APM sourcemaps

Configure APM source maps. A source map allows minified files to be mapped back to original source code--allowing you to maintain the speed advantage of minified code, without losing the ability to quickly and easily debug your application. For best results, uploading source maps should become a part of your deployment procedure, and not something you only do when you see unhelpful errors. That's because uploading source maps after errors happen won't make old errors magically readable--errors must occur again for source mapping to occur.

Run a connector

POST /api/actions/connector/{id}/_execute

Api key auth Basic auth

You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Path parameters

id string Required

An identifier for the connector.

application/json

Body

params object Required
One of:
run_acknowledge_resolve_pagerduty object run_documents object run_message_email object run_message_serverlog object run_message_slack object run_trigger_pagerduty object run_addevent object run_closealert object run_closeincident object run_createalert object run_fieldsbyissuetype object run_getchoices object run_getfields object run_getincident object run_issue object run_issues object run_issuetypes object run_postmessage object run_pushtoservice object run_validchannelid object
Test an action that acknowledges or resolves a PagerDuty alert.
Hide attributes Show attributes

dedupKey string Required

The deduplication key for the PagerDuty alert.

Maximum length is 255.

eventAction string Required

The type of event.

Values are acknowledge or resolve.
Test an action that indexes a document into Elasticsearch.
Hide attribute Show attribute

documents array[object] Required

The documents in JSON format for index connectors.

Additional properties are allowed.
Test an action that sends an email message. There must be at least one recipient in to, cc, or bcc.
Hide attributes Show attributes

bcc array[string]

A list of "blind carbon copy" email addresses. Addresses can be specified in user@host-name format or in name <user@host-name> format

cc array[string]

A list of "carbon copy" email addresses. Addresses can be specified in user@host-name format or in name <user@host-name> format

message string Required

The email message text. Markdown format is supported.

subject string Required

The subject line of the email.

to array[string]

A list of email addresses. Addresses can be specified in user@host-name format or in name <user@host-name> format.
Test an action that writes an entry to the Kibana server log.
Hide attributes Show attributes

level string

The log level of the message for server log connectors.

Values are debug, error, fatal, info, trace, or warn. Default value is info.

message string Required

The message for server log connectors.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack.
Hide attribute Show attribute

message string Required

The Slack message text, which cannot contain Markdown, images, or other advanced formatting.
Test an action that triggers a PagerDuty alert.
Hide attributes Show attributes

class string

The class or type of the event.

component string

The component of the source machine that is responsible for the event.

customDetails object

Additional details to add to the event.

dedupKey string

All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.

Maximum length is 255.

eventAction string Required

The type of event.

Value is trigger.

group string

The logical grouping of components of a service.

links array[object]

A list of links to add to the event.

Hide links attributes Show links attributes object

href string

The URL for the link.

text string

A plain text description of the purpose of the link.

severity string

The severity of the event on the affected system.

Values are critical, error, info, or warning. Default value is info.

source string

The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.

summary string

A summery of the event.

Maximum length is 1024.

timestamp string(date-time)

An ISO-8601 timestamp that indicates when the event was detected or generated.
The addEvent subaction for ServiceNow ITOM connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is addEvent.

subActionParams object

The set of configuration properties for the action.

Hide subActionParams attributes Show subActionParams attributes object

additional_info string

Additional information about the event.

description string

The details about the event.

event_class string

A specific instance of the source.

message_key string

All actions sharing this key are associated with the same ServiceNow alert. The default value is <rule ID>:<alert instance ID>.

metric_name string

The name of the metric.

node string

The host that the event was triggered for.

resource string

The name of the resource.

severity string

The severity of the event.

source string

The name of the event source type.

time_of_event string

The time of the event.

type string

The type of event.
The closeAlert subaction for Opsgenie connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is closeAlert.

subActionParams object Required

Hide subActionParams attributes Show subActionParams attributes object

alias string Required

The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.

note string

Additional information for the alert.

source string

The display name for the source of the alert.

user string

The display name for the owner.
The closeIncident subaction for ServiceNow ITSM connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is closeIncident.

subActionParams object Required

Hide subActionParams attribute Show subActionParams attribute object

incident object Required

Any of:
object-1 object object-2 object

Hide attributes Show attributes

correlation_id string | null Required

An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.

Maximum length is 100. Default value is {{rule.id}}:{{alert.id}}.

externalId string | null

The unique identifier (incidentId) for the incident in ServiceNow.

Hide attributes Show attributes

correlation_id string | null

An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.

Maximum length is 100. Default value is {{rule.id}}:{{alert.id}}.

externalId string | null Required

The unique identifier (incidentId) for the incident in ServiceNow.
The createAlert subaction for Opsgenie and TheHive connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is createAlert.

subActionParams object Required

Hide subActionParams attributes Show subActionParams attributes object

actions array[string]

The custom actions available to the alert in Opsgenie connectors.

alias string

The unique identifier used for alert deduplication in Opsgenie.

description string

A description that provides detailed information about the alert.

details object

The custom properties of the alert in Opsgenie connectors.

Additional properties are allowed.

entity string

The domain of the alert in Opsgenie connectors. For example, the application or server name.

message string

The alert message in Opsgenie connectors.

note string

Additional information for the alert in Opsgenie connectors.

priority string

The priority level for the alert in Opsgenie connectors.

Values are P1, P2, P3, P4, or P5.

responders array[object]

The entities to receive notifications about the alert in Opsgenie connectors. If type is user, either id or username is required. If type is team, either id or name is required.

Hide responders attributes Show responders attributes object

id string

The identifier for the entity.

name string

The name of the entity.

type string

The type of responders, in this case escalation.

Values are escalation, schedule, team, or user.

username string

A valid email address for the user.

severity integer

The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).

Minimum value is 1, maximum value is 4.

source string

The display name for the source of the alert in Opsgenie and TheHive connectors.

sourceRef string

A source reference for the alert in TheHive connectors.

tags array[string]

The tags for the alert in Opsgenie and TheHive connectors.

title string

A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.

tlp integer

The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).

Minimum value is 0, maximum value is 4. Default value is 2.

type string

The type of alert in TheHive connectors.

user string

The display name for the owner.

visibleTo array[object]

The teams and users that the alert will be visible to without sending a notification. Only one of id, name, or username is required.

