--- title: Elastic Kibana 8 - Security slug: connectors/elastic-kibana-8-security docTags: createdAt: 2026-06-09T16:29:54.327Z --- Elastic Kibana 8 - Security is a powerful tool for visualizing and analyzing security data, providing advanced threat detection and response capabilities. Elastic Kibana 8 is a powerful data visualization and exploration tool used for log and time-series analytics, application monitoring, and operational intelligence use cases. This connector enables seamless integration with Swimlane Turbine, allowing users to automate security operations by creating and managing cases, detection rules, and exceptions directly from the Swimlane platform. The integration enhances the ability to respond to security incidents efficiently by leveraging Kibana's robust capabilities in data analysis and visualization, thus providing a comprehensive security management solution. ## Prerequisites Before you can use the Elastic Kibana 8 - Security connector for Turbine, you'll need access to the Elastic Kibana API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing the Elastic Kibana API. - API Key: A valid API key for authenticating requests. - HTTP Basic authentication using the following parameters: - URL: The endpoint URL for accessing the Elastic Kibana API. - Username: The username for basic authentication. - Password: The password associated with the username. ## Capabilities This connector provides the following capabilities: ### Case Tasks - Add Case Comment - Create Case - Find Cases - Get Case - Update Case - Get All Case Activity ### Connector Tasks - Create Connector - Get All Connectors - Get Current Connector - Push Case to External Service - Set Default Elastic Security UI Connector - Update Elastic Security Case Closure Connector ### Detection Tasks - Create Detection Event Correlation Rule - Create Detection Indicator Match Rule - Create Detection ML Rule - Create Detection Query Rule - Create Detection Threshold Rule - Update Detection Event Correlation Rule - Update Detection Indicator Match Rule - Update Detection ML Rule - Update Detection Query Rule - Update Detection Threshold Rule - Delete Detection Rule - Export Detection Rules - Find Detection Rules - Get Detection Rule - Add Pre-Packaged Detection Rules ### Signal Tasks - Create Signal Index - Get Signals - Set Signal Status ### Timeline Tasks - Create Timeline (& Timeline templates) ### Lists Tasks - Create List Container - Create List Item - Create List Index - Find List Containers - Find List Items - Update List Container - Update List Item ### Exception Tasks - Create Exception Container - Create Exception Item - Find Exception Containers - Find Exception Items ### Tags Tasks - Get Tags ### Kibana Tasks - Create Kibana Space - Get Kibana Spaces ### Endpoint Management Tasks - Create Blocklist Entries Container - Create Blocklist Entry - Create Event Filter - Create Event Filters Container - Create Host Isolation Exception - Create Host Isolation Exceptions Container - Create Trusted Application - Create Trusted Applications Container - Delete Blocklist Entry - Delete Event Filter - Delete Host Isolation Exception - Delete Trusted Application - Find Blocklist Entries - Find Event Filters - Find Host Isolation Exceptions *... and so on* ## Asset Setup ### Connecting to Elastic Cloud In order to use this connector with Elastic Cloud you must provide the following inputs in the configured asset: - url - api\_key If you generated a ApiKey from within the Elastic Cloud portal you **may** have need run the following commands to generate the correct ApiKey: ```javascript echo "" | base64 -d ``` Which will result in a value similar to the following: ```javascript : ``` Then take this value and decode it again ```javascript echo -n ":" | base64 ``` This will result in the correct ApiKey. ### Connecting to On-Premises In order to use this connector with an on-premises Elasticsearch and Kibana, you must provide the following inputs in the configured asset: - url - username - password - port *(optional)*: The port your Kibana instance listens on (e.g. `5601`). If not specified, defaults to `443`. You can also include the port directly in the URL (e.g. `https://kibana.example.com:5601`), in which case the `port` field should be left empty. - space *(optional)*: The Kibana space ID to target (e.g. `my-space`). If not specified, the URL is built without a space ID and requests will target the default space. For more information on authentication, [click here](https://www.elastic.co/guide/en/security/8.9/security-apis.html#_authentication). ### Common Issues Within the asset if you receive an error about the host, please remove any trailing slashes from the host string. ## Notes - For more information, see the [Elactic Security API Documentation (8.10(current))](https://www.elastic.co/guide/en/kibana/8.10/api.html). This connector was last tested against product version: Elastic Kibana 8.10 ## Additional Documentation - [Elastic Kibana 8 - Security Connector Documentation](https://docs.swimlane.com/connectors/elastic-kibana-8-security) - [Elastic Kibana 8 - Security API Documentation](https://www.elastic.co/guide/en/kibana/8.10/api.html) - [Elastic Kibana 8 - Security Authentication Guide](https://docs.swimlane.com/authentication-guides/elastic-kibana-8-security) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | port | Host port to use. | number | Optional | | space | The Kibana space ID to target. Defaults to the 'default' space if not provided. | string | Optional | | x-apikey | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host | string | Required | | port | Host port to use. | number | Optional | | space | The Kibana space ID to target. Defaults to the 'default' space if not provided. | string | Optional | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Case Comment Add a comment or alert to an existing case in Elastic Kibana 8 - Security by supplying the case ID and comment type. ### Endpoint - **URL:** `/api/cases/{{case_id}}/comments` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.case_id` | string | Required | Parameters for the Add Case Comment action | | `alertId` | array | Optional | It is required only when `type` is `alert`. | | `comment` | string | Optional | It is required only when `type` is `user`. | | `index` | array | Optional | It is required only when type is alert. | | `owner` | string | Optional | Parameter for Add Case Comment | | `rule` | object | Optional | It is required only when `type` is `alert`. | | `rule.id` | string | Optional | The rule identifier. | | `rule.name` | string | Optional | The rule name. | | `type` | string | Optional | The comment type. | ### Input Example `{"json_body":{"alertId":["293f1bc0-74f6-11ea-b83a-553aecdb28b6"],"comment":"adding a test comment","index":[".siem-signals"],"owner":"cases","rule":{"id":"94d80550-aaf4-11ec-985f-97e55adae8b9","name":"security_rule"},"type":"user"},"path_parameters":{"case_id":"93f1bc0-74f6-11ea-b83a-553aecdb28b6"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `description` | string | Output field: description | | `title` | string | Output field: title | | `tags` | array | Output field: tags | | `settings` | object | Output field: settings | | `settings.syncAlerts` | boolean | Output field: settings.syncAlerts | | `owner` | string | Output field: owner | | `category` | object | Output field: category | | `assignees` | array | Output field: assignees | | `assignees.file_name` | string | Name of the resource | | `assignees.file` | string | Output field: assignees.file | | `connector` | object | Output field: connector | | `connector.id` | string | Unique identifier | | `connector.type` | string | Type of the resource | | `connector.fields` | object | Output field: connector.fields | | `connector.fields.issueType` | string | Type of the resource | | `connector.fields.priority` | string | Output field: connector.fields.priority | | `connector.fields.parent` | object | Output field: connector.fields.parent | | `connector.name` | string | Name of the resource | | `severity` | string | Output field: severity | | `status` | string | Status value | | `duration` | object | Output field: duration | | `closed_at` | object | Output field: closed\_at | | `closed_by` | object | Output field: closed\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 06:22:52 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Blocklist Entries Container Generate a blocklist container in Elastic Kibana 8 - Security using specified description, name, list ID, type, and namespace. ### Endpoint - **URL:** `/api/exception_lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------ | | `description` | string | Optional | Parameter for Create Blocklist Entries Container | | `name` | string | Optional | Name of the resource | | `list_id` | string | Optional | Unique identifier | | `type` | string | Optional | Type of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Create Blocklist Entries Container | ### Input Example `{"json_body":{"description":"Excludes Linux trusted processes","name":"Linux process exceptions","list_id":"endpoint_blocklist","type":"endpoint","namespace_type":"agnostic","tags":["linux","processes"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `os_types.file_name` | string | Name of the resource | | `os_types.file` | string | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"486","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 09:15:40 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Blocklist Entry Generate a new blocklist entry in Elastic Kibana 8 - Security using details like description, entries, list ID, and more. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------ | | `comments` | array | Optional | Parameter for Create Blocklist Entry | | `comments.file_name` | string | Required | Name of the resource | | `comments.file` | string | Required | Parameter for Create Blocklist Entry | | `description` | string | Optional | Parameter for Create Blocklist Entry | | `entries` | array | Optional | Parameter for Create Blocklist Entry | | `entries.field` | string | Required | Parameter for Create Blocklist Entry | | `entries.value` | array | Required | Value for the parameter | | `entries.type` | string | Required | Type of the resource | | `entries.operator` | string | Required | Parameter for Create Blocklist Entry | | `list_id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `namespace_type` | string | Optional | Name of the resource | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Create Blocklist Entry | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"comments":[],"description":"some description about this entry","entries":[{"field":"file.path","value":["c:/path/to/file.exe","c:/path/to/file2.exe"],"type":"match_any","operator":"included"}],"list_id":"endpoint_blocklists","name":"Linux process exceptions","namespace_type":"agnostic","os_types":["macos"],"tags":["policy:all"],"type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | array | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"649","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 09:23:57 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Case Create a new case in Elastic Kibana 8 - Security with details such as connector, description, owner, settings, tags, and title. ### Endpoint - **URL:** `/api/cases` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------- | | `assignees` | array | Optional | Parameter for Create Case | | `assignees.uid` | string | Optional | Unique identifier | | `description` | string | Optional | Parameter for Create Case | | `title` | string | Optional | Parameter for Create Case | | `tags` | array | Optional | Parameter for Create Case | | `connector` | object | Optional | Parameter for Create Case | | `connector.id` | string | Required | Unique identifier | | `connector.name` | string | Required | Name of the resource | | `connector.type` | string | Required | Type of the resource | | `connector.fields` | object | Required | Parameter for Create Case | | `connector.fields.issueType` | string | Optional | Type of the resource | | `connector.fields.priority` | string | Optional | Parameter for Create Case | | `connector.fields.parent` | object | Optional | Parameter for Create Case | | `connector.fields.caseId` | string | Required | Unique identifier | | `settings` | object | Optional | Parameter for Create Case | | `settings.syncAlerts` | boolean | Required | Parameter for Create Case | | `owner` | string | Optional | Parameter for Create Case | | `severity` | string | Optional | Parameter for Create Case | ### Input Example `{"json_body":{"assignees":[{"uid":""}],"description":"A case description.","title":"Case title 1","tags":["tag 1"],"connector":{"id":"131d4448-abe0-4789-939d-8ef60680b498","name":"My connector","type":".jira","fields":{"issueType":"10006","priority":"High","parent":null,"caseId":""}},"settings":{"syncAlerts":true},"owner":"cases","severity":"critical"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `description` | string | Output field: description | | `title` | string | Output field: title | | `tags` | array | Output field: tags | | `settings` | object | Output field: settings | | `settings.syncAlerts` | boolean | Output field: settings.syncAlerts | | `owner` | string | Output field: owner | | `category` | object | Output field: category | | `assignees` | array | Output field: assignees | | `assignees.file_name` | string | Name of the resource | | `assignees.file` | string | Output field: assignees.file | | `connector` | object | Output field: connector | | `connector.id` | string | Unique identifier | | `connector.type` | string | Type of the resource | | `connector.fields` | object | Output field: connector.fields | | `connector.fields.issueType` | string | Type of the resource | | `connector.fields.priority` | string | Output field: connector.fields.priority | | `connector.fields.parent` | object | Output field: connector.fields.parent | | `connector.name` | string | Name of the resource | | `severity` | string | Output field: severity | | `status` | string | Status value | | `duration` | object | Output field: duration | | `closed_at` | object | Output field: closed\_at | | `closed_by` | object | Output field: closed\_by | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"description":"A case description.","title":"Case title 1","tags":["tag 1"],"settings":{"syncAlerts":true},"owner":"cases","category":null,"assignees":[],"connector":{"id":"131d4448-abe0-4789-939d-8ef60680b498","type":".jira","fields":{},"name":"My connector"},"severity":"low","status":"open","duration":null,"closed_at":null,"closed_by":null,"created_at":"2023-09-29T06:09:04.418Z","created_by":{"username":"elastic","full_name":n...` ## Create Connector Establish A New Connector In Elastic Kibana 8 - Security, Requiring A Name, Type ID, Configuration Details, And Secrets. ### Endpoint - **URL:** `/api/actions/connector` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | ------------------------------ | | `name` | string | Optional | Name of the resource | | `connector_type_id` | string | Optional | Unique identifier | | `config` | object | Optional | Parameter for Create Connector | | `config.connectorType` | string | Required | Type of the resource | | `config.mappings` | object | Optional | Parameter for Create Connector | | `config.mappings.alertIdConfig` | object | Optional | Unique identifier | | `config.mappings.alertIdConfig.id` | string | Required | Unique identifier | | `config.mappings.alertIdConfig.name` | string | Required | Unique identifier | | `config.mappings.alertIdConfig.key` | string | Required | Unique identifier | | `config.mappings.alertIdConfig.fieldType` | string | Required | Unique identifier | | `config.mappings.caseIdConfig` | object | Optional | Unique identifier | | `config.mappings.caseIdConfig.id` | string | Required | Unique identifier | | `config.mappings.caseIdConfig.name` | string | Required | Unique identifier | | `config.mappings.caseIdConfig.key` | string | Required | Unique identifier | | `config.mappings.caseIdConfig.fieldType` | string | Required | Unique identifier | | `config.mappings.caseNameConfig` | object | Optional | Name of the resource | | `config.mappings.caseNameConfig.id` | string | Required | Unique identifier | | `config.mappings.caseNameConfig.name` | string | Required | Name of the resource | | `config.mappings.caseNameConfig.key` | string | Required | Name of the resource | | `config.mappings.caseNameConfig.fieldType` | string | Required | Name of the resource | | `config.mappings.commentsConfig` | object | Optional | Parameter for Create Connector | | `config.mappings.commentsConfig.id` | string | Required | Unique identifier | | `config.mappings.commentsConfig.name` | string | Required | Name of the resource | | `config.mappings.commentsConfig.key` | string | Required | Parameter for Create Connector | | `config.mappings.commentsConfig.fieldType` | string | Required | Type of the resource | ### Input Example `{"json_body":{"name":"my-swimlane-connector","connector_type_id":".swimlane","config":{"connectorType":"all","mappings":{"alertIdConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"caseIdConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"caseNameConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"commentsConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"descriptionConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"ruleNameConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"severityConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"}},"appId":"myAppID","apiUrl":"https://myswimlaneinstance.com"},"secrets":{"apiToken":"myToken"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `config` | object | Output field: config | | `config.connectorType` | string | Type of the resource | | `config.mappings` | object | Output field: config.mappings | | `config.mappings.alertIdConfig` | object | Unique identifier | | `config.mappings.alertIdConfig.id` | string | Unique identifier | | `config.mappings.alertIdConfig.name` | string | Unique identifier | | `config.mappings.alertIdConfig.key` | string | Unique identifier | | `config.mappings.alertIdConfig.fieldType` | string | Unique identifier | | `config.mappings.caseIdConfig` | object | Unique identifier | | `config.mappings.caseIdConfig.id` | string | Unique identifier | | `config.mappings.caseIdConfig.name` | string | Unique identifier | | `config.mappings.caseIdConfig.key` | string | Unique identifier | | `config.mappings.caseIdConfig.fieldType` | string | Unique identifier | | `config.mappings.caseNameConfig` | object | Name of the resource | | `config.mappings.caseNameConfig.id` | string | Unique identifier | | `config.mappings.caseNameConfig.name` | string | Name of the resource | | `config.mappings.caseNameConfig.key` | string | Name of the resource | | `config.mappings.caseNameConfig.fieldType` | string | Name of the resource | | `config.mappings.commentsConfig` | object | Output field: config.mappings.commentsConfig | | `config.mappings.commentsConfig.id` | string | Unique identifier | | `config.mappings.commentsConfig.name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"948","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 17:21:03 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Detection Event Correlation Rule Generate alerts in Elastic Kibana 8 by creating an event correlation rule with specified description, name, risk score, severity, and language. