--- title: Elastic Kibana 7 - Security slug: connectors/elastic-kibana-7-security docTags: createdAt: 2026-06-09T16:30:11.190Z --- ## Elastic Kibana V7 This connector is for Elastic Security, both on-premises and Elastic Cloud versions starting with 7.9.0. The primary focus is on the Elastic Security feature of Kibana, but this uses additional APIs for Kibana. ## Prerequisites :::BlockQuote This connector has only been tested using Elasticsearch & Kibana on-premises & Elastic Cloud 7.16. ::: Depending on how your organization has setup Elasticsearch/Kibana/etc., you need to make sure that the following requirements have been met: 1. Create or know which Kibana space they will primarily use. 2. Create a signal index. This index needs to be in the following format `.siem-signals-`. Using the `Default` Kibana space this would be `.siem-signals-default`. 3. Create detection rule(s) or load Elastic's Pre-Packaged Detection Rules ## Asset Setup ### Connecting to Elastic Cloud In order to use this connector with Elastic Cloud you must provide the following inputs in the configured asset: - host - port - api\_key If you generated a ApiKey from within the Elastic Cloud portal you **may** have need run the following commands to generate the correct ApiKey: ```javascript echo "" | base64 -d ``` Which will result in a value similar to the following: ```javascript : ``` Then take this value and decode it again ```javascript echo -n ":" | base64 ``` This will result in the correct ApiKey. ### Connecting to On-Premises In order to use this connector with an on-premises Elasticsearch and Kibana, you must provide the following inputs in the configured asset: - host - port - username - password ### Common Issues Within the asset if you receive an error about the host, please remove any trailing slashes from the host string. ## Notes - For more information, see the [Elactic Security API Documentation (7.16))](https://www.elastic.co/guide/en/security/7.16/security-apis.html). This connector was last tested against product version: Elastic Kibana 7.16.3 # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | Authorization | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Find Cases Retrieves a paginated subset of cases ### Endpoint - **URL:** `api/cases/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------ | | `parameters.page` | number | Optional | Parameters for the Find Cases action | | `parameters.perPage` | number | Optional | Parameters for the Find Cases action | | `parameters.sortField` | string | Optional | Parameters for the Find Cases action | | `parameters.sortOrder` | string | Optional | Parameters for the Find Cases action | | `parameters.tags` | string | Optional | Parameters for the Find Cases action | | `parameters.owner` | string | Optional | Parameters for the Find Cases action | | `parameters.status` | string | Optional | Parameters for the Find Cases action | | `parameters.reporters` | string | Optional | Parameters for the Find Cases action | ### Input Example `{"parameters":{"page":1,"perPage":5,"sortField":"updatedAt","sortOrder":"asc","tags":"phishing","owner":"owner","status":"open","reporters":"username"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | | `cases` | array | Output field: cases | | `cases.id` | string | Unique identifier | | `cases.version` | string | Output field: cases.version | | `cases.comments` | array | Output field: cases.comments | | `cases.comments.file_name` | string | Name of the resource | | `cases.comments.file` | string | Output field: cases.comments.file | | `cases.totalComment` | number | Output field: cases.totalComment | | `cases.closed_at` | object | Output field: cases.closed\_at | | `cases.closed_by` | object | Output field: cases.closed\_by | | `cases.created_at` | string | Output field: cases.created\_at | | `cases.created_by` | object | Output field: cases.created\_by | | `cases.created_by.email` | string | Output field: cases.created\_by.email | | `cases.created_by.full_name` | string | Name of the resource | | `cases.created_by.username` | string | Name of the resource | | `cases.external_service` | object | Output field: cases.external\_service | | `cases.updated_at` | string | Output field: cases.updated\_at | | `cases.updated_by` | object | Output field: cases.updated\_by | | `cases.updated_by.full_name` | string | Name of the resource | | `cases.updated_by.email` | string | Output field: cases.updated\_by.email | | `cases.updated_by.username` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 20:12:56 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=d6ea1d0735c74352","x-srv-span":"v=1;s=5a6153fa9cd5d837","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674493629","ETag":"W/\"a4-7hO0T/XLq3TuFViTu2ZVQQdIY+A\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Get Case Returns the specified case ### Endpoint - **URL:** `api/cases/{{case_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------- | | `path_parameters.case_id` | string | Required | Parameters for the Get Case action | | `parameters.includeComments` | boolean | Optional | Parameters for the Get Case action | ### Input Example `{"parameters":{"includeComments":true},"path_parameters":{"case_id":"a18b38a0-71b0-11ea-a0b2-c51ea50a58e2"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `version` | string | Output field: version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `totalComment` | number | Output field: totalComment | | `closed_at` | object | Output field: closed\_at | | `closed_by` | object | Output field: closed\_by | | `created_at` | string | Output field: created\_at | | `created_by` | object | Output field: created\_by | | `created_by.email` | string | Output field: created\_by.email | | `created_by.full_name` | string | Name of the resource | | `created_by.username` | string | Name of the resource | | `external_service` | object | Output field: external\_service | | `updated_at` | string | Output field: updated\_at | | `updated_by` | object | Output field: updated\_by | | `updated_by.full_name` | string | Name of the resource | | `updated_by.email` | string | Output field: updated\_by.email | | `updated_by.username` | string | Name of the resource | | `description` | string | Output field: description | | `title` | string | Output field: title | | `status` | string | Status value | | `connector` | object | Output field: connector | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 17:24:36 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=142245b81cc02af4","x-srv-span":"v=1;s=6778cda89a9eedb4","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674580310","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Get All Case Activity Returns all user activity for the specified case ### Endpoint - **URL:** `api/cases/{{case_id}}/user_actions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.case_id` | string | Required | Parameters for the Get All Case Activity action | ### Input Example `{"path_parameters":{"case_id":"a18b38a0-71b0-11ea-a0b2-c51ea50a58e2"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 16:58:55 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=456e25c3138d982b","x-srv-span":"v=1;s=fb97ac49aee7fcdb","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674578940","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Get Case Configuration Retrieves external connection details, such as the closure type and default connector for cases ### Endpoint - **URL:** `/api/cases/configure` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------ | | `parameters.owner` | string | Optional | Parameters for the Get Case Configuration action | ### Input Example `{"parameters":{"owner":"cases"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 19:27:57 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"884","Connection":"keep-alive","x-srv-trace":"v=1;t=bfa2495db98bca57","x-srv-span":"v=1;s=273ea6f05af07f02","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674588466","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding"},"reason":"OK","json_body":[{"closure_type":"close-by...` ## Find Connectors Retrieves information about connectors ### Endpoint - **URL:** `api/cases/configure/connectors/_find` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 17:07:23 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"292","Connection":"keep-alive","x-srv-trace":"v=1;t=4ca005b418610af6","x-srv-span":"v=1;s=7ffbe0153fe58eb3","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674579860","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding"},"reason":"OK","json_body":[{"id":"61787f53-4eee-4741...` ## Find Exception Containers Retrieves a paginated subset of exception containers ### Endpoint - **URL:** `api/exception_lists/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.page` | number | Optional | Parameters for the Find Exception Containers action | | `parameters.per_page` | number | Optional | Parameters for the Find Exception Containers action | | `parameters.sort_field` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.sort_order` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.cursor` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.namespace_type` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.filter` | string | Optional | Parameters for the Find Exception Containers action | ### Input Example `{"parameters":{"page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor","namespace_type":"space","filter":"name:name"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._tags` | array | Response data | | `data._tags.file_name` | string | Response data | | `data._tags.file` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | | `data.updated_by` | string | Response data | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 20:40:42 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=c420c1994848cd92","x-srv-span":"v=1;s=78883294484d23fb","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674506400","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Find Exception Items Retrieves a paginated subset of exception items in the specified container ### Endpoint - **URL:** `api/exception_lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.list_id` | string | Required | Parameters for the Find Exception Items action | | `parameters.page` | number | Optional | Parameters for the Find Exception Items action | | `parameters.per_page` | number | Optional | Parameters for the Find Exception Items action | | `parameters.sort_field` | string | Optional | Parameters for the Find Exception Items action | | `parameters.sort_order` | string | Optional | Parameters for the Find Exception Items action | | `parameters.cursor` | string | Optional | Parameters for the Find Exception Items action | ### Input Example `{"parameters":{"list_id":"allowed-processes","page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._tags` | array | Response data | | `data._tags.file_name` | string | Response data | | `data._tags.file` | string | Response data | | `data.comments` | array | Response data | | `data.comments.comment` | string | Response data | | `data.comments.created_at` | string | Response data | | `data.comments.created_by` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.entries` | array | Response data | | `data.entries.field` | string | Response data | | `data.entries.operator` | string | Response data | | `data.entries.type` | string | Response data | | `data.entries.value` | array | Response data | | `data.id` | string | Response data | | `data.item_id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 21:25:15 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=11782e3fc888d672","x-srv-span":"v=1;s=26a26302ea05a85c","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674509073","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Find List Containers Retrieves a paginated subset of list containers ### Endpoint - **URL:** `api/lists/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.page` | number | Optional | Parameters for the Find List Containers action | | `parameters.per_page` | number | Optional | Parameters for the Find List Containers action | | `parameters.sort_field` | string | Optional | Parameters for the Find List Containers action | | `parameters.sort_order` | string | Optional | Parameters for the Find List Containers action | | `parameters.cursor` | string | Optional | Parameters for the Find List Containers action | | `parameters.filter` | string | Optional | Parameters for the Find List Containers action | ### Input Example `{"parameters":{"page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor","filter":"name:name"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `data` | array | Response data | | `data._version` | string | Response data | | `data.id` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.immutable` | boolean | Response data | | `data.name` | string | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | | `data.updated_by` | string | Response data | | `data.version` | number | Response data | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 21:40:00 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"660","Connection":"keep-alive","x-srv-trace":"v=1;t=db8f3736ef937fc5","x-srv-span":"v=1;s=386f87daef9dcf10","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674509983","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding"},"reason":"OK","json_body":{"cursor":"WzIwLFsiMTk1ZjU...` ## Find List Items Retrieves a paginated subset of list items in the specified container ### Endpoint - **URL:** `/api/lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.list_id` | string | Required | Parameters for the Find List Items action | | `parameters.page` | number | Optional | Parameters for the Find List Items action | | `parameters.per_page` | number | Optional | Parameters for the Find List Items action | | `parameters.sort_field` | string | Optional | Parameters for the Find List Items action | | `parameters.sort_order` | string | Optional | Parameters for the Find List Items action | | `parameters.cursor` | string | Optional | Parameters for the Find List Items action | ### Input Example `{"parameters":{"list_id":"allowed-processes","page":1,"per_page":2,"sort_field":"name","sort_order":"desc","cursor":"cursor"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `data` | array | Response data | | `data._version` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.id` | string | Response data | | `data.list_id` | string | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | | `data.updated_by` | string | Response data | | `data.value` | string | Response data | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 21:54:12 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=1425971a5b41ab27","x-srv-span":"v=1;s=8dc3927dc8cb45ce","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674510789","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Export Rules Exports rules to an ndjson file ### Endpoint - **URL:** `api/detection_engine/rules/_export` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | -------------------------------------- | | `parameters.exclude_export_details` | boolean | Optional | Parameters for the Export Rules action | | `parameters.file_name` | string | Optional | Parameters for the Export Rules action | | `objects` | array | Optional | Parameter for Export Rules | | `objects.rule_id` | string | Optional | Unique identifier | ### Input Example `{"parameters":{"exclude_export_details":false,"file_name":"testfilename.ndjson"},"json_body":{"objects":[{"rule_id":"94052990-9c26-11ed-b17c-e7b302621d5b"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `exported_count` | number | Count value | | `exported_rules_count` | number | Count value | | `missing_rules` | array | Output field: missing\_rules | | `missing_rules.rule_id` | string | Unique identifier | | `missing_rules_count` | number | Count value | | `exported_exception_list_count` | number | Count value | | `exported_exception_list_item_count` | number | Count value | | `missing_exception_list_item_count` | number | Count value | | `missing_exception_list_items` | array | Output field: missing\_exception\_list\_items | | `missing_exception_list_items.file_name` | string | Name of the resource | | `missing_exception_list_items.file` | string | Output field: missing\_exception\_list\_items.file | | `missing_exception_lists` | array | Output field: missing\_exception\_lists | | `missing_exception_lists.file_name` | string | Name of the resource | | `missing_exception_lists.file` | string | Output field: missing\_exception\_lists.file | | `missing_exception_lists_count` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Tue, 24 Jan 2023 20:48:44 GMT","Content-Type":"application/ndjson","Content-Length":"347","Connection":"keep-alive","content-disposition":"attachment; filename=\"testfilename.ndjson\"","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license...