Hide visibleTo attributes Show visibleTo attributes object

id string

The identifier for the entity.

name string

The name of the entity.

type string Required

Valid values are team and user.

Values are team or user.

username string

The user name. This property is required only when the type is user.
The fieldsByIssueType subaction for Jira connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is fieldsByIssueType.

subActionParams object Required

Hide subActionParams attribute Show subActionParams attribute object

id string Required

The Jira issue type identifier.
The getChoices subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is getChoices.

subActionParams object Required

The set of configuration properties for the action.

Hide subActionParams attribute Show subActionParams attribute object

fields array[string] Required

An array of fields.
The getFields subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
Hide attribute Show attribute

subAction string Required

The action to test.

Value is getFields.
The getIncident subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is getIncident.

subActionParams object Required

Hide subActionParams attribute Show subActionParams attribute object

externalId string Required

The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
The issue subaction for Jira connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is issue.

subActionParams object

Hide subActionParams attribute Show subActionParams attribute object

id string Required

The Jira issue identifier.
The issues subaction for Jira connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is issues.

subActionParams object Required

Hide subActionParams attribute Show subActionParams attribute object

title string Required

The title of the Jira issue.
The issueTypes subaction for Jira connectors.
Hide attribute Show attribute

subAction string Required

The action to test.

Value is issueTypes.
Test an action that sends a message to Slack. It is applicable only when the connector type is .slack_api.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is postMessage.

subActionParams object Required

The set of configuration properties for the action.

Hide subActionParams attributes Show subActionParams attributes object

channelIds array[string]

The Slack channel identifier, which must be one of the allowedChannels in the connector configuration.

Not more than 1 element.

channels array[string] Deprecated

The name of a channel that your Slack app has access to.

Not more than 1 element.

text string

The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.

Minimum length is 1.
The pushToService subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is pushToService.

subActionParams object Required

The set of configuration properties for the action.

Hide subActionParams attributes Show subActionParams attributes object

comments array[object]

Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.

Hide comments attributes Show comments attributes object

comment string

A comment related to the incident. For example, describe how to troubleshoot the issue.

commentId integer

A unique identifier for the comment.

incident object

Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.

Hide incident attributes Show incident attributes object

additional_fields string | null

Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.

Maximum length is 20.

alertId string

The alert identifier for Swimlane connectors.

caseId string

The case identifier for the incident for Swimlane connectors.

caseName string

The case name for the incident for Swimlane connectors.

category string

The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.

correlation_display string

A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.

correlation_id string

The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as {{ruleID}}:{{alert ID}} to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of {{ruleID}}:{{alert ID}} ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.

description string

The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.

dest_ip string | array[string]

A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.

One of:
string-1 string array-2 array[string]

externalId string

The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.

id string

The external case identifier for Webhook - Case Management connectors.

impact string

The impact of the incident for ServiceNow ITSM connectors.

issueType integer

The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set subAction to issueTypes.

labels array[string]

The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.

malware_hash string | array[string]

A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.

One of:
string-1 string array-2 array[string]

malware_url string | array[string]

A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.

One of:
string-1 string array-2 array[string]

otherFields object

Custom field identifiers and their values for Jira connectors.

Additional properties are allowed.

parent string

The ID or key of the parent issue for Jira connectors. Applies only to Sub-task types of issues.

priority string

The priority of the incident in Jira and ServiceNow SecOps connectors.

ruleName string

The rule name for Swimlane connectors.

severity integer

The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).

short_description string

A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.

source_ip string | array[string]

A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.

One of:
string-1 string array-2 array[string]

status string

The status of the incident for Webhook - Case Management connectors.

subcategory string

The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.

summary string

A summary of the incident for Jira connectors.

tags array[string]

A list of tags for TheHive and Webhook - Case Management connectors.

title string

A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.

tlp integer

The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).

Minimum value is 0, maximum value is 4. Default value is 2.

urgency string

The urgency of the incident for ServiceNow ITSM connectors.
Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is .slack_api.
Hide attributes Show attributes

subAction string Required

The action to test.

Value is validChannelId.

subActionParams object Required

Hide subActionParams attribute Show subActionParams attribute object

channelId string Required

The Slack channel identifier.

Responses

200 application/json

Indicates a successful call.
Hide response attributes Show response attributes object
- config object
  
  Additional properties are allowed.
- connector_type_id string Required
  
  The connector type identifier.
- id string Required
  
  The identifier for the connector.
- is_deprecated boolean Required
  
  Indicates whether the connector is deprecated.
- is_missing_secrets boolean
  
  Indicates whether the connector is missing secrets.
- is_preconfigured boolean Required
  
  Indicates whether the connector is preconfigured. If true, the config and is_missing_secrets properties are omitted from the response.
- is_system_action boolean Required
  
  Indicates whether the connector is used for system actions.
- name string Required
  
  The name of the rule.

POST /api/actions/connector/{id}/_execute

curl \
 --request POST 'https://localhost:5601/api/actions/connector/{id}/_execute' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"params":{"documents":[{"id":"my_doc_id","name":"my_doc_name","message":"hello, world"}]}}'

Request examples

{
  "params": {
    "documents": [
      {
        "id": "my_doc_id",
        "name": "my_doc_name",
        "message": "hello, world"
      }
    ]
  }
}

{
  "params": {
    "subAction": "issueTypes"
  }
}

{
  "params": {
    "subAction": "getChoices",
    "subActionParams": {
      "fields": [
        "severity",
        "urgency"
      ]
    }
  }
}

{
  "params": {
    "subAction": "postMessage",
    "subActionParams": {
      "text": "A test message.",
      "channelIds": [
        "C123ABC456"
      ]
    }
  }
}

{
  "params": {
    "subAction": "pushToService",
    "subActionParams": {
      "comments": [
        {
          "comment": "A comment about the incident.",
          "commentId": 1
        }
      ],
      "incident": {
        "caseId": "1000",
        "caseName": "Case name",
        "description": "Description of the incident."
      }
    }
  }
}

Response examples (200)

{
  "data": {
    "took": 135,
    "items": [
      {
        "create": {
          "_id": "4JtvwYUBrcyxt2NnfW3y",
          "_index": "my-index",
          "result": "created",
          "status": 201,
          "_seq_no": 0,
          "_shards": {
            "total": 2,
            "failed": 0,
            "successful": 1
          },
          "_version": 1,
          "_primary_term": 1
        }
      }
    ],
    "errors": false
  },
  "status": "ok",
  "connector_id": "fd38c600-96a5-11ed-bb79-353b74189cba"
}

