diff --git a/docs/api-generated/README.md b/docs/api-generated/README.md deleted file mode 100644 index 97fd32119b8bc..0000000000000 --- a/docs/api-generated/README.md +++ /dev/null @@ -1,42 +0,0 @@ -# OpenAPI (Experimental) - -Open API specifications (OAS) exist in JSON or YAML format for some Kibana features, -though they are experimental and may be incomplete or change later. - -A preview of the API specifications can be added to the Kibana Guide by using -the following process: - -. Install [OpenAPI Generator](https://openapi-generator.tech/docs/installation), -or a similar tool that can generate HTML output from OAS. - -. Optionally validate the specifications by using the commands listed in the appropriate readmes. - -. Generate HTML output. For example: - - ``` - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/alerting/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/rules -t $GIT_HOME/kibana/docs/api-generated/template - - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/cases/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/cases -t $GIT_HOME/kibana/docs/api-generated/template - - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/actions/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/connectors -t $GIT_HOME/kibana/docs/api-generated/template - - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/ml/common/openapi/ml_apis_v3.yaml -o $GIT_HOME/kibana/docs/api-generated/machine-learning -t $GIT_HOME/kibana/docs/api-generated/template - ``` - -. Rename the output files. For example: - ``` - mv $GIT_HOME/kibana/docs/api-generated/rules/index.html $GIT_HOME/kibana/docs/api-generated/rules/rule-apis-passthru.asciidoc - mv $GIT_HOME/kibana/docs/api-generated/cases/index.html $GIT_HOME/kibana/docs/api-generated/cases/case-apis-passthru.asciidoc - mv $GIT_HOME/kibana/docs/api-generated/connectors/index.html $GIT_HOME/kibana/docs/api-generated/connectors/connector-apis-passthru.asciidoc - mv $GIT_HOME/kibana/docs/api-generated/machine-learning/index.html $GIT_HOME/kibana/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc - ``` - -. If you're creating a new set of API output, you will need to have a page that incorporates the output by using passthrough blocks. For more information, refer to [Asciidoctor docs](https://docs.asciidoctor.org/asciidoc/latest/pass/pass-block/) - -. Verify the output by building the Kibana documentation. At this time, the output is added as a technical preview in the appendix. - -## Known issues - -- Some OAS 3.0 features such as `anyOf`, `oneOf`, and `allOf` might not display properly in the preview. These are on the [Short-term roadmap](https://openapi-generator.tech/docs/roadmap/) at this time. - - diff --git a/docs/api-generated/cases/case-apis-passthru.asciidoc b/docs/api-generated/cases/case-apis-passthru.asciidoc deleted file mode 100644 index eb354b320d899..0000000000000 --- a/docs/api-generated/cases/case-apis-passthru.asciidoc +++ /dev/null @@ -1,5511 +0,0 @@ -//// -This content is generated from the open API specification. -Any modifications made to this file will be overwritten. -//// - -++++ -
post /s/{spaceId}/api/cases/{caseId}/comments
post /api/cases/{caseId}/comments
post /s/{spaceId}/api/cases
post /api/cases
delete /s/{spaceId}/api/cases
delete /s/{spaceId}/api/cases/{caseId}/comments/{commentId}
delete /api/cases/{caseId}/comments/{commentId}
delete /s/{spaceId}/api/cases/{caseId}/comments
delete /api/cases/{caseId}/comments
delete /api/cases
get /s/{spaceId}/api/cases/{caseId}/user_actions/_find
get /api/cases/{caseId}/user_actions/_find
get /s/{spaceId}/api/cases/{caseId}/comments/_find
get /s/{spaceId}/api/cases/configure/connectors/_find
get /api/cases/configure/connectors/_find
get /s/{spaceId}/api/cases/_find
get /api/cases/_find
get /s/{spaceId}/api/cases/{caseId}/comments
get /api/cases/{caseId}/comments
get /s/{spaceId}/api/cases/{caseId}
get /s/{spaceId}/api/cases/{caseId}/user_actions
get /api/cases/{caseId}/user_actions
get /s/{spaceId}/api/cases/{caseId}/alerts
get /api/cases/{caseId}/alerts
get /s/{spaceId}/api/cases/{caseId}/comments/{commentId}
get /api/cases/{caseId}/comments/{commentId}
get /s/{spaceId}/api/cases/configure
get /api/cases/configure
get /api/cases/{caseId}
get /s/{spaceId}/api/cases/reporters
get /api/cases/reporters
get /s/{spaceId}/api/cases/status
get /api/cases/status
get /s/{spaceId}/api/cases/tags
get /api/cases/tags
get /s/{spaceId}/api/cases/alerts/{alertId}
get /api/cases/alerts/{alertId}
post /s/{spaceId}/api/cases/{caseId}/connector/{connectorId}/_push
post /api/cases/{caseId}/connector/{connectorId}/_push
post /s/{spaceId}/api/cases/configure
post /api/cases/configure
patch /s/{spaceId}/api/cases
patch /s/{spaceId}/api/cases/{caseId}/comments
patch /api/cases/{caseId}/comments
patch /s/{spaceId}/api/cases/configure/{configurationId}
patch /api/cases/configure/{configurationId}
patch /api/cases
post /s/{spaceId}/api/cases/{caseId}/comments
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
post /api/cases/{caseId}/comments
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
post /s/{spaceId}/api/cases
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
post /api/cases
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating.application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
delete /s/{spaceId}/api/cases
read
or all
privileges and the delete
sub-feature privilege for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
delete /s/{spaceId}/api/cases/{caseId}/comments/{commentId}
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
delete /api/cases/{caseId}/comments/{commentId}
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.application/json
delete /s/{spaceId}/api/cases/{caseId}/comments
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
delete /api/cases/{caseId}/comments
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.application/json
delete /api/cases
read
or all
privileges and the delete
sub-feature privilege for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.application/json
get /s/{spaceId}/api/cases/{caseId}/user_actions/_find
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "userActions" : [ {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- }, {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- } ],
- "total" : 1,
- "perPage" : 6,
- "page" : 0
-}
-
- application/json
get /api/cases/{caseId}/user_actions/_find
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.{
- "userActions" : [ {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- }, {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- }, {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- }, {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- }, {
- "owner" : "cases",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzM1ODg4LDFd"
- } ],
- "total" : 1,
- "perPage" : 6,
- "page" : 0
-}
-
- application/json
get /s/{spaceId}/api/cases/{caseId}/comments/_find
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
get /s/{spaceId}/api/cases/configure/connectors/_find
read
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "isPreconfigured" : true,
- "isDeprecated" : true,
- "actionTypeId" : ".none",
- "referencedByCount" : 0,
- "name" : "name",
- "id" : "id",
- "config" : {
- "projectKey" : "projectKey",
- "apiUrl" : "apiUrl"
- },
- "isMissingSecrets" : true
-}
-
- application/json
get /api/cases/configure/connectors/_find
read
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.{
- "isPreconfigured" : true,
- "isDeprecated" : true,
- "actionTypeId" : ".none",
- "referencedByCount" : 0,
- "name" : "name",
- "id" : "id",
- "config" : {
- "projectKey" : "projectKey",
- "apiUrl" : "apiUrl"
- },
- "isMissingSecrets" : true
-}
-
- application/json
get /s/{spaceId}/api/cases/_find
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null none
or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null {
- "count_in_progress_cases" : 6,
- "per_page" : 5,
- "total" : 2,
- "cases" : [ {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- }, {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- } ],
- "count_open_cases" : 1,
- "count_closed_cases" : 0,
- "page" : 5
-}
-
- application/json
get /api/cases/_find
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.none
or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null {
- "count_in_progress_cases" : 6,
- "per_page" : 5,
- "total" : 2,
- "cases" : [ {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- }, {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- }, {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- }, {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- }, {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
- } ],
- "count_open_cases" : 1,
- "count_closed_cases" : 0,
- "page" : 5
-}
-
- application/json
get /s/{spaceId}/api/cases/{caseId}/comments
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
get /api/cases/{caseId}/comments
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
get /s/{spaceId}/api/cases/{caseId}
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
get /s/{spaceId}/api/cases/{caseId}/user_actions
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "owner" : "cases",
- "action_id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- }
-}
-
- application/json
get /api/cases/{caseId}/user_actions
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.{
- "owner" : "cases",
- "action_id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
- "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
- "action" : "create",
- "created_at" : "2022-05-13T09:16:17.416Z",
- "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
- "type" : "create_case",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- }
-}
-
- application/json
get /s/{spaceId}/api/cases/{caseId}/alerts
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "index" : "index",
- "id" : "id",
- "attached_at" : "2000-01-23T04:56:07.000+00:00"
-}
-
- application/json
get /api/cases/{caseId}/alerts
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.{
- "index" : "index",
- "id" : "id",
- "attached_at" : "2000-01-23T04:56:07.000+00:00"
-}
-
- application/json
get /s/{spaceId}/api/cases/{caseId}/comments/{commentId}
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null null
-
- application/json
get /api/cases/{caseId}/comments/{commentId}
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.null
-
- application/json
get /s/{spaceId}/api/cases/configure
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "closure_type" : "close-by-user",
- "owner" : "cases",
- "mappings" : [ {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- }, {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- } ],
- "connector" : {
- "name" : "none",
- "id" : "none",
- "fields" : "{}",
- "type" : ".none"
- },
- "updated_at" : "2022-06-01T19:58:48.169Z",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "created_at" : "2022-06-01T17:07:17.767Z",
- "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
- "error" : "error",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzIwNzMsMV0="
-}
-
- application/json
get /api/cases/configure
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration.{
- "closure_type" : "close-by-user",
- "owner" : "cases",
- "mappings" : [ {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- }, {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- } ],
- "connector" : {
- "name" : "none",
- "id" : "none",
- "fields" : "{}",
- "type" : ".none"
- },
- "updated_at" : "2022-06-01T19:58:48.169Z",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "created_at" : "2022-06-01T17:07:17.767Z",
- "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
- "error" : "error",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzIwNzMsMV0="
-}
-
- application/json
get /api/cases/{caseId}
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
get /s/{spaceId}/api/cases/reporters
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
-}
-
- application/json
get /api/cases/reporters
{
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
-}
-
- application/json
get /s/{spaceId}/api/cases/status
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "count_in_progress_cases" : 6,
- "count_open_cases" : 1,
- "count_closed_cases" : 0
-}
-
- application/json
get /api/cases/status
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.{
- "count_in_progress_cases" : 6,
- "count_open_cases" : 1,
- "count_closed_cases" : 0
-}
-
- application/json
get /s/{spaceId}/api/cases/tags
/s/
and the identifier are omitted from the path, the default space is used. default: null ""
-
- application/json