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------- | | `rule_id` | string | Optional | Unique identifier | | `risk_score` | number | Optional | Score value | | `description` | string | Optional | Parameter for Create Detection Event Correlation Rule | | `name` | string | Optional | Name of the resource | | `severity` | string | Optional | Parameter for Create Detection Event Correlation Rule | | `tags` | array | Optional | Parameter for Create Detection Event Correlation Rule | | `type` | string | Optional | Type of the resource | | `language` | string | Optional | Parameter for Create Detection Event Correlation Rule | | `query` | string | Optional | Parameter for Create Detection Event Correlation Rule | ### Input Example `{"json_body":{"rule_id":"eql-outbound-rundll32-connections","risk_score":21,"description":"Unusual rundll32.exe network connection","name":"rundll32.exe network connection","severity":"low","tags":["EQL","Windows","rundll32.exe"],"type":"eql","language":"eql","query":"sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | | `severity_mapping` | array | Output field: severity\_mapping | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 09:48:58 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Detection Indicator Match Rule Generate an alert by creating an indicator match rule in Elastic Kibana 8 - Security using details like name, risk score, and threat mapping. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------------------------------------------- | | `type` | string | Optional | Type of the resource | | `index` | array | Optional | Parameter for Create Detection Indicator Match Rule | | `query` | string | Optional | Parameter for Create Detection Indicator Match Rule | | `threat_index` | array | Optional | Parameter for Create Detection Indicator Match Rule | | `threat_query` | string | Optional | Parameter for Create Detection Indicator Match Rule | | `threat_mapping` | array | Optional | Parameter for Create Detection Indicator Match Rule | | `threat_mapping.entries` | array | Optional | Parameter for Create Detection Indicator Match Rule | | `threat_mapping.entries.field` | string | Optional | Parameter for Create Detection Indicator Match Rule | | `threat_mapping.entries.type` | string | Optional | Type of the resource | | `threat_mapping.entries.value` | string | Optional | Value for the parameter | | `risk_score` | number | Optional | Score value | | `severity` | string | Optional | Parameter for Create Detection Indicator Match Rule | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Create Detection Indicator Match Rule | ### Input Example `{"json_body":{"type":"threat_match","index":["packetbeat-*"],"query":"destination.ip:* or host.ip:*","threat_index":["ip-threat-list"],"threat_query":"*:*","threat_mapping":[{"entries":[{"field":"destination.ip","type":"mapping","value":"destination.ip"},{"field":"destination.port","type":"mapping","value":"destination.port"}]},{"entries":[{"field":"source.ip","type":"mapping","value":"host.ip"}]}],"risk_score":50,"severity":"medium","name":"Bad IP threat match","description":"Checks for bad IP addresses listed in the ip-threat-list index"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `tags.file_name` | string | Name of the resource | | `tags.file` | string | Output field: tags.file | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 09:53:40 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Detection ML Rule Create a machine learning-based detection rule in Elastic Kibana 8 - Security with specified risk score, severity, and job ID. Requires description, name, anomaly threshold, and machine learning job ID. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------- | | `anomaly_threshold` | number | Optional | Parameter for Create Detection ML Rule | | `rule_id` | string | Optional | Unique identifier | | `risk_score` | number | Optional | Score value | | `machine_learning_job_id` | string | Optional | Unique identifier | | `description` | string | Optional | Parameter for Create Detection ML Rule | | `interval` | string | Optional | Parameter for Create Detection ML Rule | | `name` | string | Optional | Name of the resource | | `note` | string | Optional | Parameter for Create Detection ML Rule | | `severity` | string | Optional | Parameter for Create Detection ML Rule | | `tags` | array | Optional | Parameter for Create Detection ML Rule | | `type` | string | Optional | Type of the resource | | `from` | string | Optional | Parameter for Create Detection ML Rule | | `enabled` | boolean | Optional | Parameter for Create Detection ML Rule | | `throttle` | string | Optional | Parameter for Create Detection ML Rule | | `actions` | array | Optional | Parameter for Create Detection ML Rule | | `actions.action_type_id` | string | Optional | Unique identifier | | `actions.group` | string | Optional | Parameter for Create Detection ML Rule | | `actions.id` | string | Optional | Unique identifier | | `actions.params` | object | Optional | Parameter for Create Detection ML Rule | | `actions.params.message` | string | Optional | Response message | ### Input Example `{"json_body":{"anomaly_threshold":70,"rule_id":"ml_linux_network_high_threshold","risk_score":70,"machine_learning_job_id":"linux_anomalous_network_activity_ecs","description":"Generates alerts when the job discovers anomalies over 70","interval":"5m","name":"Anomalous Linux network activity","note":"Shut down the internet.","severity":"high","tags":["machine learning","Linux"],"type":"machine_learning","from":"now-6m","enabled":true,"throttle":"rule","actions":[{"action_type_id":".slack","group":"default","id":"73cdcf10-5eea-11ee-924f-eb8f01880390","params":{"message":"Detection is created!"}}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `note` | string | Output field: note | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 09:43:34 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Detection Query Rule Initiate the creation of a new detection query rule in Elastic Kibana 8 - Security, requiring details such as description, name, risk score, severity, and query. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ----------------------------------------- | | `rule_id` | string | Optional | Unique identifier | | `risk_score` | number | Optional | Score value | | `description` | string | Optional | Parameter for Create Detection Query Rule | | `interval` | string | Optional | Parameter for Create Detection Query Rule | | `name` | string | Optional | Name of the resource | | `severity` | string | Optional | Parameter for Create Detection Query Rule | | `tags` | array | Optional | Parameter for Create Detection Query Rule | | `type` | string | Optional | Type of the resource | | `from` | string | Optional | Parameter for Create Detection Query Rule | | `query` | string | Optional | Parameter for Create Detection Query Rule | | `language` | string | Optional | Parameter for Create Detection Query Rule | | `filters` | array | Optional | Parameter for Create Detection Query Rule | | `filters.query` | object | Optional | Parameter for Create Detection Query Rule | | `filters.query.match` | object | Optional | Parameter for Create Detection Query Rule | | `filters.query.match.event.action` | object | Optional | Parameter for Create Detection Query Rule | | `filters.query.match.event.action.query` | string | Optional | Parameter for Create Detection Query Rule | | `filters.query.match.event.action.type` | string | Optional | Type of the resource | | `enabled` | boolean | Optional | Parameter for Create Detection Query Rule | ### Input Example `{"json_body":{"rule_id":"process_started_by_ms_office_program_1","risk_score":50,"description":"Process started by MS Office program - possible payload","interval":"1h","name":"MS Office child process","severity":"low","tags":["child process","ms office"],"type":"query","from":"now-70m","query":"process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE","language":"kuery","filters":[{"query":{"match":{"event.action":{"query":"Process Create (rule: ProcessCreate)","type":"phrase"}}}}],"enabled":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | | `severity_mapping` | array | Output field: severity\_mapping | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 09:57:40 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Detection Threshold Rule Create a detection threshold rule in Elastic Kibana 8 - Security with specified risk score, severity, type, query, and threshold. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------- | | `description` | string | Optional | Parameter for Create Detection Threshold Rule | | `enabled` | boolean | Optional | Parameter for Create Detection Threshold Rule | | `from` | string | Optional | Parameter for Create Detection Threshold Rule | | `index` | array | Optional | Parameter for Create Detection Threshold Rule | | `interval` | string | Optional | Parameter for Create Detection Threshold Rule | | `name` | string | Optional | Name of the resource | | `query` | string | Optional | Parameter for Create Detection Threshold Rule | | `risk_score` | number | Optional | Score value | | `rule_id` | string | Optional | Unique identifier | | `severity` | string | Optional | Parameter for Create Detection Threshold Rule | | `severity_mapping` | array | Optional | Parameter for Create Detection Threshold Rule | | `severity_mapping.field` | string | Optional | Parameter for Create Detection Threshold Rule | | `severity_mapping.operator` | string | Optional | Parameter for Create Detection Threshold Rule | | `severity_mapping.severity` | string | Optional | Parameter for Create Detection Threshold Rule | | `severity_mapping.value` | string | Optional | Value for the parameter | | `tags` | array | Optional | Parameter for Create Detection Threshold Rule | | `threshold` | object | Optional | Parameter for Create Detection Threshold Rule | | `threshold.field` | string | Required | Parameter for Create Detection Threshold Rule | | `threshold.value` | number | Required | Value for the parameter | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"description":"Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.","enabled":true,"exceptions_list":[{"id":"int-ips","namespace_type":"single","type":"detection"}],"from":"now-180s","index":["winlogbeat-*"],"interval":"2m","name":"Liverpool Windows server prml-19","query":"host.name:prml-19 and event.category:authentication and event.outcome:failure","risk_score":30,"rule_id":"liv-win-ser-logins","severity":"low","severity_mapping":[{"field":"source.geo.city_name","operator":"equals","severity":"low","value":"Manchester"},{"field":"source.geo.city_name","operator":"equals","severity":"critical","value":"Wallingford"}],"tags":["Brute force"],"threshold":{"field":"source.ip","value":20},"type":"threshold"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | | `severity_mapping` | array | Output field: severity\_mapping | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 08:37:05 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Event Filter Create a new event filter in Elastic Kibana 8 - Security using specified details like name, description, OS types, and more. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------- | | `comments` | array | Optional | Parameter for Create Event Filter | | `comments.comment` | string | Optional | Parameter for Create Event Filter | | `description` | string | Optional | Parameter for Create Event Filter | | `entries` | array | Optional | Parameter for Create Event Filter | | `entries.field` | string | Optional | Parameter for Create Event Filter | | `entries.operator` | string | Optional | Parameter for Create Event Filter | | `entries.type` | string | Optional | Type of the resource | | `entries.value` | string | Optional | Value for the parameter | | `list_id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `namespace_type` | string | Optional | Name of the resource | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Create Event Filter | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"comments":[{"comment":"a new comment about this entry"}],"description":"some description about this entry","entries":[{"field":"process.executable","operator":"included","type":"match","value":"c:\\applications\\elastic\\foo.exe"}],"list_id":"endpoint_event_filters","name":"create event filter","namespace_type":"agnostic","os_types":["windows"],"tags":["policy:all"],"type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.operator` | string | Output field: entries.operator | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"795","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 10:32:36 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Event Filters Container Create a new event filters container in Elastic Kibana 8 - Security using specified details like name, description, list ID, namespace type, and filter type. ### Endpoint - **URL:** `/api/exception_lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------- | | `description` | string | Optional | Parameter for Create Event Filters Container | | `name` | string | Optional | Name of the resource | | `list_id` | string | Optional | Unique identifier | | `type` | string | Optional | Type of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Create Event Filters Container | ### Input Example `{"json_body":{"description":"Elastic Defend Event Filters List","name":"Elastic Defend Event Filters List","list_id":"endpoint_event_filters","type":"endpoint_events","namespace_type":"agnostic","tags":["linux","processes"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `os_types.file_name` | string | Name of the resource | | `os_types.file` | string | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"507","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 10:24:20 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Exception Container Create an exception container in Elastic Kibana 8 - Security with a specified description, name, and type. ### Endpoint - **URL:** `/api/exception_lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------ | | `description` | string | Optional | Parameter for Create Exception Container | | `name` | string | Optional | Name of the resource | | `list_id` | string | Optional | Not required, automatically created when it is not provided. | | `type` | string | Optional | Type of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Create Exception Container | ### Input Example `{"json_body":{"description":"Excludes Linux trusted processes","name":"Linux process exceptions","list_id":"trusted-linux-processes","type":"detection","namespace_type":"single","tags":["linux","processes"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `os_types.file_name` | string | Name of the resource | | `os_types.file` | string | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"490","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 06:38:54 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Exception Item Create a new exception item in Elastic Kibana 8 - Security using details such as description, entries, list ID, name, and type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------- | | `description` | string | Optional | Parameter for Create Exception Item | | `entries` | array | Optional | Parameter for Create Exception Item | | `entries.field` | string | Required | Parameter for Create Exception Item | | `entries.operator` | string | Required | Parameter for Create Exception Item | | `entries.type` | string | Required | Type of the resource | | `entries.value` | array | Required | Value for the parameter | | `list_id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Create Exception Item | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"description":"Excludes the weekly maintenance job","entries":[{"field":"host.name","operator":"included","type":"match_any","value":["liv-win-anf","livw-win-mel","linux-anfield"]}],"list_id":"trusted-linux-processes","name":"Linux