Elasticsearch v2

Search for and analyze data in real time. Supports version 6 and later.

Database · Elasticsearch

Details

IDElasticsearch v2
ProviderElastic
CategoryDatabase
From Version5.0.0
Docker Imagedemisto/elasticsearch:1.0.0.11195141
Supported ModulesAgentix Cloud Runtime Security XSIAM EDR Cortex Cloud Attack Surface Management Cloud Posture Security Exposure Management

README

Elasticsearch_v2 integration is used to search for and analyze data in real time.
Supports version 6 and later.
This integration was integrated and tested with versions 6.6.2, 7.3, 8.4.1 of Elasticsearch.

Permissions

The permissions required to use this integration depends on which operations you need to perform. The API user should have the same permissions a regular user would have in order to access the data via the UI. Following are the permissions needed for certain commands:

  • !es-eql-search/search/es-search/fetch-incidents - If the Elasticsearch security features are enabled, you must have the read index privilege for the target data stream, index, or alias.
  • !get-mapping-fields - If the Elasticsearch security features are enabled, you must have the view_index_metadata or manage index privilege for the target data stream, index, or alias.
  • !es-index - If the Elasticsearch security features are enabled, you must have the write index privilege for the target data stream, index, or alias.
  • !es-kibana-* commands - To execute Kibana commands, you must have the necessary privileges for the applicable resource. The privilege required depends on the command you are using. Kibana API endpoints are gated by feature privileges granted at one of two levels: Read (GET / list / view operations) and All (POST / PUT / PATCH / DELETE operations). For rules and cases, the privilege is scoped to the feature that owns the object — a Security-owned object requires the Security feature privilege, an Observability-owned object requires the Observability feature privilege, and a stack-owned object requires the Management / Stack Rules feature privilege.

Configure Elasticsearch v2 in Cortex

Parameter Description Required
Server URL The Elasticsearch server to which the integration connects. Ensure that the URL includes the correct Elasticsearch port. The default port for Elasticsearch v7 and below is 9200. Use the Server URL for on-premises deployments. False
Kibana Server URL The Kibana server used by the es-kibana-* commands and by fetching and mirroring security alerts and cases. Required for on-premises (self-managed) deployments, where Kibana is usually hosted separately from Elasticsearch (for example, https://kibana.example.com:5601). If left empty, the Kibana URL is derived from the Server URL, which is supported only for Elastic Cloud deployments whose hostname contains “.es.” (the segment is replaced with “.kb.”). False
Authorization type Select the authentication type and enter the appropriate credentials:
- Basic Auth: Enter Username and Password.
- Bearer Auth: Enter Username and Password.
- API Key Auth: Enter the API Key ID and API Key.		 True
API key ID Use for API key auth False
API Key Use for API key auth False
Username Use for API Key auth. Optionally you can use Username as an API key ID and Password as an API key for Basic auth. False
Password Use for API Key auth. Optionally you can use Username as an API key ID and Password as an API key for Basic auth. False
Trust any certificate (not secure)   False
Use system proxy settings   False
Client type In some hosted ElasticSearch environments, the standard ElasticSearch client is not supported. If you encounter any related client issues, please consider using the OpenSearch client type. False
Index to fetch incidents from CSV False
Query String Query string uses the Lucene syntax.
For more information about the Lucene syntax see here.
The query will be used when fetching incidents. Index time field will be used as a filter in the query.

The integration test button doesn’t fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the ‘!es-integration-health-check’ command.		 False
Fields to fetch (_source already included) A comma-separated list of Elasticsearch fields to retrieve in addition to the default _source fields. For example: host.hostname, host.id. False
Index time field The time field used for sorting and limiting results. If using a nested field, separate field names with dot notation. False
Raw Query Raw Query allows raw DSL queries and will override the ‘Query String’ Lucene syntax string.
Results will not be filtered or sorted. Use additional parameters in the raw query for these purposes.
For more information about Query DSL see here.

The integration test button doesn’t fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the ‘!es-integration-health-check’ command.		 False
Time field type 3 formats supported:
Simple-Date - A plain date string. You must specify the format in which the date is stored.
For more information about time formatting, see here.
 Timestamp-Second - A numeric value representing the number of seconds since the Unix epoch (00:00:00 UTC on 1 January 1970). Example: ‘1572164838’
* Timestamp-Milliseconds - A numeric value representing the number of milliseconds since the Unix epoch. Example: ‘1572164838123’		 False
Map JSON fields into labels   False
First fetch timestamp <number> <time unit>, e.g., 12 hours, 7 days False
The maximum number of results per fetch   False
Request timeout (in seconds).   False
Incident type   False
Fetch incidents   False
Space ID The default Kibana space ID to use for es-kibana-* commands. Used to derive the Kibana base URL from the Server URL. If a space_id argument is provided to a command, it overrides this value. See Spaces for more information. False
Fetch incident types The type of incident to fetch from Elasticsearch (Elasticsearch Entity, Elasticsearch Security Alert, or Elasticsearch Case). False
Incident Mirroring Direction Mirroring works only for the Elasticsearch Security Alert and Elasticsearch Case incident types. False
Fetch cases by Severity Case severities to fetch. If none are chosen, all severity levels will be returned. Relevant only for incident type Elasticsearch Case. False
Fetch cases by Status Case statuses to fetch. If none are chosen, in-progress and open will be returned. Relevant only for incident type Elasticsearch Case. False
Fetch alerts for case When enabled, fetches alerts associated with each Elasticsearch Case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges. False
Close Mirrored XSOAR Incident Whether closing the Elasticsearch alert or case is mirrored in Cortex XSOAR. False
Close Mirrored Elasticsearch Incident Whether closing the Cortex XSOAR incident is mirrored in Elasticsearch. False

Fetch

Use the Fetch incident types parameter to select what to fetch from Elasticsearch: the default Elasticsearch Entity, Elasticsearch Security Alert, or Elasticsearch Case.

Mirroring is only available for Elasticsearch Security Alerts and Cases.

Fetch

The default fetch behavior. Configure the Index to fetch incidents from, Query String, and/or Raw Query fields to fetch generic Elasticsearch documents as incidents.

Fetch Security Alerts

To fetch security alerts, use the Raw Query field (DSL query). The index must follow one of these patterns: .internal.alerts-security.alerts-* or .siem-signals-*.

Fetch Cases

Use the Fetch cases by Severity parameter to filter cases by the required severity and the Fetch cases by Status parameter to filter cases by the required status. Enable Fetch alerts for case to also retrieve the alerts associated with each case.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Elasticsearch (Kibana) Security Alerts and Cases.

Mirroring is only available for Elasticsearch Security Alert and Elasticsearch Case incident types.

