Elastic Kibana 7 - Security

Elastic Kibana V7

This connector is for Elastic Security, both on-premises and Elastic Cloud versions starting with 7.9.0. The primary focus is on the Elastic Security feature of Kibana, but this uses additional APIs for Kibana.

Prerequisites

This connector has only been tested using Elasticsearch & Kibana on-premises & Elastic Cloud 7.16.

Depending on how your organization has setup Elasticsearch/Kibana/etc., you need to make sure that the following requirements have been met:

Create or know which Kibana space they will primarily use.

Create a signal index. This index needs to be in the following format .siem-signals-<Kibana Space Name>. Using the Default Kibana space this would be .siem-signals-default.

Create detection rule(s) or load Elastic's Pre-Packaged Detection Rules

Asset Setup

Connecting to Elastic Cloud

In order to use this connector with Elastic Cloud you must provide the following inputs in the configured asset:

host

port

api_key

If you generated a ApiKey from within the Elastic Cloud portal you may have need run the following commands to generate the correct ApiKey:

echo "<your-base64-encoded-api-key>" | base64 -d

Which will result in a value similar to the following:

<api-id>:<api-secret>

Then take this value and decode it again

echo -n "<api-id>:<api-secret>" | base64

This will result in the correct ApiKey.

Connecting to On-Premises

In order to use this connector with an on-premises Elasticsearch and Kibana, you must provide the following inputs in the configured asset:

host

port

username

password

Common Issues

Within the asset if you receive an error about the host, please remove any trailing slashes from the host string.

Notes

For more information, see the Elactic Security API Documentation (7.16)).

This connector was last tested against product version: Elastic Kibana 7.16.3

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
Authorization	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Find Cases

Retrieves a paginated subset of cases

Endpoint

URL: api/cases/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Parameters for the Find Cases action
parameters.perPage	number	Optional	Parameters for the Find Cases action
parameters.sortField	string	Optional	Parameters for the Find Cases action
parameters.sortOrder	string	Optional	Parameters for the Find Cases action
parameters.tags	string	Optional	Parameters for the Find Cases action
parameters.owner	string	Optional	Parameters for the Find Cases action
parameters.status	string	Optional	Parameters for the Find Cases action
parameters.reporters	string	Optional	Parameters for the Find Cases action

Input Example

{"parameters":{"page":1,"perPage":5,"sortField":"updatedAt","sortOrder":"asc","tags":"phishing","owner":"owner","status":"open","reporters":"username"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
page	number	Output field: page
per_page	number	Output field: per_page
total	number	Output field: total
cases	array	Output field: cases
cases.id	string	Unique identifier
cases.version	string	Output field: cases.version
cases.comments	array	Output field: cases.comments
cases.comments.file_name	string	Name of the resource
cases.comments.file	string	Output field: cases.comments.file
cases.totalComment	number	Output field: cases.totalComment
cases.closed_at	object	Output field: cases.closed_at
cases.closed_by	object	Output field: cases.closed_by
cases.created_at	string	Output field: cases.created_at
cases.created_by	object	Output field: cases.created_by
cases.created_by.email	string	Output field: cases.created_by.email
cases.created_by.full_name	string	Name of the resource
cases.created_by.username	string	Name of the resource
cases.external_service	object	Output field: cases.external_service
cases.updated_at	string	Output field: cases.updated_at
cases.updated_by	object	Output field: cases.updated_by
cases.updated_by.full_name	string	Name of the resource
cases.updated_by.email	string	Output field: cases.updated_by.email
cases.updated_by.username	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 20:12:56 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=d6ea1d0735c74352","x-srv-span":"v=1;s=5a6153fa9cd5d837","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674493629","ETag":"W/\"a4-7hO0T/XLq3TuFViTu2ZVQQdIY+A\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Get Case

Returns the specified case

Endpoint

URL: api/cases/{{case_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.case_id	string	Required	Parameters for the Get Case action
parameters.includeComments	boolean	Optional	Parameters for the Get Case action