{
  "data": [
    {
      "id": 10024,
      "name": "Improvement"
    },
    {
      "id": 10006,
      "name": "Task"
    },
    {
      "id": 10007,
      "name": "Sub-task"
    },
    {
      "id": 10025,
      "name": "New Feature"
    },
    {
      "id": 10023,
      "name": "Bug"
    },
    {
      "id": 10000,
      "name": "Epic"
    }
  ],
  "status": "ok",
  "connector_id": "b3aad810-edbe-11ec-82d1-11348ecbf4a6"
}

{
  "status": "ok",
  "connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907"
}

{
  "data": [
    {
      "label": "Critical",
      "value": 1,
      "element": "severity",
      "dependent_value": ""
    },
    {
      "label": "Major",
      "value": 2,
      "element": "severity",
      "dependent_value": ""
    },
    {
      "label": "Minor",
      "value": 3,
      "element": "severity",
      "dependent_value": ""
    },
    {
      "label": "Warning",
      "value": 4,
      "element": "severity",
      "dependent_value": ""
    },
    {
      "label": "OK",
      "value": 5,
      "element": "severity",
      "dependent_value": ""
    },
    {
      "label": "Clear",
      "value": 0,
      "element": "severity",
      "dependent_value": ""
    },
    {
      "label": "1 - High",
      "value": 1,
      "element": "urgency",
      "dependent_value": ""
    },
    {
      "label": "2 - Medium",
      "value": 2,
      "element": "urgency",
      "dependent_value": ""
    },
    {
      "label": "3 - Low",
      "value": 3,
      "element": "urgency",
      "dependent_value": ""
    }
  ],
  "status": "ok",
  "connector_id": "9d9be270-2fd2-11ed-b0e0-87533c532698"
}

{
  "data": {
    "ok": true,
    "ts": "1234567890.123456",
    "channel": "C123ABC456",
    "message": {
      "ts": "1234567890.123456",
      "team": "T01ABCDE2F",
      "text": "A test message",
      "type": "message",
      "user": "U12A345BC6D",
      "app_id": "A01BC2D34EF",
      "blocks": [
        {
          "type": "rich_text",
          "block_id": "/NXe",
          "elements": [
            {
              "type": "rich_text_section",
              "elements": [
                {
                  "text": "A test message.",
                  "type": "text"
                }
              ]
            }
          ]
        }
      ],
      "bot_id": "B12BCDEFGHI",
      "bot_profile": {
        "id": "B12BCDEFGHI",
        "name": "test",
        "icons": {
          "image_36": "https://a.slack-edge.com/80588/img/plugins/app/bot_36.png"
        },
        "app_id": "A01BC2D34EF",
        "deleted": false,
        "team_id": "T01ABCDE2F",
        "updated": 1672169705
      }
    }
  },
  "status": "ok",
  "connector_id": ".slack_api"
}

{
  "data": {
    "id": "aKPmBHWzmdRQtx6Mx",
    "url": "https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx",
    "title": "TEST-457",
    "comments": [
      {
        "commentId": 1,
        "pushedDate": "2022-09-08T16:52:27.865Z"
      }
    ],
    "pushedDate": "2022-09-08T16:52:27.866Z"
  },
  "status": "ok",
  "connector_id": "a4746470-2f94-11ed-b0e0-87533c532698"
}

Get a full K8s agent manifest

GET /api/fleet/kubernetes

Api key auth Basic auth

[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-setup.

Query parameters

download boolean
fleetServer string
enrolToken string

Responses

200 application/json
Hide response attribute Show response attribute object
- item string Required
400 application/json
Hide response attributes Show response attributes object
- error string
- errorType string
- message string Required
- statusCode number

GET /api/fleet/kubernetes

curl \
 --request GET 'https://localhost:5601/api/fleet/kubernetes' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "item": "string"
}

Response examples (400)

{
  "error": "string",
  "errorType": "string",
  "message": "string",
  "statusCode": 42.0
}

Install a package by upload

POST /api/fleet/epm/packages

Api key auth Basic auth

[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Query parameters

ignoreMappingUpdateErrors boolean

Default value is false.
skipDataStreamRollover boolean

Default value is false.

application/gzip; application/zip

Body

string(binary)

Responses

200 application/gzip; application/zip
Hide response attributes Show response attributes object
- _meta object Required
  
  Additional properties are NOT allowed.
  
  Hide _meta attribute Show _meta attribute object
  
  install_source string Required
- items array[object] Required
  
  Any of:
  object-1 object object-2 object
  
  Hide attributes Show attributes
  
  id string Required
  
  originId string
  
  type string Required
  
  Any of:
  string-1 string string-2 string
  
  Values are dashboard, lens, visualization, search, index-pattern, map, ml-module, security-rule, csp-rule-template, osquery-pack-asset, osquery-saved-query, or tag.
  
  Hide attributes Show attributes
  
  deferred boolean
  
  id string Required
  
  type string Required
  
  Values are index, index_template, component_template, ingest_pipeline, ilm_policy, data_stream_ilm_policy, transform, or ml_model.
  
  version string
400 application/gzip; application/zip
Hide response attributes Show response attributes object
- error string
- errorType string
- message string Required
- statusCode number

POST /api/fleet/epm/packages

curl \
 --request POST 'https://localhost:5601/api/fleet/epm/packages' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/gzip; application/zip" \
 --header "kbn-xsrf: true" \
 --data-binary '@file'

Create output

POST /api/fleet/outputs

Api key auth Basic auth

[Required authorization] Route required privileges: fleet-settings-all.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body object

allow_edit array[string]
ca_sha256 string | null
ca_trusted_fingerprint string | null
config_yaml string | null
hosts array[string(uri)] Required

At least 1 element.
id string
is_default boolean

Default value is false.
is_default_monitoring boolean

Default value is false.
is_internal boolean
is_preconfigured boolean
name string Required
preset string

Values are balanced, custom, throughput, scale, or latency.
proxy_id string | null
secrets object

Additional properties are NOT allowed.
Hide secrets attribute Show secrets attribute object
- ssl object
  