To set up mirroring:

  1. Enable Fetch incidents in your instance configuration.
  2. In the Fetch incident types parameter, select Elasticsearch Security Alert or Elasticsearch Case.
  3. In the Incident Mirroring Direction parameter, select in which direction the incidents should be mirrored:
    • Incoming - Changes in Elasticsearch (status, tags, workflow reason, case fields) are reflected in Cortex XSOAR.
    • Outgoing - Changes in Cortex XSOAR are reflected in Elasticsearch.
    • Incoming And Outgoing - Changes are mirrored in both directions.
  4. Optionally, select Close Mirrored XSOAR Incident to close the Cortex XSOAR incident when the Elasticsearch alert/case is closed, and Close Mirrored Elasticsearch Incident to close the Elasticsearch alert/case when the Cortex XSOAR incident is closed.

Notes:

  • The mirroring is affected by the following integration parameters: Incident Mirroring Direction, Close Mirrored XSOAR Incident, and Close Mirrored Elasticsearch Incident.
  • To ensure mirroring works as expected, mappers are required so that the fields are properly mapped to and from Elasticsearch. Select the appropriate incoming and outgoing mappers per incident type (Elasticsearch Security Alert - Incoming/Outgoing Mapper and Elasticsearch Case - Incoming/Outgoing Mapper).
  • Set the Fetch incident types parameter even when mirroring only. It is used to resolve the incident type when the remote lookup is unavailable; without it, changes may not be mirrored out.
  • Mirroring out always uses the Kibana API, because the security alert indices are Kibana system indices and writing to them directly would skip Kibana’s bookkeeping (such as kibana.alert.workflow_status_updated_at, which mirroring in relies on). The configured credentials therefore need the Security → Alerts: All Kibana privilege, and the Space ID must match the space that owns the alerts. If either is wrong, the fetch keeps working while mirroring out reports that 0 alerts were updated.

Which Security Alert fields can be mirrored

Elasticsearch only allows a detection alert’s workflow status, status reason, and workflow tags to be changed. These are the only fields mirrored out:

Cortex XSOAR incident field Elasticsearch field
Elasticsearch Workflow Alert Status kibana.alert.workflow_status
Elasticsearch Workflow Alert Status Reason kibana.alert.workflow_reason
Tags kibana.alert.workflow_tags

Other fields, such as severity, risk score, or the detection rule, cannot be pushed back to Elasticsearch because no API exists to change them on an existing alert. Editing those fields in Cortex XSOAR updates the local incident only, and an error is written to the log explaining that nothing was mirrored out. These fields are still mirrored in (from Elasticsearch to Cortex XSOAR).

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

es-search

Queries an index.

Base Command

es-search

Input

Argument Name Description Required
index The index in which to perform a search. Required
query The string to query (in Lucene syntax). Possible values are: . Optional
fields A comma-separated list of document fields to fetch. If empty, the entire document is fetched. Optional
explain Calculates an explanation of a score for a query. For example, “value:1.6943597”. Possible values are: true, false. Default is false. Optional
page The page number from which to start a search. Default is 0. Optional
size The number of documents displayed per page. Can be an integer between “1” and “10,000”. Default is 100. Optional
sort-field The field by which to sort the results table. The supported result types are boolean, numeric, date, and keyword fields. Keyword fields require the doc_values parameter to be set to “true” from the Elasticsearch server. Possible values are: . Optional
sort-order The order by which to sort the results table. The results tables can only be sorted if a sort-field is defined. Possible values are: asc, desc. Default is asc. Optional
query_dsl Will overwrite the ‘query’ arguments. Optional
timestamp_range_start The starting time of the time range. Optional
timestamp_range_end The ending time of the time range. Optional
timestamp_field Timestamp field name. Default is @timestamp. Optional

Context Output

Path Type Description
Elasticsearch.Search.Results._index String The index to which the document belongs.
Elasticsearch.Search.Results._id String The ID of the document.
Elasticsearch.Search.Results._type String The mapping type of the document.
Elasticsearch.Search.max_score Number The maximum relevance score of a query.
Elasticsearch.Search.Query String The query performed in the search.
Elasticsearch.Search.total.value Number The number of search results.
Elasticsearch.Search.Results._score Number The relevance score of the search result.
Elasticsearch.Search.Index String The index in which the search was performed.
Elasticsearch.Search.Server String The server on which the search was performed.
Elasticsearch.Search.timed_out Boolean Whether the search stopped due to a timeout.
Elasticsearch.Search.took Number The time in milliseconds taken for the search to complete.
Elasticsearch.Search.Page Number The page number from which the search started.
Elasticsearch.Search.Size Number The maximum number of scores that a search can return.

search

Searches an index.

Base Command

search

Input

Argument Name Description Required
index The index in which to perform a search. Required
query The string to query (in Lucene syntax). Possible values are: . Optional
fields A comma-separated list of document fields to fetch. If empty, fetches the entire document. Optional
explain Calculates an explanation of a score for a query. For example, “value:1.6943597”. Possible values are: true, false. Default is false. Optional
page The page number from which to start a search. Default is 0. Optional
size The number of documents displayed per page. Can be an integer between “1” and “10,000”. Default is 100. Optional
sort-field The field by which to sort the results table. The supported result types are boolean, numeric, date, and keyword fields. Keyword fields require the doc_values parameter to be set to “true” from the Elasticsearch server. Possible values are: . Optional
sort-order The order by which to sort the results table. The results tables can only be sorted if a sort-field is defined. Possible values are: asc, desc. Default is asc. Optional
timestamp_field Timestamp field name. Default is @timestamp. Optional

Context Output

Path Type Description
Elasticsearch.Search.Results._index String The index to which the document belongs.
Elasticsearch.Search.Results._id String The ID of the document.
Elasticsearch.Search.Results._type String The mapping type of the document.
Elasticsearch.Search.max_score Number The maximum relevance score of a query.
Elasticsearch.Search.Query String The query performed in the search.
Elasticsearch.Search.total.value Number The number of search results.
Elasticsearch.Search.Results._score Number The relevance score of the search result.
Elasticsearch.Search.Index String The index in which the search was performed.
Elasticsearch.Search.Server String The server on which the search was performed.
Elasticsearch.Search.timed_out Boolean Whether the search stopped due to a time out.
Elasticsearch.Search.took Number The time in milliseconds taken for the search to complete.
Elasticsearch.Search.Page Number The page number from which the search started.
Elasticsearch.Search.Size Number The maximum number of scores that a search can return.

get-mapping-fields

Returns the schema of the index to fetch from. This commmand should be used for debugging purposes.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

es-eql-search

Search using EQL query

Base Command

es-eql-search

Input

Argument Name Description Required
index The index in which to perform a search. Required
query The string to query (in Lucene syntax). Required
fields A comma-separated list of document fields to fetch. If empty, fetches the entire document. Optional
sort-tiebreaker If two or more events share the same timestamp, Elasticsearch uses a tiebreaker field value to sort the events in ascending order. Optional
filter Filter using query DSL. Optional
event_category_field The event category field. Default is event.category. Optional
size The number of documents displayed per page. Can be an integer between “1” and “10,000”. Default is 100. Optional
timestamp_range_start The starting time of the time range. Optional
timestamp_range_end The ending time of the time range. Optional
timestamp_field Timestamp field name. Default is @timestamp. Optional

Context Output

Path Type Description
Elasticsearch.Search.Results._index String The index to which the document belongs.
Elasticsearch.Search.Results._id String The ID of the document.
Elasticsearch.Search.Results._type String The mapping type of the document.
Elasticsearch.Search.max_score Number The maximum relevance score of a query.
Elasticsearch.Search.Query String The query performed in the search.
Elasticsearch.Search.total.value Number The number of search results.
Elasticsearch.Search.Results._score Number The relevance score of the search result.
Elasticsearch.Search.Index String The index in which the search was performed.
Elasticsearch.Search.Server String The server on which the search was performed.
Elasticsearch.Search.timed_out Boolean Whether the search stopped due to a timeout.
Elasticsearch.Search.took Number The time in milliseconds taken for the search to complete.
Elasticsearch.Search.Page Number The page number from which the search started.
Elasticsearch.Search.Size Number The maximum number of scores that a search can return.

es-index

Indexes a document into an Elasticsearch index.

