Body Required

• description string | null
• enabled boolean | null
• name string
• policy_ids array[string] | null
• queries object
  Hide queries attribute Show queries attribute object

  • * object Additional properties

    Additional properties are allowed.

    Hide * attributes Show * attributes object

    • ecs_mapping object | null
      Hide ecs_mapping attribute Show ecs_mapping attribute object | null

      • * object Additional properties

        Additional properties are allowed.

        Hide * attributes Show * attributes object

        • field string

        • value string | array[string]

          One of:

          string-1 string array-2 array[string]
    • id string
    • platform string | null
    • query string
    • removed boolean | null
    • saved_query_id string | null
    • snapshot boolean | null
    • version string | null
• shards object
  Hide shards attribute Show shards attribute object

  • * number Additional properties