Input Example

{"parameters":{"includeComments":true},"path_parameters":{"case_id":"a18b38a0-71b0-11ea-a0b2-c51ea50a58e2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
version	string	Output field: version
comments	array	Output field: comments
comments.file_name	string	Name of the resource
comments.file	string	Output field: comments.file
totalComment	number	Output field: totalComment
closed_at	object	Output field: closed_at
closed_by	object	Output field: closed_by
created_at	string	Output field: created_at
created_by	object	Output field: created_by
created_by.email	string	Output field: created_by.email
created_by.full_name	string	Name of the resource
created_by.username	string	Name of the resource
external_service	object	Output field: external_service
updated_at	string	Output field: updated_at
updated_by	object	Output field: updated_by
updated_by.full_name	string	Name of the resource
updated_by.email	string	Output field: updated_by.email
updated_by.username	string	Name of the resource
description	string	Output field: description
title	string	Output field: title
status	string	Status value
connector	object	Output field: connector

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 17:24:36 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=142245b81cc02af4","x-srv-span":"v=1;s=6778cda89a9eedb4","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674580310","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Get All Case Activity

Returns all user activity for the specified case

Endpoint

URL: api/cases/{{case_id}}/user_actions

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.case_id	string	Required	Parameters for the Get All Case Activity action

Input Example

{"path_parameters":{"case_id":"a18b38a0-71b0-11ea-a0b2-c51ea50a58e2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 16:58:55 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=456e25c3138d982b","x-srv-span":"v=1;s=fb97ac49aee7fcdb","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674578940","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Get Case Configuration

Retrieves external connection details, such as the closure type and default connector for cases

Endpoint

URL: /api/cases/configure

Method: GET

Input

Argument Name	Type	Required	Description
parameters.owner	string	Optional	Parameters for the Get Case Configuration action

Input Example

{"parameters":{"owner":"cases"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 19:27:57 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"884","Connection":"keep-alive","x-srv-trace":"v=1;t=bfa2495db98bca57","x-srv-span":"v=1;s=273ea6f05af07f02","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674588466","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding"},"reason":"OK","json_body":[{"closure_type":"close-by...

Find Connectors

Retrieves information about connectors

Endpoint

URL: api/cases/configure/connectors/_find

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 17:07:23 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"292","Connection":"keep-alive","x-srv-trace":"v=1;t=4ca005b418610af6","x-srv-span":"v=1;s=7ffbe0153fe58eb3","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674579860","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding"},"reason":"OK","json_body":[{"id":"61787f53-4eee-4741...

Find Exception Containers

Retrieves a paginated subset of exception containers

Endpoint

URL: api/exception_lists/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Parameters for the Find Exception Containers action
parameters.per_page	number	Optional	Parameters for the Find Exception Containers action
parameters.sort_field	string	Optional	Parameters for the Find Exception Containers action
parameters.sort_order	string	Optional	Parameters for the Find Exception Containers action
parameters.cursor	string	Optional	Parameters for the Find Exception Containers action
parameters.namespace_type	string	Optional	Parameters for the Find Exception Containers action
parameters.filter	string	Optional	Parameters for the Find Exception Containers action

Input Example

{"parameters":{"page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor","namespace_type":"space","filter":"name:name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data._tags	array	Response data
data._tags.file_name	string	Response data
data._tags.file	string	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.description	string	Response data
data.id	string	Response data
data.list_id	string	Response data
data.name	string	Response data
data.namespace_type	string	Response data
data.tags	array	Response data
data.tie_breaker_id	string	Response data
data.type	string	Response data
data.updated_at	string	Response data
data.updated_by	string	Response data
page	number	Output field: page
per_page	number	Output field: per_page
total	number	Output field: total

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 20:40:42 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=c420c1994848cd92","x-srv-span":"v=1;s=78883294484d23fb","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674506400","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Find Exception Items

Retrieves a paginated subset of exception items in the specified container

Endpoint

URL: api/exception_lists/items/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.list_id	string	Required	Parameters for the Find Exception Items action
parameters.page	number	Optional	Parameters for the Find Exception Items action
parameters.per_page	number	Optional	Parameters for the Find Exception Items action
parameters.sort_field	string	Optional	Parameters for the Find Exception Items action
parameters.sort_order	string	Optional	Parameters for the Find Exception Items action
parameters.cursor	string	Optional	Parameters for the Find Exception Items action