Base Command

es-index

Input

Argument Name Description Required
index_name The name of the index to ingest into. Required
document The document object (JSON format) to be indexed. See Elasticsearch documentation for further information about indexing documents via the Elasticsearch client. Required
id The ID of the indexed document (will be generated if empty). The document will be updated if one with a corresponding ID exists. Optional

Context Output

Path Type Description
Elasticsearch.Index.id String The ID of the indexed document.
Elasticsearch.Index.index String The name of the index which the document was ingested to.
Elasticsearch.Index.version Number The version number of the indexed document.
Elasticsearch.Index.result String The result of the index operation.

Command Example

!es-index index_name=test-xsoar document="{\"name\":\"test\"}" id=1234

Context Example

{
    "Elasticsearch": {
        "Index": {
            "id": "1234",
            "index": "test-xsoar",
            "version": 1,
            "result": "created"
        }
    }
}

Human Readable Output

Indexed document

ID Index name Version Result
1234 test-xsoar 1 created

es-integration-health-check

Returns the health status of the integration. This commmand should be used for debugging purposes.

Base Command

es-integration-health-check

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

es-get-indices-statistics

Returns Elasticsearch indices statistics and information. This command is not supported for client type OpenSearch.

Base Command

es-get-indices-statistics

Input

Argument Name Description Required
limit The maximum number of indices to return. Default is 50. Optional
all_results Whether to retrieve all the Elasticsearch indices. If true, the “limit” argument will be ignored. Optional

Context Output

Path Type Description
Elasticsearch.IndexStatistics.Name String The name of the index.
Elasticsearch.IndexStatistics.Status String The status of the index.
Elasticsearch.IndexStatistics.Health String The health status of the index.
Elasticsearch.IndexStatistics.UUID String The UUID of the index.
Elasticsearch.IndexStatistics.DocumentsCount Number The number of documents that are indexed in the index.
Elasticsearch.IndexStatistics.DocumentsDeleted Number The number of documents that were deleted from the index.

es-esql-search

Search using ES|QL query (Elasticsearch 8.11 and above).

Base Command

es-esql-search

Input

Argument Name Description Required  
query The ES|QL query string to execute using piped syntax (for example, FROM index WHERE field == “value”). Required
limit Maximum number of results to return. Optional  

Context Output

Path Description Type
Elasticsearch.ESQLSearch ES|QL search result unknown

Command Example

!es-esql-search query="FROM logs-* | WHERE host.name == \"web-01\" | LIMIT 5"

Context Example

{
    "Elasticsearch": {
        "ESQLSearch": [
            {
                "@timestamp": "2024-01-15T10:23:45.000Z",
                "host.name": "web-01",
                "message": "Connection established"
            }
        ]
    }
}

Human Readable Output

Search query

Query Total
FROM logs-* | WHERE host.name == “web-01” | LIMIT 5 1

Results

@timestamp host.name message
2024-01-15T10:23:45.000Z web-01 Connection established

es-kibana-alerting-health-get

Retrieves the health of the Kibana alerting framework.

Base Command

es-kibana-alerting-health-get

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.AlertingHealth.is_sufficiently_secure Boolean Whether the alerting framework is sufficiently secure.
Elasticsearch.Kibana.AlertingHealth.has_permanent_encryption_key Boolean Whether a permanent encryption key is configured.
Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.decryption_health.status String The decryption health status.
Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.execution_health.status String The execution health status.
Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.read_health.status String The read health status.

Command Example


#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "AlertingHealth": {
                "is_sufficiently_secure": true,
                "has_permanent_encryption_key": true,
                "alerting_framework_health": {
                    "decryption_health": {"status": "ok"},
                    "execution_health": {"status": "ok"},
                    "read_health": {"status": "ok"}
                }
            }
        }
    }
}

Human Readable Output

Kibana Alerting Framework Health

Is sufficiently secure Has permanent encryption key Decryption status Execution status Read status
true true ok ok ok

es-kibana-rule-types-list

Retrieves all rule types available in Kibana.

Base Command

es-kibana-rule-types-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.RuleType.id String The rule type ID.
Elasticsearch.Kibana.RuleType.name String The rule type name.
Elasticsearch.Kibana.RuleType.category String The rule type category.
Elasticsearch.Kibana.RuleType.producer String The rule type producer.
Elasticsearch.Kibana.RuleType.action_groups.id String The action group ID.

Command Example


#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "RuleType": [
                {
                    "id": ".index-threshold",
                    "name": "Index threshold",
                    "category": "management",
                    "producer": "stackAlerts",
                    "action_groups": [{"id": "threshold met"}, {"id": "recovered"}]
                }
            ]
        }
    }
}

Human Readable Output

Kibana Rule Types

Rule type ID Name Category Producer Action Group Id
.index-threshold Index threshold management stackAlerts threshold met, recovered

es-kibana-rule-list

Retrieves information about rules.

Base Command

es-kibana-rule-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
rule_id The identifier for the rule. Optional
search An Elasticsearch simple_query_string query that filters the objects in the response. Optional
default_search_operator The default operator to use for the simple_query_string. Optional
search_fields The fields to perform the simple_query_string parsed query against. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
has_reference_id Filters the rules that have a relation with the reference objects with a specific identifier. Optional
has_reference_type Filters the rules that have a relation with the reference objects with a specific type. Optional
fields The fields to return in the attributes key of the response. Optional
filter A KQL string that you filter with an attribute from your saved object. Optional
filter_consumers List of consumers to filter. Optional
page The page number from which to start a search. Optional
size The number of rules to return per page. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Rule.id String The rule ID.
Elasticsearch.Kibana.Rule.enabled Boolean Whether the rule is enabled.
Elasticsearch.Kibana.Rule.name String The rule name.
Elasticsearch.Kibana.Rule.rule_type_id String The rule type ID.
Elasticsearch.Kibana.Rule.created_at Date The creation date of the rule.