get /api/cases/tags
""
-
- application/json
get /s/{spaceId}/api/cases/alerts/{alertId}
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking./s/
and the identifier are omitted from the path, the default space is used. default: null [ {
- "id" : "06116b80-e1c3-11ec-be9b-9b1838238ee6",
- "title" : "security_case"
-} ]
-
- application/json
get /api/cases/alerts/{alertId}
read
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.[ {
- "id" : "06116b80-e1c3-11ec-be9b-9b1838238ee6",
- "title" : "security_case"
-} ]
-
- application/json
post /s/{spaceId}/api/cases/{caseId}/connector/{connectorId}/_push
all
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. You must also have all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're pushing./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
post /api/cases/{caseId}/connector/{connectorId}/_push
all
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. You must also have all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're pushing.application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
post /s/{spaceId}/api/cases/configure
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "closure_type" : "close-by-user",
- "owner" : "cases",
- "mappings" : [ {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- }, {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- } ],
- "connector" : {
- "name" : "none",
- "id" : "none",
- "fields" : "{}",
- "type" : ".none"
- },
- "updated_at" : "2022-06-01T19:58:48.169Z",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "created_at" : "2022-06-01T17:07:17.767Z",
- "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
- "error" : "error",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzIwNzMsMV0="
-}
-
- application/json
post /api/cases/configure
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details.application/json
{
- "closure_type" : "close-by-user",
- "owner" : "cases",
- "mappings" : [ {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- }, {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- } ],
- "connector" : {
- "name" : "none",
- "id" : "none",
- "fields" : "{}",
- "type" : ".none"
- },
- "updated_at" : "2022-06-01T19:58:48.169Z",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "created_at" : "2022-06-01T17:07:17.767Z",
- "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
- "error" : "error",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzIwNzMsMV0="
-}
-
- application/json
patch /s/{spaceId}/api/cases
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
patch /s/{spaceId}/api/cases/{caseId}/comments
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
patch /api/cases/{caseId}/comments
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
patch /s/{spaceId}/api/cases/configure/{configurationId}
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "closure_type" : "close-by-user",
- "owner" : "cases",
- "mappings" : [ {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- }, {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- } ],
- "connector" : {
- "name" : "none",
- "id" : "none",
- "fields" : "{}",
- "type" : ".none"
- },
- "updated_at" : "2022-06-01T19:58:48.169Z",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "created_at" : "2022-06-01T17:07:17.767Z",
- "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
- "error" : "error",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzIwNzMsMV0="
-}
-
- application/json
patch /api/cases/configure/{configurationId}
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API.application/json
{
- "closure_type" : "close-by-user",
- "owner" : "cases",
- "mappings" : [ {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- }, {
- "action_type" : "overwrite",
- "source" : "title",
- "target" : "summary"
- } ],
- "connector" : {
- "name" : "none",
- "id" : "none",
- "fields" : "{}",
- "type" : ".none"
- },
- "updated_at" : "2022-06-01T19:58:48.169Z",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "created_at" : "2022-06-01T17:07:17.767Z",
- "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
- "error" : "error",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzIwNzMsMV0="
-}
-
- application/json
patch /api/cases
all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating.application/json
{
- "owner" : "cases",
- "totalComment" : 0,
- "settings" : {
- "syncAlerts" : true
- },
- "totalAlerts" : 0,
- "closed_at" : "2000-01-23T04:56:07.000+00:00",
- "comments" : [ null, null, null, null, null ],
- "assignees" : [ {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- }, {
- "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
- } ],
- "created_at" : "2022-05-13T09:16:17.416Z",
- "description" : "A case description.",
- "title" : "Case title 1",
- "created_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "version" : "WzUzMiwxXQ==",
- "closed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "tags" : [ "tag-1" ],
- "duration" : 120,
- "updated_at" : "2000-01-23T04:56:07.000+00:00",
- "updated_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
- "external_service" : {
- "external_title" : "external_title",
- "pushed_by" : {
- "full_name" : "full_name",
- "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
- "email" : "email",
- "username" : "elastic"
- },
- "external_url" : "external_url",
- "pushed_at" : "2000-01-23T04:56:07.000+00:00",
- "connector_id" : "connector_id",
- "external_id" : "external_id",
- "connector_name" : "connector_name"
- }
-}
-
- application/json
4xx_response
- Unsuccessful cases API responseCase_response_properties_for_comments_inner
- Case_response_properties_for_connectors
- Case response properties for connectorsaction_types
- actions
- add_alert_comment_request_properties
- Add case comment request properties for alertsadd_case_comment_request
- Add case comment requestadd_user_comment_request_properties
- Add case comment request properties for user commentsalert_comment_response_properties
- Add case comment response properties for alertsalert_comment_response_properties_rule
- alert_identifiers
- Alert identifiersalert_indices
- Alert indicesalert_response_properties
- assignees_inner
- case_response_closed_by_properties
- Case response properties for closed_bycase_response_created_by_properties
- Case response properties for created_bycase_response_properties
- Case response propertiescase_response_pushed_by_properties
- Case response properties for pushed_bycase_response_updated_by_properties
- Case response properties for updated_byclosure_types
- connector_properties_cases_webhook
- Create or upate case request properties for Cases Webhook connectorconnector_properties_jira
- Create or update case request properties for a Jira connectorconnector_properties_jira_fields
- connector_properties_none
- Create or update case request properties for no connectorconnector_properties_resilient
- Create case request properties for a IBM Resilient connectorconnector_properties_resilient_fields
- connector_properties_servicenow
- Create case request properties for a ServiceNow ITSM connectorconnector_properties_servicenow_fields
- connector_properties_servicenow_sir
- Create case request properties for a ServiceNow SecOps connectorconnector_properties_servicenow_sir_fields
- connector_properties_swimlane
- Create case request properties for a Swimlane connectorconnector_properties_swimlane_fields
- connector_types
- create_case_request
- Create case requestcreate_case_request_connector
- external_service
- findCaseActivityDefaultSpace_200_response
- findCaseActivity_200_response
- findCaseConnectorsDefaultSpace_200_response_inner
- findCaseConnectorsDefaultSpace_200_response_inner_config
- findCasesDefaultSpace_200_response
- findCasesDefaultSpace_assignees_parameter
- findCasesDefaultSpace_owner_parameter
- findCasesDefaultSpace_searchFields_parameter
- findCases_200_response
- getCaseCommentDefaultSpace_200_response
- getCaseConfigurationDefaultSpace_200_response_inner
- getCaseConfigurationDefaultSpace_200_response_inner_connector
- getCaseConfigurationDefaultSpace_200_response_inner_created_by
- getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner
- getCaseConfigurationDefaultSpace_200_response_inner_updated_by
- getCaseStatusDefaultSpace_200_response
- getCasesByAlertDefaultSpace_200_response_inner
- owners
- payload_alert_comment
- payload_alert_comment_comment
- payload_alert_comment_comment_alertId
- payload_alert_comment_comment_index
- payload_assignees
- payload_connector
- payload_connector_connector
- payload_connector_connector_fields
- payload_create_case
- payload_description
- payload_pushed
- payload_settings
- payload_severity
- payload_status
- payload_tags
- payload_title
- payload_user_comment
- payload_user_comment_comment
- rule
- Alerting rulesearchFieldsType
- set_case_configuration_request
- Set case configuration requestset_case_configuration_request_connector
- set_case_configuration_request_settings
- settings
- severity_property
- status
- update_alert_comment_request_properties
- Update case comment request properties for alertsupdate_case_comment_request
- Update case comment requestupdate_case_configuration_request
- Update case configuration requestupdate_case_request
- Update case requestupdate_case_request_cases_inner
- update_user_comment_request_properties
- Update case comment request properties for user commentsuser_actions_find_response_properties
- user_actions_response_properties
- user_actions_response_properties_created_by
- user_actions_response_properties_payload
- user_comment_response_properties
- Case response properties for user commentsCase_response_properties_for_comments_inner
- UpCase_response_properties_for_connectors
- Case response properties for connectors Upadd_alert_comment_request_properties
- Add case comment request properties for alerts Upadd_case_comment_request
- Add case comment request Upadd_user_comment_request_properties
- Add case comment request properties for user comments Upalert_comment_response_properties
- Add case comment response properties for alerts Upalert_identifiers
- Alert identifiers Uptype
is alert
. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; index
must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.alert_indices
- Alert indices Uptype
is alert
. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the alertId
array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.alert_response_properties
- Upassignees_inner
- Upcase_response_properties
- Case response properties Upclosure_types
- Upclose-by-pushing
) or not automatically closed (close-by-user
).connector_properties_cases_webhook
- Create or upate case request properties for Cases Webhook connector Up.cases-webhook
.connector_properties_jira
- Create or update case request properties for a Jira connector Up.jira
.connector_properties_jira_fields
- Upconnector_properties_none
- Create or update case request properties for no connector Up.none
.none
. To update a case to remove the connector, specify none
. none
. To update a case to remove the connector, specify none
. .none
. To update a case to remove the connector, specify .none
. connector_properties_resilient
- Create case request properties for a IBM Resilient connector Up.resilient
.connector_properties_resilient_fields
- Upconnector_properties_servicenow
- Create case request properties for a ServiceNow ITSM connector Up.servicenow
.connector_properties_servicenow_fields
- Upconnector_properties_servicenow_sir
- Create case request properties for a ServiceNow SecOps connector Up.servicenow-sir
.connector_properties_servicenow_sir_fields
- Upconnector_properties_swimlane
- Create case request properties for a Swimlane connector Up.swimlane
.connector_properties_swimlane_fields
- Upcreate_case_request
- Create case request Upcreate_case_request_connector
- Upexternal_service
- UpfindCaseActivityDefaultSpace_200_response
- UpfindCaseActivity_200_response
- UpfindCaseConnectorsDefaultSpace_200_response_inner
- UpfindCasesDefaultSpace_owner_parameter
- UpfindCases_200_response
- UpgetCaseCommentDefaultSpace_200_response
- UpgetCaseConfigurationDefaultSpace_200_response_inner
- UpgetCaseConfigurationDefaultSpace_200_response_inner_connector
- Upnull
. none
. To retrieve connector IDs, use the find connectors API. none
. To retrieve connector names, use the find connectors API. owners
- Uppayload_alert_comment
- Uppayload_alert_comment_comment
- Uppayload_alert_comment_comment_alertId
- Uppayload_alert_comment_comment_index
- Uppayload_assignees
- Uppayload_connector
- Uppayload_connector_connector
- Uppayload_connector_connector_fields