` ## Find Rules Retrieves a paginated subset of signal detection rules ### Endpoint - **URL:** `api/detection_engine/rules/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------ | | `parameters.page` | number | Optional | Parameters for the Find Rules action | | `parameters.per_page` | number | Optional | Parameters for the Find Rules action | | `parameters.sort_field` | string | Optional | Parameters for the Find Rules action | | `parameters.sort_order` | string | Optional | Parameters for the Find Rules action | | `parameters.filter` | string | Optional | Parameters for the Find Rules action | ### Input Example `{"parameters":{"page":1,"per_page":5,"sort_field":"enabled","sort_order":"asc","filter":"alert.attributes.name:windows"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `page` | number | Output field: page | | `perPage` | number | Output field: perPage | | `total` | number | Output field: total | | `data` | array | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.enabled` | boolean | Response data | | `data.false_positives` | array | Response data | | `data.false_positives.file_name` | string | Response data | | `data.false_positives.file` | string | Response data | | `data.from` | string | Response data | | `data.id` | string | Response data | | `data.immutable` | boolean | Response data | | `data.index` | array | Response data | | `data.interval` | string | Response data | | `data.rule_id` | string | Response data | | `data.language` | string | Response data | | `data.output_index` | string | Response data | | `data.max_signals` | number | Response data | | `data.risk_score` | number | Response data | | `data.name` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 23 Jan 2023 20:22:33 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=055814721165fd01","x-srv-span":"v=1;s=d0abef80426f43dd","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674505413","ETag":"W/\"6b2-uAlfqwMoFSAYivG98wE59OY3QbY\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","jso...` ## Get Rules Retrieves a single rule using the rule\_id or id field ### Endpoint - **URL:** `api/detection_engine/rules` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------- | | `parameters.id` | string | Optional | Parameters for the Get Rules action | | `parameters.rule_id` | string | Optional | Parameters for the Get Rules action | ### Input Example `{"parameters":{"id":"c41d170b-8ba6-4de6-b8ec-76440a35ace3","rule_id":"c41d170b-8ba6-4de6-b8ec-76440a35ace3"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | ---------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `created_at` | string | Output field: created\_at | | `updated_at` | string | Output field: updated\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `enabled` | boolean | Output field: enabled | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `filters` | array | Output field: filters | | `filters.query` | object | Output field: filters.query | | `filters.query.match` | object | Output field: filters.query.match | | `filters.query.match.event.action` | object | Output field: filters.query.match.event.action | | `filters.query.match.event.action.query` | string | Output field: filters.query.match.event.action.query | | `filters.query.match.event.action.type` | string | Type of the resource | | `from` | string | Output field: from | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `interval` | string | Output field: interval | | `rule_id` | string | Unique identifier | | `language` | string | Output field: language | | `output_index` | string | Output field: output\_index | | `max_signals` | number | Output field: max\_signals | | `risk_score` | number | Score value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 24 Jan 2023 19:36:39 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-srv-trace":"v=1;t=40dfdc4d61706ab6","x-srv-span":"v=1;s=a573e9e875c58d77","Access-Control-Allow-Origin":"*","X-RateLimit-Limit":"120","X-RateLimit-Remaining":"119","X-RateLimit-Reset":"1674588944","ETag":"W/\"96-S/5iQ2y1qqIInh5BwoPc+chvDJU\"","Vary":"Accept-Encoding","Content-Encoding":"gzip"},"reason":"OK","json...