Command Example

!es-kibana-rule-list rule_id="1234"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Rule": {
                "id": "1234",
                "enabled": true,
                "name": "CPU threshold alert",
                "rule_type_id": ".index-threshold",
                "created_at": "2024-01-10T08:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Rules

Rule ID Enabled Name Type ID Creation date
1234 true CPU threshold alert .index-threshold 2024-01-10T08:00:00.000Z

es-kibana-rule-enable

Enable a rule.

Base Command

es-kibana-rule-enable

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
rule_id The identifier for the rule. Required

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-enable rule_id="1234"

Context Example

{}

Human Readable Output

The rule 1234 has been successfully enabled.

es-kibana-rule-disable

Disable a rule.

Base Command

es-kibana-rule-disable

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
rule_id The identifier for the rule. Required

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-disable rule_id="1234"

Context Example

{}

Human Readable Output

The rule 1234 has been successfully disabled.

es-kibana-rule-update

Update a rule.

Base Command

es-kibana-rule-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
rule_id The identifier for the rule. Required
alert_delay_active The number of consecutive runs that must meet the rule conditions. Optional
artifacts_dashboards_id Not more than 10 elements. Optional
artifacts_investigation_guide_blob Maximum length is 10000. Optional
consumer The name of the application or feature that owns the rule. Optional
enabled Indicates whether you want the rule to run on an interval basis after it is created. Optional
flapping_enabled Determines whether the rule can enter the flapping state. Optional
flapping_look_back_window The minimum number of runs in which the threshold must be met. Minimum value is 2, maximum value is 20. Optional
flapping_status_change_threshold The minimum number of times an alert must switch states within the defined look back window time. Optional
name The name of the rule. Optional
notify_when Indicates how frequently rule actions are triggered. Optional
schedule_interval The interval is specified in seconds, minutes, hours, or days. Optional
tags The tags for the rule. Optional
entry_id Entry ID for the file containing the request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Rule.id String The rule ID.

Command Example

!es-kibana-rule-update rule_id="1234" name="Updated CPU alert" schedule_interval="5m"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Rule": {
                "id": "1234",
                "name": "Updated CPU alert",
                "enabled": true,
                "rule_type_id": ".index-threshold",
                "created_at": "2024-01-10T08:00:00.000Z"
            }
        }
    }
}

Human Readable Output

The rule 1234 has been successfully changed.

Rule ID Changed fields
1234 name, schedule

es-kibana-rule-alert-mute

Mute an alert, or mute all alerts for a rule.

Base Command

es-kibana-rule-alert-mute

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
rule_id The identifier for the rule. Required
alert_id The identifier for the alert. Optional
validate_alerts_existence Whether to validate the existence of the alert. Optional
mute_all Whether to mute all alerts. Optional

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-alert-mute rule_id="1234" mute_all="true"

Context Example

{}

Human Readable Output

The alerts have been successfully muted.

es-kibana-rule-alert-unmute

Unmute an alert, or unmute all alerts for a rule.

Base Command

es-kibana-rule-alert-unmute

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
rule_id The identifier for the rule. Required
alert_id The identifier for the alert. Optional
unmute_all Whether to unmute all alerts. Optional

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-alert-unmute rule_id="1234" unmute_all="true"

Context Example

{}

Human Readable Output

The alerts have been successfully unmuted.

es-kibana-detection-alert-status-set

Set the status of one or more detection alerts.

Base Command

es-kibana-detection-alert-status-set

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
status The new status of the detection alert(s). Required
signal_ids List of alert IDs. Use field _id on alert document or kibana.alert.uuid. Optional
query An Elasticsearch query used to select which alerts to update, as an alternative to signal_ids. Optional
reason The reason for the status change. Optional
conflicts Determines how version conflicts should be handled. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.SecurityAlertSetStatus.total Number The total number of alerts matched by the request.
Elasticsearch.Kibana.SecurityAlertSetStatus.updated Number The number of alerts that were updated.

Command Example

!es-kibana-detection-alert-status-set status="closed" signal_ids="1234,5678"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "SecurityAlertSetStatus": {
                "total": 2,
                "updated": 2
            }
        }
    }
}

Human Readable Output

Kibana Detection Alert Status Update

Total Updated
2 2

es-kibana-case-create

Creates a new case in Kibana.

Base Command

es-kibana-case-create

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
assignee_uid An array containing users that are assigned to the case. Not more than 10 elements. Optional
category A word or phrase that categorizes the case. Maximum length is 50. Optional
connector_fields A JSON object containing the connector fields. To create a case without a connector, specify null. Optional
connector_id The identifier for the connector. To create a case without a connector, use none. Optional
connector_name The name of the connector. To create a case without a connector, use none. Optional
connector_type The type of connector. To create a case without a connector, use none. Optional
connector_fields_issue_type_jira The type of issue. Optional
connector_fields_parent_jira The key of the parent issue, when the issue type is sub-task. Optional
connector_fields_priority_jira The priority of the issue. Optional
connector_fields_issue_types_resilient The type of incident. Optional
connector_fields_severity_code_resilient The severity code of the incident. Optional
connector_fields_category_servicenow The category of the incident. Optional
connector_fields_impact_servicenow The effect an incident had on business. Optional
connector_fields_severity_servicenow The severity of the incident. Optional
connector_fields_subcategory_servicenow The subcategory of the incident. Optional
connector_fields_urgency_servicenow The extent to which the incident resolution can be delayed. Optional
connector_fields_dest_ip_servicenow Indicates whether cases will send a comma-separated list of destination IPs. Optional
connector_fields_malware_hash_servicenow Indicates whether cases will send a comma-separated list of malware hashes. Optional
connector_fields_malware_url_servicenow Indicates whether cases will send a comma-separated list of malware URLs. Optional
connector_fields_priority_servicenow The priority of the issue. Optional
connector_fields_source_ip_servicenow Indicates whether cases will send a comma-separated list of source IPs. Optional
connector_fields_case_id_swimlane The case identifier for Swimlane connectors. Optional
custom_key The unique identifier for the custom field. The key value must exist in the case configuration settings. Optional
custom_type The custom field type. It must match the type specified in the case configuration settings. Optional
custom_value The custom field value (string or boolean). Optional
description The description for the case. Maximum length is 30000. Optional
owner The application that owns the cases: Stack Management, Observability, or Elastic Security. Required
extract_observables When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional
sync_alerts Turns alert syncing on or off. Optional
severity The severity of the case. Optional
tags The words and phrases that help categorize cases. Not more than 200 elements. Optional
title A title for the case. Maximum length is 160. Optional
entry_id Entry ID for the file containing the full request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.title String The title of the case.
Elasticsearch.Kibana.Case.id String The case ID.
Elasticsearch.Kibana.Case.description String The description of the case.
Elasticsearch.Kibana.Case.owner String The owner of the case.
Elasticsearch.Kibana.Case.severity String The severity of the case.
Elasticsearch.Kibana.Case.status String The status of the case.
Elasticsearch.Kibana.Case.created_at Date The creation date of the case.
Elasticsearch.Kibana.Case.connector.type String The connector type of the case.