- Uppayload_create_case
- Uppayload_description
- Uppayload_pushed
- Uppayload_settings
- Uppayload_severity
- Uppayload_status
- Uppayload_tags
- Uppayload_title
- Uppayload_user_comment
- Uppayload_user_comment_comment
- Uprule
- Alerting rule Uptype
is alert
. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.set_case_configuration_request
- Set case configuration request Upset_case_configuration_request_connector
- Upnull
. none
. To retrieve connector IDs, use the find connectors API. none
. To retrieve connector names, use the find connectors API. set_case_configuration_request_settings
- Upsettings
- Upupdate_alert_comment_request_properties
- Update case comment request properties for alerts Upupdate_case_comment_request
- Update case comment request Upupdate_case_configuration_request
- Update case configuration request Upupdate_case_request
- Update case request Upupdate_case_request_cases_inner
- Upupdate_user_comment_request_properties
- Update case comment request properties for user comments Upuser_actions_find_response_properties
- Upuser_actions_response_properties
- Upuser_actions_response_properties_payload
- Upuser_comment_response_properties
- Case response properties for user comments Uppost /s/{spaceId}/api/actions/connector
post /s/{spaceId}/api/actions/connector/{connectorId}
delete /s/{spaceId}/api/actions/connector/{connectorId}
get /s/{spaceId}/api/actions/connector/{connectorId}
get /s/{spaceId}/api/actions/connector_types
get /s/{spaceId}/api/actions/connectors
post /s/{spaceId}/api/actions
delete /s/{spaceId}/api/actions/action/{actionId}
get /s/{spaceId}/api/actions/action/{actionId}
get /s/{spaceId}/api/actions/list_action_types
get /s/{spaceId}/api/actions
post /s/{spaceId}/api/actions/action/{actionId}/_execute
put /s/{spaceId}/api/actions/action/{actionId}
post /s/{spaceId}/api/actions/connector/{connectorId}/_execute
put /s/{spaceId}/api/actions/connector/{connectorId}
post /s/{spaceId}/api/actions/connector
all
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
null
-
- application/json
post /s/{spaceId}/api/actions/connector/{connectorId}
all
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
null
-
- application/json
delete /s/{spaceId}/api/actions/connector/{connectorId}
all
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. WARNING: When you delete a connector, it cannot be recovered./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
get /s/{spaceId}/api/actions/connector/{connectorId}
read
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges./s/
and the identifier are omitted from the path, the default space is used. default: null null
-
- application/json
get /s/{spaceId}/api/actions/connector_types
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "supported_feature_ids" : [ "alerting", "uptime", "siem" ],
- "name" : "Index",
- "enabled_in_license" : true,
- "id" : ".server-log",
- "enabled_in_config" : true,
- "minimum_license_required" : "basic",
- "enabled" : true
-}
-
- application/json
get /s/{spaceId}/api/actions/connectors
read
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "is_missing_secrets" : false,
- "is_deprecated" : false,
- "is_preconfigured" : false,
- "name" : "my-connector",
- "is_system_action" : false,
- "referenced_by_count" : 2,
- "id" : "b0766e10-d190-11ec-b04c-776c77d14fca",
- "config" : {
- "key" : ""
- },
- "connector_type_id" : ".server-log"
-}
-
- application/json
post /s/{spaceId}/api/actions
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "isPreconfigured" : true,
- "isDeprecated" : true,
- "actionTypeId" : "actionTypeId",
- "name" : "name",
- "id" : "id",
- "config" : "{}",
- "isMissingSecrets" : true
-}
-
- application/json
delete /s/{spaceId}/api/actions/action/{actionId}
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
get /s/{spaceId}/api/actions/action/{actionId}
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "isPreconfigured" : true,
- "isDeprecated" : true,
- "actionTypeId" : "actionTypeId",
- "name" : "name",
- "id" : "id",
- "config" : "{}",
- "isMissingSecrets" : true
-}
-
- application/json
get /s/{spaceId}/api/actions/list_action_types
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "enabledInConfig" : true,
- "name" : "name",
- "enabledInLicense" : true,
- "id" : "id",
- "minimumLicenseRequired" : "minimumLicenseRequired",
- "enabled" : true
-}
-
- application/json
get /s/{spaceId}/api/actions
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "isPreconfigured" : true,
- "isDeprecated" : true,
- "actionTypeId" : "actionTypeId",
- "name" : "name",
- "id" : "id",
- "config" : "{}",
- "isMissingSecrets" : true
-}
-
- application/json
post /s/{spaceId}/api/actions/action/{actionId}/_execute
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "actionId" : "actionId",
- "status" : "status"
-}
-
- application/json
put /s/{spaceId}/api/actions/action/{actionId}
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "isPreconfigured" : true,
- "isDeprecated" : true,
- "actionTypeId" : "actionTypeId",
- "name" : "name",
- "id" : "id",
- "config" : "{}",
- "isMissingSecrets" : true
-}
-
- application/json
post /s/{spaceId}/api/actions/connector/{connectorId}/_execute
read
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. If you use an index connector, you must also have all
, create
, index
, or write
indices privileges./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "connector_id" : "connector_id",
- "status" : "error"
-}
-
- application/json
put /s/{spaceId}/api/actions/connector/{connectorId}
all
privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
null
-
- application/json
Alert_identifier_mapping
- Alert identifier mappingCase_comment_mapping
- Case comment mappingCase_description_mapping
- Case description mappingCase_identifier_mapping
- Case identifier mappingCase_name_mapping
- Case name mappingConnector_mappings_properties_for_a_Swimlane_connector
- Connector mappings properties for a Swimlane connectorCreate_connector_request_body_properties
- Create connector request body propertiesGet_connector_types_response_body_properties_inner
- Get_connectors_response_body_properties
- Get connectors response body propertiesLegacy_create_connector_request_properties
- Legacy create connector request propertiesLegacy_get_connector_types_response_body_properties_inner
- Legacy_run_connector_request_body_properties
- Legacy run connector request body propertiesLegacy_update_connector_request_body_properties
- Legacy update connector request body propertiesNot_found_response
- Not found responseRule_name_mapping
- Rule name mappingRun_connector_request_body_properties
- Run connector request body propertiesRun_connector_request_body_properties_params
- Severity_mapping
- Severity mappingSubaction_parameters
- Subaction parametersUnauthorized_response
- Unauthorized responseUpdate_connector_request_body_properties
- Update connector request body propertiesaction_response_properties
- Action response propertiesconfig_properties_cases_webhook
- Connector request properties for Webhook - Case Management connectorconfig_properties_d3security
- Connector request properties for a D3 Security connectorconfig_properties_email
- Connector request properties for an email connectorconfig_properties_genai
- Connector request properties for an OpenAI connectorconfig_properties_genai_oneOf
- config_properties_genai_oneOf_1
- config_properties_index
- Connector request properties for an index connectorconfig_properties_jira
- Connector request properties for a Jira connectorconfig_properties_opsgenie
- Connector request properties for an Opsgenie connectorconfig_properties_pagerduty
- Connector request properties for a PagerDuty connectorconfig_properties_resilient
- Connector request properties for a IBM Resilient connectorconfig_properties_servicenow
- Connector request properties for a ServiceNow ITSM connectorconfig_properties_servicenow_itom
- Connector request properties for a ServiceNow ITSM connectorconfig_properties_swimlane
- Connector request properties for a Swimlane connectorconfig_properties_tines
- Connector request properties for a Tines connectorconfig_properties_torq
- Connector request properties for a Torq connectorconfig_properties_webhook
- Connector request properties for a Webhook connectorconfig_properties_xmatters
- Connector request properties for an xMatters connectorconnector_response_properties
- Connector response propertiesconnector_response_properties_cases_webhook
- Connector request properties for a Webhook - Case Management connectorconnector_response_properties_d3security
- Connector response properties for a D3 Security connectorconnector_response_properties_email
- Connector response properties for an email connectorconnector_response_properties_index
- Connector response properties for an index connectorconnector_response_properties_jira
- Connector response properties for a Jira connectorconnector_response_properties_opsgenie
- Connector response properties for an Opsgenie connectorconnector_response_properties_pagerduty
- Connector response properties for a PagerDuty connectorconnector_response_properties_resilient
- Connector response properties for a IBM Resilient connectorconnector_response_properties_serverlog
- Connector response properties for a server log connectorconnector_response_properties_servicenow
- Connector response properties for a ServiceNow ITSM connectorconnector_response_properties_servicenow_itom
- Connector response properties for a ServiceNow ITOM connectorconnector_response_properties_servicenow_sir
- Connector response properties for a ServiceNow SecOps connectorconnector_response_properties_slack_api
- Connector response properties for a Slack connectorconnector_response_properties_slack_webhook
- Connector response properties for a Slack connectorconnector_response_properties_swimlane
- Connector response properties for a Swimlane connectorconnector_response_properties_teams
- Connector response properties for a Microsoft Teams connectorconnector_response_properties_tines
- Connector response properties for a Tines connectorconnector_response_properties_torq
- Connector response properties for a Torq connectorconnector_response_properties_webhook
- Connector response properties for a Webhook connectorconnector_response_properties_xmatters
- Connector response properties for an xMatters connectorconnector_types
- Connector typescreate_connector_request_cases_webhook
- Create Webhook - Case Managment connector requestcreate_connector_request_d3security
- Create D3 Security connector requestcreate_connector_request_email
- Create email connector requestcreate_connector_request_genai
- Create OpenAI connector requestcreate_connector_request_index
- Create index connector requestcreate_connector_request_jira
- Create Jira connector requestcreate_connector_request_opsgenie
- Create Opsgenie connector requestcreate_connector_request_pagerduty
- Create PagerDuty connector requestcreate_connector_request_resilient
- Create IBM Resilient connector requestcreate_connector_request_serverlog
- Create server log connector requestcreate_connector_request_servicenow
- Create ServiceNow ITSM connector requestcreate_connector_request_servicenow_itom
- Create ServiceNow ITOM connector requestcreate_connector_request_servicenow_sir
- Create ServiceNow SecOps connector requestcreate_connector_request_slack_api
- Create Slack connector requestcreate_connector_request_slack_webhook
- Create Slack connector requestcreate_connector_request_swimlane
- Create Swimlane connector requestcreate_connector_request_teams
- Create Microsoft Teams connector requestcreate_connector_request_tines
- Create Tines connector requestcreate_connector_request_torq
- Create Torq connector requestcreate_connector_request_webhook
- Create Webhook connector requestcreate_connector_request_xmatters
- Create xMatters connector requestfeatures
- getConnector_404_response
- legacyRunConnector_200_response
- runConnector_200_response
- runConnector_200_response_data
- run_connector_params_documents
- Index connector parametersrun_connector_params_level_message
- Server log connector parametersrun_connector_subaction_addevent
- The addEvent subactionrun_connector_subaction_addevent_subActionParams
- run_connector_subaction_closealert
- The closeAlert subactionrun_connector_subaction_closealert_subActionParams
- run_connector_subaction_createalert
- The createAlert subactionrun_connector_subaction_createalert_subActionParams
- run_connector_subaction_createalert_subActionParams_responders_inner