  Additional properties are NOT allowed.
  Hide ssl attribute Show ssl attribute object
  
  key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
shipper object | null

Additional properties are NOT allowed.
Hide shipper attributes Show shipper attributes object | null
- compression_level number | null Required
- disk_queue_compression_enabled boolean | null Required
- disk_queue_enabled boolean | null
  
  Default value is false.
- disk_queue_encryption_enabled boolean | null Required
- disk_queue_max_size number | null Required
- disk_queue_path string | null Required
- loadbalance boolean | null Required
- max_batch_bytes number | null Required
- mem_queue_events number | null Required
- queue_flush_timeout number | null Required
ssl object | null

Additional properties are NOT allowed.
Hide ssl attributes Show ssl attributes object | null
- certificate string
- certificate_authorities array[string]
- key string
- verification_mode string
  
  Values are full, none, certificate, or strict.
type string Required

Value is elasticsearch.

allow_edit array[string]
ca_sha256 string | null
ca_trusted_fingerprint string | null
config_yaml string | null
hosts array[string(uri)] Required

At least 1 element.
id string
is_default boolean

Default value is false.
is_default_monitoring boolean

Default value is false.
is_internal boolean
is_preconfigured boolean
kibana_api_key string | null
kibana_url string | null
name string Required
preset string

Values are balanced, custom, throughput, scale, or latency.
proxy_id string | null
secrets object

Additional properties are NOT allowed.
Hide secrets attributes Show secrets attributes object
- kibana_api_key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
- service_token object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
- ssl object
  
  Additional properties are NOT allowed.
  Hide ssl attribute Show ssl attribute object
  
  key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
service_token string | null
shipper object | null

Additional properties are NOT allowed.
Hide shipper attributes Show shipper attributes object | null
- compression_level number | null Required
- disk_queue_compression_enabled boolean | null Required
- disk_queue_enabled boolean | null
  
  Default value is false.
- disk_queue_encryption_enabled boolean | null Required
- disk_queue_max_size number | null Required
- disk_queue_path string | null Required
- loadbalance boolean | null Required
- max_batch_bytes number | null Required
- mem_queue_events number | null Required
- queue_flush_timeout number | null Required
ssl object | null

Additional properties are NOT allowed.
Hide ssl attributes Show ssl attributes object | null
- certificate string
- certificate_authorities array[string]
- key string
- verification_mode string
  
  Values are full, none, certificate, or strict.
sync_integrations boolean
type string Required

Value is remote_elasticsearch.

allow_edit array[string]
ca_sha256 string | null
ca_trusted_fingerprint string | null
config_yaml string | null
hosts array[string] Required

At least 1 element.
id string
is_default boolean

Default value is false.
is_default_monitoring boolean

Default value is false.
is_internal boolean
is_preconfigured boolean
name string Required
proxy_id string | null
secrets object

Additional properties are NOT allowed.
Hide secrets attribute Show secrets attribute object
- ssl object
  
  Additional properties are NOT allowed.
  Hide ssl attribute Show ssl attribute object
  
  key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
shipper object | null

Additional properties are NOT allowed.
Hide shipper attributes Show shipper attributes object | null
- compression_level number | null Required
- disk_queue_compression_enabled boolean | null Required
- disk_queue_enabled boolean | null
  
  Default value is false.
- disk_queue_encryption_enabled boolean | null Required
- disk_queue_max_size number | null Required
- disk_queue_path string | null Required
- loadbalance boolean | null Required
- max_batch_bytes number | null Required
- mem_queue_events number | null Required
- queue_flush_timeout number | null Required
ssl object | null

Additional properties are NOT allowed.
Hide ssl attributes Show ssl attributes object | null
- certificate string
- certificate_authorities array[string]
- key string
- verification_mode string
  
  Values are full, none, certificate, or strict.
type string Required

Value is logstash.

allow_edit array[string]
auth_type string Required

Values are none, user_pass, ssl, or kerberos.
broker_timeout number
ca_sha256 string | null
ca_trusted_fingerprint string | null
client_id string
compression string

Values are gzip, snappy, lz4, or none.
compression_level array | null | boolean | number | object | string Required

Any of:
array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
config_yaml string | null
connection_type array | null | boolean | number | object | string Required

Any of:
array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
hash object

Additional properties are NOT allowed.
Hide hash attributes Show hash attributes object
- hash string
- random boolean
headers array[object]
Hide headers attributes Show headers attributes object
- key string Required
- value string Required
hosts array[string] Required

At least 1 element.
id string
is_default boolean

Default value is false.
is_default_monitoring boolean

Default value is false.
is_internal boolean
is_preconfigured boolean
key string
name string Required
partition string

Values are random, round_robin, or hash.
password array | null | boolean | number | object | string Required

Any of:
array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
proxy_id string | null
random object

Additional properties are NOT allowed.
Hide random attribute Show random attribute object
- group_events number
required_acks integer

Values are 1, 0, or -1.
round_robin object

Additional properties are NOT allowed.
Hide round_robin attribute Show round_robin attribute object
- group_events number
sasl object | null

Additional properties are NOT allowed.
Hide sasl attribute Show sasl attribute object | null
- mechanism string
  
  Values are PLAIN, SCRAM-SHA-256, or SCRAM-SHA-512.
secrets object

Additional properties are NOT allowed.
Hide secrets attributes Show secrets attributes object
- password object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
- ssl object
  
  Additional properties are NOT allowed.
  Hide ssl attribute Show ssl attribute object
  
  key object | string Required
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
shipper object | null

Additional properties are NOT allowed.
Hide shipper attributes Show shipper attributes object | null
- compression_level number | null Required
- disk_queue_compression_enabled boolean | null Required
- disk_queue_enabled boolean | null
  
  Default value is false.
- disk_queue_encryption_enabled boolean | null Required
- disk_queue_max_size number | null Required
- disk_queue_path string | null Required
- loadbalance boolean | null Required
- max_batch_bytes number | null Required
- mem_queue_events number | null Required
- queue_flush_timeout number | null Required
ssl object | null

Additional properties are NOT allowed.
Hide ssl attributes Show ssl attributes object | null
- certificate string
- certificate_authorities array[string]
- key string
- verification_mode string
  
  Values are full, none, certificate, or strict.
timeout number
topic string
type string Required

Value is kafka.
username array | null | boolean | number | object | string Required

Any of:
array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
version string

Responses

200 application/json
Hide response attribute Show response attribute object
- item object Required
  
  Any of:
  object-1 object object-2 object object-3 object object-4 object
  
  Hide attributes Show attributes
  
  allow_edit array[string]
  
  ca_sha256 string | null
  
  ca_trusted_fingerprint string | null
  
  config_yaml string | null
  
  hosts array[string(uri)] Required
  
  At least 1 element.
  
  id string
  
  is_default boolean
  
  Default value is false.
  
  is_default_monitoring boolean
  
  Default value is false.
  
  is_internal boolean
  
  is_preconfigured boolean
  
  name string Required
  
  preset string
  
  Values are balanced, custom, throughput, scale, or latency.
  
  proxy_id string | null
  
  secrets object
  
  Additional properties are allowed.
  
