" }, "frequency": { "summary": false, "notify_when": "onActiveAlert" } } ] } }, "create_es_query_rule_request": { "summary": "Elasticsearch query rule (DSL)", "description": "Create an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL) to define its query and a server log connector to send notifications.\n", "value": { "actions": [ { "group": "query matched", "params": { "level": "info", "message": "The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts." }, "id": "fdbece50-406c-11ee-850e-c71febc4ca7f", "frequency": { "throttle": "1d", "summary": true, "notify_when": "onThrottleInterval" } }, { "group": "recovered", "params": { "level": "info", "message": "Recovered" }, "id": "fdbece50-406c-11ee-850e-c71febc4ca7f", "frequency": { "summary": false, "notify_when": "onActionGroupChange" } } ], "consumer": "alerts", "name": "my Elasticsearch query rule", "params": { "esQuery": "\"\"\"{\"query\":{\"match_all\" : {}}}\"\"\"", "index": [ "kibana_sample_data_logs" ], "size": 100, "threshold": [ 100 ], "thresholdComparator": ">", "timeField": "@timestamp", "timeWindowSize": 1, "timeWindowUnit": "d" }, "rule_type_id": ".es-query", "schedule": { "interval": "1d" } } }, "create_es_query_kql_rule_request": { "summary": "Elasticsearch query rule (KQL)", "description": "Create an Elasticsearch query rule that uses Kibana query language (KQL).", "value": { "consumer": "alerts", "name": "my Elasticsearch query KQL rule", "params": { "aggType": "count", "excludeHitsFromPreviousRun": true, "groupBy": "all", "searchConfiguration": { "query": { "query": "\"\"geo.src : \"US\" \"\"", "language": "kuery" }, "index": "90943e30-9a47-11e8-b64d-95841ca0b247" }, "searchType": "searchSource", "size": 100, "threshold": [ 1000 ], "thresholdComparator": ">", "timeWindowSize": 5, "timeWindowUnit": "m" }, "rule_type_id": ".es-query", "schedule": { "interval": "1m" } } }, "create_index_threshold_rule_request": { "summary": "Index threshold rule", "description": "Create an index threshold rule that uses a server log connector to send notifications when the threshold is met.\n", "value": { "actions": [ { "id": "48de3460-f401-11ed-9f8e-399c75a2deeb", "frequency": { "notify_when": "onActionGroupChange", "summary": false }, "group": "threshold met", "params": { "level": "info", "message": "Rule '{{rule.name}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}" } } ], "alert_delay": { "active": 3 }, "consumer": "alerts", "name": "my rule", "params": { "aggType": "avg", "termSize": 6, "thresholdComparator": ">", "timeWindowSize": 5, "timeWindowUnit": "m", "groupBy": "top", "threshold": [ 1000 ], "index": [ ".test-index" ], "timeField": "@timestamp", "aggField": "sheet.version", "termField": "name.keyword" }, "rule_type_id": ".index-threshold", "schedule": { "interval": "1m" }, "tags": [ "cpu" ] } }, "create_tracking_containment_rule_request": { "summary": "Tracking containment rule", "description": "Create a tracking containment rule that checks when an entity is contained or no longer contained within a boundary.\n", "value": { "consumer": "alerts", "name": "my tracking rule", "params": { "index": "kibana_sample_data_logs", "dateField\"": "@timestamp", "geoField": "geo.coordinates", "entity": "agent.keyword", "boundaryType": "entireIndex", "boundaryIndexTitle": "boundary*", "boundaryGeoField": "location", "boundaryNameField": "name", "indexId": "90943e30-9a47-11e8-b64d-95841ca0b247", "boundaryIndexId": "0cd90abf-abe7-44c7-909a-f621bbbcfefc" }, "rule_type_id": ".geo-containment", "schedule": { "interval": "1h" } } }, "create_es_query_esql_rule_response": { "summary": "Elasticsearch query rule (ES|QL)", "description": "The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).", "value": { "id": "e0d62360-78e8-11ee-9177-f7d404c8c945", "enabled": true, "name": "my Elasticsearch query ESQL rule", "tags": [ ], "rule_type_id": ".es-query", "consumer": "stackAlerts", "schedule": { "interval": "1d" }, "actions": [ { "group": "query matched", "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945", "params": { "level": "info", "message": "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}" }, "connector_type_id": ".server-log", "frequency": { "summary": false, "notify_when": "onActiveAlert", "throttle": "null" }, "uuid": "bfe370a3-531b-4855-bbe6-ad739f578844" } ], "params": { "searchType": "esqlQuery", "esqlQuery": { "esql": "FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != \"GB\" | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | sort sumbytes desc | limit 10" }, "timeField": "@timestamp", "timeWindowSize": 1, "timeWindowUnit": "d", "size": 0, "thresholdComparator": ">", "threshold": [ 0 ], "excludeHitsFromPreviousRun\"": "true,", "aggType": "count", "groupBy": "all" }, "scheduled_task_id": "e0d62360-78e8-11ee-9177-f7d404c8c945", "created_by": "elastic", "updated_by": "elastic\",", "created_at": "2023-11-01T19:00:10.453Z", "updated_at": "2023-11-01T19:00:10.453Z", "api_key_owner": "elastic", "api_key_created_by_user": false, "throttle": "null", "mute_all": false, "notify_when": "null", "muted_alert_ids": [ ], "execution_status": { "status": "pending", "last_execution_date": "2023-11-01T19:00:10.453Z" }, "revision": 0, "running": false } }, "create_es_query_rule_response": { "summary": "Elasticsearch query rule (DSL)", "description": "The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).", "value": { "id": "58148c70-407f-11ee-850e-c71febc4ca7f", "enabled": true, "name": "my Elasticsearch query rule", "tags": [ ], "rule_type_id": ".es-query", "consumer": "alerts", "schedule": { "interval": "1d" }, "actions": [ { "group": "query