- run_connector_subaction_createalert_subActionParams_visibleTo_inner
- run_connector_subaction_fieldsbyissuetype
- The fieldsByIssueType subactionrun_connector_subaction_fieldsbyissuetype_subActionParams
- run_connector_subaction_getchoices
- The getChoices subactionrun_connector_subaction_getchoices_subActionParams
- run_connector_subaction_getfields
- The getFields subactionrun_connector_subaction_getincident
- The getIncident subactionrun_connector_subaction_getincident_subActionParams
- run_connector_subaction_issue
- The issue subactionrun_connector_subaction_issue_subActionParams
- run_connector_subaction_issues
- The issues subactionrun_connector_subaction_issues_subActionParams
- run_connector_subaction_issuetypes
- The issueTypes subactionrun_connector_subaction_pushtoservice
- The pushToService subactionrun_connector_subaction_pushtoservice_subActionParams
- run_connector_subaction_pushtoservice_subActionParams_comments_inner
- run_connector_subaction_pushtoservice_subActionParams_incident
- run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip
- run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash
- run_connector_subaction_pushtoservice_subActionParams_incident_malware_url
- run_connector_subaction_pushtoservice_subActionParams_incident_source_ip
- secrets_properties_cases_webhook
- Connector secrets properties for Webhook - Case Management connectorsecrets_properties_d3security
- Connector secrets properties for a D3 Security connectorsecrets_properties_email
- Connector secrets properties for an email connectorsecrets_properties_genai
- Connector secrets properties for an OpenAI connectorsecrets_properties_jira
- Connector secrets properties for a Jira connectorsecrets_properties_opsgenie
- Connector secrets properties for an Opsgenie connectorsecrets_properties_pagerduty
- Connector secrets properties for a PagerDuty connectorsecrets_properties_resilient
- Connector secrets properties for IBM Resilient connectorsecrets_properties_servicenow
- Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectorssecrets_properties_slack_api
- Connector secrets properties for a Web API Slack connectorsecrets_properties_slack_webhook
- Connector secrets properties for a Webhook Slack connectorsecrets_properties_swimlane
- Connector secrets properties for a Swimlane connectorsecrets_properties_teams
- Connector secrets properties for a Microsoft Teams connectorsecrets_properties_tines
- Connector secrets properties for a Tines connectorsecrets_properties_torq
- Connector secrets properties for a Torq connectorsecrets_properties_webhook
- Connector secrets properties for a Webhook connectorsecrets_properties_xmatters
- Connector secrets properties for an xMatters connectorupdateConnector_400_response
- update_connector_request_cases_webhook
- Update Webhook - Case Managment connector requestupdate_connector_request_d3security
- Update D3 Security connector requestupdate_connector_request_email
- Update email connector requestupdate_connector_request_index
- Update index connector requestupdate_connector_request_jira
- Update Jira connector requestupdate_connector_request_opsgenie
- Update Opsgenie connector requestupdate_connector_request_pagerduty
- Update PagerDuty connector requestupdate_connector_request_resilient
- Update IBM Resilient connector requestupdate_connector_request_serverlog
- Update server log connector requestupdate_connector_request_servicenow
- Update ServiceNow ITSM connector or ServiceNow SecOps requestupdate_connector_request_servicenow_itom
- Create ServiceNow ITOM connector requestupdate_connector_request_slack_api
- Update Slack connector requestupdate_connector_request_slack_webhook
- Update Slack connector requestupdate_connector_request_swimlane
- Update Swimlane connector requestupdate_connector_request_teams
- Update Microsoft Teams connector requestupdate_connector_request_tines
- Update Tines connector requestupdate_connector_request_torq
- Update Torq connector requestupdate_connector_request_webhook
- Update Webhook connector requestupdate_connector_request_xmatters
- Update xMatters connector requestAlert_identifier_mapping
- Alert identifier mapping UpCase_comment_mapping
- Case comment mapping UpCase_description_mapping
- Case description mapping UpCase_identifier_mapping
- Case identifier mapping UpCase_name_mapping
- Case name mapping UpConnector_mappings_properties_for_a_Swimlane_connector
- Connector mappings properties for a Swimlane connector UpCreate_connector_request_body_properties
- Create connector request body properties UpGet_connector_types_response_body_properties_inner
- Up.yml
file. Get_connectors_response_body_properties
- Get connectors response body properties Upconfig
and is_missing_secrets
properties are omitted from the response. is_preconfigured
is true, this value is not calculated. Legacy_create_connector_request_properties
- Legacy create connector request properties UpLegacy_get_connector_types_response_body_properties_inner
- Up.yml
file. Legacy_run_connector_request_body_properties
- Legacy run connector request body properties UpLegacy_update_connector_request_body_properties
- Legacy update connector request body properties UpRule_name_mapping
- Rule name mapping UpRun_connector_request_body_properties
- Run connector request body properties UpRun_connector_request_body_properties_params
- UpSeverity_mapping
- Severity mapping UpSubaction_parameters
- Subaction parameters UpUpdate_connector_request_body_properties
- Update connector request body properties Upaction_response_properties
- Action response properties Upconfig_properties_cases_webhook
- Connector request properties for Webhook - Case Management connector Up.cases-webhook
.case.comment
. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. patch
, post
, and put
. xpack.actions.allowedHosts setting
, add the hostname to the allowed hosts. case.title
and case.description
. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. patch
, post
, and put
. xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. case.title
and case.description
. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}
), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. patch
, post
, and put
. xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. config_properties_d3security
- Connector request properties for a D3 Security connector Up.d3security
.xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. config_properties_email
- Connector request properties for an email connector Up.email
.service
is exchange_server
, this property is required. user@host-name
format. service
is elastic_cloud
(for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service
is other
, this property must be defined. service
is elastic_cloud
(for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service
is other
, this property must be defined. service
is elastic_cloud
(for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. service
is exchange_server
, this property is required. config_properties_genai
- Connector request properties for an OpenAI connector Up.gen-ai
.config_properties_genai_oneOf
- Upconfig_properties_genai_oneOf_1
- Upconfig_properties_index
- Connector request properties for an index connector Up.index
.config_properties_jira
- Connector request properties for a Jira connector Up.jira
.config_properties_opsgenie
- Connector request properties for an Opsgenie connector Up.opsgenie
.https://api.opsgenie.com
or https://api.eu.opsgenie.com
. If you are using the xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. config_properties_pagerduty
- Connector request properties for a PagerDuty connector Up.pagerduty
.config_properties_resilient
- Connector request properties for a IBM Resilient connector Up.resilient
.config_properties_servicenow
- Connector request properties for a ServiceNow ITSM connector Up.servicenow
.isOAuth
is true
. isOAuth
is true
. Email
, the user identifier should be the user's email address. This property is required when isOAuth
is true
. false
, the Elastic application should be installed in ServiceNow. config_properties_servicenow_itom
- Connector request properties for a ServiceNow ITSM connector Up.servicenow
.isOAuth
is true
. isOAuth
is true
. Email
, the user identifier should be the user's email address. This property is required when isOAuth
is true
. config_properties_swimlane
- Connector request properties for a Swimlane connector Up.swimlane
.config_properties_tines
- Connector request properties for a Tines connector Up.tines
.xpack.actions.allowedHosts
setting, make sure this hostname is added to the allowed hosts. config_properties_torq
- Connector request properties for a Torq connector Up.torq
.config_properties_webhook
- Connector request properties for a Webhook connector Up.webhook
.authType
is webhook-authentication-ssl
, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format. true
, a user name and password must be provided for login type authentication. xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. full
to validate that the certificate has an issue date within the not_before
and not_after
dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate
to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none
to skip certificate validation. config_properties_xmatters
- Connector request properties for an xMatters connector Up.xmatters
.connector_response_properties
- Connector response properties Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_cases_webhook
- Connector request properties for a Webhook - Case Management connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_d3security
- Connector response properties for a D3 Security connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_email
- Connector response properties for an email connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_index
- Connector response properties for an index connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_jira
- Connector response properties for a Jira connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_opsgenie
- Connector response properties for an Opsgenie connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_pagerduty
- Connector response properties for a PagerDuty connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_resilient
- Connector response properties for a IBM Resilient connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_serverlog
- Connector response properties for a server log connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_servicenow
- Connector response properties for a ServiceNow ITSM connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_servicenow_itom
- Connector response properties for a ServiceNow ITOM connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_servicenow_sir
- Connector response properties for a ServiceNow SecOps connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_slack_api
- Connector response properties for a Slack connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_slack_webhook
- Connector response properties for a Slack connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_swimlane
- Connector response properties for a Swimlane connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_teams
- Connector response properties for a Microsoft Teams connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_tines
- Connector response properties for a Tines connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_torq
- Connector response properties for a Torq connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_webhook
- Connector response properties for a Webhook connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_response_properties_xmatters
- Connector response properties for an xMatters connector Upconfig
and is_missing_secrets
properties are omitted from the response. connector_types
- Connector types Up.email
, .index
, .jira
, .opsgenie
, or .server-log
.create_connector_request_cases_webhook
- Create Webhook - Case Managment connector request Upcreate_connector_request_d3security
- Create D3 Security connector request Upcreate_connector_request_email
- Create email connector request Upcreate_connector_request_genai
- Create OpenAI connector request Upcreate_connector_request_index
- Create index connector request Upcreate_connector_request_jira
- Create Jira connector request Upcreate_connector_request_opsgenie
- Create Opsgenie connector request Upcreate_connector_request_pagerduty
- Create PagerDuty connector request Upcreate_connector_request_resilient
- Create IBM Resilient connector request Upcreate_connector_request_serverlog