  Hide secrets attribute Show secrets attribute object
  
  ssl object
  
  Additional properties are allowed.
  
  Hide ssl attribute Show ssl attribute object
  
  key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  shipper object | null
  
  Additional properties are allowed.
  
  Hide shipper attributes Show shipper attributes object | null
  
  compression_level number | null Required
  
  disk_queue_compression_enabled boolean | null Required
  
  disk_queue_enabled boolean | null
  
  Default value is false.
  
  disk_queue_encryption_enabled boolean | null Required
  
  disk_queue_max_size number | null Required
  
  disk_queue_path string | null Required
  
  loadbalance boolean | null Required
  
  max_batch_bytes number | null Required
  
  mem_queue_events number | null Required
  
  queue_flush_timeout number | null Required
  
  ssl object | null
  
  Additional properties are allowed.
  
  Hide ssl attributes Show ssl attributes object | null
  
  certificate string
  
  certificate_authorities array[string]
  
  key string
  
  verification_mode string
  
  Values are full, none, certificate, or strict.
  
  type string Required
  
  Value is elasticsearch.
  
  Hide attributes Show attributes
  
  allow_edit array[string]
  
  ca_sha256 string | null
  
  ca_trusted_fingerprint string | null
  
  config_yaml string | null
  
  hosts array[string(uri)] Required
  
  At least 1 element.
  
  id string
  
  is_default boolean
  
  Default value is false.
  
  is_default_monitoring boolean
  
  Default value is false.
  
  is_internal boolean
  
  is_preconfigured boolean
  
  kibana_api_key string | null
  
  kibana_url string | null
  
  name string Required
  
  preset string
  
  Values are balanced, custom, throughput, scale, or latency.
  
  proxy_id string | null
  
  secrets object
  
  Additional properties are allowed.
  
  Hide secrets attributes Show secrets attributes object
  
  kibana_api_key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  service_token object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  ssl object
  
  Additional properties are allowed.
  
  Hide ssl attribute Show ssl attribute object
  
  key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  service_token string | null
  
  shipper object | null
  
  Additional properties are allowed.
  
  Hide shipper attributes Show shipper attributes object | null
  
  compression_level number | null Required
  
  disk_queue_compression_enabled boolean | null Required
  
  disk_queue_enabled boolean | null
  
  Default value is false.
  
  disk_queue_encryption_enabled boolean | null Required
  
  disk_queue_max_size number | null Required
  
  disk_queue_path string | null Required
  
  loadbalance boolean | null Required
  
  max_batch_bytes number | null Required
  
  mem_queue_events number | null Required
  
  queue_flush_timeout number | null Required
  
  ssl object | null
  
  Additional properties are allowed.
  
  Hide ssl attributes Show ssl attributes object | null
  
  certificate string
  
  certificate_authorities array[string]
  
  key string
  
  verification_mode string
  
  Values are full, none, certificate, or strict.
  
  sync_integrations boolean
  
  type string Required
  
  Value is remote_elasticsearch.
  
  Hide attributes Show attributes
  
  allow_edit array[string]
  
  ca_sha256 string | null
  
  ca_trusted_fingerprint string | null
  
  config_yaml string | null
  
  hosts array[string] Required
  
  At least 1 element.
  
  id string
  
  is_default boolean
  
  Default value is false.
  
  is_default_monitoring boolean
  
  Default value is false.
  
  is_internal boolean
  
  is_preconfigured boolean
  
  name string Required
  
  proxy_id string | null
  
  secrets object
  
  Additional properties are allowed.
  
  Hide secrets attribute Show secrets attribute object
  
  ssl object
  
  Additional properties are allowed.
  
  Hide ssl attribute Show ssl attribute object
  
  key object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  shipper object | null
  
  Additional properties are allowed.
  
  Hide shipper attributes Show shipper attributes object | null
  
  compression_level number | null Required
  
  disk_queue_compression_enabled boolean | null Required
  
  disk_queue_enabled boolean | null
  
  Default value is false.
  
  disk_queue_encryption_enabled boolean | null Required
  
  disk_queue_max_size number | null Required
  
  disk_queue_path string | null Required
  
  loadbalance boolean | null Required
  
  max_batch_bytes number | null Required
  
  mem_queue_events number | null Required
  
  queue_flush_timeout number | null Required
  
  ssl object | null
  
  Additional properties are allowed.
  
  Hide ssl attributes Show ssl attributes object | null
  
  certificate string
  
  certificate_authorities array[string]
  
  key string
  
  verification_mode string
  
  Values are full, none, certificate, or strict.
  
  type string Required
  
  Value is logstash.
  
  Hide attributes Show attributes
  
  allow_edit array[string]
  
  auth_type string Required
  
  Values are none, user_pass, ssl, or kerberos.
  
  broker_timeout number
  
  ca_sha256 string | null
  
  ca_trusted_fingerprint string | null
  
  client_id string
  
  compression string
  
  Values are gzip, snappy, lz4, or none.
  
  compression_level array | null | boolean | number | object | string Required
  
  Any of:
  array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
  
  config_yaml string | null
  
  connection_type array | null | boolean | number | object | string Required
  
  Any of:
  array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
  
  hash object
  
  Additional properties are allowed.
  
  Hide hash attributes Show hash attributes object
  
  hash string
  
  random boolean
  
  headers array[object]
  
  Hide headers attributes Show headers attributes object
  
  key string Required
  
  value string Required
  
  hosts array[string] Required
  
  At least 1 element.
  
  id string
  
  is_default boolean
  
  Default value is false.
  
  is_default_monitoring boolean
  
  Default value is false.
  
  is_internal boolean
  
  is_preconfigured boolean
  
  key string
  
  name string Required
  
  partition string
  
  Values are random, round_robin, or hash.
  
  password array | null | boolean | number | object | string Required
  
  Any of:
  array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
  
  proxy_id string | null
  
  random object
  
  Additional properties are allowed.
  