matched", "id": "fdbece50-406c-11ee-850e-c71febc4ca7f", "params": { "level": "info", "message": "The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts." }, "connector_type_id": ".server-log", "frequency": { "summary": true, "notify_when": "onThrottleInterval", "throttle": "1d" }, "uuid": "53f3c2a3-e5d0-4cfa-af3b-6f0881385e78" }, { "group": "recovered", "id": "fdbece50-406c-11ee-850e-c71febc4ca7f", "params": { "level": "info", "message": "Recovered" }, "connector_type_id": ".server-log", "frequency": { "summary": false, "notify_when": "onActionGroupChange", "throttle": "null" }, "uuid": "2324e45b-c0df-45c7-9d70-4993e30be758" } ], "params": { "thresholdComparator": ">", "timeWindowSize": 1, "timeWindowUnit": "d", "threshold": [ 100 ], "size": 100, "timeField": "@timestamp", "index": [ "kibana_sample_data_logs" ], "esQuery": "\"\"\"{\"query\":{\"match_all\" : {}}}\"\"\"", "excludeHitsFromPreviousRun": true, "aggType": "count", "groupBy": "all", "searchType": "esQuery" }, "scheduled_task_id": "58148c70-407f-11ee-850e-c71febc4ca7f", "created_by": "elastic", "updated_by": "elastic", "created_at": "2023-08-22T00:03:38.263Z", "updated_at": "2023-08-22T00:03:38.263Z", "api_key_owner": "elastic", "api_key_created_by_user": false, "throttle": "null", "mute_all": false, "notify_when": "null", "muted_alert_ids": [ ], "execution_status": { "status": "pending", "last_execution_date": "2023-08-22T00:03:38.263Z" }, "revision": 0, "running": false } }, "create_es_query_kql_rule_response": { "summary": "Elasticsearch query rule (KQL)", "description": "The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).", "value": { "id": "7bd506d0-2284-11ee-8fad-6101956ced88", "enabled": true, "name": "my Elasticsearch query KQL rule\"", "tags": [ ], "rule_type_id": ".es-query", "consumer": "alerts", "schedule": { "interval": "1m" }, "actions": [ ], "params": { "searchConfiguration": { "query": { "query": "\"\"geo.src : \"US\" \"\"", "language": "kuery" }, "index": "90943e30-9a47-11e8-b64d-95841ca0b247" }, "searchType": "searchSource", "timeWindowSize": 5, "timeWindowUnit": "m", "threshold": [ 1000 ], "thresholdComparator": ">", "size": 100, "aggType": "count", "groupBy": "all", "excludeHitsFromPreviousRun": true }, "created_by": "elastic", "updated_by": "elastic", "created_at": "2023-07-14T20:24:50.729Z", "updated_at": "2023-07-14T20:24:50.729Z", "api_key_owner": "elastic", "api_key_created_by_user": false, "throttle": "null", "notify_when": "null", "mute_all": false, "muted_alert_ids": [ ], "scheduled_task_id": "7bd506d0-2284-11ee-8fad-6101956ced88", "execution_status": { "status": "pending", "last_execution_date": "2023-07-14T20:24:50.729Z" }, "revision": 0, "running": false } }, "create_index_threshold_rule_response": { "summary": "Index threshold rule", "description": "The response for successfully creating an index threshold rule.", "value": { "actions": [ { "group": "threshold met", "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2", "uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d", "connector_type_id": ".server-log", "frequency": { "notify_when": "onActionGroupChange", "summary": false, "throttle": "null" }, "params": { "level": "info", "message": "Rule {{rule.name}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}" } } ], "alert_delay": { "active": 3 }, "api_key_created_by_user": false, "api_key_owner": "elastic", "consumer": "alerts", "created_at": "2022-06-08T17:20:31.632Z", "created_by": "elastic", "enabled": true, "execution_status": { "last_execution_date": "2022-06-08T17:20:31.632Z", "status": "pending" }, "id": "41893910-6bca-11eb-9e0d-85d233e3ee35", "muted_alert_ids": [ ], "mute_all": false, "name": "my rule", "notify_when": "null", "params": { "aggType": "avg", "termSize": 6, "thresholdComparator": ">", "timeWindowSize": 5, "timeWindowUnit": "m", "groupBy": "top", "threshold": [ 1000 ], "index": [ ".test-index" ], "timeField": "@timestamp", "aggField": "sheet.version", "termField": "name.keyword" }, "revision": 0, "rule_type_id": ".index-threshold", "running": false, "schedule": { "interval": "1m" }, "scheduled_task_id": "425b0800-6bca-11eb-9e0d-85d233e3ee35", "tags": [ "cpu" ], "throttle": "null", "updated_at": "2022-06-08T17:20:31.632Z", "updated_by": "elastic" } }, "create_tracking_containment_rule_response": { "summary": "Tracking containment rule", "description": "The response for successfully creating a tracking containment rule.", "value": { "id": "b6883f9d-5f70-4758-a66e-369d7c26012f", "name": "my tracking rule", "tags": [ ], "enabled": true, "consumer": "alerts", "throttle": "null", "revision": 1, "running": false, "schedule": { "interval": "1h" }, "params": { "index": "kibana_sample_data_logs", "dateField": "@timestamp", "geoField": "geo.coordinates", "entity": "agent.keyword", "boundaryType": "entireIndex", "boundaryIndexTitle": "boundary*", "boundaryGeoField": "location", "boundaryNameField": "name", "indexId": "90943e30-9a47-11e8-b64d-95841ca0b247", "boundaryIndexId": "0cd90abf-abe7-44c7-909a-f621bbbcfefc" }, "rule_type_id": ".geo-containment", "created_by": "elastic", "updated_by": "elastic", "created_at": "2024-02-14T19:52:55.920Z", "updated_at": "2024-02-15T03:24:32.574Z", "api_key_owner": "elastic", "notify_when": "null", "mute_all": false, "muted_alert_ids": [ ], "scheduled_task_id": "b6883f9d-5f70-4758-a66e-369d7c26012f", "execution_status": { "status": "ok", "last_execution_date": "2024-02-15T03:25:38.125Z", "last_duration": 74 }, "actions": [ ], "last_run": { "alerts_count": { "active": 0, "new": 0, "recovered": 0, "ignored": 0 }, "outcome_msg": "null", "outcome_order": 0, "outcome": "succeeded", "warning": "null" }, "next_run": "2024-02-15T03:26:38.033Z", "api_key_created_by_user": false } }, "find_rules_response": { "summary": "Index threshold