- Create server log connector request Upcreate_connector_request_servicenow
- Create ServiceNow ITSM connector request Upcreate_connector_request_servicenow_itom
- Create ServiceNow ITOM connector request Upcreate_connector_request_servicenow_sir
- Create ServiceNow SecOps connector request Upcreate_connector_request_slack_api
- Create Slack connector request Upcreate_connector_request_slack_webhook
- Create Slack connector request Upcreate_connector_request_swimlane
- Create Swimlane connector request Upcreate_connector_request_teams
- Create Microsoft Teams connector request Upcreate_connector_request_tines
- Create Tines connector request Upcreate_connector_request_torq
- Create Torq connector request Upcreate_connector_request_webhook
- Create Webhook connector request Upcreate_connector_request_xmatters
- Create xMatters connector request Upfeatures
- Upalerting
, cases
, uptime
, and siem
.getConnector_404_response
- UplegacyRunConnector_200_response
- UprunConnector_200_response
- UprunConnector_200_response_data
- Uprun_connector_params_documents
- Index connector parameters Uprun_connector_params_level_message
- Server log connector parameters Uprun_connector_subaction_addevent
- The addEvent subaction UpaddEvent
subaction for ServiceNow ITOM connectors.run_connector_subaction_addevent_subActionParams
- Up<rule ID>:<alert instance ID>
. run_connector_subaction_closealert
- The closeAlert subaction UpcloseAlert
subaction for Opsgenie connectors.run_connector_subaction_closealert_subActionParams
- Uprun_connector_subaction_createalert
- The createAlert subaction UpcreateAlert
subaction for Opsgenie connectors.run_connector_subaction_createalert_subActionParams
- Uptype
is user
, either id
or username
is required. If type
is team
, either id
or name
is required. id
, name
, or username
is required. run_connector_subaction_fieldsbyissuetype
- The fieldsByIssueType subaction UpfieldsByIssueType
subaction for Jira connectors.run_connector_subaction_fieldsbyissuetype_subActionParams
- Uprun_connector_subaction_getchoices
- The getChoices subaction UpgetChoices
subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.run_connector_subaction_getchoices_subActionParams
- Uprun_connector_subaction_getfields
- The getFields subaction UpgetFields
subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.run_connector_subaction_getincident
- The getIncident subaction UpgetIncident
subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.run_connector_subaction_getincident_subActionParams
- Uprun_connector_subaction_issue
- The issue subaction Upissue
subaction for Jira connectors.run_connector_subaction_issue_subActionParams
- Uprun_connector_subaction_issues
- The issues subaction Upissues
subaction for Jira connectors.run_connector_subaction_issues_subActionParams
- Uprun_connector_subaction_issuetypes
- The issueTypes subaction UpissueTypes
subaction for Jira connectors.run_connector_subaction_pushtoservice
- The pushToService subaction UppushToService
subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.run_connector_subaction_pushtoservice_subActionParams
- Uprun_connector_subaction_pushtoservice_subActionParams_incident
- Up{{ruleID}}:{{alert ID}}
to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of {{ruleID}}:{{alert ID}}
ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. subAction
to issueTypes
. Sub-task
types of issues. run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip
- Uprun_connector_subaction_pushtoservice_subActionParams_incident_malware_hash
- Uprun_connector_subaction_pushtoservice_subActionParams_incident_malware_url
- Uprun_connector_subaction_pushtoservice_subActionParams_incident_source_ip
- Upsecrets_properties_cases_webhook
- Connector secrets properties for Webhook - Case Management connector Upsecrets_properties_d3security
- Connector secrets properties for a D3 Security connector Up.d3security
.secrets_properties_email
- Connector secrets properties for an email connector Up.email
.service
is exchange_server
, this property is required. hasAuth
is set to true
, this property is required. hasAuth
is set to true
, this property is required. secrets_properties_genai
- Connector secrets properties for an OpenAI connector Up.gen-ai
.secrets_properties_jira
- Connector secrets properties for a Jira connector Up.jira
.secrets_properties_opsgenie
- Connector secrets properties for an Opsgenie connector Up.opsgenie
.secrets_properties_pagerduty
- Connector secrets properties for a PagerDuty connector Up.pagerduty
.secrets_properties_resilient
- Connector secrets properties for IBM Resilient connector Up.resilient
.secrets_properties_servicenow
- Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors Up.servicenow
, .servicenow-sir
, or .servicenow-itom
.isOAuth
is true
. isOAuth
is true
. isOAuth
is true
and you set a password on your private key. secrets_properties_slack_api
- Connector secrets properties for a Web API Slack connector Up.slack
.secrets_properties_slack_webhook
- Connector secrets properties for a Webhook Slack connector Up.slack
.secrets_properties_swimlane
- Connector secrets properties for a Swimlane connector Up.swimlane
.secrets_properties_teams
- Connector secrets properties for a Microsoft Teams connector Up.teams
.xpack.actions.allowedHosts
setting, add the hostname to the allowed hosts. secrets_properties_tines
- Connector secrets properties for a Tines connector Up.tines
.secrets_properties_torq
- Connector secrets properties for a Torq connector Up.torq
.secrets_properties_webhook
- Connector secrets properties for a Webhook connector Up.webhook
.authType
is webhook-authentication-ssl
and certType
is ssl-crt-key
, it is a base64 encoded version of the CRT or CERT file. authType
is webhook-authentication-ssl
and certType
is ssl-crt-key
, it is a base64 encoded version of the KEY file. authType
is webhook-authentication-ssl
and certType
is ssl-pfx
, it is a base64 encoded version of the PFX or P12 file. hasAuth
is set to true
and authType
is webhook-authentication-basic
, this property is required. hasAuth
is set to true
and authType
is webhook-authentication-basic
, this property is required. secrets_properties_xmatters
- Connector secrets properties for an xMatters connector Up.xmatters
.usesBasic
is false
. updateConnector_400_response
- Upupdate_connector_request_cases_webhook
- Update Webhook - Case Managment connector request Upupdate_connector_request_d3security
- Update D3 Security connector request Upupdate_connector_request_email
- Update email connector request Upupdate_connector_request_jira
- Update Jira connector request Upupdate_connector_request_opsgenie
- Update Opsgenie connector request Upupdate_connector_request_pagerduty
- Update PagerDuty connector request Upupdate_connector_request_resilient
- Update IBM Resilient connector request Upupdate_connector_request_serverlog
- Update server log connector request Upupdate_connector_request_servicenow
- Update ServiceNow ITSM connector or ServiceNow SecOps request Upupdate_connector_request_servicenow_itom
- Create ServiceNow ITOM connector request Upupdate_connector_request_swimlane
- Update Swimlane connector request Upupdate_connector_request_tines
- Update Tines connector request Upupdate_connector_request_torq
- Update Torq connector request Upupdate_connector_request_webhook
- Update Webhook connector request Upupdate_connector_request_xmatters
- Update xMatters connector request Upget /s/{spaceId}/api/ml/saved_objects/sync
all
privileges for the Machine Learning feature in the Analytics section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "datafeedsAdded" : {
- "key" : {
- "success" : true
- }
- },
- "savedObjectsCreated" : {
- "anomaly-detector" : {
- "key" : {
- "success" : true
- }
- },
- "data-frame-analytics" : {
- "key" : {
- "success" : true
- }
- },
- "trained-model" : {
- "key" : {
- "success" : true
- }
- }
- },
- "savedObjectsDeleted" : {
- "anomaly-detector" : {
- "key" : {
- "success" : true
- }
- },
- "data-frame-analytics" : {
- "key" : {
- "success" : true
- }
- },
- "trained-model" : {
- "key" : {
- "success" : true
- }
- }
- },
- "datafeedsRemoved" : {
- "key" : {
- "success" : true
- }
- }
-}
-
- application/json
mlSync200Response
- Successful sync API responsemlSync4xxResponse
- Unsuccessful sync API responsemlSyncResponseAnomalyDetectors
- Sync API response for anomaly detection jobsmlSyncResponseDataFrameAnalytics
- Sync API response for data frame analytics jobsmlSyncResponseDatafeeds
- Sync API response for datafeedsmlSyncResponseSavedObjectsCreated
- Sync API response for created saved objectsmlSyncResponseSavedObjectsDeleted
- Sync API response for deleted saved objectsmlSyncResponseTrainedModels
- Sync API response for trained modelsmlSync200Response
- Successful sync API response UpmlSyncResponseAnomalyDetectors
- Sync API response for anomaly detection jobs UpmlSyncResponseDataFrameAnalytics
- Sync API response for data frame analytics jobs UpmlSyncResponseDatafeeds
- Sync API response for datafeeds UpmlSyncResponseSavedObjectsCreated
- Sync API response for created saved objects UpmlSyncResponseSavedObjectsDeleted
- Sync API response for deleted saved objects UpmlSyncResponseTrainedModels
- Sync API response for trained models Uppost /s/{spaceId}/api/alerting/rule
post /s/{spaceId}/api/alerting/rule/{ruleId}
delete /s/{spaceId}/api/alerting/rule/{ruleId}
post /s/{spaceId}/api/alerting/rule/{ruleId}/_disable
post /s/{spaceId}/api/alerting/rule/{ruleId}/_enable
get /s/{spaceId}/api/alerting/rules/_find
get /s/{spaceId}/api/alerting/_health
get /s/{spaceId}/api/alerting/rule/{ruleId}
get /s/{spaceId}/api/alerting/rule_types
post /s/{spaceId}/api/alerts/alert/{alertId}
post /s/{spaceId}/api/alerts/alert/{alertId}/_disable
post /s/{spaceId}/api/alerts/alert/{alertId}/_enable
get /s/{spaceId}/api/alerts/alerts/_find
get /s/{spaceId}/api/alerts/alert/{alertId}
get /s/{spaceId}/api/alerts/alerts/list_alert_types
get /s/{spaceId}/api/alerts/alerts/_health
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute
post /s/{spaceId}/api/alerts/alert/{alertId}/_mute_all
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute
post /s/{spaceId}/api/alerts/alert/{alertId}/_unmute_all
put /s/{spaceId}/api/alerts/alert/{alertId}
delete /s/{spaceId}/api/alerts/alert/{alertId}
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_mute
post /s/{spaceId}/api/alerting/rule/{ruleId}/_mute_all
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_unmute
post /s/{spaceId}/api/alerting/rule/{ruleId}/_unmute_all
put /s/{spaceId}/api/alerting/rule/{ruleId}
post /s/{spaceId}/api/alerting/rule/{ruleId}/_update_api_key
post /s/{spaceId}/api/alerting/rule
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "throttle" : "10m",
- "created_at" : "2022-12-05T23:36:58.284Z",
- "api_key_created_by_user" : false,
- "enabled" : true,
- "running" : true,
- "notify_when" : "notify_when",
- "next_run" : "2022-12-06T00:14:43.818Z",
- "updated_at" : "2022-12-05T23:36:58.284Z",
- "execution_status" : {
- "last_execution_date" : "2022-12-06T00:13:43.89Z",
- "last_duration" : 55,
- "status" : "ok"
- },
- "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "consumer" : "alerts",
- "last_run" : {
- "alerts_count" : {
- "ignored" : 6,
- "new" : 1,
- "recovered" : 5,
- "active" : 0
- },
- "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
- "outcome_order" : 5,
- "warning" : "warning",
- "outcome" : "succeeded"
- },
- "params" : {
- "key" : ""
- },
- "created_by" : "elastic",
- "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
- "rule_type_id" : "monitoring_alert_cluster_health",
- "revision" : 2,
- "tags" : [ "tags", "tags" ],
- "api_key_owner" : "elastic",
- "schedule" : {
- "interval" : "1m"
- },
- "name" : "cluster_health_rule",
- "updated_by" : "elastic",
- "mute_all" : false,
- "actions" : [ {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- }, {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- } ]
-}
-
- application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "throttle" : "10m",
- "created_at" : "2022-12-05T23:36:58.284Z",
- "api_key_created_by_user" : false,
- "enabled" : true,
- "running" : true,
- "notify_when" : "notify_when",
- "next_run" : "2022-12-06T00:14:43.818Z",
- "updated_at" : "2022-12-05T23:36:58.284Z",
- "execution_status" : {
- "last_execution_date" : "2022-12-06T00:13:43.89Z",
- "last_duration" : 55,
- "status" : "ok"
- },
- "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "consumer" : "alerts",
- "last_run" : {
- "alerts_count" : {
- "ignored" : 6,
- "new" : 1,
- "recovered" : 5,
- "active" : 0
- },