maintenance job","namespace_type":"single","tags":["in-house processes","linux"],"type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.operator` | string | Output field: entries.operator | | `entries.type` | string | Type of the resource | | `entries.value` | array | Value for the parameter | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `os_types.file_name` | string | Name of the resource | | `os_types.file` | string | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"659","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 08:20:52 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Host Isolation Exception Create an exception to host isolation in Elastic Kibana 8 - Security by specifying details like description, entries, list ID, name, namespace type, OS types, and type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------------- | | `description` | string | Optional | Parameter for Create Host Isolation Exception | | `entries` | array | Optional | Parameter for Create Host Isolation Exception | | `entries.field` | string | Required | Parameter for Create Host Isolation Exception | | `entries.value` | string | Required | Value for the parameter | | `entries.type` | string | Required | Type of the resource | | `entries.operator` | string | Required | Parameter for Create Host Isolation Exception | | `list_id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `namespace_type` | string | Optional | Name of the resource | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Create Host Isolation Exception | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"description":"create host isolation exception","entries":[{"field":"destination.ip","value":"10.10.0.1","type":"match","operator":"included"}],"list_id":"endpoint_host_isolation_exceptions","name":"create host isolation exception","namespace_type":"agnostic","os_types":["linux","macos","windows"],"tags":["policy:all"],"type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | string | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"653","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 16:59:11 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Host Isolation Exceptions Container Create a container in Elastic Kibana 8 - Security to manage host isolation exceptions, requiring description, list\_id, name, namespace\_type, and type. ### Endpoint - **URL:** `/api/exception_lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------- | | `description` | string | Optional | Parameter for Create Host Isolation Exceptions Container | | `name` | string | Optional | Name of the resource | | `list_id` | string | Optional | Unique identifier | | `type` | string | Optional | Type of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Create Host Isolation Exceptions Container | ### Input Example `{"json_body":{"description":"Elastic Defend Host Isolation Exceptions List","name":"Elastic Defend Host Isolation Exceptions List","list_id":"endpoint_host_isolation_exceptions","type":"endpoint_host_isolation_exceptions","namespace_type":"agnostic","tags":["Host Isolation Exception","linux"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `os_types.file_name` | string | Name of the resource | | `os_types.file` | string | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"577","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 16:53:32 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Kibana Space Create a new space in Elastic Kibana 8 using the provided 'id' and 'name'. Ensure necessary headers are included. ### Endpoint - **URL:** `/api/spaces/space` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Create Kibana Space | | `initials` | string | Optional | Must have a maximum length of | | `color` | string | Optional | Parameter for Create Kibana Space | | `imageUrl` | string | Optional | The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed, and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images. | | `disabledFeatures` | array | Optional | Parameter for Create Kibana Space | | `disabledFeatures.file_name` | string | Required | Name of the resource | | `disabledFeatures.file` | string | Required | Parameter for Create Kibana Space | ### Input Example `{"json_body":{"id":"my-kibana-space","name":"my-kibana-space","description":"My space description created","initials":"MK","color":"#aabbcc","disabledFeatures":[]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `color` | string | Output field: color | | `initials` | string | Output field: initials | | `disabledFeatures` | array | Output field: disabledFeatures | | `disabledFeatures.file_name` | string | Name of the resource | | `disabledFeatures.file` | string | Output field: disabledFeatures.file | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"150","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 08:59:18 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create List Container Create a new list container in Elastic Kibana 8 - Security using specified description, name, and type. ### Endpoint - **URL:** `/api/lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------- | | `id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Create List Container | | `type` | string | Optional | Type of the resource | | `serializer` | string | Optional | Parameter for Create List Container | | `deserializer` | string | Optional | Parameter for Create List Container | | `version` | number | Optional | Parameter for Create List Container | ### Input Example `{"json_body":{"id":"internal-ip-range-excludes","name":"Exclude internal IP addresses","description":"Contains list items that exclude internal IP addresses from detection rules.","type":"ip","serializer":"(?.+)/(?.+)","deserializer":"{{{gte}}}--{{{lte}}}","version":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `deserializer` | string | Output field: deserializer | | `immutable` | boolean | Output field: immutable | | `name` | string | Name of the resource | | `serializer` | string | Output field: serializer | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"488","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 17:23:14 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create List Item Associate a new list item with a specified list in Elastic Kibana 8 - Security, requiring 'list\_id' and 'value'. ### Endpoint - **URL:** `/api/lists/items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------- | | `id` | string | Optional | Unique identifier | | `list_id` | string | Optional | Unique identifier | | `value` | string | Optional | Value for the parameter | ### Input Example `{"json_body":{"id":"internal-ip-1","list_id":"internal-ip-excludes","value":"10.0.0.12"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `id` | string | Unique identifier | | `type` | string | Type of the resource | | `value` | string | Value for the parameter | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `list_id` | string | Unique identifier | | `tie_breaker_id` | string | Unique identifier | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"291","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 17:29:20 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Signal Index Initiate the creation of a new signal index in Elastic Kibana 8 - Security to categorize detection alerts. ### Endpoint - **URL:** `/api/detection_engine/index` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `acknowledged` | boolean | Output field: acknowledged | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"21","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 13:26:41 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":"...` ## Create Timeline Create a new timeline or template in Elastic Kibana 8 - Security using the provided timeline data. ### Endpoint - **URL:** `/api/timeline` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------ | -------- | ------------ | ----------------------------- | | `timeline` | object | Optional | Parameter for Create Timeline | | `timeline.columns` | array | Optional | Parameter for Create Timeline | | `timeline.columns.id` | string | Optional | Unique identifier | | `timeline.dataProviders` | array | Optional | Response data | | `timeline.dataProviders.and` | array | Optional | Response data | | `timeline.dataProviders.and.name` | string | Optional | Response data | | `timeline.dataProviders.and.enabled` | boolean | Optional | Response data | | `timeline.dataProviders.and.excluded` | boolean | Optional | Response data | | `timeline.dataProviders.and.id` | string | Optional | Response data | | `timeline.dataProviders.and.queryMatch` | object | Optional | Response data | | `timeline.dataProviders.and.queryMatch.field` | string | Optional | Response data | | `timeline.dataProviders.and.queryMatch.value` | string | Optional | Response data | | `timeline.dataProviders.and.queryMatch.operator` | string | Optional | Response data | | `timeline.dataProviders.enabled` | boolean | Optional | Response data | | `timeline.dataProviders.excluded` | boolean | Optional | Response data | | `timeline.dataProviders.id` | string | Optional | Response data | | `timeline.dataProviders.name` | string | Optional | Response data | | `timeline.dataProviders.queryMatch` | object | Optional | Response data | | `timeline.dataProviders.queryMatch.field` | string | Optional | Response data | | `timeline.dataProviders.queryMatch.value` | string | Optional | Response data | | `timeline.dataProviders.queryMatch.operator` | string | Optional | Response data | | `timeline.dateRange` | object | Optional | Parameter for Create Timeline | | `timeline.dateRange.end` | number | Optional | Parameter for Create Timeline | | `timeline.dateRange.start` | number | Optional | Parameter for Create Timeline | | `timeline.description` | string | Optional | Parameter for Create Timeline | ### Input Example `{"json_body":{"timeline":{"columns":[{"id":"user.name"},{"id":"event.category"}],"dataProviders":[{"and":[{"name":"event.category","enabled":true,"excluded":false,"id":"timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d11","queryMatch":{"field":"event.category","value":"process","operator":":"}},{"name":"user.name","enabled":true,"excluded":false,"id":"timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d12","queryMatch":{"field":"user.name","value":"SYSTEM","operator":":"}}],"enabled":true,"excluded":false,"id":"timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d13","name":"host.os.platform","queryMatch":{"field":"host.os.platform","value":"windows","operator":":"}}],"dateRange":{"end":1594005719000,"start":1593832919000},"description":"Gets Windows system processes from all hosts","title":"Windows system processes"}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.persistTimeline` | object | Response data | | `data.persistTimeline.code` | number | Response data | | `data.persistTimeline.message` | string | Response data | | `data.persistTimeline.timeline` | object | Response data | | `data.persistTimeline.timeline.savedObjectId` | string | Response data | | `data.persistTimeline.timeline.version` | string | Response data | | `data.persistTimeline.timeline.columns` | array | Response data | | `data.persistTimeline.timeline.columns.id` | string | Response data | | `data.persistTimeline.timeline.dataProviders` | array | Response data | | `data.persistTimeline.timeline.dataProviders.and` | array | Response data | | `data.persistTimeline.timeline.dataProviders.enabled` | boolean | Response data | | `data.persistTimeline.timeline.dataProviders.excluded` | boolean | Response data | | `data.persistTimeline.timeline.dataProviders.id` | string | Response data | | `data.persistTimeline.timeline.dataProviders.name` | string | Response data | | `data.persistTimeline.timeline.dataProviders.queryMatch` | object | Response data | | `data.persistTimeline.timeline.dataViewId` | object | Response data | | `data.persistTimeline.timeline.description` | string | Response data | | `data.persistTimeline.timeline.excludedRowRendererIds` | array | Response data | | `data.persistTimeline.timeline.excludedRowRendererIds.file_name` | string | Response data | | `data.persistTimeline.timeline.excludedRowRendererIds.file` | string | Response data | | `data.persistTimeline.timeline.title` | string | Response data | | `data.persistTimeline.timeline.dateRange` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 16:55:38 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Create Trusted Application Create a trusted application in Elastic Kibana 8 - Security using specified details such as name, description, entries, and OS types. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------- | | `comments` | array | Optional | Parameter for Create Trusted Application | | `comments.file_name` | string | Required | Name of the resource | | `comments.file` | string | Required | Parameter for Create Trusted Application | | `description` | string | Optional | Parameter for Create Trusted Application | | `entries` | array | Optional | Parameter for Create Trusted Application | | `entries.field` | string | Required | Parameter for Create Trusted Application | | `entries.value` | string | Required | Value for the parameter | | `entries.type` | string | Required | Type of the resource | | `entries.operator` | string | Required | Parameter for Create Trusted Application | | `list_id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `namespace_type` | string | Optional | Name of the resource | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Create Trusted Application | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"comments":[],"description":"some description about this entry","entries":[{"field":"process.executable.caseless","value":"c:\\applications\\elastic\\foo.exe","type":"match","operator":"included"}],"list_id":"endpoint_trusted_app","name":"create endpoint trusted app","namespace_type":"agnostic","os_types":["windows"],"tags":["policy:all"],"type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | string | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"659","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:11:44 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Create Trusted Applications Container Create a container in Elastic Kibana 8 - Security to manage trusted applications, requiring details like description, list\_id, name, namespace\_type, and type. ### Endpoint - **URL:** `/api/exception_lists` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------------- | | `description` | string | Optional | Parameter for Create Trusted Applications Container | | `name` | string | Optional | Name of the resource | | `list_id` | string | Optional | Unique identifier | | `type` | string | Optional | Type of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Create Trusted Applications Container | ### Input Example `{"json_body":{"description":"Elastic Defend Trusted Apps List","name":"Elastic Defend Trusted Apps List","list_id":"endpoint_trusted_app","type":"endpoint","namespace_type":"agnostic","tags":["Defend","Trusted"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `os_types.file_name` | string | Name of the resource | | `os_types.file` | string | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"91","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:02:23 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":"...` ## Delete Blocklist Entry Remove a specific blocklist entry from Elastic Kibana 8 using the provided entry ID and namespace type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.id` | string | Required | Parameters for the Delete Blocklist Entry action | | `parameters.namespace_type` | string | Required | Parameters for the Delete Blocklist Entry action | ### Input Example `{"parameters":{"id":"e880f600-6360-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | array | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"681","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 10:15:51 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Delete Detection Rule Delete a specified detection rule in Elastic Kibana 8 - Security using the provided rule ID. ### Endpoint - **URL:** `/api/detection_engine/rules?id={{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Delete Detection Rule action | ### Input Example `{"path_parameters":{"id":"3ba66e80-629b-11ee-924f-eb8f01880390"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `name` | string | Name of the resource | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `revision` | number | Output field: revision | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:48:41 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Delete Event Filter Remove a specified event filter from Elastic Kibana 8 using the provided 'id' and 'namespace\_type'. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Delete Event Filter action | | `parameters.namespace_type` | string | Required | Parameters for the Delete Event Filter action | ### Input Example `{"parameters":{"id":"7fe2fe90-636a-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.operator` | string | Output field: entries.operator | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"954","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 13:46:16 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Delete Host Isolation Exception Remove a specified host isolation exception in Elastic Kibana 8 using the provided 'id' and 'namespace\_type'. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Delete Host Isolation Exception action | | `parameters.namespace_type` | string | Required | Parameters for the Delete Host Isolation Exception action | ### Input Example `{"parameters":{"id":"80f34d90-63a0-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"663","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 17:21:05 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Delete Trusted Application Remove a trusted application from Elastic Kibana 8 using the provided 'id' and 'namespace\_type'. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ---------------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Delete Trusted Application action | | `parameters.namespace_type` | string | Required | Parameters for the Delete Trusted Application action | ### Input Example `{"parameters":{"id":"38e91330-640f-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | string | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"786","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:30:12 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Export Detection Rules Export detection rules to an .ndjson file for easy sharing and backup from Elastic Kibana 8 - Security. ### Endpoint - **URL:** `/api/detection_engine/rules/_export` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.exclude_export_details` | boolean | Optional | Parameters for the Export Detection Rules action | | `parameters.file_name` | string | Optional | Parameters for the Export Detection Rules action | | `objects` | array | Optional | Parameter for Export Detection Rules | | `objects.rule_id` | string | Optional | Unique identifier | ### Input Example `{"parameters":{"exclude_export_details":false,"file_name":"export.ndjson"},"json_body":{"objects":[{"rule_id":"a8fd8c70-7be8-4d70-95d3-5135bf17d498"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Disposition":"attachment; filename=\"export.ndjson\"","Content-Length":"1665","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/ndjson","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:59:19 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kb...` ## Find Blocklist Entries Identify blocklist entries in Elastic Kibana 8 - Security using list\_id and namespace\_type as search parameters. ### Endpoint - **URL:** `/api/exception_lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.list_id` | string | Required | Parameters for the Find Blocklist Entries action | | `parameters.namespace_type` | string | Required | Parameters for the Find Blocklist Entries action | | `parameters.page` | number | Optional | Parameters for the Find Blocklist Entries action | | `parameters.per_page` | number | Optional | Parameters for the Find Blocklist Entries action | | `parameters.sort_field` | string | Optional | Parameters for the Find Blocklist Entries action | | `parameters.sort_order` | string | Optional | Parameters for the Find Blocklist Entries action | | `parameters.search` | string | Optional | Parameters for the Find Blocklist Entries action | ### Input Example `{"parameters":{"list_id":"endpoint_blocklists","namespace_type":"agnostic","page":1,"per_page":10,"sort_field":"name","sort_order":"desc","search":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._version` | string | Response data | | `data.comments` | array | Response data | | `data.comments.file_name` | string | Response data | | `data.comments.file` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.entries` | array | Response data | | `data.entries.field` | string | Response data | | `data.entries.value` | array | Response data | | `data.entries.type` | string | Response data | | `data.entries.operator` | string | Response data | | `data.id` | string | Response data | | `data.item_id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.os_types` | array | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"725","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 10:06:23 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Find Case Activity Retrieve user activity details for a specified case in Elastic Kibana 8 - Security using the provided case ID. ### Endpoint - **URL:** `/api/cases/{{case_id}}/user_actions/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.case_id` | string | Required | Parameters for the Find Case Activity action | ### Input Example `{"path_parameters":{"case_id":"b1116be0-5e8e-11ee-924f-eb8f01880390"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `userActions` | array | Output field: userActions | | `userActions.type` | string | Type of the resource | | `userActions.payload` | object | Output field: userActions.payload | | `userActions.payload.comment` | object | Output field: userActions.payload.comment | | `userActions.payload.comment.comment` | string | Output field: userActions.payload.comment.comment | | `userActions.payload.comment.owner` | string | Output field: userActions.payload.comment.owner | | `userActions.payload.comment.type` | string | Type of the resource | | `userActions.created_at` | string | Output field: userActions.created\_at | | `userActions.created_by` | object | Output field: userActions.created\_by | | `userActions.created_by.username` | string | Name of the resource | | `userActions.created_by.full_name` | object | Name of the resource | | `userActions.created_by.email` | object | Output field: userActions.created\_by.email | | `userActions.owner` | string | Output field: userActions.owner | | `userActions.action` | string | Output field: userActions.action | | `userActions.comment_id` | string | Unique identifier | | `userActions.id` | string | Unique identifier | | `userActions.version` | string | Output field: userActions.version | | `page` | number | Output field: page | | `perPage` | number | Output field: perPage | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"1016","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 16:50:40 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-00000000...` ## Find Cases Manage and review paginated cases from Elastic Kibana 8 - Security, streamlining the case handling process. ### Endpoint - **URL:** `/api/cases/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------- | | `parameters.assignees` | string | Optional | Parameters for the Find Cases action | | `parameters.defaultSearchOperator` | string | Optional | Parameters for the Find Cases action | | `parameters.from` | string | Optional | The date must be specified as a KQL(Kibana Query Language) data range or date match expression. | | `parameters.owner` | array | Optional | Parameters for the Find Cases action | | `parameters.page` | number | Optional | Parameters for the Find Cases action | | `parameters.perPage` | number | Optional | Parameters for the Find Cases action | | `parameters.reporters` | array | Optional | Parameters for the Find Cases action | | `parameters.search` | string | Optional | Parameters for the Find Cases action | | `parameters.searchFields` | array | Optional | Parameters for the Find Cases action | | `parameters.severity` | string | Optional | Parameters for the Find Cases action | | `parameters.sortField` | string | Optional | Parameters for the Find Cases action | | `parameters.sortOrder` | string | Optional | Parameters for the Find Cases action | | `parameters.status` | string | Optional | Parameters for the Find Cases action | | `parameters.tags` | array | Optional | Parameters for the Find Cases action | | `parameters.to` | string | Optional | Parameters for the Find Cases action | ### Input Example `{"parameters":{"assignees":"","defaultSearchOperator":"OR","from":"","owner":["cases","observability"],"page":1,"perPage":20,"reporters":[""],"search":"","searchFields":[""],"severity":"critical","sortField":"updatedAt","sortOrder":"desc","status":"in-progress","tags":[""],"to":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | | `cases` | array | Output field: cases | | `cases.description` | string | Output field: cases.description | | `cases.title` | string | Output field: cases.title | | `cases.tags` | array | Output field: cases.tags | | `cases.settings` | object | Output field: cases.settings | | `cases.settings.syncAlerts` | boolean | Output field: cases.settings.syncAlerts | | `cases.owner` | string | Output field: cases.owner | | `cases.category` | object | Output field: cases.category | | `cases.assignees` | array | Output field: cases.assignees | | `cases.assignees.file_name` | string | Name of the resource | | `cases.assignees.file` | string | Output field: cases.assignees.file | | `cases.connector` | object | Output field: cases.connector | | `cases.connector.id` | string | Unique identifier | | `cases.connector.type` | string | Type of the resource | | `cases.connector.fields` | object | Output field: cases.connector.fields | | `cases.connector.fields.issueType` | string | Type of the resource | | `cases.connector.fields.priority` | string | Output field: cases.connector.fields.priority | | `cases.connector.fields.parent` | object | Output field: cases.connector.fields.parent | | `cases.connector.name` | string | Name of the resource | | `cases.severity` | string | Output field: cases.severity | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"791","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 06:17:41 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Find Detection Rules Retrieve a paginated list of detection rules from Elastic Kibana 8 - Security for analysis and management purposes. ### Endpoint - **URL:** `/api/detection_engine/rules/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | number | Optional | Parameters for the Find Detection Rules action | | `parameters.per_page` | number | Optional | Parameters for the Find Detection Rules action | | `parameters.sort_field` | string | Optional | Parameters for the Find Detection Rules action | | `parameters.sort_order` | string | Optional | Parameters for the Find Detection Rules action | | `parameters.filter` | string | Optional | Filters the returned results according to the value of the specified field, using the alert.attributes.
:::Iframe{code=""} :::
:
:::Iframe{code=""} :::
syntax. | ### Input Example `{"parameters":{"page":1,"per_page":20,"sort_field":"enabled","sort_order":"asc","filter":"alert.attributes.name:windows"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `page` | number | Output field: page | | `perPage` | number | Output field: perPage | | `total` | number | Output field: total | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"43","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 11:04:54 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000...` ## Find event filters Locate event filters in Elastic Kibana 8 by specifying list\_id and namespace\_type parameters. ### Endpoint - **URL:** `/api/exception_lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.list_id` | string | Required | Parameters for the Find event filters action | | `parameters.namespace_type` | string | Required | Parameters for the Find event filters action | | `parameters.page` | number | Optional | Parameters for the Find event filters action | | `parameters.per_page` | number | Optional | Parameters for the Find event filters action | | `parameters.sort_field` | string | Optional | Parameters for the Find event filters action | | `parameters.sort_order` | string | Optional | Parameters for the Find event filters action | | `parameters.filter` | string | Optional | Parameters for the Find event filters action | ### Input Example `{"parameters":{"list_id":"endpoint_event_filters","namespace_type":"agnostic","page":1,"per_page":10,"sort_field":"name","sort_order":"desc","filter":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._version` | string | Response data | | `data.comments` | array | Response data | | `data.comments.comment` | string | Response data | | `data.comments.created_at` | string | Response data | | `data.comments.created_by` | string | Response data | | `data.comments.id` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.entries` | array | Response data | | `data.entries.field` | string | Response data | | `data.entries.operator` | string | Response data | | `data.entries.type` | string | Response data | | `data.entries.value` | string | Response data | | `data.id` | string | Response data | | `data.item_id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.os_types` | array | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"998","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 13:42:33 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Find Exception Containers Retrieve a paginated subset of exception containers from Elastic Kibana 8 - Security for streamlined incident management. ### Endpoint - **URL:** `/api/exception_lists/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.search` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.page` | number | Optional | Parameters for the Find Exception Containers action | | `parameters.per_page` | number | Optional | Parameters for the Find Exception Containers action | | `parameters.sort_field` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.sort_order` | string | Optional | Parameters for the Find Exception Containers action | | `parameters.namespace_type` | string | Optional | Parameters for the Find Exception Containers action | ### Input Example `{"parameters":{"filter":"","search":"","page":1,"per_page":10,"sort_field":"name","sort_order":"desc","namespace_type":"single"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._version` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.id` | string | Response data | | `data.immutable` | boolean | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.os_types` | array | Response data | | `data.os_types.file_name` | string | Response data | | `data.os_types.file` | string | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | | `data.updated_by` | string | Response data | | `data.version` | number | Response data | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"534","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 08:42:46 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Find Exception Items Retrieve exception items from a specified list in Elastic Kibana 8 - Security using 'list\_id' for targeted pagination. ### Endpoint - **URL:** `/api/exception_lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.list_id` | string | Required | Parameters for the Find Exception Items action | | `parameters.page` | number | Optional | Parameters for the Find Exception Items action | | `parameters.per_page` | number | Optional | Parameters for the Find Exception Items action | | `parameters.sort_field` | string | Optional | Parameters for the Find Exception Items action | | `parameters.sort_order` | string | Optional | Parameters for the Find Exception Items action | ### Input Example `{"parameters":{"list_id":"trusted-linux-processes","page":1,"per_page":10,"sort_field":"name","sort_order":"desc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._version` | string | Response data | | `data.comments` | array | Response data | | `data.comments.file_name` | string | Response data | | `data.comments.file` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.entries` | array | Response data | | `data.entries.field` | string | Response data | | `data.entries.operator` | string | Response data | | `data.entries.type` | string | Response data | | `data.entries.value` | array | Response data | | `data.id` | string | Response data | | `data.item_id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.os_types` | array | Response data | | `data.os_types.file_name` | string | Response data | | `data.os_types.file` | string | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"703","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 08:47:31 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Find Host Isolation Exceptions Locate host isolation exceptions in Elastic Kibana 8 using specified list\_id and namespace\_type. ### Endpoint - **URL:** `/api/exception_lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------- | | `parameters.list_id` | string | Required | Parameters for the Find Host Isolation Exceptions action | | `parameters.namespace_type` | string | Required | Parameters for the Find Host Isolation Exceptions action | | `parameters.page` | number | Optional | Parameters for the Find Host Isolation Exceptions action | | `parameters.per_page` | number | Optional | Parameters for the Find Host Isolation Exceptions action | | `parameters.sort_field` | string | Optional | Parameters for the Find Host Isolation Exceptions action | | `parameters.sort_order` | string | Optional | Parameters for the Find Host Isolation Exceptions action | | `parameters.filter` | string | Optional | Parameters for the Find Host Isolation Exceptions action | ### Input Example `{"parameters":{"list_id":"endpoint_host_isolation_exceptions","namespace_type":"agnostic","page":1,"per_page":10,"sort_field":"name","sort_order":"desc","filter":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._version` | string | Response data | | `data.comments` | array | Response data | | `data.comments.file_name` | string | Response data | | `data.comments.file` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.entries` | array | Response data | | `data.entries.field` | string | Response data | | `data.entries.type` | string | Response data | | `data.entries.value` | string | Response data | | `data.entries.operator` | string | Response data | | `data.id` | string | Response data | | `data.item_id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.os_types` | array | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"707","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 17:16:48 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Find List Containers Retrieve a subset of list containers in Elastic Kibana 8 - Security for efficient data management and pagination support. ### Endpoint - **URL:** `/api/lists/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Find List Containers action | | `parameters.page` | number | Optional | Parameters for the Find List Containers action | | `parameters.per_page` | number | Optional | Parameters for the Find List Containers action | | `parameters.sort_field` | string | Optional | Parameters for the Find List Containers action | | `parameters.sort_order` | string | Optional | Parameters for the Find List Containers action | ### Input Example `{"parameters":{"filter":"type:keyword","page":1,"per_page":10,"sort_field":"name","sort_order":"desc"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `data` | array | Response data | | `data._version` | string | Response data | | `data.id` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.immutable` | boolean | Response data | | `data.name` | string | Response data | | `data.tie_breaker_id` | string | Response data | | `data.type` | string | Response data | | `data.updated_at` | string | Response data | | `data.updated_by` | string | Response data | | `data.version` | number | Response data | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"60","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 17:38:16 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000...