Command Example

!es-kibana-case-create owner="securitySolution" title="Suspicious login" description="Multiple failed logins detected" severity="medium"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "title": "Suspicious login",
                "description": "Multiple failed logins detected",
                "owner": "securitySolution",
                "severity": "medium",
                "status": "open",
                "created_at": "2024-01-15T10:00:00.000Z",
                "connector": {"type": ".none"}
            }
        }
    }
}

Human Readable Output

Kibana Case

Title ID Description Owner Severity Status Created at Connector type
Suspicious login 1234 Multiple failed logins detected securitySolution medium open 2024-01-15T10:00:00.000Z .none

es-kibana-case-update

Update cases in Kibana.

Base Command

es-kibana-case-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. Required
version The current version of the case. To determine this value, use es-kibana-case-list. Required
assignee_uid An array containing users that are assigned to the case. Not more than 10 elements. Optional
category A word or phrase that categorizes the case. Maximum length is 50. Optional
close_reason The close reason to sync to attached alerts when closing the case. Optional
connector_fields A JSON object containing the connector fields. To remove a connector, specify null. Optional
connector_id The identifier for the connector. To remove a connector, specify none. Optional
connector_name The name of the connector. To remove a connector, specify none. Optional
connector_type The type of connector. To remove a connector, specify none. Optional
connector_fields_issue_type_jira The type of issue. Optional
connector_fields_parent_jira The key of the parent issue, when the issue type is sub-task. Optional
connector_fields_priority_jira The priority of the issue. Optional
connector_fields_issue_types_resilient The type of incident. Optional
connector_fields_severity_code_resilient The severity code of the incident. Optional
connector_fields_category_servicenow The category of the incident. Optional
connector_fields_impact_servicenow The effect an incident had on business. Optional
connector_fields_severity_servicenow The severity of the incident. Optional
connector_fields_subcategory_servicenow The subcategory of the incident. Optional
connector_fields_urgency_servicenow The extent to which the incident resolution can be delayed. Optional
connector_fields_dest_ip_servicenow Indicates whether cases will send a comma-separated list of destination IPs. Optional
connector_fields_malware_hash_servicenow Indicates whether cases will send a comma-separated list of malware hashes. Optional
connector_fields_malware_url_servicenow Indicates whether cases will send a comma-separated list of malware URLs. Optional
connector_fields_priority_servicenow The priority of the issue. Optional
connector_fields_source_ip_servicenow Indicates whether cases will send a comma-separated list of source IPs. Optional
connector_fields_case_id_swimlane The case identifier for Swimlane connectors. Optional
custom_key The unique identifier for the custom field. The key value must exist in the case configuration settings. Optional
custom_type The custom field type. It must match the type specified in the case configuration settings. Optional
custom_value The custom field value (string or boolean). Optional
description The description for the case. Maximum length is 30000. Optional
extract_observables When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional
sync_alerts Turns alert syncing on or off. Optional
severity The severity of the case. Optional
status The status of the case. Optional
tags The words and phrases that help categorize cases. Not more than 200 elements. Optional
title A title for the case. Maximum length is 160. Optional
entry_id Entry ID for the file containing the request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.title String The title of the case.
Elasticsearch.Kibana.Case.id String The case ID.
Elasticsearch.Kibana.Case.description String The description of the case.
Elasticsearch.Kibana.Case.owner String The owner of the case.
Elasticsearch.Kibana.Case.severity String The severity of the case.
Elasticsearch.Kibana.Case.status String The status of the case.
Elasticsearch.Kibana.Case.created_at Date The creation date of the case.
Elasticsearch.Kibana.Case.connector.type String The connector type of the case.

Command Example

!es-kibana-case-update case_id="1234" version="WzEsMV0=" title="Suspicious login - updated" severity="high"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "title": "Suspicious login - updated",
                "description": "Multiple failed logins detected",
                "owner": "securitySolution",
                "severity": "high",
                "status": "open",
                "created_at": "2024-01-15T10:00:00.000Z",
                "connector": {"type": ".none"}
            }
        }
    }
}

Human Readable Output

Kibana Case(s) Updated

Title ID Description Owner Severity Status Created at Connector type
Suspicious login - updated 1234 Multiple failed logins detected securitySolution high open 2024-01-15T10:00:00.000Z .none

es-kibana-case-delete

Deletes one or more cases by ID.

Base Command

es-kibana-case-delete

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The cases that you want to remove. To get the case identifiers, use es-kibana-case-list. Required

Context Output

There is no context output for this command.

Command Example

!es-kibana-case-delete case_id="1234"

Context Example

{}

Human Readable Output

The cases 1234 have been successfully deleted.

es-kibana-case-list

Retrieves the details of Kibana cases.

Base Command

es-kibana-case-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. To retrieve case IDs, use the search cases API (leave empty). Optional
assignees Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles. Optional
category Filters the returned cases by category. Optional
default_search_operator The default operator to use for the simple_query_string. Optional
search An Elasticsearch simple_query_string query that filters the objects in the response. Optional
from Returns only cases that were created after a specific date (KQL data range or date match expression). Optional
to Returns only cases that were created before a specific date (KQL data range or date match expression). Optional
owner A filter to limit the response to a specific set of applications. Optional
reporters Filters the returned cases by the user name of the reporter. Optional
search_fields The fields to perform the simple_query_string parsed query against. Optional
severity The severity of the case. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
status Filters the returned cases by state. Optional
tags Filters the returned cases by tags. Optional
page The page number from which to start a search. Optional
size The number of items to return. Limited to 100 items. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.title String The title of the case.
Elasticsearch.Kibana.Case.id String The case ID.
Elasticsearch.Kibana.Case.description String The description of the case.
Elasticsearch.Kibana.Case.owner String The owner of the case.
Elasticsearch.Kibana.Case.severity String The severity of the case.
Elasticsearch.Kibana.Case.status String The status of the case.
Elasticsearch.Kibana.Case.created_at Date The creation date of the case.
Elasticsearch.Kibana.Case.connector.type String The connector type of the case.

Command Example


#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "Case": [
                {
                    "id": "1234",
                    "title": "Suspicious login",
                    "description": "Multiple failed logins detected",
                    "owner": "securitySolution",
                    "severity": "medium",
                    "status": "open",
                    "created_at": "2024-01-15T10:00:00.000Z",
                    "connector": {"type": ".none"}
                }
            ]
        }
    }
}

Human Readable Output

Kibana Cases

Title ID Description Owner Severity Status Created at Connector type
Suspicious login 1234 Multiple failed logins detected securitySolution medium open 2024-01-15T10:00:00.000Z .none

es-kibana-case-alerts-list

Retrieves all alerts for a case.

Base Command

es-kibana-case-alerts-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. To retrieve case IDs, use es-kibana-case-list. Required
limit Limit on the number of keys to return. Optional
offset Starting record index to begin retrieving records from. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.Alert.id String The alert ID.
Elasticsearch.Kibana.Case.Alert.index String The alert index.
Elasticsearch.Kibana.Case.Alert.attached_at Date The date the alert was attached to the case.

