Body

• name string Required

  The display name for the connector.

• config object

  The connector configuration details.

  One of:

  bedrock_config object crowdstrike_config object d3security_config object email_config object gemini_config object resilient_config object index_config object jira_config object genai_azure_config object genai_openai_config object opsgenie_config object pagerduty_config object sentinelone_config object servicenow_config object servicenow_itom_config object slack_api_config object swimlane_config object thehive_config object tines_config object torq_config object webhook_config object cases_webhook_config object xmatters_config object

  Defines properties for connectors when type is .bedrock.

  Hide attributes Show attributes

  • apiUrl string Required

    The Amazon Bedrock request URL.

  • defaultModel string

    The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.

    Default value is anthropic.claude-3-5-sonnet-20240620-v1:0.

  • Additional properties are allowed

  Defines config properties for connectors when type is .crowdstrike.

  Hide attributes Show attributes

  • url string Required

    The CrowdStrike tenant URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • Additional properties are allowed

  Defines properties for connectors when type is .d3security.

  Hide attributes Show attributes

  • url string Required

    The D3 Security API request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • Additional properties are allowed

  Defines properties for connectors when type is .email.

  Hide attributes Show attributes

  • clientId string | null

    The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.

  • from string Required

    The from address for all emails sent by the connector. It must be specified in user@host-name format.

  • hasAuth boolean

    Specifies whether a user and password are required inside the secrets configuration.

    Default value is true.

  • host string

    The host name of the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.

  • oauthTokenUrl string | null
  • port integer

    The port to connect to on the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.

  • secure boolean

    Specifies whether the connection to the service provider will use TLS. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.

  • service string

    The name of the email service.

    Values are elastic_cloud, exchange_server, gmail, other, outlook365, or ses.

  • tenantId string | null

    The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.

  • Additional properties are allowed

  Defines properties for connectors when type is .gemini.

  Hide attributes Show attributes

  • apiUrl string Required

    The Google Gemini request URL.

  • defaultModel string

    The generative artificial intelligence model for Google Gemini to use.

    Default value is gemini-1.5-pro-001.

  • gcpRegion string Required

    The GCP region where the Vertex AI endpoint enabled.

  • gcpProjectID string Required

    The Google ProjectID that has Vertex AI endpoint enabled.

  • Additional properties are allowed

  Defines properties for connectors when type is .resilient.

  Hide attributes Show attributes

  • apiUrl string Required

    The IBM Resilient instance URL.

  • orgId string Required

    The IBM Resilient organization ID.

  • Additional properties are allowed

  Defines properties for connectors when type is .index.

  Hide attributes Show attributes

  • executionTimeField string | null

    A field that indicates when the document was indexed.

  • index string Required

    The Elasticsearch index to be written to.

  • refresh boolean

    The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.

    Default value is false.

  • Additional properties are allowed

  Defines properties for connectors when type is .jira.

  Hide attributes Show attributes

  • apiUrl string Required

    The Jira instance URL.

  • projectKey string Required

    The Jira project key.

  • Additional properties are allowed

  Defines properties for connectors when type is .gen-ai and the API provider is Azure OpenAI.

  Hide attributes Show attributes

  • apiProvider string Required

    The OpenAI API provider.

    Value is Azure OpenAI.

  • apiUrl string Required

    The OpenAI API endpoint.

  • Additional properties are allowed

  Defines properties for connectors when type is .gen-ai and the API provider is OpenAI.

  Hide attributes Show attributes

  • apiProvider string Required

    The OpenAI API provider.

    Value is OpenAI.

  • apiUrl string Required

    The OpenAI API endpoint.

  • defaultModel string

    The default model to use for requests.

  • Additional properties are allowed

  Defines properties for connectors when type is .opsgenie.

  Hide attributes Show attributes

  • apiUrl string Required

    The Opsgenie URL. For example, https://api.opsgenie.com or https://api.eu.opsgenie.com. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • Additional properties are allowed

  Defines properties for connectors when type is .pagerduty.

  Hide attributes Show attributes

  • apiUrl string | null

    The PagerDuty event URL.

  • Additional properties are allowed

  Defines properties for connectors when type is .sentinelone.