- "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
- "outcome_order" : 5,
- "warning" : "warning",
- "outcome" : "succeeded"
- },
- "params" : {
- "key" : ""
- },
- "created_by" : "elastic",
- "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
- "rule_type_id" : "monitoring_alert_cluster_health",
- "revision" : 2,
- "tags" : [ "tags", "tags" ],
- "api_key_owner" : "elastic",
- "schedule" : {
- "interval" : "1m"
- },
- "name" : "cluster_health_rule",
- "updated_by" : "elastic",
- "mute_all" : false,
- "actions" : [ {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- }, {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- } ]
-}
-
- application/json
delete /s/{spaceId}/api/alerting/rule/{ruleId}
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule you're deleting. For example, the Management > Stack Rules feature, Analytics > Discover or Machine Learning features, Observability, or Security features. WARNING: After you delete a rule, you cannot recover it. If the API key that is used by the rule was created automatically, it is deleted./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/_disable
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/_enable
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
get /s/{spaceId}/api/alerting/rules/_find
read
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rules you're seeking. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. To find rules associated with the Stack Monitoring feature, use the monitoring_user
built-in role./s/
and the identifier are omitted from the path, the default space is used. default: null attributes
key of the response. default: null savedObjectType.attributes.title: "myTitle"
. However, if you used a direct attribute of a saved object, such as updatedAt
, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22
. default: null attributes
key of the response. default: null {
- "per_page" : 6,
- "total" : 1,
- "data" : [ {
- "throttle" : "10m",
- "created_at" : "2022-12-05T23:36:58.284Z",
- "api_key_created_by_user" : false,
- "enabled" : true,
- "running" : true,
- "notify_when" : "notify_when",
- "next_run" : "2022-12-06T00:14:43.818Z",
- "updated_at" : "2022-12-05T23:36:58.284Z",
- "execution_status" : {
- "last_execution_date" : "2022-12-06T00:13:43.89Z",
- "last_duration" : 55,
- "status" : "ok"
- },
- "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "consumer" : "alerts",
- "last_run" : {
- "alerts_count" : {
- "ignored" : 6,
- "new" : 1,
- "recovered" : 5,
- "active" : 0
- },
- "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
- "outcome_order" : 5,
- "warning" : "warning",
- "outcome" : "succeeded"
- },
- "params" : {
- "key" : ""
- },
- "created_by" : "elastic",
- "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
- "rule_type_id" : "monitoring_alert_cluster_health",
- "revision" : 2,
- "tags" : [ "tags", "tags" ],
- "api_key_owner" : "elastic",
- "schedule" : {
- "interval" : "1m"
- },
- "name" : "cluster_health_rule",
- "updated_by" : "elastic",
- "mute_all" : false,
- "actions" : [ {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- }, {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- } ]
- }, {
- "throttle" : "10m",
- "created_at" : "2022-12-05T23:36:58.284Z",
- "api_key_created_by_user" : false,
- "enabled" : true,
- "running" : true,
- "notify_when" : "notify_when",
- "next_run" : "2022-12-06T00:14:43.818Z",
- "updated_at" : "2022-12-05T23:36:58.284Z",
- "execution_status" : {
- "last_execution_date" : "2022-12-06T00:13:43.89Z",
- "last_duration" : 55,
- "status" : "ok"
- },
- "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "consumer" : "alerts",
- "last_run" : {
- "alerts_count" : {
- "ignored" : 6,
- "new" : 1,
- "recovered" : 5,
- "active" : 0
- },
- "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
- "outcome_order" : 5,
- "warning" : "warning",
- "outcome" : "succeeded"
- },
- "params" : {
- "key" : ""
- },
- "created_by" : "elastic",
- "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
- "rule_type_id" : "monitoring_alert_cluster_health",
- "revision" : 2,
- "tags" : [ "tags", "tags" ],
- "api_key_owner" : "elastic",
- "schedule" : {
- "interval" : "1m"
- },
- "name" : "cluster_health_rule",
- "updated_by" : "elastic",
- "mute_all" : false,
- "actions" : [ {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- }, {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- } ]
- } ],
- "page" : 0
-}
-
- application/json
get /s/{spaceId}/api/alerting/_health
read
privileges for the Management > Stack Rules feature or for at least one of the Analytics > Discover, Analytics > Machine Learning, Observability, or Security features./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "alerting_framework_health" : {
- "execution_health" : {
- "status" : "ok",
- "timestamp" : "2023-01-13T01:28:00.28Z"
- },
- "read_health" : {
- "status" : "ok",
- "timestamp" : "2023-01-13T01:28:00.28Z"
- },
- "decryption_health" : {
- "status" : "ok",
- "timestamp" : "2023-01-13T01:28:00.28Z"
- }
- },
- "has_permanent_encryption_key" : true,
- "is_sufficiently_secure" : true
-}
-
- application/json
get /s/{spaceId}/api/alerting/rule/{ruleId}
read
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rules you're seeking. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. To get rules associated with the Stack Monitoring feature, use the monitoring_user
built-in role./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "throttle" : "10m",
- "created_at" : "2022-12-05T23:36:58.284Z",
- "api_key_created_by_user" : false,
- "enabled" : true,
- "running" : true,
- "notify_when" : "notify_when",
- "next_run" : "2022-12-06T00:14:43.818Z",
- "updated_at" : "2022-12-05T23:36:58.284Z",
- "execution_status" : {
- "last_execution_date" : "2022-12-06T00:13:43.89Z",
- "last_duration" : 55,
- "status" : "ok"
- },
- "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "consumer" : "alerts",
- "last_run" : {
- "alerts_count" : {
- "ignored" : 6,
- "new" : 1,
- "recovered" : 5,
- "active" : 0
- },
- "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
- "outcome_order" : 5,
- "warning" : "warning",
- "outcome" : "succeeded"
- },
- "params" : {
- "key" : ""
- },
- "created_by" : "elastic",
- "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
- "rule_type_id" : "monitoring_alert_cluster_health",
- "revision" : 2,
- "tags" : [ "tags", "tags" ],
- "api_key_owner" : "elastic",
- "schedule" : {
- "interval" : "1m"
- },
- "name" : "cluster_health_rule",
- "updated_by" : "elastic",
- "mute_all" : false,
- "actions" : [ {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- }, {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- } ]
-}
-
- application/json
get /s/{spaceId}/api/alerting/rule_types
read
privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, and Security features. To get rule types associated with the Stack Monitoring feature, use the monitoring_user
built-in role./s/
and the identifier are omitted from the path, the default space is used. default: null {
- "recovery_action_group" : {
- "name" : "name",
- "id" : "id"
- },
- "does_set_recovery_context" : true,
- "is_exportable" : true,
- "authorized_consumers" : {
- "alerts" : {
- "all" : true,
- "read" : true
- },
- "discover" : {
- "all" : true,
- "read" : true
- },
- "stackAlerts" : {
- "all" : true,
- "read" : true
- },
- "infrastructure" : {
- "all" : true,
- "read" : true
- },
- "siem" : {
- "all" : true,
- "read" : true
- },
- "monitoring" : {
- "all" : true,
- "read" : true
- },
- "logs" : {
- "all" : true,
- "read" : true
- },
- "apm" : {
- "all" : true,
- "read" : true
- },
- "ml" : {
- "all" : true,
- "read" : true
- },
- "uptime" : {
- "all" : true,
- "read" : true
- }
- },
- "action_groups" : [ {
- "name" : "name",
- "id" : "id"
- }, {
- "name" : "name",
- "id" : "id"
- } ],
- "minimum_license_required" : "basic",
- "action_variables" : {
- "context" : [ {
- "name" : "name",
- "description" : "description",
- "useWithTripleBracesInTemplates" : true
- }, {
- "name" : "name",
- "description" : "description",
- "useWithTripleBracesInTemplates" : true
- } ],
- "state" : [ {
- "name" : "name",
- "description" : "description"
- }, {
- "name" : "name",
- "description" : "description"
- } ],
- "params" : [ {
- "name" : "name",
- "description" : "description"
- }, {
- "name" : "name",
- "description" : "description"
- } ]
- },
- "rule_task_timeout" : "5m",
- "name" : "name",
- "enabled_in_license" : true,
- "producer" : "stackAlerts",
- "id" : "id",
- "default_action_group_id" : "default_action_group_id"
-}
-
- application/json
post /s/{spaceId}/api/alerts/alert/{alertId}
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "alertTypeId" : ".index-threshold",
- "throttle" : "throttle",
- "updatedBy" : "elastic",
- "executionStatus" : {
- "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
- "status" : "ok"
- },
- "params" : {
- "key" : ""
- },
- "enabled" : true,
- "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
- "tags" : [ "tags", "tags" ],
- "createdAt" : "2022-12-05T23:36:58.284Z",
- "schedule" : {
- "interval" : "interval"
- },
- "notifyWhen" : "onActionGroupChange",
- "createdBy" : "elastic",
- "muteAll" : false,
- "name" : "my alert",
- "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "actions" : [ "{}", "{}" ],
- "apiKeyOwner" : "elastic",
- "updatedAt" : "2022-12-05T23:36:58.284Z"
-}
-
- application/json
post /s/{spaceId}/api/alerts/alert/{alertId}/_disable
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerts/alert/{alertId}/_enable
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
get /s/{spaceId}/api/alerts/alerts/_find
params
are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data./s/
and the identifier are omitted from the path, the default space is used. default: null simple_query_string
. default: OR attributes
key of the response. default: null savedObjectType.attributes.title: "myTitle"
. However, if you used a direct attribute of a saved object, such as updatedAt
, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22
. default: null simple_query_string
query that filters the alerts in the response. default: null simple_query_string
parsed query against. default: null attributes
key of the response. default: null {
- "total" : 1,
- "perPage" : 6,
- "data" : [ {
- "alertTypeId" : ".index-threshold",
- "throttle" : "throttle",
- "updatedBy" : "elastic",
- "executionStatus" : {
- "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
- "status" : "ok"
- },
- "params" : {
- "key" : ""
- },
- "enabled" : true,
- "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
- "tags" : [ "tags", "tags" ],
- "createdAt" : "2022-12-05T23:36:58.284Z",
- "schedule" : {
- "interval" : "interval"
- },
- "notifyWhen" : "onActionGroupChange",
- "createdBy" : "elastic",
- "muteAll" : false,
- "name" : "my alert",
- "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "actions" : [ "{}", "{}" ],
- "apiKeyOwner" : "elastic",
- "updatedAt" : "2022-12-05T23:36:58.284Z"
- }, {
- "alertTypeId" : ".index-threshold",
- "throttle" : "throttle",
- "updatedBy" : "elastic",
- "executionStatus" : {
- "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
- "status" : "ok"
- },
- "params" : {
- "key" : ""
- },
- "enabled" : true,
- "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
- "tags" : [ "tags", "tags" ],
- "createdAt" : "2022-12-05T23:36:58.284Z",
- "schedule" : {
- "interval" : "interval"
- },
- "notifyWhen" : "onActionGroupChange",
- "createdBy" : "elastic",
- "muteAll" : false,
- "name" : "my alert",
- "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "actions" : [ "{}", "{}" ],
- "apiKeyOwner" : "elastic",
- "updatedAt" : "2022-12-05T23:36:58.284Z"
- } ],
- "page" : 0
-}
-
- application/json
get /s/{spaceId}/api/alerts/alert/{alertId}
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "alertTypeId" : ".index-threshold",
- "throttle" : "throttle",
- "updatedBy" : "elastic",
- "executionStatus" : {
- "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
- "status" : "ok"
- },
- "params" : {
- "key" : ""
- },
- "enabled" : true,
- "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
- "tags" : [ "tags", "tags" ],
- "createdAt" : "2022-12-05T23:36:58.284Z",
- "schedule" : {
- "interval" : "interval"
- },
- "notifyWhen" : "onActionGroupChange",
- "createdBy" : "elastic",
- "muteAll" : false,
- "name" : "my alert",
- "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "actions" : [ "{}", "{}" ],
- "apiKeyOwner" : "elastic",
- "updatedAt" : "2022-12-05T23:36:58.284Z"
-}
-
- application/json
get /s/{spaceId}/api/alerts/alerts/list_alert_types