Command Example

!es-kibana-case-alerts-list case_id="1234"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "1234": {
                    "Alert": [
                        {
                            "id": "5678",
                            "index": ".alerts-security.alerts-default",
                            "attached_at": "2024-01-15T11:00:00.000Z"
                        }
                    ]
                }
            }
        }
    }
}

Human Readable Output

Alerts for Case 1234

Case id Attached at Alert id Index
1234 2024-01-15T11:00:00.000Z 5678 .alerts-security.alerts-default

es-kibana-case-comment-add

Add a case comment or alert.

Base Command

es-kibana-case-comment-add

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. To retrieve case IDs, use es-kibana-case-list. Required
alert_id The alert identifiers. Required only when type is alert. Optional
index The alert indices. Required only when type is alert. Optional
owner The application that owns the cases: Stack Management, Observability, or Elastic Security. Required
rule_id The rule identifier. Optional
rule_name The rule name. Optional
type The type of comment. Required
comment The new comment. Required only when type is user. Maximum length is 30000. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.id String The case ID.
Elasticsearch.Kibana.Case.comments.comment String The comment text.
Elasticsearch.Kibana.Case.comments.created_by.username String The user who created the comment.

Command Example

!es-kibana-case-comment-add case_id="1234" type="user" owner="securitySolution" comment="Investigated and confirmed malicious activity."

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "comments": [
                    {
                        "comment": "Investigated and confirmed malicious activity.",
                        "created_by": {"username": "analyst"}
                    }
                ]
            }
        }
    }
}

Human Readable Output

Kibana Case Comment Added

Case id Comment Created by
1234 Investigated and confirmed malicious activity. analyst

es-kibana-case-comment-update

Update a case comment or alert.

Base Command

es-kibana-case-comment-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. To retrieve case IDs, use es-kibana-case-list. Required
comment_id The identifier for the comment. Optional
comment The new comment. Required only when type is user. Maximum length is 30000. Optional
alert_id The alert identifiers. Required only when type is alert. Optional
index The alert indices. Required only when type is alert. Optional
owner The application that owns the cases: Stack Management, Observability, or Elastic Security. Required
rule_id The rule identifier. Optional
rule_name The rule name. Optional
type The type of comment. Required
version The current comment version. To retrieve version values, use the get comments API. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.id String The case ID.
Elasticsearch.Kibana.Case.comments.comment String The comment text.
Elasticsearch.Kibana.Case.comments.updated_by.username String The user who updated the comment.
Elasticsearch.Kibana.Case.comments.updated_at Date The date the comment was updated.

Command Example

!es-kibana-case-comment-update case_id="1234" comment_id="5678" type="user" owner="securitySolution" comment="Updated: confirmed false positive." version="WzEsMV0="

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "comments": [
                    {
                        "id": "5678",
                        "comment": "Updated: confirmed false positive.",
                        "updated_by": {"username": "analyst"},
                        "updated_at": "2024-01-15T12:00:00.000Z"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Kibana Case Comment Updated

Case id Comment Updated by Updated at
1234 Updated: confirmed false positive. analyst 2024-01-15T12:00:00.000Z

es-kibana-case-comment-delete

Deletes all comments and alerts from a case.

Base Command

es-kibana-case-comment-delete

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. To retrieve case IDs, use es-kibana-case-list. Required

Context Output

There is no context output for this command.

Command Example

!es-kibana-case-comment-delete case_id="1234"

Context Example

{}

Human Readable Output

The comments and alerts for the case 1234 have been successfully deleted.

es-kibana-case-file-attach

Attach a file to a case.

Base Command

es-kibana-case-file-attach

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
case_id The identifier for the case. To retrieve case IDs, use es-kibana-case-list. Required
entry_id Entry ID for the file that needs to be attached. Required
file_name The desired name of the file being attached to the case (without file extension). Optional

Context Output

Path Type Description
Elasticsearch.Kibana.Case.id String The case ID.
Elasticsearch.Kibana.Case.comments.updated_by.username String The user who attached the file.

Command Example

!es-kibana-case-file-attach case_id="1234" entry_id="1@1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "comments": [
                    {
                        "updated_by": {"username": "analyst"}
                    }
                ]
            }
        }
    }
}

Human Readable Output

File successfully attached to case 1234.

es-kibana-endpoint-exception-list-item-create

Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.

Base Command

es-kibana-endpoint-exception-list-item-create

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
description Describes the exception list. Optional
entries_field A string that does not contain only whitespace characters. Optional
entries_list_id Value list’s identifier. Optional
entries_list_type Specifies the Elasticsearch data type of excludes the list container holds. Optional
entries_operator The exception item entry operator. Optional
entries_type The exception item entry type. Optional
item_id Human readable string identifier, e.g. trusted-linux-processes. Optional
meta Additional properties are allowed (JSON object). Optional
name Exception list name. Minimum length is 1. Optional
os_types Use this field to specify the operating system. Optional
tags String array containing words and phrases to help categorize exception items. Optional
entry_id Entry ID for the file containing the full request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.EndpointExceptionListItem.id String The exception list item ID.
Elasticsearch.Kibana.EndpointExceptionListItem.item_id String The exception list item human-readable ID.
Elasticsearch.Kibana.EndpointExceptionListItem.list_id String The exception list ID.
Elasticsearch.Kibana.EndpointExceptionListItem.name String The exception list item name.
Elasticsearch.Kibana.EndpointExceptionListItem.description String The exception list item description.
Elasticsearch.Kibana.EndpointExceptionListItem.created_at Date The creation date of the exception list item.

Command Example

!es-kibana-endpoint-exception-list-item-create name="Trusted process" description="Allow known safe process" entries_field="process.name" entries_type="match" entries_operator="included" entries_value="safe_process.exe" os_types="windows"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "EndpointExceptionListItem": {
                "id": "1234",
                "item_id": "trusted-process-1",
                "list_id": "endpoint_list",
                "name": "Trusted process",
                "description": "Allow known safe process",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Endpoint Exception List Item

ID Item ID List ID Name Description Creation date
1234 trusted-process-1 endpoint_list Trusted process Allow known safe process 2024-01-15T10:00:00.000Z

es-kibana-endpoint-exception-list-item-update

Update an Elastic Endpoint exception list item.

Base Command

es-kibana-endpoint-exception-list-item-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
exception_list_item_id Exception’s identifier. Optional
item_id Human readable string identifier, e.g. trusted-linux-processes. Optional
_version The version id, normally returned by the API when the item is retrieved. Optional
description Describes the exception list. Optional
entries_field A string that does not contain only whitespace characters. Optional
entries_list_id Value list’s identifier. Optional
entries_list_type Specifies the Elasticsearch data type of excludes the list container holds. Optional
entries_operator The exception item entry operator. Optional
entries_type The exception item entry type. Optional
entries_value A string that does not contain only whitespace characters. Optional
meta Additional properties are allowed (JSON object). Optional
name Exception list name. Minimum length is 1. Optional
os_types Use this field to specify the operating system. Optional
tags String array containing words and phrases to help categorize exception items. Optional
entry_id Entry ID for the file containing the full request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.EndpointExceptionListItem.id String The exception list item ID.
Elasticsearch.Kibana.EndpointExceptionListItem.item_id String The exception list item human-readable ID.
Elasticsearch.Kibana.EndpointExceptionListItem.list_id String The exception list ID.
Elasticsearch.Kibana.EndpointExceptionListItem.name String The exception list item name.
Elasticsearch.Kibana.EndpointExceptionListItem.description String The exception list item description.
Elasticsearch.Kibana.EndpointExceptionListItem.created_at Date The creation date of the exception list item.