  Hide random attribute Show random attribute object
  
  group_events number
  
  required_acks integer
  
  Values are 1, 0, or -1.
  
  round_robin object
  
  Additional properties are allowed.
  
  Hide round_robin attribute Show round_robin attribute object
  
  group_events number
  
  sasl object | null
  
  Additional properties are allowed.
  
  Hide sasl attribute Show sasl attribute object | null
  
  mechanism string
  
  Values are PLAIN, SCRAM-SHA-256, or SCRAM-SHA-512.
  
  secrets object
  
  Additional properties are allowed.
  
  Hide secrets attributes Show secrets attributes object
  
  password object | string
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  ssl object
  
  Additional properties are allowed.
  
  Hide ssl attribute Show ssl attribute object
  
  key object | string Required
  
  Any of:
  object-1 object string-2 string
  
  Hide attribute Show attribute
  
  id string Required
  
  shipper object | null
  
  Additional properties are allowed.
  
  Hide shipper attributes Show shipper attributes object | null
  
  compression_level number | null Required
  
  disk_queue_compression_enabled boolean | null Required
  
  disk_queue_enabled boolean | null
  
  Default value is false.
  
  disk_queue_encryption_enabled boolean | null Required
  
  disk_queue_max_size number | null Required
  
  disk_queue_path string | null Required
  
  loadbalance boolean | null Required
  
  max_batch_bytes number | null Required
  
  mem_queue_events number | null Required
  
  queue_flush_timeout number | null Required
  
  ssl object | null
  
  Additional properties are allowed.
  
  Hide ssl attributes Show ssl attributes object | null
  
  certificate string
  
  certificate_authorities array[string]
  
  key string
  
  verification_mode string
  
  Values are full, none, certificate, or strict.
  
  timeout number
  
  topic string
  
  type string Required
  
  Value is kafka.
  
  username array | null | boolean | number | object | string Required
  
  Any of:
  array-1 array | null boolean-2 boolean | null number-3 number | null object-4 object | null string-5 string | null
  
  version string
400 application/json
Hide response attributes Show response attributes object
- error string
- errorType string
- message string Required
- statusCode number

POST /api/fleet/outputs

curl \
 --request POST 'https://localhost:5601/api/fleet/outputs' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"allow_edit":["string"],"ca_sha256":"string","ca_trusted_fingerprint":"string","config_yaml":"string","hosts":["https://example.com"],"id":"string","is_default":false,"is_default_monitoring":false,"is_internal":true,"is_preconfigured":true,"name":"string","preset":"balanced","proxy_id":"string","secrets":{"ssl":{"key":{"id":"string"}}},"shipper":{"compression_level":42.0,"disk_queue_compression_enabled":true,"disk_queue_enabled":false,"disk_queue_encryption_enabled":true,"disk_queue_max_size":42.0,"disk_queue_path":"string","loadbalance":true,"max_batch_bytes":42.0,"mem_queue_events":42.0,"queue_flush_timeout":42.0},"ssl":{"certificate":"string","certificate_authorities":["string"],"key":"string","verification_mode":"full"},"type":"elasticsearch"}'

Request examples

# Headers
kbn-xsrf: true

# Payload
{
  "allow_edit": [
    "string"
  ],
  "ca_sha256": "string",
  "ca_trusted_fingerprint": "string",
  "config_yaml": "string",
  "hosts": [
    "https://example.com"
  ],
  "id": "string",
  "is_default": false,
  "is_default_monitoring": false,
  "is_internal": true,
  "is_preconfigured": true,
  "name": "string",
  "preset": "balanced",
  "proxy_id": "string",
  "secrets": {
    "ssl": {
      "key": {
        "id": "string"
      }
    }
  },
  "shipper": {
    "compression_level": 42.0,
    "disk_queue_compression_enabled": true,
    "disk_queue_enabled": false,
    "disk_queue_encryption_enabled": true,
    "disk_queue_max_size": 42.0,
    "disk_queue_path": "string",
    "loadbalance": true,
    "max_batch_bytes": 42.0,
    "mem_queue_events": 42.0,
    "queue_flush_timeout": 42.0
  },
  "ssl": {
    "certificate": "string",
    "certificate_authorities": [
      "string"
    ],
    "key": "string",
    "verification_mode": "full"
  },
  "type": "elasticsearch"
}

# Headers
kbn-xsrf: true

# Payload
{
  "allow_edit": [
    "string"
  ],
  "ca_sha256": "string",
  "ca_trusted_fingerprint": "string",
  "config_yaml": "string",
  "hosts": [
    "https://example.com"
  ],
  "id": "string",
  "is_default": false,
  "is_default_monitoring": false,
  "is_internal": true,
  "is_preconfigured": true,
  "kibana_api_key": "string",
  "kibana_url": "string",
  "name": "string",
  "preset": "balanced",
  "proxy_id": "string",
  "secrets": {
    "kibana_api_key": {
      "id": "string"
    },
    "service_token": {
      "id": "string"
    },
    "ssl": {
      "key": {
        "id": "string"
      }
    }
  },
  "service_token": "string",
  "shipper": {
    "compression_level": 42.0,
    "disk_queue_compression_enabled": true,
    "disk_queue_enabled": false,
    "disk_queue_encryption_enabled": true,
    "disk_queue_max_size": 42.0,
    "disk_queue_path": "string",
    "loadbalance": true,
    "max_batch_bytes": 42.0,
    "mem_queue_events": 42.0,
    "queue_flush_timeout": 42.0
  },
  "ssl": {
    "certificate": "string",
    "certificate_authorities": [
      "string"
    ],
    "key": "string",
    "verification_mode": "full"
  },
  "sync_integrations": true,
  "type": "remote_elasticsearch"
}