rule", "description": "A response that contains information about an index threshold rule.", "value": { "page": 1, "total": 1, "per_page": 10, "data": [ { "id": "3583a470-74f6-11ed-9801-35303b735aef", "consumer": "alerts", "tags": [ "cpu" ], "name": "my alert", "enabled": true, "throttle": "null", "schedule": { "interval": "1m" }, "params": { "aggType": "avg", "termSize": 6, "thresholdComparator": ">", "timeWindowSize": 5, "timeWindowUnit": "m", "groupBy": "top", "threshold": [ 1000 ], "index": [ "test-index" ], "timeField": "@timestamp", "aggField": "sheet.version", "termField": "name.keyword" }, "revision": 1, "rule_type_id": ".index-threshold", "created_by": "elastic", "updated_by": "elastic", "created_at": "2022-12-05T23:40:33.132Z", "updated_at": "2022-12-05T23:40:33.132Z", "api_key_owner": "elastic", "mute_all": false, "muted_alert_ids": [ ], "scheduled_task_id": "3583a470-74f6-11ed-9801-35303b735aef", "execution_status": { "status": "ok", "last_execution_date": "2022-12-06T01:44:23.983Z", "last_duration": 48 }, "actions": [ { "id": "9dca3e00-74f5-11ed-9801-35303b735aef", "group": "threshold met", "uuid": "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61", "params": { "level": "info", "message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}", "connector_type_id": ".server-log" }, "frequency": { "summary": false, "notify_when": "onActionGroupChange", "throttle": "null" } } ], "last_run": { "alerts_count": { "new": 0, "ignored": 0, "recovered": 0, "active": 0 }, "outcome_msg": "null", "warning": "null", "outcome": "succeeded" }, "next_run": "2022-12-06T01:45:23.912Z", "api_key_created_by_user": false } ] } }, "find_rules_response_conditional_action": { "summary": "Security rule", "description": "A response that contains information about a security rule that has conditional actions.", "value": { "page": 1, "total": 1, "per_page": 10, "data": [ { "id": "6107a8f0-f401-11ed-9f8e-399c75a2deeb", "name": "security_rule", "consumer": "siem", "enabled": true, "tags": [ ], "throttle": "null", "revision": 1, "running": false, "schedule": { "interval": "1m" }, "params": { "author": [ ], "description": "A security threshold rule.", "ruleId": "an_internal_rule_id", "falsePositives": [ ], "from": "now-3660s", "immutable": false, "license": "", "outputIndex": "", "meta": { "from": "1h", "kibana_siem_app_url": "https://localhost:5601/app/security" }, "maxSignals": 100, "riskScore": 21, "riskScoreMapping": [ ], "severity": "low", "severityMapping": [ ], "threat": [ ], "to": "now", "references": [ ], "version": 1, "exceptionsList": [ ], "type": "threshold", "language": "kuery", "index": [ "kibana_sample_data_logs" ], "query": "*", "filters": [ ], "threshold": { "field": [ "bytes" ], "value": 1, "cardinality": [ ] } }, "rule_type_id": "siem.thresholdRule", "created_by": "elastic", "updated_by": "elastic", "created_at": "2023-05-16T15:50:28.358Z", "updated_at": "2023-05-16T20:25:42.559Z", "api_key_owner": "elastic", "notify_when": "null", "mute_all": false, "muted_alert_ids": [ ], "scheduled_task_id": "6107a8f0-f401-11ed-9f8e-399c75a2deeb", "execution_status": { "status": "ok", "last_execution_date": "2023-05-16T20:26:49.590Z", "last_duration": 166 }, "actions": [ { "group": "default", "id": "49eae970-f401-11ed-9f8e-399c75a2deeb", "params": { "documents": [ { "rule_id": { "[object Object]": "null" }, "rule_name": { "[object Object]": "null" }, "alert_id": { "[object Object]": "null" }, "context_message": { "[object Object]": "null" } } ] }, "connector_type_id": ".index", "frequency": { "summary": true, "notify_when": "onActiveAlert", "throttle": "null" }, "uuid": "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61", "alerts_filter": { "timeframe": { "days": [ 7 ], "timezone": "UTC", "hours": { "start": "08:00", "end": "17:00" } }, "query": { "kql": "", "filters": [ { "meta": { "disabled": false, "negate": false, "alias": "null", "index": "c4bdca79-e69e-4d80-82a1-e5192c621bea", "key": "client.geo.region_iso_code", "field": "client.geo.region_iso_code", "params": { "query": "CA-QC", "type": "phrase" } }, "$state": { "store": "appState" }, "query": { "match_phrase": { "client.geo.region_iso_code": "CA-QC" } } } ] } } } ], "last_run": { "alerts_count": { "new": 0, "ignored": 0, "recovered": 0, "active": 0 }, "outcome_msg": [ "Rule execution completed successfully" ], "outcome_order": 0, "warning": "null", "outcome": "succeeded" }, "next_run": "2023-05-16T20:27:49.507Z", "api_key_created_by_user": false } ] } }, "get_roles_response1": { "summary": "Get all role details", "value": [ { "name": "my_kibana_role", "description": "My kibana role description", "metadata": { "version": 1 }, "transient_metadata": { "enabled": true }, "elasticsearch": { "indices": [ ], "cluster": [ ], "run_as": [ ] }, "kibana": [ { "base": [ "all" ], "feature": { }, "spaces": [ "*" ] } ] }, { "name": "my_admin_role", "description": "My admin role description", "metadata": { "version": 1 }, "transient_metadata": { "enabled": true }, "elasticsearch": { "cluster": [ "all" ], "indices": [ { "names": [ "index1", "index2" ], "privileges": [ "all" ], "field_security": { "grant": [ "title", "body" ] }, "query": "{\\\"match\\\": {\\\"title\\\": \\\"foo\\\"}}" } ] }, "kibana": [ ] } ] }, "get_role_response1": { "summary": "Get role details", "value": { "name": "my_kibana_role", "description": "Grants all cluster privileges and full access to index1 and index2. Grants full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grants all Kibana privileges in the default space.", "metadata": { "version": 1 }, "transient_metadata": { "enabled": true }, "elasticsearch": { "cluster": [ "all" ], "remote_cluster": [ { "privileges": [ "monitor_enrich" ], "clusters": [ "remote_cluster1" ] } ], "indices": [ { "names": [ "index1", "index2" ], "privileges": [ "all" ], "allow_restricted_indices": false } ], "remote_indices": [ { "names": [ "remote_index1", "remote_index2" ], "privileges": [ "all" ], "allow_restricted_indices": false, "clusters": [ "remote_cluster1" ] } ], "run_as": [ ] }, "kibana": [ { "base": [ "all" ], "feature": { }, "spaces": [ "default" ] } ], "_transform_error": [ ], "_unrecognized_applications": [ ] } }, "create_role_request1": { "summary": "Feature privileges in multiple spaces", "description": "Grant access to various features in some spaces.", "value": { "description": "Grant full access to discover and dashboard features in the default space. Grant read access in the marketing, and sales spaces.", "metadata": { "version": 1 }, "elasticsearch": { "cluster": [ ], "indices": [ ] }, "kibana": [ { "base": [ ], "feature": { "discover": [ "all" ], "dashboard": [ "all" ] }, "spaces": [ "default" ] }, { "base": [ "read" ], "spaces": [ "marketing", "sales" ] } ] } }, "create_role_request2": { "summary": "Dashboard privileges in a space", "description": "Grant access to dashboard features in a Marketing space.", "value": { "description": "Grant dashboard access in the Marketing space.", "metadata": { "version": 1 }, "elasticsearch": { "cluster": [ ], "indices": [ ] }, "kibana": [ { "base": [ ], "feature": { "dashboard": [ "read" ] }, "spaces": [ "marketing" ] } ] } }, "create_role_request3": { "summary": "Feature privileges in a space", "description": "Grant full access to all features in the default space.", "value": { "metadata": { "version": 1 }, "elasticsearch": { "cluster": [ ], "indices": [ ] }, "kibana": [ { "base": [ "all" ], "feature": { }, "spaces": [ "default" ] } ] } }, "create_role_request4": { "summary": "Elasticsearch and Kibana feature privileges", "description": "Grant Elasticsearch and Kibana feature privileges.", "value": { "description": "Grant all cluster privileges and full access to index1 and index2. Grant full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grant all Kibana privileges in the default space.", "metadata": { "version": 1 }, "elasticsearch": { "cluster": [ "all" ], "indices": [ { "names": [ "index1", "index2" ], "privileges": [ "all" ] } ], "remote_indices": [ { "clusters": [ "remote_cluster1" ], "names": [ "remote_index1", "remote_index2" ], "privileges": [ "all" ] } ], "remote_cluster": [ { "clusters": [ "remote_cluster1" ], "privileges": [ "monitor_enrich" ] } ] }, "kibana": [ { "base": [ "all" ], "feature": { }, "spaces": [ "default" ] } ] } }, "copy_saved_objects_request1": { "summary": "Copy with createNewCopies", "description": "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n", "value": { "objects": [ { "type": "dashboard", "id": "my-dashboard" } ], "spaces": [ "marketing" ], "includeReferences": true } }, "copy_saved_objects_request2": { "summary": "Copy without createNewCopies", "description": "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n", "value": { "objects": [ { "type": "dashboard", "id": "my-dashboard" } ], "spaces": [ "marketing" ], "includeReferences": true, "createNewCopies": false } }, "copy_saved_objects_response1": { "summary": "Copy with createNewCopies", "description": "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. The result indicates a successful copy and all three objects are created. Since these objects were created as new copies, each entry in the successResults array includes a destinationId attribute.\n", "value": { "marketing": { "success": true, "successCount": 3, "successResults": [ { "id": "my-dashboard", "type": "dashboard", "destinationId": "1e127098-5b80-417f-b0f1-c60c8395358f", "meta": { "icon": "dashboardApp", "title": "Look at my dashboard" } }, { "id": "my-vis", "type": "visualization", "destinationId": "a610ed80-1c73-4507-9e13-d3af736c8e04", "meta": { "icon": "visualizeApp", "title": "Look at my visualization" } }, { "id": "my-index-pattern", "type": "index-pattern", "destinationId": "bc3c9c70-bf6f-4bec-b4ce-f4189aa9e26b", "meta": { "icon": "indexPatternApp", "title": "my-pattern-*" } } ] } } }, "copy_saved_objects_response2": { "summary": "Copy without createNewCopies", "description": "The response for successfully copying a dashboard with the my-dashboard ID with createNewCopies turned off. The result indicates a successful copy and all three objects are created.\n", "value": { "marketing": { "success": true, "successCount": 3, "successResults": [ { "id": "my-dashboard", "type": "dashboard", "meta": { "icon": "dashboardApp", "title": "Look at my dashboard" } }, { "id": "my-vis", "type": "visualization", "meta": { "icon": "visualizeApp", "title": "Look at my visualization" } }, { "id": "my-index-pattern", "type": "index-pattern", "meta": { "icon": "indexPatternApp", "title": "my-pattern-*" } } ] } } }, "copy_saved_objects_response3": { "summary": "Failed copy response with conflict errors", "description": "A response for a failed copy of a dashboard with the my-dashboard ID including all references from the default space to the marketing and sales spaces. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to an index pattern. The result indicates a successful copy for the marketing space and an unsuccessful copy for the sales space because the data view, visualization, and Canvas workpad each resulted in a conflict error. Objects are created when the error is resolved using the resolve copy conflicts API.