  Hide attributes Show attributes

  • url string Required

    The SentinelOne tenant URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • Additional properties are allowed

  Defines properties for connectors when type is .servicenow.

  Hide attributes Show attributes

  • apiUrl string Required

    The ServiceNow instance URL.

  • clientId string

    The client ID assigned to your OAuth application. This property is required when isOAuth is true.

  • isOAuth boolean

    The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

    Default value is false.

  • jwtKeyId string

    The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

  • userIdentifierValue string

    The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.

  • usesTableApi boolean

    Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to false, the Elastic application should be installed in ServiceNow.

    Default value is true.

  • Additional properties are allowed

  Defines properties for connectors when type is .servicenow-itom.

  Hide attributes Show attributes

  • apiUrl string Required

    The ServiceNow instance URL.

  • clientId string

    The client ID assigned to your OAuth application. This property is required when isOAuth is true.

  • isOAuth boolean

    The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

    Default value is false.

  • jwtKeyId string

    The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

  • userIdentifierValue string

    The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.

  • Additional properties are allowed

  Defines properties for connectors when type is .slack_api.

  Hide attributes Show attributes

  • allowedChannels array[object]

    A list of valid Slack channels.

    Hide allowedChannels attributes Show allowedChannels attributes object

    • id string Required

      The Slack channel ID.

      Minimum length is 1.

    • name string Required

      The Slack channel name.

      Minimum length is 1.

  • Additional properties are allowed

  Defines properties for connectors when type is .swimlane.

  Hide attributes Show attributes

  • apiUrl string Required

    The Swimlane instance URL.

  • appId string Required

    The Swimlane application ID.

  • connectorType string Required

    The type of connector. Valid values are all, alerts, and cases.

    Values are all, alerts, or cases.

  • mappings object

    The field mapping.

    Hide mappings attributes Show mappings attributes object

    • alertIdConfig object

      Mapping for the alert ID.

      Hide alertIdConfig attributes Show alertIdConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

    • caseIdConfig object

      Mapping for the case ID.

      Hide caseIdConfig attributes Show caseIdConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

    • caseNameConfig object

      Mapping for the case name.

      Hide caseNameConfig attributes Show caseNameConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

    • commentsConfig object

      Mapping for the case comments.

      Hide commentsConfig attributes Show commentsConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

    • descriptionConfig object

      Mapping for the case description.

      Hide descriptionConfig attributes Show descriptionConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

    • ruleNameConfig object

      Mapping for the name of the alert's rule.

      Hide ruleNameConfig attributes Show ruleNameConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

    • severityConfig object

      Mapping for the severity.

      Hide severityConfig attributes Show severityConfig attributes object

      • fieldType string Required

        The type of field in Swimlane.

      • id string Required

        The identifier for the field in Swimlane.

      • key string Required

        The key for the field in Swimlane.

      • name string Required

        The name of the field in Swimlane.

  • Additional properties are allowed

  Defines configuration properties for connectors when type is .thehive.

  Hide attributes Show attributes

  • organisation string

    The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.

  • url string Required

    The instance URL in TheHive. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • Additional properties are allowed

  Defines properties for connectors when type is .tines.

  Hide attributes Show attributes

  • url string Required

    The Tines tenant URL. If you are using the xpack.actions.allowedHosts setting, make sure this hostname is added to the allowed hosts.

  • Additional properties are allowed

  Defines properties for connectors when type is .torq.

  Hide attributes Show attributes

  • webhookIntegrationUrl string Required

    The endpoint URL of the Elastic Security integration in Torq.

  • Additional properties are allowed

  Defines properties for connectors when type is .webhook.

  Hide attributes Show attributes

  • authType string | null

    The type of authentication to use: basic, SSL, or none.

    Values are webhook-authentication-basic or webhook-authentication-ssl.

  • ca string

    A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.

  • certType string

    If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.

    Values are ssl-crt-key or ssl-pfx.

  • hasAuth boolean

    If true, a username and password for login type authentication must be provided.

    Default value is true.

  • headers object | null

    A set of key-value pairs sent as headers with the request.

  • method string

    The HTTP request method, either post or put.

    Values are post or put. Default value is post.