Command Example

!es-kibana-endpoint-exception-list-item-update item_id="trusted-process-1" name="Trusted process updated" description="Updated description" entries_field="process.name" entries_type="match" entries_operator="included" entries_value="safe_process.exe"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "EndpointExceptionListItem": {
                "id": "1234",
                "item_id": "trusted-process-1",
                "list_id": "endpoint_list",
                "name": "Trusted process updated",
                "description": "Updated description",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Endpoint Exception List Item

ID Item ID List ID Name Description Creation date
1234 trusted-process-1 endpoint_list Trusted process updated Updated description 2024-01-15T10:00:00.000Z

es-kibana-endpoint-exception-list-item-delete

Delete an Elastic Endpoint exception list item.

Base Command

es-kibana-endpoint-exception-list-item-delete

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
item_id Either id or item_id must be specified. Required

Context Output

There is no context output for this command.

Command Example

!es-kibana-endpoint-exception-list-item-delete item_id="trusted-process-1"

Context Example

{}

Human Readable Output

The item trusted-process-1 has been successfully deleted.

es-kibana-endpoint-exception-list-item-list

Retrieves Elastic Endpoint exception list items.

Base Command

es-kibana-endpoint-exception-list-item-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
filter Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax. Optional
item_id Either id or item_id must be specified. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
page The page number to return. Minimum value is 0. Optional
size The number of exception list items to return per page. Minimum value is 0. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.EndpointExceptionListItem.id String The exception list item ID.
Elasticsearch.Kibana.EndpointExceptionListItem.item_id String The exception list item human-readable ID.
Elasticsearch.Kibana.EndpointExceptionListItem.list_id String The exception list ID.
Elasticsearch.Kibana.EndpointExceptionListItem.name String The exception list item name.
Elasticsearch.Kibana.EndpointExceptionListItem.description String The exception list item description.
Elasticsearch.Kibana.EndpointExceptionListItem.created_at Date The creation date of the exception list item.

Command Example


#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "EndpointExceptionListItem": [
                {
                    "id": "1234",
                    "item_id": "trusted-process-1",
                    "list_id": "endpoint_list",
                    "name": "Trusted process",
                    "description": "Allow known safe process",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Endpoint Exception List Items

ID Item ID List ID Name Description Creation date
1234 trusted-process-1 endpoint_list Trusted process Allow known safe process 2024-01-15T10:00:00.000Z

es-kibana-exception-list-list

Get a list of all exception list containers.

Base Command

es-kibana-exception-list-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
exception_list_id Exception list’s identifier. Either id or list_id must be specified. Optional
list_id Human readable exception list string identifier. Either id or list_id must be specified. Optional
filter Filters the returned results according to the value of the specified field. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
page The page number to return. Minimum value is 1. Optional
size The number of exception lists to return per page. Minimum value is 1. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ExceptionList.id String The exception list ID.
Elasticsearch.Kibana.ExceptionList.list_id String The human-readable exception list ID.
Elasticsearch.Kibana.ExceptionList.name String The exception list name.
Elasticsearch.Kibana.ExceptionList.description String The exception list description.
Elasticsearch.Kibana.ExceptionList.created_at Date The creation date of the exception list.

Command Example


#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionList": [
                {
                    "id": "1234",
                    "list_id": "my-exception-list",
                    "name": "My Exception List",
                    "description": "Exceptions for trusted processes",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Exception Lists

Exception list ID List ID Name Description Creation date
1234 my-exception-list My Exception List Exceptions for trusted processes 2024-01-15T10:00:00.000Z

es-kibana-exception-list-create

Create an exception list.

Base Command

es-kibana-exception-list-create

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
description Describes the exception list. Optional
list_id The exception list’s human-readable string identifier. Optional
meta Placeholder for metadata about the list container (JSON object). Optional
name The name of the exception list. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional
os_types Use this field to specify the operating system. Only enter one value. Optional
tags String array containing words and phrases to help categorize exception containers. Optional
type The type of exception list to be created. Required
version The document version automatically increased on updates. Optional
entry_id Entry ID for the file containing the request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ExceptionList.id String The exception list ID.
Elasticsearch.Kibana.ExceptionList.list_id String The human-readable exception list ID.
Elasticsearch.Kibana.ExceptionList.name String The exception list name.
Elasticsearch.Kibana.ExceptionList.description String The exception list description.
Elasticsearch.Kibana.ExceptionList.created_at Date The creation date of the exception list.

Command Example

!es-kibana-exception-list-create type="detection" name="My Exception List" description="Exceptions for trusted processes" list_id="my-exception-list"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionList": {
                "id": "1234",
                "list_id": "my-exception-list",
                "name": "My Exception List",
                "description": "Exceptions for trusted processes",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List

Exception list ID List ID Name Description Creation date
1234 my-exception-list My Exception List Exceptions for trusted processes 2024-01-15T10:00:00.000Z

es-kibana-exception-list-update

Updates an existing exception list.

Base Command

es-kibana-exception-list-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
_version The version id, normally returned by the API when the item was retrieved. Optional
description Describes the exception list. Required
exception_list_id Exception list’s identifier. Optional
list_id The exception list’s human-readable string identifier. Optional
meta Placeholder for metadata about the list container (JSON object). Optional
name The name of the exception list. Required
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional
os_types Use this field to specify the operating system. Only enter one value. Optional
tags String array containing words and phrases to help categorize exception containers. Optional
type The type of exception list to be created. Required
version The document version automatically increased on updates. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ExceptionList.id String The exception list ID.
Elasticsearch.Kibana.ExceptionList.list_id String The human-readable exception list ID.
Elasticsearch.Kibana.ExceptionList.name String The exception list name.
Elasticsearch.Kibana.ExceptionList.description String The exception list description.
Elasticsearch.Kibana.ExceptionList.created_at Date The creation date of the exception list.

Command Example

!es-kibana-exception-list-update exception_list_id="1234" name="My Exception List Updated" description="Updated description" type="detection"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionList": {
                "id": "1234",
                "list_id": "my-exception-list",
                "name": "My Exception List Updated",
                "description": "Updated description",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List

Exception list ID List ID Name Description Creation date
1234 my-exception-list My Exception List Updated Updated description 2024-01-15T10:00:00.000Z

es-kibana-exception-list-delete

Delete an exception list using the id or list_id field.