\n", "value": { "marketing": { "success": true, "successCount": 4, "successResults": [ { "id": "my-dashboard", "type": "dashboard", "meta": { "icon": "dashboardApp", "title": "Look at my dashboard" } }, { "id": "my-vis", "type": "visualization", "meta": { "icon": "visualizeApp", "title": "Look at my visualization" } }, { "id": "my-canvas", "type": "canvas-workpad", "meta": { "icon": "canvasApp", "title": "Look at my canvas" } }, { "id": "my-index-pattern", "type": "index-pattern", "meta": { "icon": "indexPatternApp", "title": "my-pattern-*" } } ] }, "sales": { "success": false, "successCount": "1,", "errors": [ { "id": "my-pattern", "type": "index-pattern", "title": "my-pattern-*", "error": { "type": "conflict" }, "meta": { "icon": "indexPatternApp", "title": "my-pattern-*" } }, { "id": "my-visualization", "type": "my-vis", "title": "Look at my visualization", "error": { "type": "conflict", "destinationId": "another-vis" }, "meta": { "icon": "visualizeApp", "title": "Look at my visualization" } }, { "id": "my-canvas", "type": "canvas-workpad", "title": "Look at my canvas", "error": { "type": "ambiguous_conflict", "destinations": [ { "id": "another-canvas", "title": "Look at another canvas", "updatedAt": "2020-07-08T16:36:32.377Z" }, { "id": "yet-another-canvas", "title": "Look at yet another canvas", "updatedAt": "2020-07-05T12:29:54.849Z" } ] }, "meta": { "icon": "canvasApp", "title": "Look at my canvas" } } ], "successResults\"": [ { "id": "my-dashboard", "type": "dashboard", "meta": { "icon": "dashboardApp", "title": "Look at my dashboard" } } ] } } }, "copy_saved_objects_response4": { "summary": "Failed copy with missing reference errors", "description": "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to a data view. The result indicates an unsuccessful copy because the visualization resulted in a missing references error. Objects are created when the errors are resolved using the resolve copy conflicts API.\n", "value": { "marketing": { "success": false, "successCount": 2, "errors": [ { "id": "my-vis", "type": "visualization", "title": "Look at my visualization", "error": { "type": "missing_references", "references": [ { "type": "index-pattern", "id": "my-pattern-*" } ] }, "meta": { "icon": "visualizeApp", "title": "Look at my visualization" } } ], "successResults": [ { "id": "my-dashboard", "type": "dashboard", "meta": { "icon": "dashboardApp", "title": "Look at my dashboard" } }, { "id": "my-canvas", "type": "canvas-workpad", "meta": { "icon": "canvasApp", "title": "Look at my canvas" } } ] } } }, "disable_legacy_url_request1": { "summary": "Disable legacy URL aliases", "description": "This request leaves the alias intact but the legacy URL for this alias (http://localhost:5601/s/bills-space/app/dashboards#/view/123) will no longer function. The dashboard still exists and you can access it with the new URL.\n", "value": { "aliases": [ { "targetSpace": "bills-space", "targetType": "dashboard", "sourceId": 123 } ] } }, "resolve_copy_saved_objects_request1": { "summary": "Resolve conflict errors", "description": "Resolve conflict errors for a data view, visualization, and Canvas workpad by overwriting the existing saved objects. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard accordingly.\n", "value": { "objects": [ { "type": "dashboard", "id": "my-dashboard" } ], "includeReferences": true, "createNewCopies": false, "retries": { "sales": [ { "type": "index-pattern", "id": "my-pattern", "overwrite": true }, { "type": "visualization", "id": "my-vis", "overwrite": "true,", "destinationId": "another-vis" }, { "type": "canvas", "id": "my-canvas", "overwrite": true, "destinationId": "yet-another-canvas" }, { "type": "dashboard", "id": "my-dashboard" } ] } } }, "resolve_copy_saved_objects_request2": { "summary": "Resolve missing reference errors", "description": "Resolve missing reference errors for a visualization by ignoring the error. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard and canvas accordingly.\n", "value": { "objects": [ { "type": "dashboard", "id": "my-dashboard" } ], "includeReferences": true, "createNewCopies": false, "retries": { "marketing": [ { "type": "visualization", "id": "my-vis", "ignoreMissingReferences": true }, { "type": "canvas", "id": "my-canvas" }, { "type": "dashboard", "id": "my-dashboard" } ] } } }, "update_saved_objects_spaces_request1": { "summary": "Update saved object spaces", "description": "Update the spaces of each saved object and all its references.", "value": { "objects": [ { "type": "index-pattern", "id": "90943e30-9a47-11e8-b64d-95841ca0b247" } ], "spacesToAdd": [ "test" ], "spacesToRemove": [ ] } }, "update_saved_objects_spaces_response1": { "summary": "Update saved object spaces", "description": "The response from updating the spaces of saved objects.\n", "value": { "objects": [ { "type": "index-pattern", "id": "90943e30-9a47-11e8-b64d-95841ca0b247", "spaces": [ "default", "test" ] } ] } }, "get_spaces_response1": { "summary": "Get all spaces", "description": "Get all spaces without specifying any options.", "value": [ { "id": "default", "name": "Default", "description": "This is the Default Space", "disabledFeatures": [ ], "imageUrl": "", "_reserved": true }, { "id": "marketing", "name": "Marketing", "description": "This is the Marketing Space", "color": "null", "disabledFeatures": [ "apm" ], "initials": "MK", "imageUrl": "data:image/png;base64,iVBORw0KGgoAAAANSU" }, { "id": "sales", "name": "Sales", "initials": "MK", "disabledFeatures": [ "discover" ], "imageUr\"": "", "solution": "oblt" } ] }, "get_spaces_response2": { "summary": "Get all spaces with custom options", "description": "The user has read-only access to the Sales space. Get all spaces with the following query parameters: \"purpose=shareSavedObjectsIntoSpace&include_authorized_purposes=true\"\n", "value": [ { "id": "default", "name": "Default", "description": "This is the Default