` ## Find List Items Retrieve a paginated subset of list items from a specified container in Elastic Kibana 8 - Security. ### Endpoint - **URL:** `/api/lists/items/_find` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.list_id` | string | Optional | Parameters for the Find List Items action | | `parameters.page` | number | Optional | Parameters for the Find List Items action | | `parameters.per_page` | number | Optional | Parameters for the Find List Items action | | `parameters.sort_field` | string | Optional | Parameters for the Find List Items action | | `parameters.sort_order` | string | Optional | Parameters for the Find List Items action | ### Input Example `{"parameters":{"list_id":"internal-ip-range-excludes","page":1,"per_page":10,"sort_field":"name","sort_order":"desc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `page` | number | Output field: page | | `per_page` | number | Output field: per\_page | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"60","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 06:00:02 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":"...` ## Find Trusted Applications Locate trusted applications within Elastic Kibana 8 using specified list\_id and namespace\_type. ### Endpoint - **URL:** `/api/exception_lists/items/_find` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.list_id` | string | Required | Parameters for the Find Trusted Applications action | | `parameters.namespace_type` | string | Required | Parameters for the Find Trusted Applications action | | `parameters.page` | number | Optional | Parameters for the Find Trusted Applications action | | `parameters.per_page` | number | Optional | Parameters for the Find Trusted Applications action | | `parameters.sort_field` | string | Optional | Parameters for the Find Trusted Applications action | | `parameters.sort_order` | string | Optional | Parameters for the Find Trusted Applications action | | `parameters.filter` | string | Optional | Parameters for the Find Trusted Applications action | ### Input Example `{"parameters":{"list_id":"endpoint_trusted_app","namespace_type":"agnostic","page":1,"per_page":10,"sort_field":"name","sort_order":"desc"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data._version` | string | Response data | | `data.comments` | array | Response data | | `data.comments.comment` | string | Response data | | `data.comments.created_at` | string | Response data | | `data.comments.created_by` | string | Response data | | `data.comments.id` | string | Response data | | `data.created_at` | string | Response data | | `data.created_by` | string | Response data | | `data.description` | string | Response data | | `data.entries` | array | Response data | | `data.entries.field` | string | Response data | | `data.entries.value` | string | Response data | | `data.entries.type` | string | Response data | | `data.entries.operator` | string | Response data | | `data.id` | string | Response data | | `data.item_id` | string | Response data | | `data.list_id` | string | Response data | | `data.name` | string | Response data | | `data.namespace_type` | string | Response data | | `data.os_types` | array | Response data | | `data.tags` | array | Response data | | `data.tie_breaker_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"830","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:26:51 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Get Action Details Retrieve details of a specific response action in Elastic Kibana 8 - Security using the action\_id. ### Endpoint - **URL:** `/api/endpoint/action/{{action_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.action_id` | string | Required | Parameters for the Get Action Details action | ### Input Example `{"path_parameters":{"action_id":"fr518850-681a-4y60-aa98-e22640cae2b8"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.agents` | array | Response data | | `data.command` | string | Response data | | `data.startedAt` | string | Response data | | `data.completedAt` | string | Response data | | `data.createdBy` | string | Response data | | `data.isCompleted` | boolean | Response data | | `data.wasSuccessful` | boolean | Response data | | `data.isExpired` | boolean | Response data | | `data.outputs` | object | Response data | | `data.outputs.afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0` | object | Response data | | `data.outputs.afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0.type` | string | Response data | | `data.outputs.afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0.content` | object | Response data | | `data.outputs.afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0.content.entries` | array | Response data | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## Get All Connector Retrieve all available connectors from Elastic Kibana 8 - Security for comprehensive management and configuration. ### Endpoint - **URL:** `/api/actions/connectors` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Tue, 03 Oct 2023 16:06:01 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Get Case Retrieve detailed information for a specific case in Elastic Kibana 8 - Security by providing the case ID. ### Endpoint - **URL:** `/api/cases/{{case_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------- | | `path_parameters.case_id` | string | Required | Parameters for the Get Case action | | `parameters.includeComments` | boolean | Optional | Parameters for the Get Case action | ### Input Example `{"parameters":{"includeComments":true},"path_parameters":{"case_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `description` | string | Output field: description | | `title` | string | Output field: title | | `tags` | array | Output field: tags | | `settings` | object | Output field: settings | | `settings.syncAlerts` | boolean | Output field: settings.syncAlerts | | `owner` | string | Output field: owner | | `category` | object | Output field: category | | `assignees` | array | Output field: assignees | | `assignees.file_name` | string | Name of the resource | | `assignees.file` | string | Output field: assignees.file | | `connector` | object | Output field: connector | | `connector.id` | string | Unique identifier | | `connector.type` | string | Type of the resource | | `connector.fields` | object | Output field: connector.fields | | `connector.fields.issueType` | string | Type of the resource | | `connector.fields.priority` | string | Output field: connector.fields.priority | | `connector.fields.parent` | object | Output field: connector.fields.parent | | `connector.name` | string | Name of the resource | | `severity` | string | Output field: severity | | `status` | string | Status value | | `duration` | object | Output field: duration | | `closed_at` | object | Output field: closed\_at | | `closed_by` | object | Output field: closed\_by | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"674","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 06:14:33 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Get Connector Retrieve a specific Elastic Kibana 8 - Security connector using its unique identifier (ID). ### Endpoint - **URL:** `/api/actions/connector/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Connector action | ### Input Example `{"path_parameters":{"id":"73cdcf10-5eea-11ee-924f-eb8f01880390"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `config` | object | Output field: config | | `config.connectorType` | string | Type of the resource | | `config.mappings` | object | Output field: config.mappings | | `config.mappings.ruleNameConfig` | object | Name of the resource | | `config.mappings.ruleNameConfig.id` | string | Unique identifier | | `config.mappings.ruleNameConfig.name` | string | Name of the resource | | `config.mappings.ruleNameConfig.key` | string | Name of the resource | | `config.mappings.ruleNameConfig.fieldType` | string | Name of the resource | | `config.mappings.alertIdConfig` | object | Unique identifier | | `config.mappings.caseIdConfig` | object | Unique identifier | | `config.mappings.caseNameConfig` | object | Name of the resource | | `config.mappings.commentsConfig` | object | Output field: config.mappings.commentsConfig | | `config.mappings.severityConfig` | object | Output field: config.mappings.severityConfig | | `config.mappings.descriptionConfig` | object | Output field: config.mappings.descriptionConfig | | `config.appId` | string | Unique identifier | | `config.apiUrl` | string | URL endpoint for the request | | `connector_type_id` | string | Unique identifier | | `is_preconfigured` | boolean | Output field: is\_preconfigured | | `is_deprecated` | boolean | Output field: is\_deprecated | | `is_missing_secrets` | boolean | Output field: is\_missing\_secrets | | `is_system_action` | boolean | Output field: is\_system\_action | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"535","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Mon, 09 Oct 2023 06:10:38 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Get Current Connector Retrieve a list of available connectors in the Elastic Security UI, providing users with current integration options. ### Endpoint - **URL:** `/api/cases/configure` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"695","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Mon, 09 Oct 2023 06:03:55 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Get Detection Rule Retrieve a specific detection rule from Elastic Kibana 8 - Security using the provided rule ID. ### Endpoint - **URL:** `/api/detection_engine/rules?id={{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Detection Rule action | ### Input Example `{"path_parameters":{"id":"e4099430-629b-11ee-924f-eb8f01880390"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `name` | string | Name of the resource | | `tags` | array | Output field: tags | | `tags.file_name` | string | Name of the resource | | `tags.file` | string | Output field: tags.file | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `revision` | number | Output field: revision | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 12:58:45 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Get Endpoint Retrieve metadata for a specified host in Elastic Defend using the provided endpoint ID as a path parameter. ### Endpoint - **URL:** `/api/endpoint/metadata/{{endpoint_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.endpoint_id` | string | Required | Parameters for the Get Endpoint action | ### Input Example `{"path_parameters":{"endpoint_id":"fr518850-681a-4y60-aa98-e22640cae2b8"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `host_status` | string | Status value | | `last_checkin` | string | Output field: last\_checkin | | `metadata` | object | Response data | | `metadata.@timestamp` | string | Response data | | `metadata.Endpoint` | object | Response data | | `metadata.Endpoint.capabilities` | array | Response data | | `metadata.Endpoint.configuration` | object | Response data | | `metadata.Endpoint.configuration.isolation` | boolean | Response data | | `metadata.Endpoint.policy` | object | Response data | | `metadata.Endpoint.policy.applied` | object | Response data | | `metadata.Endpoint.policy.applied.endpoint_policy_version` | string | Response data | | `metadata.Endpoint.policy.applied.id` | string | Response data | | `metadata.Endpoint.policy.applied.name` | string | Response data | | `metadata.Endpoint.policy.applied.status` | string | Response data | | `metadata.Endpoint.policy.applied.version` | string | Response data | | `metadata.Endpoint.state` | object | Response data | | `metadata.Endpoint.state.isolation` | boolean | Response data | | `metadata.Endpoint.status` | string | Response data | | `metadata.agent` | object | Response data | | `metadata.agent.build` | object | Response data | | `metadata.agent.build.original` | string | Response data | | `metadata.agent.id` | string | Response data | | `metadata.agent.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## Get Kibana Space Retrieves information about available Kibana Spaces within the Elastic Kibana 8 - Security environment. ### Endpoint - **URL:** `/api/spaces/space` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"287","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 09:06:29 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Get Processes Retrieve a list of running processes from specified hosts in Elastic Defend using endpoint IDs. ### Endpoint - **URL:** `/api/endpoint/action/running_procs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `endpoint_ids` | array | Optional | Unique identifier | | `alert_ids` | array | Optional | Unique identifier | | `case_ids` | array | Optional | Unique identifier | | `comment` | string | Optional | Parameter for Get Processes | ### Input Example `{"json_body":{"endpoint_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"alert_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"case_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"comment":""}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.agents` | array | Response data | | `data.command` | string | Response data | | `data.isExpired` | boolean | Response data | | `data.isCompleted` | boolean | Response data | | `data.wasSuccessful` | boolean | Response data | | `data.errors` | array | Response data | | `data.errors.file_name` | string | Response data | | `data.errors.file` | string | Response data | | `data.startedAt` | string | Response data | | `data.completedAt` | string | Response data | | `data.outputs` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.type` | string | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content.key` | string | Response data | | `data.createdBy` | string | Response data | | `data.comment` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## Get Signals Obtain an overview of detected threats and anomalies by retrieving signals from Elastic Kibana 8 - Security. ### Endpoint - **URL:** `/api/detection_engine/signals/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------ | -------- | ------------ | ------------------------- | | `aggs` | object | Optional | Parameter for Get Signals | | `aggs.latest` | object | Optional | Parameter for Get Signals | | `aggs.latest.max` | object | Optional | Parameter for Get Signals | | `aggs.latest.max.field` | string | Optional | Parameter for Get Signals | | `aggs.oldest` | object | Optional | Parameter for Get Signals | | `aggs.oldest.min` | object | Optional | Parameter for Get Signals | | `aggs.oldest.min.field` | string | Optional | Parameter for Get Signals | | `query` | object | Optional | Parameter for Get Signals | | `query.bool` | object | Optional | Parameter for Get Signals | | `query.bool.filter` | array | Optional | Parameter for Get Signals | | `query.bool.filter.match` | object | Optional | Parameter for Get Signals | | `query.bool.filter.match.signal.status` | string | Optional | Status value | | `query.bool.filter.range` | object | Optional | Parameter for Get Signals | | `query.bool.filter.range.signal.rule.risk_score` | object | Optional | Score value | ### Input Example `{"json_body":{"aggs":{"latest":{"max":{"field":"@timestamp"}},"oldest":{"min":{"field":"@timestamp"}}},"query":{"bool":{"filter":[{"match":{"signal.status":"open"}},{"range":{"signal.rule.risk_score":{"gte":70}}}]}}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.skipped` | number | Output field: \_shards.skipped | | `_shards.failed` | number | Output field: \_shards.failed | | `hits` | object | Output field: hits | | `hits.total` | object | Output field: hits.total | | `hits.total.value` | number | Value for the parameter | | `hits.total.relation` | string | Output field: hits.total.relation | | `hits.max_score` | number | Score value | | `hits.hits` | array | Output field: hits.hits | | `hits.hits._index` | string | Output field: hits.hits.\_index | | `hits.hits._id` | string | Unique identifier | | `hits.hits._score` | number | Score value | | `hits.hits._source` | object | Output field: hits.hits.\_source | | `hits.hits._source.kibana.version` | string | Output field: hits.hits.\_source.kibana.version | | `hits.hits._source.kibana.alert.rule.category` | string | Output field: hits.hits.\_source.kibana.alert.rule.category | | `hits.hits._source.kibana.alert.rule.consumer` | string | Output field: hits.hits.