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "defaultActionGroupId" : "defaultActionGroupId",
- "isExportable" : true,
- "actionVariables" : {
- "context" : [ {
- "name" : "name",
- "description" : "description"
- }, {
- "name" : "name",
- "description" : "description"
- } ],
- "state" : [ {
- "name" : "name",
- "description" : "description"
- }, {
- "name" : "name",
- "description" : "description"
- } ],
- "params" : [ {
- "name" : "name",
- "description" : "description"
- }, {
- "name" : "name",
- "description" : "description"
- } ]
- },
- "actionGroups" : [ {
- "name" : "name",
- "id" : "id"
- }, {
- "name" : "name",
- "id" : "id"
- } ],
- "name" : "name",
- "producer" : "producer",
- "authorizedConsumers" : "{}",
- "recoveryActionGroup" : {
- "name" : "name",
- "id" : "id"
- },
- "enabledInLicense" : true,
- "id" : "id",
- "minimumLicenseRequired" : "minimumLicenseRequired"
-}
-
- application/json
get /s/{spaceId}/api/alerts/alerts/_health
/s/
and the identifier are omitted from the path, the default space is used. default: null {
- "hasPermanentEncryptionKey" : true,
- "alertingFrameworkHealth" : {
- "executionHealth" : {
- "status" : "ok",
- "timestamp" : "2023-01-13T01:28:00.28Z"
- },
- "decryptionHealth" : {
- "status" : "ok",
- "timestamp" : "2023-01-13T01:28:00.28Z"
- },
- "readHealth" : {
- "status" : "ok",
- "timestamp" : "2023-01-13T01:28:00.28Z"
- }
- },
- "isSufficientlySecure" : true
-}
-
- application/json
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerts/alert/{alertId}/_mute_all
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerts/alert/{alertId}/_unmute_all
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
put /s/{spaceId}/api/alerts/alert/{alertId}
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "alertTypeId" : ".index-threshold",
- "throttle" : "throttle",
- "updatedBy" : "elastic",
- "executionStatus" : {
- "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
- "status" : "ok"
- },
- "params" : {
- "key" : ""
- },
- "enabled" : true,
- "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
- "tags" : [ "tags", "tags" ],
- "createdAt" : "2022-12-05T23:36:58.284Z",
- "schedule" : {
- "interval" : "interval"
- },
- "notifyWhen" : "onActionGroupChange",
- "createdBy" : "elastic",
- "muteAll" : false,
- "name" : "my alert",
- "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "actions" : [ "{}", "{}" ],
- "apiKeyOwner" : "elastic",
- "updatedAt" : "2022-12-05T23:36:58.284Z"
-}
-
- application/json
delete /s/{spaceId}/api/alerts/alert/{alertId}
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_mute
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/_mute_all
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_unmute
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/_unmute_all
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
put /s/{spaceId}/api/alerting/rule/{ruleId}
all
privileges for the appropriate Kibana features, depending on the consumer
and rule_type_id
of the rule you're updating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read
privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs. NOTE: If the API key has different privileges than the key that created or most recently updated the rule, the rule behavior might change. Though some properties are optional, when you update the rule the existing property values are overwritten with default values. Therefore, it is recommended to explicitly set all property values./s/
and the identifier are omitted from the path, the default space is used. default: null application/json
{
- "throttle" : "10m",
- "created_at" : "2022-12-05T23:36:58.284Z",
- "api_key_created_by_user" : false,
- "enabled" : true,
- "running" : true,
- "notify_when" : "notify_when",
- "next_run" : "2022-12-06T00:14:43.818Z",
- "updated_at" : "2022-12-05T23:36:58.284Z",
- "execution_status" : {
- "last_execution_date" : "2022-12-06T00:13:43.89Z",
- "last_duration" : 55,
- "status" : "ok"
- },
- "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
- "consumer" : "alerts",
- "last_run" : {
- "alerts_count" : {
- "ignored" : 6,
- "new" : 1,
- "recovered" : 5,
- "active" : 0
- },
- "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
- "outcome_order" : 5,
- "warning" : "warning",
- "outcome" : "succeeded"
- },
- "params" : {
- "key" : ""
- },
- "created_by" : "elastic",
- "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
- "rule_type_id" : "monitoring_alert_cluster_health",
- "revision" : 2,
- "tags" : [ "tags", "tags" ],
- "api_key_owner" : "elastic",
- "schedule" : {
- "interval" : "1m"
- },
- "name" : "cluster_health_rule",
- "updated_by" : "elastic",
- "mute_all" : false,
- "actions" : [ {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- }, {
- "alerts_filter" : {
- "timeframe" : {
- "hours" : {
- "start" : "08:00",
- "end" : "17:00"
- },
- "timezone" : "Europe/Madrid",
- "days" : [ 1, 2, 3, 4, 5 ]
- },
- "query" : {
- "kql" : "kql",
- "filters" : [ {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- }, {
- "$state" : "{}",
- "meta" : {
- "field" : "field",
- "controlledBy" : "controlledBy",
- "negate" : true,
- "alias" : "alias",
- "index" : "index",
- "disabled" : true,
- "params" : "{}",
- "type" : "type",
- "value" : "value",
- "isMultiIndex" : true,
- "key" : "key",
- "group" : "group"
- },
- "query" : "{}"
- } ]
- }
- },
- "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
- "params" : {
- "key" : ""
- },
- "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
- "connector_type_id" : ".server-log",
- "frequency" : {
- "summary" : true,
- "throttle" : "10m",
- "notify_when" : "onActiveAlert"
- },
- "group" : "default"
- } ]
-}
-
- application/json
post /s/{spaceId}/api/alerting/rule/{ruleId}/_update_api_key
/s/
and the identifier are omitted from the path, the default space is used. default: null application/json
400_response
- Bad request401_response
- Unsuccessful rule API response404_response
- Count
- CountCount_count
- Count_criteria
- Count_logView
- Legacy_create_alert_request_properties
- Legacy create alert request propertiesLegacy_create_alert_request_properties_schedule
- Legacy_update_alert_request_properties
- Legacy update alert request propertiesLegacy_update_alert_request_properties_actions_inner
- Legacy_update_alert_request_properties_schedule
- Ratio
- Ratioactions_inner
- actions_inner_alerts_filter
- actions_inner_alerts_filter_query
- actions_inner_alerts_filter_timeframe
- actions_inner_alerts_filter_timeframe_hours
- actions_inner_frequency
- aggtype
- alert_response_properties
- Legacy alert response propertiesalert_response_properties_executionStatus
- alert_response_properties_schedule
- count_criterion
- count criterioncreate_anomaly_detection_alert_rule_request
- Create anomaly detection rule requestcreate_anomaly_detection_jobs_health_rule_request
- Create anomaly detection jobs health rule requestcreate_apm_anomaly_rule_request
- Create APM anomaly rule rule requestcreate_apm_error_count_rule_request
- Create APM error count rule requestcreate_apm_transaction_duration_rule_request
- Create latency threshold rule requestcreate_apm_transaction_error_rate_rule_request
- Create APM transaction error rate rule requestcreate_es_query_rule_request
- Create Elasticsearch query rule requestcreate_geo_containment_rule_request
- Create traacking containment rule requestcreate_index_threshold_rule_request
- Create index threshold rule requestcreate_infra_inventory_rule_request
- Create infra inventory rule requestcreate_infra_metric_anomaly_rule_request
- Create infrastructure anomaly rule requestcreate_infra_metric_threshold_rule_request
- Create infra metric threshold rule requestcreate_log_threshold_rule_request
- Create log threshold rule requestcreate_monitoring_ccr_exceptions_rule_request
- Create CCR read exceptions rule requestcreate_monitoring_cluster_health_rule_request
- Create cluster health rule requestcreate_monitoring_cpu_usage_rule_request
- Create CPU usage rule requestcreate_monitoring_disk_usage_rule_request
- Create disk usage rule requestcreate_monitoring_elasticsearch_version_mismatch_rule_request
- Create Elasticsearch version mismatch rule requestcreate_monitoring_jvm_memory_usage_rule_request
- Create JVM memory usage rule requestcreate_monitoring_kibana_version_mismatch_rule_request
- Create Kibana version mismatch rule requestcreate_monitoring_license_expiration_rule_request
- Create license expiration rule requestcreate_monitoring_logstash_version_mismatch_rule_request
- Create Logstash version mismatch rule requestcreate_monitoring_missing_data_rule_request
- Create missing monitoring data rule requestcreate_monitoring_nodes_changed_rule_request
- Create nodes changed rule requestcreate_monitoring_shard_size_rule_request
- Create shard size rule requestcreate_monitoring_thread_pool_search_rejections_rule_request
- Create thread pool search rejections rule requestcreate_monitoring_thread_pool_write_rejections_rule_request
- Create thread pool write rejections rule requestcreate_rule_request
- Create rule request body propertiescreate_siem_eql_rule_request
- Create event correlation rule requestcreate_siem_indicator_rule_request
- Create indicator match rule requestcreate_siem_ml_rule_request
- Create machine learning rule requestcreate_siem_new_terms_rule_request
- Create new terms rule requestcreate_siem_notifications_rule_request
- Create security solution notification (legacy) rule requestcreate_siem_query_rule_request
- Create custom query rule requestcreate_siem_saved_query_rule_request
- Create saved query rule requestcreate_siem_threshold_rule_request
- Create threshold rule requestcreate_slo_burn_rate_rule_request
- Create slo burn rate rule requestcreate_synthetics_monitor_status_rule_request
- Create synthetics monitor status rule requestcreate_synthetics_uptime_duration_anomaly_rule_request
- Create synthetics uptime duration anomaly rule requestcreate_synthetics_uptime_tls_certificate_rule_request
- Create TLS certificate rule requestcreate_synthetics_uptime_tls_rule_request
- Create synthetics uptime TLS rule requestcreate_transform_health_rule_request
- Create transform health rule requestcreate_uptime_monitor_status_rule_request
- Create uptime monitor status rule requestcustom_criterion
- custom criterioncustom_criterion_customMetric_inner
- custom_criterion_customMetric_inner_oneOf
- custom_criterion_customMetric_inner_oneOf_1
- filter
- filter_meta
- findRules_200_response
- findRules_has_reference_parameter
- findRules_search_fields_parameter
- getAlertingHealth_200_response
- getAlertingHealth_200_response_alerting_framework_health
- getAlertingHealth_200_response_alerting_framework_health_decryption_health
- getAlertingHealth_200_response_alerting_framework_health_execution_health
- getAlertingHealth_200_response_alerting_framework_health_read_health
- getRuleTypes_200_response_inner
- getRuleTypes_200_response_inner_action_groups_inner
- getRuleTypes_200_response_inner_action_variables
- getRuleTypes_200_response_inner_action_variables_context_inner
- getRuleTypes_200_response_inner_action_variables_params_inner
- getRuleTypes_200_response_inner_authorized_consumers
- getRuleTypes_200_response_inner_authorized_consumers_alerts
- getRuleTypes_200_response_inner_recovery_action_group
- groupby
- legacyFindAlerts_200_response
- legacyGetAlertTypes_200_response_inner
- legacyGetAlertTypes_200_response_inner_actionVariables
- legacyGetAlertTypes_200_response_inner_actionVariables_context_inner
- legacyGetAlertTypes_200_response_inner_recoveryActionGroup
- legacyGetAlertingHealth_200_response
- legacyGetAlertingHealth_200_response_alertingFrameworkHealth
- legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth
- legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth
- legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth
- non_count_criterion
- non count criterionnotify_when
- params_es_query_rule
- params_es_query_rule_oneOf
- params_es_query_rule_oneOf_1
- params_es_query_rule_oneOf_searchConfiguration
- params_es_query_rule_oneOf_searchConfiguration_query
- params_index_threshold_rule
- params_property_apm_anomaly
- params_property_apm_error_count
- params_property_apm_transaction_duration
- params_property_apm_transaction_error_rate
- params_property_infra_inventory
- params_property_infra_inventory_criteria_inner
- params_property_infra_inventory_criteria_inner_customMetric
- params_property_infra_metric_threshold
- params_property_infra_metric_threshold_criteria_inner
- params_property_log_threshold
- params_property_slo_burn_rate
- params_property_slo_burn_rate_longWindow
- params_property_slo_burn_rate_shortWindow