Space", "disabledFeatures": [ ], "imageUrl": "", "_reserved": true, "authorizedPurposes": { "any": true, "copySavedObjectsIntoSpace": true, "findSavedObjects": true, "shareSavedObjectsIntoSpace": true } }, { "id": "marketing", "name": "Marketing", "description": "This is the Marketing Space", "color": "null", "disabledFeatures": [ "apm" ], "initials": "MK", "imageUrl": "data:image/png;base64,iVBORw0KGgoAAAANSU", "authorizedPurposes": { "any": true, "copySavedObjectsIntoSpace": true, "findSavedObjects": true, "shareSavedObjectsIntoSpace": true } }, { "id": "sales", "name": "Sales", "initials": "MK", "disabledFeatures": [ "discover" ], "imageUrl": "", "authorizedPurposes": { "any": true, "copySavedObjectsIntoSpace": false, "findSavedObjects": true, "shareSavedObjectsIntoSpace": false } } ] }, "create_space_request": { "summary": "Create a marketing space", "value": { "id": "marketing", "name": "Marketing", "description": "This is the Marketing Space", "color": "null", "initials": "MK", "disabledFeatures": [ ], "imageUrl": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAD4AAABACAYAAABC6cT1AAAGf0lEQVRoQ+3abYydRRUH8N882xYo0IqagEVjokQJKAiKBjXExC9G/aCkGowCIghCkRcrVSSKIu/FEiqgGL6gBIlAYrAqUTH6hZgQFVEMKlQFfItWoQWhZe8z5uzMLdvbfbkLxb13d+fbvfe588x/zpn/+Z9zJpmnI81T3BaAzzfLL1h8weLzZAcWXH2eGHo7zAWLL1h8nuzAjFw9G1N6Kzq8HnuM36MR8iibF3Fv4q+7cv8yDV6K13bYq2furSP8Ag8ncr/vnSnwRViJT2GfCV7yL1yHGxLb+l3EdM9lluNEnIC9xz+f2ZL4Er6Z2DrdXN3fZwp8CU7OfDHxggle8lTLbQ1nJ/7Z7yKmey5zYGZt4h2IzR8/trRc2PDlxJPTzfVcgJ+CC0wMPOa9F6cm7up3EVM9V9386MxliVdM8GwAv6hh/awCz/w7lY25OtF5ruBz4ZLP42NYNrDAFbC3YPWuILnMAfgq3oaRQQYea/stViV+sgssvjKzLvGySeaaNVfP4d7Btokgvxj/bblgpueuF1hmWcyTCmfE3J3M1lTcv0vMswM88zR+jpw4osu6me8kzkpsfLZWzxyRuabO22buxxOJ12FxnXfWgEe83pB5sOE47BsLymzscOoi7nw2JJfZreUjiUsTyzKPZm5NvBDvSuw268AzNzV8H5/Am+qCnsAXgpgSW2Zq9cyKlksbPlTd+te4quWNieMHBfiNDdciYnwsdI/MaOaWhnMTf54J8CqNj8x8JXFIZltYu+HqlmNT8YSBsHgAPw/vxvlVV4du/s0oaxbxg0TbL/jMni0nNcVjQq7+HZfgtpbzBg342TgQ63AkmsymxBW4IjE6A+D7Vzd/fyWxIM/VuCe+HzTgZ2Jpy/kNJ2FJLmLm24mPJ/42A+Bvrxt4SISwlhsaPodH26LZB8rVA3inwwebsrixJCZzX+KMxI/7AV61eVh3DV6Mx3EOvh4kN6jAg8nfUCXm4d1wE66OyxNPTQc+s3/o/MoXizL3JE5O3F3P/uBZPPF4Zr+Wi5uSO48ZPRdyCwn7YB/A35m5KhWNHox4fcNnIs0ddOCRSBxf8+cQG+Huf0l8NJVYP+nI7NXy2ar4QqIGm69JfKPOE2w/mBavCzwM11R2D+ChsUO7hyUfmwx55qDM1xJvqZ7y08TpifuGBfjeURVJnNIVGpkNiXNS0ds7jcySDitDCCWW56LJ10fRo8sNA+3qXUSZD2CtQlZh9T+1rB7h9oliembflnMbzqgSNZKbKGHdPm7OwXb1CvQ1metSETMpszmzvikCJNh/h5E5PHNl4qga/+/cxqrdeWDYgIe7X5L4cGJPJX2940lOX8pD41FnFnc4riluvQKbK0dcHJFi2IBHNTQSlguru4d2/wPOTNzRA3x5y+U1E1uqWDkETOT026XuUJzx6u7ReLhSYenQ7uHua0fKZmwfmcPqsQjxE5WVONcRxn7X89zgn/EKPMRMxOVQXmP18Mx3q3b/Y/0cQE/IhFtHESMsHFlZ1Ml3CH3DZPHImY+pxcKumNmYirtvqMBfhMuU6s3iqOQkTsMPe1tCQwO8Ajs0lxr7W+vnp1MJc9EgCNd/cy6x+9D4veXmprj5wxMw/3C4egW6zzgZOlYZzfwo3F2J7ael0pJamvlPKgWNKFft1AAcKotXoFEbD7kaoSoQPVKB35+5KHF0lai/rJo+up87jWEE/qqqwY+qrL21LWLm95lPJ16ppKw31XC3PXYPJauPEx7B6BHCgrSizRs18qiaRp8tlN3ueCTYPHH9RNaunjI8Z7wLYpT3jZSCYXQ8e9vTsRE/q+no3XMKeObgGtaintbb/AvXj4JDkNw/5hrwYPfIvlZFUbLn7G5q+eQIN09Vnho6cqvnM/Lt99RixH49wO8K0ZL41WTWHoQzvsNVkOheZqKhEGpsp3SzB+BBtZAYve7uOR9tuTaaB6l0XScdYfEQPpkTUyHEGP+XqyDBzu+NBCITUjNWHynkrbWKOuWFn1xKzqsyx0bdvS78odp0+N503Zao0uCsWuSIDku8/7EO60b41vN5+Ses9BKlTdvd8bhp9EBvJjWJAIn/vxwHe6b3tSk6JFPV4nq85oAOrx555v/x/rh3E6Lo+bnuNS4uB4Cuq0ZfvO8X1rM6q/+vnjLVqZq7v83onttc2oYF4HPJmv1gWbB4P7s0l55ZsPhcsmY/WBYs3s8uzaVn5q3F/wf70mRuBCtbjQAAAABJRU5ErkJggg==" } }, "get_space_response": { "summary": "Get details about a marketing space", "value": { "id": "marketing", "name": "Marketing", "description": "This is the Marketing Space", "color": "null", "initials": "MK", "disabledFeatures": [ ], "imageUrl": "", "solution": "es" } }, "update_space_request": { "summary": "Update a marketing space", "description": "Update the marketing space to remove the imageUrl.", "value": { "id": "marketing", "name": "Marketing", "description": "This is the Marketing Space", "color": "null", "initials": "MK", "disabledFeatures": [ ], "imageUrl": "" } } }, "securitySchemes": { "apiKeyAuth": { "type": "apiKey", "description": "These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`\n", "name": "Authorization", "in": "header" }, "basicAuth": { "type": "http", "scheme": "basic" } } }, "security": [ { "apiKeyAuth": [ ] }, { "basicAuth": [ ] } ], "tags": [ { "name": "alerting", "description": "Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.\n", "externalDocs": { "description": "Alerting documentation", "url": "https://www.elastic.co/guide/en/kibana/8.19/alerting-getting-started.html" }, "x-displayName": "Alerting" }, { "name": "APM agent configuration", "description": "Adjust APM agent configuration without need to redeploy your application.\n" }, { "name": "APM agent keys", "description": "Configure APM agent keys to authorize requests from APM agents to the APM Server.\n" }, { "name": "APM annotations", "description": "Annotate visualizations in the APM app with significant events. Annotations enable you to easily see how events are impacting the performance of your applications.\n" }, { "name": "APM server schema", "description": "Create APM fleet server schema." }, { "name": "APM sourcemaps", "description": "Configure APM source maps." }, { "name": "cases", "description": "Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.\n", "externalDocs": { "description": "Cases documentation", "url": "https://www.elastic.co/guide/en/kibana/8.19/cases.html" }, "x-displayName": "Cases" }, { "name": "connectors", "description": "Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.\n", "externalDocs": { "description": "Connector documentation", "url": "https://www.elastic.co/guide/en/kibana/8.19/action-types.html" }, "x-displayName": "Connectors" }, { "name": "Data streams", "description": "Data stream APIs enable you to manage data streams, which are collections of indices that share the same index template and are managed as a single unit for time-series data.