\_source.kibana.alert.rule.consumer | | `hits.hits._source.kibana.alert.rule.execution.uuid` | string | Unique identifier | | `hits.hits._source.kibana.alert.rule.name` | string | Name of the resource | | `hits.hits._source.kibana.alert.rule.producer` | string | Output field: hits.hits.\_source.kibana.alert.rule.producer | ### Output Example `{"status_code":200,"response_headers":{"x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","kbn-name":"ubu2004template","kbn-license-sig":"a43abc045d066ce42208f51f7d1f6ab599a400a120e87ef8e5ed3b4b62b5bfea","content-type":"application/json; charset=utf-8","cache-control":"private, no-cache, no-store, must-revalidate","vary":"accept-encoding","content-encoding":"gzip","Date":"Wed, 15 Mar 2023 20:49:15 GMT","Connection":"keep-alive","Keep-Alive":"timeout=120","Transfer-...` ## Get Tags Aggregates and returns all unique tags from security rules in Elastic Kibana 8. ### Endpoint - **URL:** `/api/detection_engine/tags` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 08:49:08 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Isolate a Host Isolate a host from the network in Elastic Defend using the specified endpoint IDs. ### Endpoint - **URL:** `/api/endpoint/action/isolate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------- | | `endpoint_ids` | array | Optional | Unique identifier | | `alert_ids` | array | Optional | Unique identifier | | `case_ids` | array | Optional | Unique identifier | | `comment` | string | Optional | Parameter for Isolate a Host | ### Input Example `{"json_body":{"endpoint_ids":["9972d10e-4b9e-41aa-a534-a85e2a28ea42","bc0e4f0c-3bca-4633-9fee-156c0b505d16"],"alert_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"case_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"comment":"Locked down, pending further investigation"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `action` | string | Output field: action | | `data` | object | Response data | | `data.id` | string | Response data | | `data.agents` | array | Response data | | `data.command` | string | Response data | | `data.isExpired` | boolean | Response data | | `data.isCompleted` | boolean | Response data | | `data.wasSuccessful` | boolean | Response data | | `data.errors` | array | Response data | | `data.errors.file_name` | string | Response data | | `data.errors.file` | string | Response data | | `data.startedAt` | string | Response data | | `data.completedAt` | string | Response data | | `data.outputs` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.type` | string | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content.key` | string | Response data | | `data.createdBy` | string | Response data | | `data.comment` | string | Response data | | `data.parameters.entity_id` | string | Parameters for the Isolate a Host action | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## List Endpoints Retrieve a comprehensive list of hosts with Elastic Defend for enhanced security oversight. ### Endpoint - **URL:** `/api/endpoint/metadata` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.page` | number | Optional | Parameters for the List Endpoints action | | `parameters.page_size` | number | Optional | Parameters for the List Endpoints action | | `parameters.kuery` | string | Optional | Parameters for the List Endpoints action | | `parameters.hostStatuses` | array | Optional | Parameters for the List Endpoints action | | `parameters.sortField` | string | Optional | Parameters for the List Endpoints action | | `parameters.sortDirection` | string | Optional | Parameters for the List Endpoints action | ### Input Example `{"parameters":{"page":0,"page_size":10,"kuery":"united.endpoint.host.os.name : 'Windows'","hostStatuses":["healthy","updating"],"sortField":"enrolled_at","sortDirection":"asc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `total` | number | Output field: total | | `page` | number | Output field: page | | `pageSize` | number | Output field: pageSize | | `sortField` | string | Output field: sortField | | `sortDirection` | string | Output field: sortDirection | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"92","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 07:16:18 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e795...` ## List Response Actions Retrieve a list of available response actions from Elastic Kibana 8 - Security to inform playbook decisions. ### Endpoint - **URL:** `/api/endpoint/action` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.page` | number | Optional | Parameters for the List Response Actions action | | `parameters.pageSize` | number | Optional | Parameters for the List Response Actions action | | `parameters.commands` | array | Optional | Parameters for the List Response Actions action | | `parameters.agentIds` | array | Optional | Parameters for the List Response Actions action | | `parameters.userIds` | array | Optional | Parameters for the List Response Actions action | | `parameters.startDate` | string | Optional | A start date in ISO format or Date Math format. | | `parameters.endDate` | string | Optional | A end date in ISO format or Date Math format. | ### Input Example `{"parameters":{"page":1,"pageSize":10,"commands":["isolate","running-processes"],"agentIds":["132323"],"userIds":["123233"],"startDate":"now-24h/h","endDate":"now+1h"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `page` | number | Output field: page | | `pageSize` | number | Output field: pageSize | | `total` | number | Output field: total | | `startDate` | string | Date value | | `endDate` | string | Date value | | `elasticAgentIds` | array | Unique identifier | | `data` | array | Response data | | `data.id` | string | Response data | | `data.agents` | array | Response data | | `data.command` | string | Response data | | `data.startedAt` | string | Response data | | `data.isCompleted` | boolean | Response data | | `data.completedAt` | string | Response data | | `data.wasSuccessful` | boolean | Response data | | `data.isExpired` | boolean | Response data | | `data.createdBy` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"76","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 07:27:39 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance...` ## Prepackaged Elastic Prebuilt Detection Rules Load and update prebuilt detection rules in Elastic Kibana 8 to enhance security monitoring capabilities. ### Endpoint - **URL:** `/api/detection_engine/rules/prepackaged` - **Method:** `PUT` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `rules_installed` | number | Output field: rules\_installed | | `rules_updated` | number | Output field: rules\_updated | | `timelines_installed` | number | Output field: timelines\_installed | | `timelines_updated` | number | Output field: timelines\_updated | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"88","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 13:08:48 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":"...` ## Prepackaged Get Detection Rule Status Retrieve the current status of prepackaged detection rules within Elastic Kibana 8 - Security. ### Endpoint - **URL:** `/api/detection_engine/rules/prepackaged/_status` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `rules_custom_installed` | number | Output field: rules\_custom\_installed | | `rules_installed` | number | Output field: rules\_installed | | `rules_not_installed` | number | Output field: rules\_not\_installed | | `rules_not_updated` | number | Output field: rules\_not\_updated | | `timelines_installed` | number | Output field: timelines\_installed | | `timelines_not_installed` | number | Output field: timelines\_not\_installed | | `timelines_not_updated` | number | Output field: timelines\_not\_updated | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"175","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 13:12:12 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Release an Isolated Host Remove isolation from specified hosts in Elastic Kibana 8 - Security to allow network reconnection. Requires 'endpoint\_ids'. ### Endpoint - **URL:** `/api/endpoint/action/unisolate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `endpoint_ids` | array | Optional | Unique identifier | | `alert_ids` | array | Optional | Unique identifier | | `case_ids` | array | Optional | Unique identifier | | `comment` | string | Optional | Parameter for Release an Isolated Host | ### Input Example `{"json_body":{"endpoint_ids":["9972d10e-4b9e-41aa-a534-a85e2a28ea42","bc0e4f0c-3bca-4633-9fee-156c0b505d16"],"alert_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"case_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"comment":"Remediation complete, restoring network"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `action` | string | Output field: action | | `data` | object | Response data | | `data.id` | string | Response data | | `data.agents` | array | Response data | | `data.command` | string | Response data | | `data.isExpired` | boolean | Response data | | `data.isCompleted` | boolean | Response data | | `data.wasSuccessful` | boolean | Response data | | `data.errors` | array | Response data | | `data.errors.file_name` | string | Response data | | `data.errors.file` | string | Response data | | `data.startedAt` | string | Response data | | `data.completedAt` | string | Response data | | `data.outputs` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.type` | string | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content.key` | string | Response data | | `data.createdBy` | string | Response data | | `data.comment` | string | Response data | | `data.parameters.entity_id` | string | Parameters for the Release an Isolated Host action | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## Retrieve Blocklist Entry Retrieve a specific blocklist entry from Elastic Kibana 8 - Security using the provided namespace type and ID. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Retrieve Blocklist Entry action | | `parameters.namespace_type` | string | Required | Parameters for the Retrieve Blocklist Entry action | ### Input Example `{"parameters":{"id":"e880f600-6360-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | array | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"681","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 10:12:25 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Retrieve Event Filter Retrieve a specific event filter from Elastic Kibana 8 - Security using the provided 'id' and 'namespace\_type'. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Retrieve Event Filter action | | `parameters.namespace_type` | string | Required | Parameters for the Retrieve Event Filter action | ### Input Example `{"parameters":{"id":"7fe2fe90-636a-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.operator` | string | Output field: entries.operator | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"954","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 13:38:23 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Retrieve Host Isolation Exception Retrieve details of a specific host isolation exception in Elastic Kibana 8 - Security using the provided ID and namespace type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Retrieve Host Isolation Exception action | | `parameters.namespace_type` | string | Required | Parameters for the Retrieve Host Isolation Exception action | ### Input Example `{"parameters":{"id":"80f34d90-63a0-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"663","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 17:12:27 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Retrieve Trusted Application Retrieve details for a specific trusted application in Elastic Kibana 8 - Security using its unique ID and namespace type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.id` | string | Required | Parameters for the Retrieve Trusted Application action | | `parameters.namespace_type` | string | Required | Parameters for the Retrieve Trusted Application action | ### Input Example `{"parameters":{"id":"38e91330-640f-11ee-924f-eb8f01880390","namespace_type":"agnostic"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | string | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"786","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:23:26 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-000000000...` ## Set Alert Status Update the status of specified alerts in Elastic Kibana 8 - Security using a provided status value. ### Endpoint - **URL:** `/api/detection_engine/signals/status` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ------------------------------ | | `signal_ids` | array | Optional | Unique identifier | | `status` | string | Optional | Status value | | `query` | object | Optional | Parameter for Set Alert Status | | `query.bool` | object | Optional | Parameter for Set Alert Status | | `query.bool.filter` | array | Optional | Parameter for Set Alert Status | | `query.bool.filter.range` | object | Optional | Parameter for Set Alert Status | | `query.bool.filter.range.@timestamp` | object | Optional | Parameter for Set Alert Status | ### Input Example `{"json_body":{"signal_ids":["694156bbe6a487e06d049bd6019bd49fec4172cfb33f5d81c3b4a977f0026fba","f4d1c62c4e8946c835cb497329127803c09b955de49a8fa186be3899522667b0"],"status":"closed","query":{"bool":{"filter":[{"range":{"signal.rule.risk_score":{"lte":20}}},{"range":{"@timestamp":{"lte":"now-M"}}}]}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `total` | number | Output field: total | | `updated` | number | Output field: updated | | `deleted` | number | Output field: deleted | | `batches` | number | Output field: batches | | `version_conflicts` | number | Output field: version\_conflicts | | `noops` | number | Output field: noops | | `retries` | object | Output field: retries | | `retries.bulk` | number | Output field: retries.bulk | | `retries.search` | number | Output field: retries.search | | `throttled_millis` | number | Output field: throttled\_millis | | `requests_per_second` | number | Output field: requests\_per\_second | | `throttled_until_millis` | number | Output field: throttled\_until\_millis | | `failures` | array | Output field: failures | | `failures.file_name` | string | Name of the resource | | `failures.file` | string | Output field: failures.file | ### Output Example `{"status_code":200,"response_headers":{"x-content-type-options":"nosniff","referrer-policy":"no-referrer-when-downgrade","kbn-name":"ubu2004template","kbn-license-sig":"a43abc045d066ce42208f51f7d1f6ab599a400a120e87ef8e5ed3b4b62b5bfea","content-type":"application/json; charset=utf-8","cache-control":"private, no-cache, no-store, must-revalidate","vary":"accept-encoding","content-encoding":"gzip","Date":"Wed, 15 Mar 2023 20:49:15 GMT","Connection":"keep-alive","Keep-Alive":"timeout=120","Transfer-...` ## Set Default Elastic Security Configure the default connector and closure type for Elastic Security UI, requiring specified connector and closure\_type. ### Endpoint - **URL:** `/api/cases/configure` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------ | | `connector` | object | Optional | Parameter for Set Default Elastic Security | | `connector.id` | string | Required | Unique identifier | | `connector.name` | string | Required | Name of the resource | | `connector.type` | string | Required | Type of the resource | | `connector.fields` | object | Required | Parameter for Set Default Elastic Security | | `connector.fields.caseId` | object | Optional | Unique identifier | | `closure_type` | string | Optional | Type of the resource | | `owner` | string | Optional | Parameter for Set Default Elastic Security | ### Input Example `{"json_body":{"connector":{"id":"73cdcf10-5eea-11ee-924f-eb8f01880390","name":"swimlane connector","type":".swimlane","fields":{"caseId":null}},"closure_type":"close-by-user","owner":"securitySolution"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `closure_type` | string | Type of the resource | | `connector` | object | Output field: connector | | `connector.id` | string | Unique identifier | | `connector.type` | string | Type of the resource | | `connector.fields` | object | Output field: connector.fields | | `connector.fields.caseId` | object | Unique identifier | | `connector.name` | string | Name of the resource | | `owner` | string | Output field: owner | | `created_at` | string | Output field: created\_at | | `created_by` | object | Output field: created\_by | | `created_by.username` | string | Name of the resource | | `created_by.full_name` | object | Name of the resource | | `created_by.email` | object | Output field: created\_by.email | | `updated_at` | object | Output field: updated\_at | | `updated_by` | object | Output field: updated\_by | | `mappings` | array | Output field: mappings | | `mappings.source` | string | Output field: mappings.source | | `mappings.target` | string | Output field: mappings.target | | `mappings.action_type` | string | Type of the resource | | `version` | string | Output field: version | | `error` | object | Error message if any | | `id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"626","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Tue, 03 Oct 2023 17:21:57 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Set Signal Status Update the status of specified signals in Elastic Kibana 8 - Security using a list of signal IDs and status. ### Endpoint - **URL:** `/api/detection_engine/signals/status` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `status` | string | Optional | Status value | | `signal_ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"status":"open","signal_ids":["2437654347868"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"160","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 