Input Example

{"parameters":{"list_id":"allowed-processes","page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data._tags	array	Response data
data._tags.file_name	string	Response data
data._tags.file	string	Response data
data.comments	array	Response data
data.comments.comment	string	Response data
data.comments.created_at	string	Response data
data.comments.created_by	string	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.description	string	Response data
data.entries	array	Response data
data.entries.field	string	Response data
data.entries.operator	string	Response data
data.entries.type	string	Response data
data.entries.value	array	Response data
data.id	string	Response data
data.item_id	string	Response data
data.list_id	string	Response data
data.name	string	Response data
data.namespace_type	string	Response data
data.tags	array	Response data
data.tie_breaker_id	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 21:25:15 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=11782e3fc888d672","x-srv-span":"v=1;s=26a26302ea05a85c","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674509073","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Find List Containers

Retrieves a paginated subset of list containers

Endpoint

URL: api/lists/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Parameters for the Find List Containers action
parameters.per_page	number	Optional	Parameters for the Find List Containers action
parameters.sort_field	string	Optional	Parameters for the Find List Containers action
parameters.sort_order	string	Optional	Parameters for the Find List Containers action
parameters.cursor	string	Optional	Parameters for the Find List Containers action
parameters.filter	string	Optional	Parameters for the Find List Containers action

Input Example

{"parameters":{"page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor","filter":"name:name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cursor	string	Output field: cursor
data	array	Response data
data._version	string	Response data
data.id	string	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.description	string	Response data
data.immutable	boolean	Response data
data.name	string	Response data
data.tie_breaker_id	string	Response data
data.type	string	Response data
data.updated_at	string	Response data
data.updated_by	string	Response data
data.version	number	Response data
page	number	Output field: page
per_page	number	Output field: per_page
total	number	Output field: total

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 21:40:00 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"660","Connection":"keep-alive","x-srv-trace":"v=1;t=db8f3736ef937fc5","x-srv-span":"v=1;s=386f87daef9dcf10","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674509983","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding"},"reason":"OK","json_body":{"cursor":"WzIwLFsiMTk1ZjU...

Find List Items

Retrieves a paginated subset of list items in the specified container

Endpoint

URL: /api/lists/items/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.list_id	string	Required	Parameters for the Find List Items action
parameters.page	number	Optional	Parameters for the Find List Items action
parameters.per_page	number	Optional	Parameters for the Find List Items action
parameters.sort_field	string	Optional	Parameters for the Find List Items action
parameters.sort_order	string	Optional	Parameters for the Find List Items action
parameters.cursor	string	Optional	Parameters for the Find List Items action

Input Example

{"parameters":{"list_id":"allowed-processes","page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cursor	string	Output field: cursor
data	array	Response data
data._version	string	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.id	string	Response data
data.list_id	string	Response data
data.tie_breaker_id	string	Response data
data.type	string	Response data
data.updated_at	string	Response data
data.updated_by	string	Response data
data.value	string	Response data
page	number	Output field: page
per_page	number	Output field: per_page
total	number	Output field: total

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 21:54:12 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=1425971a5b41ab27","x-srv-span":"v=1;s=8dc3927dc8cb45ce","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674510789","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Export Rules

Exports rules to an ndjson file

Endpoint

URL: api/detection_engine/rules/_export

Method: POST

Input

Argument Name	Type	Required	Description
parameters.exclude_export_details	boolean	Optional	Parameters for the Export Rules action
parameters.file_name	string	Optional	Parameters for the Export Rules action
objects	array	Optional	Parameter for Export Rules
objects.rule_id	string	Optional	Unique identifier

Input Example

{"parameters":{"exclude_export_details":false,"file_name":"testfilename.ndjson"},"json_body":{"objects":[{"rule_id":"94052990-9c26-11ed-b17c-e7b302621d5b"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
exported_count	number	Count value
exported_rules_count	number	Count value
missing_rules	array	Output field: missing_rules
missing_rules.rule_id	string	Unique identifier
missing_rules_count	number	Count value
exported_exception_list_count	number	Count value
exported_exception_list_item_count	number	Count value
missing_exception_list_item_count	number	Count value
missing_exception_list_items	array	Output field: missing_exception_list_items
missing_exception_list_items.file_name	string	Name of the resource
missing_exception_list_items.file	string	Output field: missing_exception_list_items.file
missing_exception_lists	array	Output field: missing_exception_lists
missing_exception_lists.file_name	string	Name of the resource
missing_exception_lists.file	string	Output field: missing_exception_lists.file
missing_exception_lists_count	number	Count value

Output Example

{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Tue, 24 Jan 2023 20:48:44 GMT","Content-Type":"application/ndjson","Content-Length":"347","Connection":"keep-alive","content-disposition":"attachment; filename=\"testfilename.ndjson\"","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license...