\n", "x-displayName": "Data streams" }, { "name": "data views", "description": "Data view APIs enable you to manage data views, formerly known as Kibana index patterns.", "x-displayName": "Data views" }, { "name": "Elastic Agent actions", "description": "Elastic Agent actions APIs enable you to manage actions performed on Elastic Agents, including agent reassignment, diagnostics collection, enrollment management, upgrades, and bulk operations for agent lifecycle management.\n", "x-displayName": "Elastic Agent actions" }, { "name": "Elastic Agent binary download sources", "description": "Elastic Agent binary download sources APIs enable you to manage download sources for Elastic Agent binaries, including creating, updating, and deleting custom download sources for agent binaries.\n", "x-displayName": "Elastic Agent binary download sources" }, { "name": "Elastic Agent policies", "description": "Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.\n", "x-displayName": "Elastic Agent policies" }, { "name": "Elastic Agent status", "description": "Enables you to retrieve status information about Elastic Agents, including health summaries and operational status.\n", "x-displayName": "Elastic Agent status" }, { "name": "Elastic Agents", "description": "Elastic Agents APIs enable you to manage Elastic Agents, including retrieving agent information, managing agent lifecycle, handling file uploads, and initiating agent setup.\n", "x-displayName": "Elastic Agents" }, { "name": "Elastic Package Manager (EPM)", "description": "Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.\n", "x-displayName": "Elastic Package Manager (EPM)" }, { "name": "Fleet enrollment API keys", "description": "Fleet enrollment API keys APIs enable you to manage enrollment API keys for Fleet, including creating, retrieving, and revoking API keys used for agent enrollment.\n", "x-displayName": "Fleet enrollment API keys" }, { "name": "Fleet internals", "description": "Fleet internals APIs enable you to manage Fleet internal operations, including checking permissions, monitoring Fleet Server health, managing settings, and initiating Fleet setup.\n", "x-displayName": "Fleet internals" }, { "name": "Fleet Kubernetes" }, { "name": "Fleet outputs", "description": "Fleet outputs APIs enable you to manage Fleet outputs, including creating, updating, and deleting output configurations, generating Logstash API keys, and monitoring output health.\n", "x-displayName": "Fleet outputs" }, { "name": "Fleet package policies", "description": "Fleet package policies APIs enable you to manage Fleet package policies, including creating, updating, and deleting policies, performing bulk operations, and managing policy upgrades.\n", "x-displayName": "Fleet package policies" }, { "name": "Fleet proxies", "description": "Fleet proxies APIs enable you to manage Fleet proxies, including creating, updating, and deleting proxy configurations for Fleet agent communication.\n", "x-displayName": "Fleet proxies" }, { "name": "Fleet Server hosts", "description": "Fleet Server hosts APIs enable you to manage Fleet Server hosts, including creating, updating, and deleting Fleet Server host configurations.\n", "x-displayName": "Fleet Server hosts" }, { "name": "Fleet service tokens", "description": "Enables you to create tokens for Fleet service authentication and authorization.\n", "x-displayName": "Fleet service tokens" }, { "name": "Fleet uninstall tokens", "description": "Fleet uninstall tokens APIs enable you to manage Fleet uninstall tokens, including retrieving metadata and decrypted tokens for agent uninstallation.\n", "x-displayName": "Fleet uninstall tokens" }, { "name": "logstash", "description": "Programmatically integrate with Logstash configuration management.\n> warn\n> Do not directly access the `.logstash` index. The structure of the `.logstash` index is subject to change, which could cause your integration to break. Instead, use the Logstash configuration management APIs.\n", "externalDocs": { "description": "Centralized pipeline management", "url": "https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html" }, "x-displayName": "Logstash configuration management" }, { "name": "maintenance-window", "description": "You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.\n", "externalDocs": { "description": "Maintenance window documentation", "url": "https://www.elastic.co/guide/en/kibana/8.19/maintenance-windows.html" }, "x-displayName": "Maintenance windows" }, { "name": "ml", "description": "Enables you to synchronize machine learning saved objects.\n", "x-displayName": "Machine learning" }, { "name": "roles", "description": "Manage the roles that grant Elasticsearch and Kibana privileges.", "externalDocs": { "description": "Kibana role management", "url": "https://www.elastic.co/guide/en/kibana/8.19/kibana-role-management.html" }, "x-displayName": "Roles" }, { "name": "saved objects", "description": "Export sets of saved objects that you want to import into Kibana, resolve import errors, and rotate an encryption key for encrypted saved objects with the saved objects APIs.\n\nTo manage a specific type of saved object, use the corresponding APIs.\nFor example, use:\n\n* [Data views](../group/endpoint-data-views)\n* [Spaces](../group/endpoint-spaces)\n* [Short URLs](../group/endpoint-short-url)\n\nWarning: Do not write documents directly to the `.kibana` index. When you write directly to the `.kibana` index, the data becomes corrupted and permanently breaks future Kibana versions.