Create a Knowledge Base Entry

Base URL: https://{kibana_url}

POST /api/security_ai_assistant/knowledge_base/entries

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Any of:

type: document

type enum required: Entry type.; Values: document
global boolean: Whether this Knowledge Base Entry is global, defaults to false.
name string required: Name of the Knowledge Base Entry.
namespace string: Kibana Space, defaults to 'default' space.
users object[]: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
kbResource enum required: Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.; Values: security_labs defend_insights user
source string required: Source document name or filepath.
text string required: Knowledge Base Entry content.
required boolean: Whether this resource should always be included, defaults to false.
vector object: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.

type: index

type enum required: Entry type.; Values: index
global boolean: Whether this Knowledge Base Entry is global, defaults to false.
name string required: Name of the Knowledge Base Entry.
namespace string: Kibana Space, defaults to 'default' space.
users object[]: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
description string required: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
field string required: Field to query for Knowledge Base content.
index string required: Index or Data Stream to query for Knowledge Base content.
queryDescription string required: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
inputSchema object[]: Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
outputFields string[]: Fields to extract from the query result, defaults to all fields if not provided or empty.

Responses

Successful request returning Knowledge Base Entries

application/json

Any of:

type: document

type enum required: Entry type.; Values: document
global boolean required: Whether this Knowledge Base Entry is global, defaults to false.
name string required: Name of the Knowledge Base Entry.
namespace string required: Kibana Space, defaults to 'default' space.
users object[] required: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
createdAt string required: Time the Knowledge Base Entry was created.
createdBy string required: User who created the Knowledge Base Entry.
id string · format: nonempty · min length: 1 required: A string that does not contain only whitespace characters.
updatedAt string required: Time the Knowledge Base Entry was last updated.
updatedBy string required: User who last updated the Knowledge Base Entry.
kbResource enum required: Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.; Values: security_labs defend_insights user
source string required: Source document name or filepath.
text string required: Knowledge Base Entry content.
required boolean: Whether this resource should always be included, defaults to false.
vector object: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.

type: index

type enum required: Entry type.; Values: index
global boolean required: Whether this Knowledge Base Entry is global, defaults to false.
name string required: Name of the Knowledge Base Entry.
namespace string required: Kibana Space, defaults to 'default' space.
users object[] required: Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
createdAt string required: Time the Knowledge Base Entry was created.
createdBy string required: User who created the Knowledge Base Entry.
id string · format: nonempty · min length: 1 required: A string that does not contain only whitespace characters.
updatedAt string required: Time the Knowledge Base Entry was last updated.
updatedBy string required: User who last updated the Knowledge Base Entry.
description string required: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
field string required: Field to query for Knowledge Base content.
index string required: Index or Data Stream to query for Knowledge Base content.
queryDescription string required: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
inputSchema object[]: Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
outputFields string[]: Fields to extract from the query result, defaults to all fields if not provided or empty.

Bad Request response.

application/json