# Headers
kbn-xsrf: true

# Payload
{
  "allow_edit": [
    "string"
  ],
  "ca_sha256": "string",
  "ca_trusted_fingerprint": "string",
  "config_yaml": "string",
  "hosts": [
    "string"
  ],
  "id": "string",
  "is_default": false,
  "is_default_monitoring": false,
  "is_internal": true,
  "is_preconfigured": true,
  "name": "string",
  "proxy_id": "string",
  "secrets": {
    "ssl": {
      "key": {
        "id": "string"
      }
    }
  },
  "shipper": {
    "compression_level": 42.0,
    "disk_queue_compression_enabled": true,
    "disk_queue_enabled": false,
    "disk_queue_encryption_enabled": true,
    "disk_queue_max_size": 42.0,
    "disk_queue_path": "string",
    "loadbalance": true,
    "max_batch_bytes": 42.0,
    "mem_queue_events": 42.0,
    "queue_flush_timeout": 42.0
  },
  "ssl": {
    "certificate": "string",
    "certificate_authorities": [
      "string"
    ],
    "key": "string",
    "verification_mode": "full"
  },
  "type": "logstash"
}

# Headers
kbn-xsrf: true

# Payload
{
  "allow_edit": [
    "string"
  ],
  "auth_type": "none",
  "broker_timeout": 42.0,
  "ca_sha256": "string",
  "ca_trusted_fingerprint": "string",
  "client_id": "string",
  "compression": "gzip",
  "compression_level": [],
  "config_yaml": "string",
  "connection_type": [],
  "hash": {
    "hash": "string",
    "random": true
  },
  "headers": [
    {
      "key": "string",
      "value": "string"
    }
  ],
  "hosts": [
    "string"
  ],
  "id": "string",
  "is_default": false,
  "is_default_monitoring": false,
  "is_internal": true,
  "is_preconfigured": true,
  "key": "string",
  "name": "string",
  "partition": "random",
  "password": [],
  "proxy_id": "string",
  "random": {
    "group_events": 42.0
  },
  "required_acks": 1,
  "round_robin": {
    "group_events": 42.0
  },
  "sasl": {
    "mechanism": "PLAIN"
  },
  "secrets": {
    "password": {
      "id": "string"
    },
    "ssl": {
      "key": {
        "id": "string"
      }
    }
  },
  "shipper": {
    "compression_level": 42.0,
    "disk_queue_compression_enabled": true,
    "disk_queue_enabled": false,
    "disk_queue_encryption_enabled": true,
    "disk_queue_max_size": 42.0,
    "disk_queue_path": "string",
    "loadbalance": true,
    "max_batch_bytes": 42.0,
    "mem_queue_events": 42.0,
    "queue_flush_timeout": 42.0
  },
  "ssl": {
    "certificate": "string",
    "certificate_authorities": [
      "string"
    ],
    "key": "string",
    "verification_mode": "full"
  },
  "timeout": 42.0,
  "topic": "string",
  "type": "kafka",
  "username": [],
  "version": "string"
}

Response examples (200)

{
  "item": {
    "allow_edit": [
      "string"
    ],
    "ca_sha256": "string",
    "ca_trusted_fingerprint": "string",
    "config_yaml": "string",
    "hosts": [
      "https://example.com"
    ],
    "id": "string",
    "is_default": false,
    "is_default_monitoring": false,
    "is_internal": true,
    "is_preconfigured": true,
    "name": "string",
    "preset": "balanced",
    "proxy_id": "string",
    "secrets": {
      "ssl": {
        "key": {
          "id": "string"
        }
      }
    },
    "shipper": {
      "compression_level": 42.0,
      "disk_queue_compression_enabled": true,
      "disk_queue_enabled": false,
      "disk_queue_encryption_enabled": true,
      "disk_queue_max_size": 42.0,
      "disk_queue_path": "string",
      "loadbalance": true,
      "max_batch_bytes": 42.0,
      "mem_queue_events": 42.0,
      "queue_flush_timeout": 42.0
    },
    "ssl": {
      "certificate": "string",
      "certificate_authorities": [
        "string"
      ],
      "key": "string",
      "verification_mode": "full"
    },
    "type": "elasticsearch"
  }
}

Response examples (400)

{
  "error": "string",
  "errorType": "string",
  "message": "string",
  "statusCode": 42.0
}

Create a KnowledgeBase

POST /api/security_ai_assistant/knowledge_base/{resource}

Api key auth Basic auth

Create a KnowledgeBase

Path parameters

resource string

The KnowledgeBase resource value.

Query parameters

modelId string

Optional ELSER modelId to use when setting up the Knowledge Base
ignoreSecurityLabs boolean

Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base

Default value is false.

Responses

200 application/json

Indicates a successful call.
Hide response attribute Show response attribute object
- success boolean
  
  Identify the success of the method execution.
400 application/json

Generic Error
Hide response attributes Show response attributes object
- error string
- message string
- statusCode number

POST /api/security_ai_assistant/knowledge_base/{resource}

curl \
 --request POST 'https://localhost:5601/api/security_ai_assistant/knowledge_base/{resource}' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "success": true
}

Response examples (400)

{
  "error": "string",
  "message": "string",
  "statusCode": 42.0
}

Clean up detection alert migrations Deprecated

DELETE /api/detection_engine/signals/migration

Api key auth Basic auth

Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of the migration process. A successful migration will result in both the old and new indices being present. As such, the old, orphaned index can (and likely should) be deleted.

While you can delete these indices manually, the endpoint accomplishes this task by applying a deletion policy to the relevant index, causing it to be deleted after 30 days. It also deletes other artifacts specific to the migration implementation.

application/json

Body Required

Array of migration_ids to cleanup

migration_ids array[string] Required

Array of migration_ids to cleanup.

At least 1 element.