\n", "x-displayName": "Saved objects" }, { "name": "Security AI Assistant API", "description": "Manage and interact with Security Assistant resources.", "x-displayName": "Security AI assistant" }, { "name": "Security Detections API", "description": "Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.\n\nThis API supports both key-based authentication and basic authentication.\n\nTo use key-based authentication, create an API key, then specify the key in the header of your API calls.\n\nTo use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.\n\nIn both cases, the API key is subsequently used for authorization when the rule runs.\n> warn\n> If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.\n\n> If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.\n\nTo create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.\n", "x-displayName": "Security detections" }, { "name": "Security Endpoint Exceptions API", "description": "Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.", "x-displayName": "Security Elastic Endpoint exceptions" }, { "name": "Security Endpoint Management API", "description": "Interact with and manage endpoints running the Elastic Defend integration.", "x-displayName": "Security endpoint management" }, { "name": "Security Entity Analytics API", "description": "Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.\n", "x-displayName": "Security entity analytics" }, { "name": "Security Exceptions API", "description": "Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts.\n\nExceptions are made up of:\n\n* **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.\n* **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert.\n\nFor detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated.\n> info\n> You cannot use lists with endpoint rule exceptions.\n\n> info\n> Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container.\n\n## Exceptions requirements\n\nBefore you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).\n", "x-displayName": "Security exceptions" }, { "name": "Security Lists API", "description": "Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.\n\nLists are made up of:\n\n* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used:\n * `boolean`\n * `byte`\n * `date`\n * `date_nanos`\n * `date_range`\n * `double`\n * `double_range`\n * `float`\n * `float_range`\n * `half_float`\n * `integer`\n * `integer_range`\n * `ip`\n * `ip_range`\n * `keyword`\n * `long`\n * `long_range`\n * `short`\n * `text`\n* **List items**: The values used to determine whether the exception prevents an alert from being generated.\n\nAll list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:\n1. `192.168.1.1`\n2. `192.168.1.3`\n3. `192.168.1.18`\n4. `192.168.1.12`\n5. `192.168.1.7`\n\nTo use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.\n> info\n> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.\n\n## Lists requirements\n\nBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.\n", "x-displayName": "Security lists" }, { "name": "Security Osquery API", "description": "Run live queries, manage packs and saved queries.", "x-displayName": "Security Osquery" }, { "name": "Security Timeline API", "description": "You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.", "x-displayName": "Security timeline" }, { "name": "short url", "description": "Manage Kibana short URLs.", "x-displayName": "Short URLs" }, { "name": "slo", "description": "SLO APIs enable you to define, manage and track service-level objectives", "x-displayName": "Service level objectives" }, { "name": "spaces", "description": "Manage your Kibana spaces.", "externalDocs": { "description": "Space overview", "url": "https://www.elastic.co/guide/en/kibana/8.19/xpack-spaces.html" }, "x-displayName": "Spaces" }, { "name": "synthetics", "description": "Synthetics APIs enable you to check the status of your services and applications.", "externalDocs": { "description": "Synthetic monitoring", "url": "https://www.elastic.co/guide/en/observability/8.19/monitor-uptime-synthetics.html" }, "x-displayName": "Synthetics" }, { "name": "system", "description": "Get information about the system status, resource usage, features, and installed plugins.\n", "x-displayName": "System" }, { "name": "task manager", "description": "Task manager APIs enable you to check the health of the Kibana task manager, which is used by features such as alerting, actions, and reporting to run mission critical work as persistent background tasks.", "externalDocs": { "description": "Task manager", "url": "https://www.elastic.co/guide/en/kibana/current/task-manager-production-considerations.html" }, "x-displayName": "Task manager" }, { "name": "upgrade", "description": "Check the upgrade status of your Elasticsearch cluster and reindex indices that were created in the previous major version. The assistant helps you prepare for the next major version of Elasticsearch.", "x-displayName": "Upgrade assistant" }, { "name": "uptime", "description": "Uptime APIs enable you to view and update uptime monitoring settings.", "externalDocs": { "description": "Uptime monitoring", "url": "https://www.elastic.co/guide/en/observability/current/uptime-intro.html" }, "x-displayName": "Uptime" }, { "name": "user session", "description": "Enables you to invalidate user sessions for security and session management purposes.\n", "x-displayName": "User session management" } ], "x-topics": [ { "title": "Kibana spaces", "content": "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```\ncurl -X GET \"http://localhost:5601/s/marketing/api/data_views\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/guide/en/kibana/8.19/xpack-spaces.html).\n" } ] }