Find Rules

Retrieves a paginated subset of signal detection rules

Endpoint

URL: api/detection_engine/rules/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Parameters for the Find Rules action
parameters.per_page	number	Optional	Parameters for the Find Rules action
parameters.sort_field	string	Optional	Parameters for the Find Rules action
parameters.sort_order	string	Optional	Parameters for the Find Rules action
parameters.filter	string	Optional	Parameters for the Find Rules action

Input Example

{"parameters":{"page":1,"per_page":5,"sort_field":"enabled","sort_order":"asc","filter":"alert.attributes.name:windows"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
page	number	Output field: page
perPage	number	Output field: perPage
total	number	Output field: total
data	array	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.created_by	string	Response data
data.description	string	Response data
data.enabled	boolean	Response data
data.false_positives	array	Response data
data.false_positives.file_name	string	Response data
data.false_positives.file	string	Response data
data.from	string	Response data
data.id	string	Response data
data.immutable	boolean	Response data
data.index	array	Response data
data.interval	string	Response data
data.rule_id	string	Response data
data.language	string	Response data
data.output_index	string	Response data
data.max_signals	number	Response data
data.risk_score	number	Response data
data.name	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 20:22:33 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=055814721165fd01","x-srv-span":"v=1;s=d0abef80426f43dd","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674505413","ETag":"W/\"6b2-uAlfqwMoFSAYivG98wE59OY3QbY\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","jso...

Get Rules

Retrieves a single rule using the rule_id or id field

Endpoint

URL: api/detection_engine/rules

Method: GET

Input

Argument Name	Type	Required	Description
parameters.id	string	Optional	Parameters for the Get Rules action
parameters.rule_id	string	Optional	Parameters for the Get Rules action

Input Example

{"parameters":{"id":"c41d170b-8ba6-4de6-b8ec-76440a35ace3","rule_id":"c41d170b-8ba6-4de6-b8ec-76440a35ace3"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
created_by	string	Output field: created_by
description	string	Output field: description
enabled	boolean	Output field: enabled
false_positives	array	Output field: false_positives
false_positives.file_name	string	Name of the resource
false_positives.file	string	Output field: false_positives.file
filters	array	Output field: filters
filters.query	object	Output field: filters.query
filters.query.match	object	Output field: filters.query.match
filters.query.match.event.action	object	Output field: filters.query.match.event.action
filters.query.match.event.action.query	string	Output field: filters.query.match.event.action.query
filters.query.match.event.action.type	string	Type of the resource
from	string	Output field: from
id	string	Unique identifier
immutable	boolean	Output field: immutable
interval	string	Output field: interval
rule_id	string	Unique identifier
language	string	Output field: language
output_index	string	Output field: output_index
max_signals	number	Output field: max_signals
risk_score	number	Score value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 19:36:39 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=40dfdc4d61706ab6","x-srv-span":"v=1;s=a573e9e875c58d77","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674588944","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...

Search Signals

The signals endpoint is for retrieving, aggregating, and updating detection alerts

Endpoint

URL: api/detection_engine/signals/search

Method: POST

Input

Argument Name	Type	Required	Description
aggs	object	Optional	Parameter for Search Signals
aggs.latest	object	Optional	Parameter for Search Signals
aggs.latest.max	object	Optional	Parameter for Search Signals
aggs.latest.max.field	string	Optional	Parameter for Search Signals
aggs.oldest	object	Optional	Parameter for Search Signals
aggs.oldest.min	object	Optional	Parameter for Search Signals
aggs.oldest.min.field	string	Optional	Parameter for Search Signals
query	object	Optional	Parameter for Search Signals
query.bool	object	Optional	Parameter for Search Signals
query.bool.filter	array	Optional	Parameter for Search Signals
query.bool.filter.match	object	Optional	Parameter for Search Signals
query.bool.filter.match.signal.status	string	Optional	Status value
query.bool.filter.range	object	Optional	Parameter for Search Signals
query.bool.filter.range.signal.rule.risk_score	object	Optional	Score value