Responses

200 application/json

Successful response
Hide response attributes Show response attributes object
- destinationIndex string Required
- error object
  
  Hide error attributes Show error attributes object
  
  message string Required
  
  status_code integer Required
- id string Required
- sourceIndex string Required
- status string Required
  
  Values are success, failure, or pending.
- updated string(date-time) Required
- version string Required
400 application/json

Invalid input data response
One of:
Security_Detections_API_PlatformErrorResponse object Security_Detections_API_SiemErrorResponse object
Hide attributes Show attributes

error string Required

message string Required

statusCode integer Required
Hide attributes Show attributes

message string Required

status_code integer Required
401 application/json

Unsuccessful authentication response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode integer Required
500 application/json

Internal server error response
Hide response attributes Show response attributes object
- message string Required
- status_code integer Required

DELETE /api/detection_engine/signals/migration

curl \
 --request DELETE 'https://localhost:5601/api/detection_engine/signals/migration' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"migration_ids":["924f7c50-505f-11eb-ae0a-3fa2e626a51d"]}'

Request example

{
  "migration_ids": [
    "924f7c50-505f-11eb-ae0a-3fa2e626a51d"
  ]
}

Response examples (200)

{
  "migrations": [
    {
      "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
      "status": "success",
      "updated": "2021-01-06T22:05:56.859Z",
      "version": 16,
      "sourceIndex": ".siem-signals-default-000002",
      "destinationIndex": ".siem-signals-default-000002-r000016"
    }
  ]
}

Response examples (400)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

{
  "message": "string",
  "status_code": 42
}

Response examples (401)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

Response examples (500)

{
  "message": "string",
  "status_code": 42
}

Update an exception list

PUT /api/exception_lists

Api key auth Basic auth

Update an exception list using the id or list_id field.

application/json

Body Required

Exception list's properties

_version string

The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
description string Required

Describes the exception list.
id string(nonempty)

Exception list's identifier.

Minimum length is 1.
list_id string(nonempty)

Exception list's human readable string identifier, e.g. trusted-linux-processes.

Minimum length is 1.
meta object

Placeholder for metadata about the list container.

Additional properties are allowed.
name string Required

The name of the exception list.
namespace_type string
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
- single: Only available in the Kibana space in which it is created.
- agnostic: Available in all Kibana spaces.
Values are agnostic or single. Default value is single.
os_types array[string]

Use this field to specify the operating system. Only enter one value.

Values are linux, macos, or windows.
tags array[string]

String array containing words and phrases to help categorize exception containers.
type string Required

The type of exception list to be created. Different list types may denote where they can be utilized.

Values are detection, rule_default, endpoint, endpoint_trusted_apps, endpoint_events, endpoint_host_isolation_exceptions, or endpoint_blocklists.
version integer

The document version, automatically increasd on updates.

Minimum value is 1.

Responses

200 application/json

Successful response
Hide response attributes Show response attributes object
- _version string
  
  The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
- created_at string(date-time) Required
  
  Autogenerated date of object creation.
- created_by string Required
  
  Autogenerated value - user that created object.
- description string Required
  
  Describes the exception list.
- id string(nonempty) Required
  
  Exception list's identifier.
  
  Minimum length is 1.
- immutable boolean Required
- list_id string(nonempty) Required
  
  Exception list's human readable string identifier, e.g. trusted-linux-processes.
  
  Minimum length is 1.
- meta object
  
  Placeholder for metadata about the list container.
  
  Additional properties are allowed.
- name string Required
  
  The name of the exception list.
- namespace_type string Required
  
  Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
  
  single: Only available in the Kibana space in which it is created.
  
  agnostic: Available in all Kibana spaces.
  
  Values are agnostic or single. Default value is single.
- os_types array[string]
  
  Use this field to specify the operating system. Only enter one value.
  
  Values are linux, macos, or windows.
- tags array[string]
  
  String array containing words and phrases to help categorize exception containers.
- tie_breaker_id string Required
  
  Field used in search to ensure all containers are sorted and returned correctly.
- type string Required
  
  The type of exception list to be created. Different list types may denote where they can be utilized.
  
  Values are detection, rule_default, endpoint, endpoint_trusted_apps, endpoint_events, endpoint_host_isolation_exceptions, or endpoint_blocklists.
- updated_at string(date-time) Required
  
  Autogenerated date of last object update.
- updated_by string Required
  
  Autogenerated value - user that last updated object.
- version integer Required
  
  The document version, automatically increasd on updates.
  
  Minimum value is 1.
400 application/json

Invalid input data response
One of:
Security_Exceptions_API_PlatformErrorResponse object Security_Exceptions_API_SiemErrorResponse object
Hide attributes Show attributes

error string Required

message string Required

statusCode integer Required
Hide attributes Show attributes

message string Required

status_code integer Required
401 application/json

Unsuccessful authentication response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode integer Required
403 application/json

Not enough privileges response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode integer Required
404 application/json

Exception list not found response
Hide response attributes Show response attributes object
- message string Required
- status_code integer Required
500 application/json

Internal server error response
Hide response attributes Show response attributes object
- message string Required
- status_code integer Required

PUT /api/exception_lists

curl \
 --request PUT 'https://localhost:5601/api/exception_lists' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"name":"Updated exception list name","tags":["draft malware"],"type":"detection","list_id":"simple_list","os_types":["linux"],"description":"Different description"}'

Request example

{
  "name": "Updated exception list name",
  "tags": [
    "draft malware"
  ],
  "type": "detection",
  "list_id": "simple_list",
  "os_types": [
    "linux"
  ],
  "description": "Different description"
}

Response examples (200)

{
  "id": "fa7f545f-191b-4d32-b1f0-c7cd62a79e55",
  "name": "Updated exception list name",
  "tags": [
    "draft malware"
  ],
  "type": "detection",
  "list_id": "simple_list",
  "version": 2,
  "_version": "WzExLDFd",
  "os_types": [],
  "immutable": false,
  "created_at": "2025-01-07T20:43:55.264Z",
  "created_by": "elastic",
  "updated_at": "2025-01-07T21:32:03.726Z",
  "updated_by": "elastic",
  "description": "Different description",
  "namespace_type": "single",
  "tie_breaker_id": "319fe983-acdd-4806-b6c4-3098eae9392f"
}

Response examples (400)

{
  "error": "Bad Request",
  "message": "[request body]: list_id: Expected string, received number",
  "statusCode": 400
}

Response examples (401)

{
  "error": "Unauthorized",
  "message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

Response examples (403)

{
  "error": "Forbidden",
  "message": "API [PUT /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
  "statusCode": 403
}

Response examples (404)

{
  "message\"": "exception list id: \"foo\" does not exist",
  "status_code\"": 404
}

Response examples (500)

{
  "message": "Internal Server Error",
  "status_code": 500
}

params object Required

dest_ip string | array[string]

malware_hash string | array[string]

malware_url string | array[string]

source_ip string | array[string]

type string Required

Body object

key object | string

key object | string

key object | string

key object | string Required

item object Required

key object | string

key object | string

key object | string

key object | string Required

Clean up detection alert migrations Deprecated

Body Required

Body Required