Create a connector

The Amazon Bedrock request URL.

Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, us-west-1).

When true, the connector can send emails with HTML-formatted content in the body. Defaults to false. This option is unavailable when service is elastic_cloud.

The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.

The from address for all emails sent by the connector. It must be specified in user@host-name format.

Specifies whether a user and password are required inside the secrets configuration.

The host name of the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.

The port to connect to on the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.

Specifies whether the connection to the service provider will use TLS. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.

The name of the email service.

The Google Gemini request URL.

The generative artificial intelligence model for Google Gemini to use.

The GCP region where the Vertex AI endpoint enabled.

The IBM Resilient instance URL.

A field that indicates when the document was indexed.

The Elasticsearch index to be written to.

The Jira instance URL.

The OpenAI API provider.

The OpenAI API provider.

The OpenAI API endpoint.

The OpenAI API provider.

The OpenAI-compatible API endpoint.

The default model to use for requests.

PEM-encoded certificate content.

PEM-encoded private key content.

PEM-encoded CA certificate content.

SSL verification mode for PKI authentication.

The ServiceNow instance URL.

The client ID assigned to your OAuth application. This property is required when isOAuth is true.

The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.

The ServiceNow instance URL.

The client ID assigned to your OAuth application. This property is required when isOAuth is true.

The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

The Swimlane instance URL.

The Swimlane application ID.

The type of connector. Valid values are all, alerts, and cases.

The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.

The URL used to request an OAuth2 access token. If hasAuth is set to true and authType is webhook-oauth2-client-credentials, this property is required.

Additional fields, encoded as a JSON object, sent as part of the OAuth2 access token request body.

The type of authentication to use: basic, SSL, OAuth2 client credentials, or none.

A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.

If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.

The client identifier for OAuth2 authentication. If hasAuth is set to true and authType is webhook-oauth2-client-credentials, this property is required.

If true, a username and password for login type authentication must be provided.

A set of key-value pairs sent as headers with the request.

The HTTP request method: post, put, patch, get, or delete.

The scope requested when acquiring the OAuth2 access token.

The request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

The type of authentication to use: basic, SSL, OAuth2 client credentials, or none.

A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.

If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.

A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is case.comment. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

The REST API HTTP request method to create a case comment in the third-party system. Valid values are patch, post, and put.

The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

The REST API HTTP request method to create a case in the third-party system. Valid values are patch, post, and put.

The JSON key in the create external case response that contains the case ID.

The REST API URL to create a case in the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

The JSON key in get external case response that contains the case title.

The REST API URL to get the case by ID from the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

If true, a username and password for login type authentication must be provided.

A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.

The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

The REST API HTTP request method to update the case in the third-party system. Valid values are patch, post, and put.

The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.

The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when usesBasic is true.