- params_property_synthetics_monitor_status
- params_property_synthetics_monitor_status_availability
- params_property_synthetics_monitor_status_filters
- params_property_synthetics_monitor_status_filters_oneOf
- params_property_synthetics_monitor_status_timerange
- params_property_synthetics_uptime_tls
- rule_response_properties
- Rule response propertiesrule_response_properties_execution_status
- rule_response_properties_last_run
- rule_response_properties_last_run_alerts_count
- schedule
- thresholdcomparator
- timewindowunit
- update_rule_request
- Update rule request400_response
- Bad request Up404_response
- UpCount
- Count UpCount_count
- UpCount_criteria
- UpCount_logView
- UpLegacy_create_alert_request_properties
- Legacy create alert request properties Upparams
value. This will also validate against the alert type params validator, if defined. 10m
or 1h
will prevent it from sending 90 notifications during this period. Legacy_create_alert_request_properties_schedule
- UpLegacy_update_alert_request_properties
- Legacy update alert request properties Upparams
value. This will also validate against the alert type params validator, if defined. 10m
or 1h
will prevent it from sending 90 notifications during this period. Legacy_update_alert_request_properties_actions_inner
- Updefault
. params
that the action type will receive. params
are handled as Mustache templates and passed a default set of context. Legacy_update_alert_request_properties_schedule
- UpRatio
- Ratio Upactions_inner
- Updefault
. params
are handled as Mustache templates and passed a default set of context. actions_inner_alerts_filter
- Upactions_inner_alerts_filter_query
- Upactions_inner_alerts_filter_timeframe
- Up1
represents Monday. An empty array is equivalent to specifying all the days of the week. hours
values. Values such as UTC
and UTC+1
also work but lack built-in daylight savings time support and are not recommended. actions_inner_alerts_filter_timeframe_hours
- Upstart
value is 00:00
and the end
value is 24:00
, actions be generated all day.actions_inner_frequency
- Upsummary
to true
, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when
or throttle
are defined at the rule level.notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. alert_response_properties
- Legacy alert response properties Upalert_response_properties_schedule
- Upcount_criterion
- count criterion Upcreate_anomaly_detection_alert_rule_request
- Create anomaly detection rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_anomaly_detection_jobs_health_rule_request
- Create anomaly detection jobs health rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_apm_anomaly_rule_request
- Create APM anomaly rule rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_apm_error_count_rule_request
- Create APM error count rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_apm_transaction_duration_rule_request
- Create latency threshold rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_apm_transaction_error_rate_rule_request
- Create APM transaction error rate rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_es_query_rule_request
- Create Elasticsearch query rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_geo_containment_rule_request
- Create traacking containment rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_index_threshold_rule_request
- Create index threshold rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_infra_inventory_rule_request
- Create infra inventory rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_infra_metric_anomaly_rule_request
- Create infrastructure anomaly rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_infra_metric_threshold_rule_request
- Create infra metric threshold rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_log_threshold_rule_request
- Create log threshold rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_ccr_exceptions_rule_request
- Create CCR read exceptions rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_cluster_health_rule_request
- Create cluster health rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_cpu_usage_rule_request
- Create CPU usage rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_disk_usage_rule_request
- Create disk usage rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_elasticsearch_version_mismatch_rule_request
- Create Elasticsearch version mismatch rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_jvm_memory_usage_rule_request
- Create JVM memory usage rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_kibana_version_mismatch_rule_request
- Create Kibana version mismatch rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_license_expiration_rule_request
- Create license expiration rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_logstash_version_mismatch_rule_request
- Create Logstash version mismatch rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_missing_data_rule_request
- Create missing monitoring data rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_nodes_changed_rule_request
- Create nodes changed rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_shard_size_rule_request
- Create shard size rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_thread_pool_search_rejections_rule_request
- Create thread pool search rejections rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_monitoring_thread_pool_write_rejections_rule_request
- Create thread pool write rejections rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_rule_request
- Create rule request body properties Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_eql_rule_request
- Create event correlation rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_indicator_rule_request
- Create indicator match rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_ml_rule_request
- Create machine learning rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_new_terms_rule_request
- Create new terms rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_notifications_rule_request
- Create security solution notification (legacy) rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_query_rule_request
- Create custom query rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_saved_query_rule_request
- Create saved query rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_siem_threshold_rule_request
- Create threshold rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_slo_burn_rate_rule_request
- Create slo burn rate rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_synthetics_monitor_status_rule_request
- Create synthetics monitor status rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_synthetics_uptime_duration_anomaly_rule_request
- Create synthetics uptime duration anomaly rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_synthetics_uptime_tls_certificate_rule_request
- Create TLS certificate rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_synthetics_uptime_tls_rule_request
- Create synthetics uptime TLS rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_transform_health_rule_request
- Create transform health rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. create_uptime_monitor_status_rule_request
- Create uptime monitor status rule request Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. custom_criterion
- custom criterion Upfilter
- Upkbn-es-query
package.filter_meta
- UpfindRules_200_response
- UpfindRules_search_fields_parameter
- UpgetAlertingHealth_200_response
- UpgetAlertingHealth_200_response_alerting_framework_health
- Updecryption_health
, execution_health
, and read_health
.getAlertingHealth_200_response_alerting_framework_health_decryption_health
- UpgetAlertingHealth_200_response_alerting_framework_health_execution_health
- UpgetAlertingHealth_200_response_alerting_framework_health_read_health
- UpgetRuleTypes_200_response_inner
- UpgetRuleTypes_200_response_inner_action_variables
- UpgetRuleTypes_200_response_inner_authorized_consumers
- UpgetRuleTypes_200_response_inner_recovery_action_group
- Upgroupby
- Upall
) or split into groups (top
) using a grouping field (termField
). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to termSize
number of groups) are checked.legacyFindAlerts_200_response
- UplegacyGetAlertTypes_200_response_inner
- UplegacyGetAlertTypes_200_response_inner_actionVariables
- UplegacyGetAlertTypes_200_response_inner_recoveryActionGroup
- UplegacyGetAlertingHealth_200_response
- UplegacyGetAlertingHealth_200_response_alertingFrameworkHealth
- UpdecryptionHealth
, executionHealth
, and readHealth
.legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth
- UplegacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth
- UplegacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth
- Upnon_count_criterion
- non count criterion Upnotify_when
- UponActionGroupChange
: Actions run when the alert status changes; onActiveAlert
: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval
: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when
at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.params_es_query_rule
- UpaggType
is avg
, max
, min
or sum
. true
, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. groupBy
is top
. The name of the field that is used for grouping the aggregation. groupBy
is top
. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. thresholdComparator
. If the thresholdComparator
is between
or notBetween
, you must specify the boundary values. timeWindowUnit
units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. params_es_query_rule_oneOf
- UpaggType
is avg
, max
, min
or sum
. true
, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. groupBy
is top
. The name of the field that is used for grouping the aggregation. groupBy
is top
. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. thresholdComparator
. If the thresholdComparator
is between
or notBetween
, you must specify the boundary values. timeWindowUnit
units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. params_es_query_rule_oneOf_1
- UpaggType
is avg
, max
, min
or sum
. true
, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. groupBy
is top
. The name of the field that is used for grouping the aggregation. groupBy
is top
. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. thresholdComparator
. If the thresholdComparator
is between
or notBetween
, you must specify the boundary values. timeWindowUnit
units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. params_es_query_rule_oneOf_searchConfiguration
- Upparams_index_threshold_rule
- UpaggType
is avg
, max
, min
or sum
. groupBy
is top
. The name of the field that is used for grouping the aggregation. groupBy
is top
. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. thresholdComparator
. If the thresholdComparator
is between
or notBetween
, you must specify the boundary values. timeWindowUnit
units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. params_property_apm_anomaly
- Upparams_property_apm_error_count
- Upparams_property_apm_transaction_duration
- Upparams_property_apm_transaction_error_rate
- Upparams_property_infra_inventory
- Upparams_property_infra_inventory_criteria_inner
- Upparams_property_infra_metric_threshold
- Upparams_property_infra_metric_threshold_criteria_inner
- Upparams_property_log_threshold
- Upparams_property_slo_burn_rate
- Upparams_property_slo_burn_rate_longWindow
- Upparams_property_slo_burn_rate_shortWindow
- Upparams_property_synthetics_monitor_status
- Upparams_property_synthetics_monitor_status_filters
- Upparams_property_synthetics_monitor_status_filters_oneOf
- Upparams_property_synthetics_uptime_tls
- Uprule_response_properties
- Rule response properties Upalerts
, apm
, discover
, infrastructure
, logs
, metrics
, ml
, monitoring
, securitySolution
, siem
, stackAlerts
, or uptime
. .es-query
, .index-threshold
, logs.alert.document.count
, monitoring_alert_cluster_health
, siem.thresholdRule
, or xpack.ml.anomaly_detection_alert
. notify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. rule_response_properties_last_run
- Upschedule
- Upthresholdcomparator
- Uptimewindowunit
- Upupdate_rule_request
- Update rule request Upnotify_when
is set to onThrottleInterval
. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. {{httpMethod}} {{path}}
{{httpMethod}} {{path}}
{{{mediaType}}}
{{{example}}}
- {{/examples}}
- {{/hasExamples}}
-
- {{#hasProduces}}
- {{{mediaType}}}
{{example}}
- {{/examples}}
- {{/responses}}
- {{name}}
{{#title}} - {{.}}{{/title}}{{name}}
{{#title}} - {{.}}{{/title}} Up