  • url string

    The request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • verificationMode string

    Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.

    Values are certificate, full, or none. Default value is full.

  • Additional properties are allowed

  Defines properties for connectors when type is .cases-webhook.

  Hide attributes Show attributes

  • authType string | null

    The type of authentication to use: basic, SSL, or none.

    Values are webhook-authentication-basic or webhook-authentication-ssl.

  • ca string

    A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.

  • certType string

    If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.

    Values are ssl-crt-key or ssl-pfx.

  • createCommentJson string

    A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is case.comment. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

  • createCommentMethod string

    The REST API HTTP request method to create a case comment in the third-party system. Valid values are patch, post, and put.

    Values are patch, post, or put. Default value is put.

  • createCommentUrl string

    The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • createIncidentJson string Required

    A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

  • createIncidentMethod string

    The REST API HTTP request method to create a case in the third-party system. Valid values are patch, post, and put.

    Values are patch, post, or put. Default value is post.

  • createIncidentResponseKey string Required

    The JSON key in the create external case response that contains the case ID.

  • createIncidentUrl string Required

    The REST API URL to create a case in the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • getIncidentResponseExternalTitleKey string Required

    The JSON key in get external case response that contains the case title.

  • getIncidentUrl string Required

    The REST API URL to get the case by ID from the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

  • hasAuth boolean

    If true, a username and password for login type authentication must be provided.

    Default value is true.

  • headers string

    A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.

  • updateIncidentJson string Required

    The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

  • updateIncidentMethod string

    The REST API HTTP request method to update the case in the third-party system. Valid values are patch, post, and put.

    Values are patch, post, or put. Default value is put.

  • updateIncidentUrl string Required

    The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • verificationMode string

    Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.

    Values are certificate, full, or none. Default value is full.

  • viewIncidentUrl string Required

    The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.

  • Additional properties are allowed

  Defines properties for connectors when type is .xmatters.

  Hide attributes Show attributes

  • configUrl string | null

    The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when usesBasic is true.

  • usesBasic boolean

    Specifies whether the connector uses HTTP basic authentication (true) or URL authentication (false).

    Default value is true.

  • Additional properties are allowed

• secrets object

  One of:

  bedrock_secrets object crowdstrike_secrets object d3security_secrets object email_secrets object gemini_secrets object resilient_secrets object jira_secrets object teams_secrets object genai_secrets object opsgenie_secrets object pagerduty_secrets object sentinelone_secrets object servicenow_secrets object slack_api_secrets object swimlane_secrets object thehive_secrets object tines_secrets object torq_secrets object webhook_secrets object cases_webhook_secrets object xmatters_secrets object

  Defines secrets for connectors when type is .bedrock.

  Hide attributes Show attributes

  • accessKey string Required

    The AWS access key for authentication.

  • secret string Required

    The AWS secret for authentication.

  • Additional properties are allowed

  Defines secrets for connectors when type is .crowdstrike.

  Hide attributes Show attributes

  • clientId string Required

    The CrowdStrike API client identifier.

  • clientSecret string Required

    The CrowdStrike API client secret to authenticate the clientId.

  • Additional properties are allowed

  Defines secrets for connectors when type is .d3security.

  Hide attributes Show attributes

  • token string Required

    The D3 Security token.

  • Additional properties are allowed

  Defines secrets for connectors when type is .email.

  Hide attributes Show attributes

  • clientSecret string

    The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If service is exchange_server, this property is required.

  • password string

    The password for HTTP basic authentication. If hasAuth is set to true, this property is required.

  • user string

    The username for HTTP basic authentication. If hasAuth is set to true, this property is required.

  • Additional properties are allowed

  Defines secrets for connectors when type is .gemini.

  Hide attributes Show attributes

  • credentialsJSON string Required

    The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it.

  • Additional properties are allowed

  Defines secrets for connectors when type is .resilient.

  Hide attributes Show attributes

  • apiKeyId string Required

    The authentication key ID for HTTP Basic authentication.

  • apiKeySecret string Required

    The authentication key secret for HTTP Basic authentication.

  • Additional properties are allowed

  Defines secrets for connectors when type is .jira.

  Hide attributes Show attributes

  • apiToken string Required

    The Jira API authentication token for HTTP basic authentication.