13:41:10 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Suspend a Process Suspend a specific process on a host using Elastic Defend by specifying necessary parameters in the JSON body. ### Endpoint - **URL:** `/api/endpoint/action/suspend_process` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------- | | `endpoint_ids` | array | Optional | Unique identifier | | `alert_ids` | array | Optional | Unique identifier | | `case_ids` | array | Optional | Unique identifier | | `parameters.pid` | string | Required | Parameters for the Suspend a Process action | | `comment` | string | Optional | Parameter for Suspend a Process | ### Input Example `{"json_body":{"endpoint_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"alert_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"case_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"parameters":{"pid":"abc123"},"comment":"terminate the process"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.data` | object | Response data | | `data.data.id` | string | Response data | | `data.data.agents` | array | Response data | | `data.data.command` | string | Response data | | `data.data.isExpired` | boolean | Response data | | `data.data.isCompleted` | boolean | Response data | | `data.data.wasSuccessful` | boolean | Response data | | `data.data.errors` | array | Response data | | `data.data.errors.file_name` | string | Response data | | `data.data.errors.file` | string | Response data | | `data.data.startedAt` | string | Response data | | `data.data.completedAt` | string | Response data | | `data.data.outputs` | object | Response data | | `data.data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8` | object | Response data | | `data.data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.type` | string | Response data | | `data.data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content` | object | Response data | | `data.data.createdBy` | string | Response data | | `data.data.comment` | string | Response data | | `data.data.parameters.pid` | string | Parameters for the Suspend a Process action | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## Terminate a Process Terminate a process on selected hosts within Elastic Defend using specified endpoint IDs and parameters. ### Endpoint - **URL:** `/api/endpoint/action/kill_process` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------- | | `endpoint_ids` | array | Optional | Unique identifier | | `alert_ids` | array | Optional | Unique identifier | | `case_ids` | array | Optional | Unique identifier | | `parameters.pid` | string | Required | Parameters for the Terminate a Process action | | `comment` | string | Optional | Parameter for Terminate a Process | ### Input Example `{"json_body":{"endpoint_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"alert_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"case_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"],"parameters":{"pid":"abc123"},"comment":"terminate the process"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.agents` | array | Response data | | `data.command` | string | Response data | | `data.isExpired` | boolean | Response data | | `data.isCompleted` | boolean | Response data | | `data.wasSuccessful` | boolean | Response data | | `data.errors` | array | Response data | | `data.errors.file_name` | string | Response data | | `data.errors.file` | string | Response data | | `data.startedAt` | string | Response data | | `data.completedAt` | string | Response data | | `data.outputs` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.type` | string | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content` | object | Response data | | `data.outputs.ed518850-681a-4d60-bb98-e22640cae2a8.content.key` | string | Response data | | `data.createdBy` | string | Response data | | `data.comment` | string | Response data | | `data.parameters.pid` | string | Parameters for the Terminate a Process action | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"115","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:36:00 GMT","Elastic-Api-Version":"2023-10-31","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instanc...` ## Update blocklist entry Update an existing blocklist entry in Elastic Kibana 8 - Security using details like description, entries, and identifiers. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------ | | `_version` | string | Optional | Parameter for Update blocklist entry | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Update blocklist entry | | `entries` | array | Optional | Parameter for Update blocklist entry | | `entries.field` | string | Required | Parameter for Update blocklist entry | | `entries.value` | array | Required | Value for the parameter | | `entries.type` | string | Required | Type of the resource | | `entries.operator` | string | Required | Parameter for Update blocklist entry | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Update blocklist entry | | `id` | string | Optional | Unique identifier | | `comments` | array | Optional | Parameter for Update blocklist entry | | `comments.file_name` | string | Required | Name of the resource | | `comments.file` | string | Required | Parameter for Update blocklist entry | | `item_id` | string | Optional | Unique identifier | | `namespace_type` | string | Optional | Name of the resource | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"_version":"WzI1ODEsMV0=","name":"Linux process exceptions updates","description":"These applications must be blocked","entries":[{"field":"file.path","value":["c:/path/to/file.exe","c:/path/to/file2.exe","c:/path/to/file3.exe"],"type":"match_any","operator":"included"}],"os_types":["macos"],"tags":["policy:all"],"id":"e880f600-6360-11ee-924f-eb8f01880390","comments":[],"item_id":"695590a7-5655-480d-8375-f486de462cfb","namespace_type":"agnostic","type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | array | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"478","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 09:55:38 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update Cases Update specified cases in Elastic Kibana 8 - Security using the provided JSON body details. Requires 'cases' as input. ### Endpoint - **URL:** `/api/cases` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | -------------------------- | | `cases` | array | Optional | Parameter for Update Cases | | `cases.id` | string | Required | Unique identifier | | `cases.version` | string | Required | Parameter for Update Cases | | `cases.connector` | object | Optional | Parameter for Update Cases | | `cases.connector.id` | string | Required | Unique identifier | | `cases.connector.name` | string | Required | Name of the resource | | `cases.connector.type` | string | Required | Type of the resource | | `cases.connector.fields` | object | Required | Parameter for Update Cases | | `cases.connector.fields.issueType` | string | Required | Type of the resource | | `cases.connector.fields.priority` | object | Required | Parameter for Update Cases | | `cases.connector.fields.parent` | object | Required | Parameter for Update Cases | | `cases.connector.fields.caseId` | string | Optional | Unique identifier | | `cases.description` | string | Optional | Parameter for Update Cases | | `cases.tags` | array | Optional | Parameter for Update Cases | | `cases.assignees` | array | Optional | Parameter for Update Cases | | `cases.assignees.file_name` | string | Required | Name of the resource | | `cases.assignees.file` | string | Required | Parameter for Update Cases | | `cases.settings` | object | Optional | Parameter for Update Cases | | `cases.settings.syncAlerts` | boolean | Required | Parameter for Update Cases | | `cases.severity` | string | Optional | Parameter for Update Cases | | `cases.status` | string | Optional | Status value | | `cases.title` | string | Optional | Parameter for Update Cases | ### Input Example `{"json_body":{"cases":[{"id":"a18b38a0-71b0-11ea-a0b2-c51ea50a58e2","version":"WzIzLDFd","connector":{"id":"131d4448-abe0-4789-939d-8ef60680b498","name":"My connector","type":".swimlane","fields":{"issueType":"10006","priority":null,"parent":null,"caseId":""}},"description":"A new description.","tags":["tag-1","tag-2"],"assignees":[],"settings":{"syncAlerts":true},"severity":"critical","status":"open","title":"first case"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"165","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 09:04:04 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update Detection Event correlation rule Update an existing event correlation detection rule in Elastic Kibana 8 - Security, including id, name, risk score, severity, and more. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------- | | `id` | string | Optional | Unique identifier | | `risk_score` | number | Optional | Score value | | `description` | string | Optional | Parameter for Update Detection Event correlation rule | | `name` | string | Optional | Name of the resource | | `severity` | string | Optional | Parameter for Update Detection Event correlation rule | | `tags` | array | Optional | Parameter for Update Detection Event correlation rule | | `type` | string | Optional | Type of the resource | | `language` | string | Optional | Parameter for Update Detection Event correlation rule | | `query` | string | Optional | Parameter for Update Detection Event correlation rule | ### Input Example `{"json_body":{"rule_id":"eql-outbound-rundll32-connections","risk_score":21,"description":"Unusual rundll32.exe network connection","name":"rundll32.exe network connection update","severity":"low","tags":["EQL","Windows","rundll32.exe"],"type":"eql","language":"eql","query":"sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | | `severity_mapping` | array | Output field: severity\_mapping | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:18:52 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Update Detection Indicator match rule Update an existing indicator match rule in Elastic Kibana 8 - Security with parameters like risk score, severity, and threat details. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------------------------------------------- | | `id` | string | Optional | Unique identifier | | `type` | string | Optional | Type of the resource | | `index` | array | Optional | Parameter for Update Detection Indicator match rule | | `query` | string | Optional | Parameter for Update Detection Indicator match rule | | `threat_index` | array | Optional | Parameter for Update Detection Indicator match rule | | `threat_query` | string | Optional | Parameter for Update Detection Indicator match rule | | `threat_mapping` | array | Optional | Parameter for Update Detection Indicator match rule | | `threat_mapping.entries` | array | Optional | Parameter for Update Detection Indicator match rule | | `threat_mapping.entries.field` | string | Optional | Parameter for Update Detection Indicator match rule | | `threat_mapping.entries.type` | string | Optional | Type of the resource | | `threat_mapping.entries.value` | string | Optional | Value for the parameter | | `risk_score` | number | Optional | Score value | | `severity` | string | Optional | Parameter for Update Detection Indicator match rule | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Update Detection Indicator match rule | ### Input Example `{"json_body":{"rule_id":"a8fd8c70-7be8-4d70-95d3-5135bf17d498","type":"threat_match","index":["packetbeat-*"],"query":"destination.ip:* or host.ip:*","threat_index":["ip-threat-list"],"threat_query":"*:*","threat_mapping":[{"entries":[{"field":"destination.ip","type":"mapping","value":"destination.ip"},{"field":"destination.port","type":"mapping","value":"destination.port"}]},{"entries":[{"field":"source.ip","type":"mapping","value":"host.ip"}]}],"risk_score":50,"severity":"medium","name":"Bad IP threat match update","description":"Checks for bad IP addresses listed in the ip-threat-list index"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `tags.file_name` | string | Name of the resource | | `tags.file` | string | Output field: tags.file | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:23:37 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Update Detection ML Rule Update an existing machine learning rule in Elastic Kibana 8 - Security using parameters like risk score, severity, and anomaly threshold. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------- | | `anomaly_threshold` | number | Optional | Parameter for Update Detection ML Rule | | `id` | string | Optional | Unique identifier | | `risk_score` | number | Optional | Score value | | `machine_learning_job_id` | string | Optional | Unique identifier | | `description` | string | Optional | Parameter for Update Detection ML Rule | | `interval` | string | Optional | Parameter for Update Detection ML Rule | | `name` | string | Optional | Name of the resource | | `note` | string | Optional | Parameter for Update Detection ML Rule | | `severity` | string | Optional | Parameter for Update Detection ML Rule | | `tags` | array | Optional | Parameter for Update Detection ML Rule | | `type` | string | Optional | Type of the resource | | `from` | string | Optional | Parameter for Update Detection ML Rule | | `enabled` | boolean | Optional | Parameter for Update Detection ML Rule | | `throttle` | string | Optional | Parameter for Update Detection ML Rule | | `actions` | array | Optional | Parameter for Update Detection ML Rule | | `actions.action_type_id` | string | Optional | Unique identifier | | `actions.group` | string | Optional | Parameter for Update Detection ML Rule | | `actions.id` | string | Optional | Unique identifier | | `actions.params` | object | Optional | Parameter for Update Detection ML Rule | | `actions.params.message` | string | Optional | Response message | ### Input Example `{"json_body":{"anomaly_threshold":70,"rule_id":"ml_linux_network_high_threshold","risk_score":70,"machine_learning_job_id":"linux_anomalous_network_activity_ecs","description":"Generates alerts when the job discovers anomalies over 70","interval":"5m","name":"Anomalous Linux network activity","note":"Shut down the internet.","severity":"high","tags":["machine learning","Linux"],"type":"machine_learning","from":"now-6m","enabled":true,"throttle":"rule","actions":[{"action_type_id":".slack","group":"default","id":"73cdcf10-5eea-11ee-924f-eb8f01880390","params":{"message":"Detection is created!"}}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `note` | string | Output field: note | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:30:34 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Update Detection Query Rule Update an existing query detection rule in Elastic Kibana 8 - Security using the provided ID, name, risk score, severity, type, and query. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ----------------------------------------- | | `id` | string | Optional | Unique identifier | | `risk_score` | number | Optional | Score value | | `description` | string | Optional | Parameter for Update Detection Query Rule | | `interval` | string | Optional | Parameter for Update Detection Query Rule | | `name` | string | Optional | Name of the resource | | `severity` | string | Optional | Parameter for Update Detection Query Rule | | `tags` | array | Optional | Parameter for Update Detection Query Rule | | `type` | string | Optional | Type of the resource | | `from` | string | Optional | Parameter for Update Detection Query Rule | | `query` | string | Optional | Parameter for Update Detection Query Rule | | `language` | string | Optional | Parameter for Update Detection Query Rule | | `filters` | array | Optional | Parameter for Update Detection Query Rule | | `filters.query` | object | Optional | Parameter for Update Detection Query Rule | | `filters.query.match` | object | Optional | Parameter for Update Detection Query Rule | | `filters.query.match.event.action` | object | Optional | Parameter for Update Detection Query Rule | | `filters.query.match.event.action.query` | string | Optional | Parameter for Update Detection Query Rule | | `filters.query.match.event.action.type` | string | Optional | Type of the resource | | `enabled` | boolean | Optional | Parameter for Update Detection Query Rule | ### Input Example `{"json_body":{"rule_id":"process_started_by_ms_office_program_1","risk_score":50,"description":"Process started by MS Office program - possible payload","interval":"1h","name":"MS Office child process update","severity":"low","tags":["child process","ms office"],"type":"query","from":"now-70m","query":"process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE","language":"kuery","filters":[{"query":{"match":{"event.action":{"query":"Process Create (rule: ProcessCreate)","type":"phrase"}}}}],"enabled":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | | `severity_mapping` | array | Output field: severity\_mapping | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:15:08 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Update Detection Threshold Rule Update an existing query threshold rule in Elastic Kibana 8 - Security with parameters like id, name, risk score, severity, and more. ### Endpoint - **URL:** `/api/detection_engine/rules` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------- | | `description` | string | Optional | Parameter for Update Detection Threshold Rule | | `enabled` | boolean | Optional | Parameter for Update Detection Threshold Rule | | `from` | string | Optional | Parameter for Update Detection Threshold Rule | | `index` | array | Optional | Parameter for Update Detection Threshold Rule | | `interval` | string | Optional | Parameter for Update Detection Threshold Rule | | `name` | string | Optional | Name of the resource | | `query` | string | Optional | Parameter for Update Detection Threshold Rule | | `risk_score` | number | Optional | Score value | | `id` | string | Optional | Unique identifier | | `severity` | string | Optional | Parameter for Update Detection Threshold Rule | | `severity_mapping` | array | Optional | Parameter for Update Detection Threshold Rule | | `severity_mapping.field` | string | Optional | Parameter for Update Detection Threshold Rule | | `severity_mapping.operator` | string | Optional | Parameter for Update Detection Threshold Rule | | `severity_mapping.severity` | string | Optional | Parameter for Update Detection Threshold Rule | | `severity_mapping.value` | string | Optional | Value for the parameter | | `tags` | array | Optional | Parameter for Update Detection Threshold Rule | | `threshold` | object | Optional | Parameter for Update Detection Threshold Rule | | `threshold.field` | string | Required | Parameter for Update Detection Threshold Rule | | `threshold.value` | number | Required | Value for the parameter | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"description":"Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.","enabled":true,"from":"now-180s","index":["winlogbeat-*"],"interval":"2m","name":"Liverpool Windows server prml-19 update","query":"host.name:prml-19 and event.category:authentication and event.outcome:failure","risk_score":30,"rule_id":"liv-win-ser-logins","severity":"low","severity_mapping":[{"field":"source.geo.city_name","operator":"equals","severity":"low","value":"Manchester"},{"field":"source.geo.city_name","operator":"equals","severity":"critical","value":"Wallingford"}],"tags":["Brute force"],"threshold":{"field":"source.ip","value":20},"type":"threshold"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `risk_score` | number | Score value | | `severity` | string | Output field: severity | | `output_index` | string | Output field: output\_index | | `investigation_fields` | array | Output field: investigation\_fields | | `investigation_fields.file_name` | string | Name of the resource | | `investigation_fields.file` | string | Output field: investigation\_fields.file | | `tags` | array | Output field: tags | | `interval` | string | Output field: interval | | `enabled` | boolean | Output field: enabled | | `author` | array | Output field: author | | `author.file_name` | string | Name of the resource | | `author.file` | string | Output field: author.file | | `false_positives` | array | Output field: false\_positives | | `false_positives.file_name` | string | Name of the resource | | `false_positives.file` | string | Output field: false\_positives.file | | `from` | string | Output field: from | | `max_signals` | number | Output field: max\_signals | | `risk_score_mapping` | array | Output field: risk\_score\_mapping | | `risk_score_mapping.file_name` | string | Name of the resource | | `risk_score_mapping.file` | string | Output field: risk\_score\_mapping.file | | `severity_mapping` | array | Output field: severity\_mapping | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Wed, 04 Oct 2023 10:41:52 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...` ## Update Elastic Security Case Closure Connector Update the case closure connector settings in Elastic Kibana 8 - Security using a specific configuration ID and version. ### Endpoint - **URL:** `/api/cases/configure/{{configuration_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------------------------------------------------------------ | | `path_parameters.configuration_id` | string | Required | Parameters for the Update Elastic Security Case Closure Connector action | | `connector` | object | Optional | Parameter for Update Elastic Security Case Closure Connector | | `connector.id` | string | Required | Unique identifier | | `connector.name` | string | Required | Name of the resource | | `connector.type` | string | Required | Type of the resource | | `connector.fields` | object | Required | Parameter for Update Elastic Security Case Closure Connector | | `connector.fields.caseId` | object | Optional | Unique identifier | | `closure_type` | string | Optional | Type of the resource | | `version` | string | Optional | Parameter for Update Elastic Security Case Closure Connector | ### Input Example `{"json_body":{"connector":{"id":"131d4448-abe0-4789-939d-8ef60680b498","name":"My connector","type":".swimlane","fields":{"caseId":null}},"closure_type":"close-by-pushing","version":"WzIwMiwxXQ=="},"path_parameters":{"configuration_id":"5a48f180-6211-11ee-924f-eb8f01880390"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `closure_type` | string | Type of the resource | | `connector` | object | Output field: connector | | `connector.id` | string | Unique identifier | | `connector.type` | string | Type of the resource | | `connector.fields` | object | Output field: connector.fields | | `connector.fields.caseId` | object | Unique identifier | | `connector.name` | string | Name of the resource | | `owner` | string | Output field: owner | | `created_at` | string | Output field: created\_at | | `created_by` | object | Output field: created\_by | | `created_by.username` | string | Name of the resource | | `created_by.full_name` | object | Name of the resource | | `created_by.email` | object | Output field: created\_by.email | | `updated_at` | string | Output field: updated\_at | | `updated_by` | object | Output field: updated\_by | | `updated_by.username` | string | Name of the resource | | `updated_by.full_name` | object | Name of the resource | | `updated_by.email` | object | Output field: updated\_by.email | | `mappings` | array | Output field: mappings | | `mappings.source` | string | Output field: mappings.source | | `mappings.target` | string | Output field: mappings.target | | `mappings.action_type` | string | Type of the resource | | `version` | string | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"693","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Tue, 03 Oct 2023 17:35:06 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update Event Filter Modify an existing event filter in Elastic Kibana 8 - Security using details like description, entries, and identifiers. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------- | | `_version` | string | Optional | Parameter for Update Event Filter | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Update Event Filter | | `entries` | array | Optional | Parameter for Update Event Filter | | `entries.field` | string | Required | Parameter for Update Event Filter | | `entries.operator` | string | Required | Parameter for Update Event Filter | | `entries.type` | string | Required | Type of the resource | | `entries.value` | string | Required | Value for the parameter | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Update Event Filter | | `id` | string | Optional | Unique identifier | | `comments` | array | Optional | Parameter for Update Event Filter | | `comments.comment` | string | Optional | Parameter for Update Event Filter | | `comments.id` | string | Optional | Unique identifier | | `item_id` | string | Optional | Unique identifier | | `namespace_type` | string | Optional | Name of the resource | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"_version":"WzI1ODUsMV0=","name":"Some name for this item updated","description":"some description about this entry updated","entries":[{"field":"process.executable","operator":"included","type":"match","value":"c:\\applications\\elastic\\fooV2.exe"}],"os_types":["windows"],"tags":["policy:all"],"id":"7fe2fe90-636a-11ee-924f-eb8f01880390","comments":[{"comment":"updated comment","id":"4cb925a9-9df5-441d-839a-c218c158b0b4"},{"comment":"add new comment"}],"item_id":"2afcc085-e670-4042-88c7-c686400075e2","namespace_type":"agnostic","type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.operator` | string | Output field: entries.operator | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"954","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 13:17:44 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update Host Isolation Exception Update an existing host isolation exception in Elastic Kibana 8 - Security using details like description, entries, ID, item ID, name, namespace type, OS types, and type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------------- | | `_version` | string | Optional | Parameter for Update Host Isolation Exception | | `description` | string | Optional | Parameter for Update Host Isolation Exception | | `entries` | array | Optional | Parameter for Update Host Isolation Exception | | `entries.field` | string | Required | Parameter for Update Host Isolation Exception | | `entries.type` | string | Required | Type of the resource | | `entries.value` | string | Required | Value for the parameter | | `entries.operator` | string | Required | Parameter for Update Host Isolation Exception | | `id` | string | Optional | Unique identifier | | `item_id` | string | Optional | Unique identifier | | `name` | string | Optional | Name of the resource | | `namespace_type` | string | Optional | Name of the resource | | `tags` | array | Optional | Parameter for Update Host Isolation Exception | | `os_types` | array | Optional | Type of the resource | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"_version":"WzI1ODksMV0=","description":"via API","entries":[{"field":"destination.ip","type":"match","value":"10.10.0.15","operator":"included"}],"id":"80f34d90-63a0-11ee-924f-eb8f01880390","item_id":"fb00f1ac-11cd-432e-be2f-1bb7fa5ca7e0","name":"Host Isolation Exception - Created with API- update","namespace_type":"agnostic","tags":["Update","Host Isolation"],"os_types":["linux","macos","windows"],"type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.file_name` | string | Name of the resource | | `comments.file` | string | Output field: comments.file | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.type` | string | Type of the resource | | `entries.value` | string | Value for the parameter | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"663","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 17:07:27 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update List Container Update an existing list container in Elastic Kibana 8 - Security using the specified 'id', 'name', and 'description'. ### Endpoint - **URL:** `/api/lists` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------- | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Update List Container | | `_version` | string | Optional | Parameter for Update List Container | | `id` | string | Optional | Unique identifier | ### Input Example `{"json_body":{"name":"Exclude internal IP addresses update","description":"Contains list items that exclude internal IP addresses from detection rules.","_version":"WzIsMV0=","id":"internal-ip-range-excludes"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `deserializer` | string | Output field: deserializer | | `id` | string | Unique identifier | | `immutable` | boolean | Output field: immutable | | `name` | string | Name of the resource | | `serializer` | string | Output field: serializer | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `version` | number | Output field: version | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"495","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 06:06:07 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update List Item Update an existing list item in Elastic Kibana 8 - Security using the provided 'id' and 'value'. ### Endpoint - **URL:** `/api/lists/items` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------ | | `id` | string | Optional | Unique identifier | | `value` | string | Optional | Value for the parameter | | `_version` | string | Optional | Parameter for Update List Item | ### Input Example `{"json_body":{"id":"internal-ip-1","value":"10.0.0.12","_version":"WzAsMV0="}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | | `updated_at` | string | Output field: updated\_at | | `updated_by` | string | Output field: updated\_by | | `value` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"291","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 06:34:58 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` ## Update Trusted Application Update an existing trusted application in Elastic Kibana 8 - Security using details like description, entries, ID, item ID, name, namespace type, OS types, and type. ### Endpoint - **URL:** `/api/exception_lists/items` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ---------------------------------------- | | `_version` | string | Optional | Parameter for Update Trusted Application | | `name` | string | Optional | Name of the resource | | `description` | string | Optional | Parameter for Update Trusted Application | | `entries` | array | Optional | Parameter for Update Trusted Application | | `entries.field` | string | Required | Parameter for Update Trusted Application | | `entries.value` | string | Required | Value for the parameter | | `entries.type` | string | Required | Type of the resource | | `entries.operator` | string | Required | Parameter for Update Trusted Application | | `os_types` | array | Optional | Type of the resource | | `tags` | array | Optional | Parameter for Update Trusted Application | | `id` | string | Optional | Unique identifier | | `comments` | array | Optional | Parameter for Update Trusted Application | | `comments.comment` | string | Optional | Parameter for Update Trusted Application | | `item_id` | string | Optional | Unique identifier | | `namespace_type` | string | Optional | Name of the resource | | `type` | string | Optional | Type of the resource | ### Input Example `{"json_body":{"_version":"WzI1OTQsMV0=","name":"create endpoint trusted app updated!","description":"This app is good","entries":[{"field":"process.hash.sha1","value":"aedb279e378bed6c2db3c9dc9e12ba635e0b391c","type":"match","operator":"included"}],"os_types":["windows"],"tags":["policy:all"],"id":"38e91330-640f-11ee-924f-eb8f01880390","comments":[{"comment":"comment is updated"}],"item_id":"cbc73361-5d6f-4cbd-84c2-eb3564a934ae","namespace_type":"agnostic","type":"simple"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_version` | string | Output field: \_version | | `comments` | array | Output field: comments | | `comments.comment` | string | Output field: comments.comment | | `comments.created_at` | string | Output field: comments.created\_at | | `comments.created_by` | string | Output field: comments.created\_by | | `comments.id` | string | Unique identifier | | `created_at` | string | Output field: created\_at | | `created_by` | string | Output field: created\_by | | `description` | string | Output field: description | | `entries` | array | Output field: entries | | `entries.field` | string | Output field: entries.field | | `entries.value` | string | Value for the parameter | | `entries.type` | string | Type of the resource | | `entries.operator` | string | Output field: entries.operator | | `id` | string | Unique identifier | | `item_id` | string | Unique identifier | | `list_id` | string | Unique identifier | | `name` | string | Name of the resource | | `namespace_type` | string | Name of the resource | | `os_types` | array | Type of the resource | | `tags` | array | Output field: tags | | `tie_breaker_id` | string | Unique identifier | | `type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"786","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Oct 2023 06:19:54 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...` # Response Headers | **Header** | **Description** | **Example** | | -------------------------- | ----------------------------------------------------- | --------------------------------------------------------------------------------------------- | | Accept-Ranges | HTTP response header: Accept-Ranges | bytes | | Cache-Control | Directives for caching mechanisms | private, no-cache, no-store, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | Content-Disposition | HTTP response header: Content-Disposition | attachment; filename="export.ndjson" | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 626 | | Content-Security-Policy | HTTP response header: Content-Security-Policy | script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self' | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Cross-Origin-Opener-Policy | HTTP response header: Cross-Origin-Opener-Policy | same-origin | | Date | The date and time at which the message was originated | Fri, 29 Sep 2023 17:21:03 GMT | | Elastic-Api-Version | HTTP response header: Elastic-Api-Version | 2023-10-31 | | Kbn-License-Sig | HTTP response header: Kbn-License-Sig | 32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519 | | Kbn-Name | HTTP response header: Kbn-Name | instance-0000000000 | | Keep-Alive | HTTP response header: Keep-Alive | timeout=120 | | Permissions-Policy | HTTP response header: Permissions-Policy | camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=() | | referrer-policy | HTTP response header: referrer-policy | no-referrer-when-downgrade | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | accept-encoding | | Warning | HTTP response header: Warning | 299 Kibana-8.10.2 "Deprecated query parameter includeComments" | | X-Cloud-Request-Id | HTTP response header: X-Cloud-Request-Id | Cs8Ky2kERpSpoZqkG3dQhQ | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | X-Found-Handling-Cluster | HTTP response header: X-Found-Handling-Cluster | 397bafc2854d4f8ebe25ade55fbf3b17 | | X-Found-Handling-Instance | HTTP response header: X-Found-Handling-Instance | instance-0000000000 |