Input Example

{"json_body":{"aggs":{"latest":{"max":{"field":"@timestamp"}},"oldest":{"min":{"field":"@timestamp"}}},"query":{"bool":{"filter":[{"match":{"signal.status":"open"}},{"range":{"signal.rule.risk_score":{"gte":70}}}]}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
took	number	Output field: took
timed_out	boolean	Output field: timed_out
_shards	object	Output field: _shards
_shards.total	number	Output field: _shards.total
_shards.successful	number	Whether the operation was successful
_shards.skipped	number	Output field: _shards.skipped
_shards.failed	number	Output field: _shards.failed
hits	object	Output field: hits
hits.total	object	Output field: hits.total
hits.total.value	number	Value for the parameter
hits.total.relation	string	Output field: hits.total.relation
hits.max_score	object	Score value
hits.hits	array	Output field: hits.hits
hits.hits.file_name	string	Name of the resource
hits.hits.file	string	Output field: hits.hits.file
aggregations	object	Output field: aggregations
aggregations.oldest	object	Output field: aggregations.oldest
aggregations.oldest.value	number	Value for the parameter
aggregations.oldest.value_as_string	string	Value for the parameter
aggregations.latest	object	Output field: aggregations.latest
aggregations.latest.value	number	Value for the parameter
aggregations.latest.value_as_string	string	Value for the parameter

Output Example

{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Wed, 25 Jan 2023 14:57:26 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"225","Connection":"keep-alive","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license-sig":"41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11e...

Get All Kibana Spaces

Retrieve all Kibana spaces

Endpoint

URL: api/spaces/space

Method: GET

Input

Argument Name	Type	Required	Description
parameters.purpose	string	Optional	Parameters for the Get All Kibana Spaces action
parameters.include_authorized_purposes	boolean	Optional	Parameters for the Get All Kibana Spaces action

Input Example

{"parameters":{"purpose":"any","include_authorized_purposes":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Tue, 24 Jan 2023 19:45:33 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"136","Connection":"keep-alive","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license-sig":"41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11e...

Get Tags

Aggregates and returns all rule tags

Endpoint

URL: api/detection_engine/tags

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Tue, 24 Jan 2023 20:10:27 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"749","Connection":"keep-alive","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license-sig":"41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11e...

Response Headers

Header	Description	Example
accept-ranges	HTTP response header: accept-ranges	bytes
Access-Control-Allow-Origin	HTTP response header: Access-Control-Allow-Origin	*
cache-control	Directives for caching mechanisms	private, no-cache, no-store, must-revalidate
Connection	HTTP response header: Connection	keep-alive
content-disposition	HTTP response header: content-disposition	attachment; filename="testfilename.ndjson"
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	884
content-security-policy	HTTP response header: content-security-policy	script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'
Content-Type	The media type of the resource	application/ndjson
Date	The date and time at which the message was originated	Mon, 23 Jan 2023 21:25:15 GMT
ETag	An identifier for a specific version of a resource	W/"96-S/5iQ2y1qqIInh5BwoPc+chvDJU"
kbn-license-sig	HTTP response header: kbn-license-sig	41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11efde7c9b78e7a281
kbn-name	HTTP response header: kbn-name	ubu2204template
referrer-policy	HTTP response header: referrer-policy	no-referrer-when-downgrade
Server	Information about the software used by the origin server	nginx/1.18.0 (Ubuntu)
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Accept-Encoding
x-content-type-options	HTTP response header: x-content-type-options	nosniff
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	120
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	119
X-RateLimit-Reset	The time at which the current rate limit window resets	1674588944
x-srv-span	HTTP response header: x-srv-span	v=1;s=273ea6f05af07f02
x-srv-trace	HTTP response header: x-srv-trace	v=1;t=bfa2495db98bca57