  • email string Required

    The account email for HTTP Basic authentication.

  • Additional properties are allowed

  Defines secrets for connectors when type is .teams.

  Hide attributes Show attributes

  • webhookUrl string Required

    The URL of the incoming webhook. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

  • Additional properties are allowed

  Defines secrets for connectors when type is .gen-ai.

  Hide attributes Show attributes

  • apiKey string

    The OpenAI API key.

  • Additional properties are allowed

  Defines secrets for connectors when type is .opsgenie.

  Hide attributes Show attributes

  • apiKey string Required

    The Opsgenie API authentication key for HTTP Basic authentication.

  • Additional properties are allowed

  Defines secrets for connectors when type is .pagerduty.

  Hide attributes Show attributes

  • routingKey string Required

    A 32 character PagerDuty Integration Key for an integration on a service.

  • Additional properties are allowed

  Defines secrets for connectors when type is .sentinelone.

  Hide attributes Show attributes

  • token string Required

    The A SentinelOne API token.

  • Additional properties are allowed

  Defines secrets for connectors when type is .servicenow, .servicenow-sir, or .servicenow-itom.

  Hide attributes Show attributes

  • clientSecret string

    The client secret assigned to your OAuth application. This property is required when isOAuth is true.

  • password string

    The password for HTTP basic authentication. This property is required when isOAuth is false.

  • privateKey string

    The RSA private key that you created for use in ServiceNow. This property is required when isOAuth is true.

  • privateKeyPassword string

    The password for the RSA private key. This property is required when isOAuth is true and you set a password on your private key.

  • username string

    The username for HTTP basic authentication. This property is required when isOAuth is false.

  • Additional properties are allowed

  Defines secrets for connectors when type is .slack.

  Hide attributes Show attributes

  • token string Required

    Slack bot user OAuth token.

  • Additional properties are allowed

  Defines secrets for connectors when type is .swimlane.

  Hide attributes Show attributes

  • apiToken string

    Swimlane API authentication token.

  • Additional properties are allowed

  Defines secrets for connectors when type is .thehive.

  Hide attributes Show attributes

  • apiKey string Required

    The API key for authentication in TheHive.

  • Additional properties are allowed

  Defines secrets for connectors when type is .tines.

  Hide attributes Show attributes

  • email string Required

    The email used to sign in to Tines.

  • token string Required

    The Tines API token.

  • Additional properties are allowed

  Defines secrets for connectors when type is .torq.

  Hide attributes Show attributes

  • token string Required

    The secret of the webhook authentication header.

  • Additional properties are allowed

  Defines secrets for connectors when type is .webhook.

  Hide attributes Show attributes

  • crt string

    If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the CRT or CERT file.

  • key string

    If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the KEY file.

  • pfx string

    If authType is webhook-authentication-ssl and certType is ssl-pfx, it is a base64 encoded version of the PFX or P12 file.

  • password string

    The password for HTTP basic authentication or the passphrase for the SSL certificate files. If hasAuth is set to true and authType is webhook-authentication-basic, this property is required.

  • user string

    The username for HTTP basic authentication. If hasAuth is set to true and authType is webhook-authentication-basic, this property is required.

  • Additional properties are allowed

  Hide attributes Show attributes

  • crt string

    If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the CRT or CERT file.

  • key string

    If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the KEY file.

  • pfx string

    If authType is webhook-authentication-ssl and certType is ssl-pfx, it is a base64 encoded version of the PFX or P12 file.

  • password string

    The password for HTTP basic authentication. If hasAuth is set to true and and authType is webhook-authentication-basic, this property is required.

  • user string

    The username for HTTP basic authentication. If hasAuth is set to true and authType is webhook-authentication-basic, this property is required.

  • Additional properties are allowed

  Defines secrets for connectors when type is .xmatters.

  Hide attributes Show attributes

  • password string

    A user name for HTTP basic authentication. It is applicable only when usesBasic is true.

  • secretsUrl string

    The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when usesBasic is false.

  • user string

    A password for HTTP basic authentication. It is applicable only when usesBasic is true.

  • Additional properties are allowed
• Additional properties are NOT allowed