Run a connector
- Base URL
-
https://{kibana_url}
- POST /api/actions/connector/{id}/_execute
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
Authentication
Authorization: <value>These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey
Authorization: Basic <credentials>Request body
-
paramsunion oneOfrequired - One of:
-
subActionParamsobjectrequired -
incidentobjectrequired -
Requires at least one of:
correlation_idorexternalId -
correlation_idstring · max length: 100 · default: {{rule.id}}:{{alert.id}}nullable -
An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
-
subActionParamsobjectrequired -
entitystring -
The domain of the alert in Opsgenie connectors. For example, the application or server name.
-
respondersobject[] -
The entities to receive notifications about the alert in Opsgenie connectors. If
typeisuser, eitheridorusernameis required. Iftypeisteam, eitheridornameis required. -
severityinteger · min: 1 · max: 4 -
The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
-
titlestring -
A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.
-
tlpinteger · min: 0 · max: 4 · default: 2 -
The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).
-
subActionParamsobjectrequired -
The set of configuration properties for the action.
-
commentsobject[] -
Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.
-
incidentobject -
Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.
-
additional_fieldsstring · max length: 20nullable -
Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.
-
correlation_displaystring -
A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
-
correlation_idstring -
The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as
{{ruleID}}`:`{{alert ID}}to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of{{ruleID}}`:`{{alert ID}}ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. -
descriptionstring -
The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
-
dest_ipunion string | string[] -
A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
-
externalIdstring -
The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
-
issueTypeinteger -
The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set
subActiontoissueTypes. -
labelsstring[] -
The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
-
malware_hashunion string | string[] -
A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
-
malware_urlunion string | string[] -
A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
-
otherFieldsobject · max properties: 20 -
Custom field identifiers and their values for Jira connectors.
-
parentstring -
The ID or key of the parent issue for Jira connectors. Applies only to
Sub-tasktypes of issues. -
severityinteger -
The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).
-
short_descriptionstring -
A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
-
source_ipunion string | string[] -
A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
-
subcategorystring -
The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
titlestring -
A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.
Test an action that acknowledges or resolves a PagerDuty alert.
Test an action that indexes a document into Elasticsearch.
Test an action that sends an email message. There must be at least one recipient in to, cc, or bcc.
Test an action that writes an entry to the Kibana server log.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack.
Test an action that triggers a PagerDuty alert.
The addEvent subaction for ServiceNow ITOM connectors.
The closeAlert subaction for Opsgenie connectors.
The closeIncident subaction for ServiceNow ITSM connectors.
The createAlert subaction for Opsgenie and TheHive connectors.
The fieldsByIssueType subaction for Jira connectors.
The getAgentDetails subaction for CrowdStrike connectors.
The getAgents subaction for SentinelOne connectors.
The getChoices subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
The getFields subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
The getIncident subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
The issue subaction for Jira connectors.
The issues subaction for Jira connectors.
The issueTypes subaction for Jira connectors.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack_api.
The pushToService subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
Responses
Indicates a successful call.
Indicates that this call is forbidden.