` ## Search Signals The signals endpoint is for retrieving, aggregating, and updating detection alerts ### Endpoint - **URL:** `api/detection_engine/signals/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------ | -------- | ------------ | ---------------------------- | | `aggs` | object | Optional | Parameter for Search Signals | | `aggs.latest` | object | Optional | Parameter for Search Signals | | `aggs.latest.max` | object | Optional | Parameter for Search Signals | | `aggs.latest.max.field` | string | Optional | Parameter for Search Signals | | `aggs.oldest` | object | Optional | Parameter for Search Signals | | `aggs.oldest.min` | object | Optional | Parameter for Search Signals | | `aggs.oldest.min.field` | string | Optional | Parameter for Search Signals | | `query` | object | Optional | Parameter for Search Signals | | `query.bool` | object | Optional | Parameter for Search Signals | | `query.bool.filter` | array | Optional | Parameter for Search Signals | | `query.bool.filter.match` | object | Optional | Parameter for Search Signals | | `query.bool.filter.match.signal.status` | string | Optional | Status value | | `query.bool.filter.range` | object | Optional | Parameter for Search Signals | | `query.bool.filter.range.signal.rule.risk_score` | object | Optional | Score value | ### Input Example `{"json_body":{"aggs":{"latest":{"max":{"field":"@timestamp"}},"oldest":{"min":{"field":"@timestamp"}}},"query":{"bool":{"filter":[{"match":{"signal.status":"open"}},{"range":{"signal.rule.risk_score":{"gte":70}}}]}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.skipped` | number | Output field: \_shards.skipped | | `_shards.failed` | number | Output field: \_shards.failed | | `hits` | object | Output field: hits | | `hits.total` | object | Output field: hits.total | | `hits.total.value` | number | Value for the parameter | | `hits.total.relation` | string | Output field: hits.total.relation | | `hits.max_score` | object | Score value | | `hits.hits` | array | Output field: hits.hits | | `hits.hits.file_name` | string | Name of the resource | | `hits.hits.file` | string | Output field: hits.hits.file | | `aggregations` | object | Output field: aggregations | | `aggregations.oldest` | object | Output field: aggregations.oldest | | `aggregations.oldest.value` | number | Value for the parameter | | `aggregations.oldest.value_as_string` | string | Value for the parameter | | `aggregations.latest` | object | Output field: aggregations.latest | | `aggregations.latest.value` | number | Value for the parameter | | `aggregations.latest.value_as_string` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Wed, 25 Jan 2023 14:57:26 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"225","Connection":"keep-alive","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license-sig":"41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11e...` ## Get All Kibana Spaces Retrieve all Kibana spaces ### Endpoint - **URL:** `api/spaces/space` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.purpose` | string | Optional | Parameters for the Get All Kibana Spaces action | | `parameters.include_authorized_purposes` | boolean | Optional | Parameters for the Get All Kibana Spaces action | ### Input Example `{"parameters":{"purpose":"any","include_authorized_purposes":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Tue, 24 Jan 2023 19:45:33 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"136","Connection":"keep-alive","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license-sig":"41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11e...` ## Get Tags Aggregates and returns all rule tags ### Endpoint - **URL:** `api/detection_engine/tags` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx/1.18.0 (Ubuntu)","Date":"Tue, 24 Jan 2023 20:10:27 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"749","Connection":"keep-alive","x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","content-security-policy":"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inli...","kbn-name":"ubu2204template","kbn-license-sig":"41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11e...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | accept-ranges | HTTP response header: accept-ranges | bytes | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | \* | | cache-control | Directives for caching mechanisms | private, no-cache, no-store, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | content-disposition | HTTP response header: content-disposition | attachment; filename="testfilename.ndjson" | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 884 | | content-security-policy | HTTP response header: content-security-policy | script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self' | | Content-Type | The media type of the resource | application/ndjson | | Date | The date and time at which the message was originated | Mon, 23 Jan 2023 21:25:15 GMT | | ETag | An identifier for a specific version of a resource | W/"96-S/5iQ2y1qqIInh5BwoPc+chvDJU" | | kbn-license-sig | HTTP response header: kbn-license-sig | 41fb004c5f952e932d4f566dc859516a1f89cc84a3bf9c11efde7c9b78e7a281 | | kbn-name | HTTP response header: kbn-name | ubu2204template | | referrer-policy | HTTP response header: referrer-policy | no-referrer-when-downgrade | | Server | Information about the software used by the origin server | nginx/1.18.0 (Ubuntu) | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | X-RateLimit-Limit | The number of requests allowed in the current rate limit window | 120 | | X-RateLimit-Remaining | The number of requests remaining in the current rate limit window | 119 | | X-RateLimit-Reset | The time at which the current rate limit window resets | 1674588944 | | x-srv-span | HTTP response header: x-srv-span | v=1;s=273ea6f05af07f02 | | x-srv-trace | HTTP response header: x-srv-trace | v=1;t=bfa2495db98bca57 |