Base Command

es-kibana-exception-list-delete

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
exception_list_id Exception list’s identifier. Either id or list_id must be specified. Optional
list_id Human readable exception list string identifier. Either id or list_id must be specified. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional

Context Output

There is no context output for this command.

Command Example

!es-kibana-exception-list-delete list_id="my-exception-list"

Context Example

{}

Human Readable Output

The exception list my-exception-list has been successfully deleted.

es-kibana-exception-list-item-list

Get a list of all exception list items in the specified list.

Base Command

es-kibana-exception-list-item-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
exception_list_item_id Exception list item’s identifier. Either id or item_id must be specified. Optional
item_id Human readable exception item string identifier. Either id or item_id must be specified. Optional
exception_list_id The list_ids of the items to fetch. Optional
filter Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional
search Free-text search term applied to exception list item fields. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
page The page number to return. Minimum value is 0. Optional
size The number of exception list items to return per page. Minimum value is 0. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ExceptionListItem.id String The exception list item ID.
Elasticsearch.Kibana.ExceptionListItem.item_id String The exception list item human-readable ID.
Elasticsearch.Kibana.ExceptionListItem.list_id String The exception list ID.
Elasticsearch.Kibana.ExceptionListItem.name String The exception list item name.
Elasticsearch.Kibana.ExceptionListItem.description String The exception list item description.
Elasticsearch.Kibana.ExceptionListItem.created_at Date The creation date of the exception list item.

Command Example

!es-kibana-exception-list-item-list exception_list_id="my-exception-list"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionListItem": [
                {
                    "id": "1234",
                    "item_id": "my-item-1",
                    "list_id": "my-exception-list",
                    "name": "Trusted IP",
                    "description": "Known safe IP address",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Exception List Items

ID Item ID List ID Name Description Creation date
1234 my-item-1 my-exception-list Trusted IP Known safe IP address 2024-01-15T10:00:00.000Z

es-kibana-exception-list-item-create

Create an exception item and associate it with the specified exception list.

Base Command

es-kibana-exception-list-item-create

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
comment A string that does not contain only whitespace characters. Optional
description Describes the exception list. Optional
expire_time The exception item’s expiration date, in ISO format. Optional
item_id Human readable string identifier, e.g. trusted-linux-processes. Optional
meta Additional properties are allowed (JSON object). Optional
name Exception list name. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional
type The type of exception list to be created. Optional
entries_field A string that does not contain only whitespace characters. Optional
entries_operator The exception item entry operator. Optional
entries_type The exception item entry type. Optional
entries_value The exception item entry value. Optional
entries_list_id Value list’s identifier. Optional
entries_list_type Specifies the Elasticsearch data type of excludes the list container holds. Optional
list_id The exception list’s human-readable string identifier. Optional
os_types Use this field to specify the operating system. Only enter one value. Optional
tags String array containing words and phrases to help categorize exception containers. Optional
entry_id Entry ID for the file containing the request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ExceptionListItem.id String The exception list item ID.
Elasticsearch.Kibana.ExceptionListItem.item_id String The exception list item human-readable ID.
Elasticsearch.Kibana.ExceptionListItem.list_id String The exception list ID.
Elasticsearch.Kibana.ExceptionListItem.name String The exception list item name.
Elasticsearch.Kibana.ExceptionListItem.description String The exception list item description.
Elasticsearch.Kibana.ExceptionListItem.created_at Date The creation date of the exception list item.

Command Example

!es-kibana-exception-list-item-create list_id="my-exception-list" name="Trusted IP" description="Known safe IP address" entries_field="source.ip" entries_type="match" entries_operator="included" entries_value="192.168.1.1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionListItem": {
                "id": "1234",
                "item_id": "my-item-1",
                "list_id": "my-exception-list",
                "name": "Trusted IP",
                "description": "Known safe IP address",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List Item

ID Item ID List ID Name Description Creation date
1234 my-item-1 my-exception-list Trusted IP Known safe IP address 2024-01-15T10:00:00.000Z

es-kibana-exception-item-list-update

Updates an existing exception list item.

Base Command

es-kibana-exception-item-list-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
_version The version ID, normally returned by the API when the item is retrieved. Optional
comment A string that does not contain only whitespace characters. Optional
comment_id A string that does not contain only whitespace characters. Optional
description Describes the exception list. Optional
expire_time The exception item’s expiration date, in ISO format. Optional
exception_list_item_id Exception’s identifier. Optional
item_id Human readable string identifier, e.g. trusted-linux-processes. Optional
meta Additional properties are allowed (JSON object). Optional
name Exception list name. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional
type The type of exception list to be created. Optional
entries_field A string that does not contain only whitespace characters. Optional
entries_operator The exception item entry operator. Optional
entries_type The exception item entry type. Optional
entries_value The exception item entry value. Optional
entries_list_id Value list’s identifier. Optional
entries_list_type Specifies the Elasticsearch data type of excludes the list container holds. Optional
list_id The exception list’s human-readable string identifier. Optional
os_types Use this field to specify the operating system. Only enter one value. Optional
tags String array containing words and phrases to help categorize exception containers. Optional
entry_id Entry ID for the file containing the request JSON. If provided, other parameters won’t be considered. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ExceptionListItem.id String The exception list item ID.
Elasticsearch.Kibana.ExceptionListItem.item_id String The exception list item human-readable ID.
Elasticsearch.Kibana.ExceptionListItem.list_id String The exception list ID.
Elasticsearch.Kibana.ExceptionListItem.name String The exception list item name.
Elasticsearch.Kibana.ExceptionListItem.description String The exception list item description.
Elasticsearch.Kibana.ExceptionListItem.updated_at Date The update date of the exception list item.

Command Example

!es-kibana-exception-item-list-update item_id="my-item-1" name="Trusted IP updated" description="Updated safe IP" entries_field="source.ip" entries_type="match" entries_operator="included" entries_value="192.168.1.1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionListItem": {
                "id": "1234",
                "item_id": "my-item-1",
                "list_id": "my-exception-list",
                "name": "Trusted IP updated",
                "description": "Updated safe IP",
                "updated_at": "2024-01-15T12:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List Item Updated

Exception list item ID Item Id List ID Name Description Update date
1234 my-item-1 my-exception-list Trusted IP updated Updated safe IP 2024-01-15T12:00:00.000Z

es-kibana-exception-list-item-delete

Deletes an exception list item.

Base Command

es-kibana-exception-list-item-delete

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
exception_list_item_id Exception list item’s identifier. Either id or item_id must be specified. Optional
item_id Human readable exception item string identifier. Either id or item_id must be specified. Optional
namespace_type Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces. Optional

Context Output

There is no context output for this command.

Command Example

!es-kibana-exception-list-item-delete item_id="my-item-1"

Context Example

{}

Human Readable Output

The exception list item my-item-1 has been successfully deleted.

es-kibana-value-lists-list

Retrieves details of a value list (the list container).

Base Command

es-kibana-value-lists-list

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
value_list_id Value list identifier (id) returned when the list was created. Optional
filter Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax. Optional
cursor Returns the lists that come after the last lists returned in the previous call. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
page The page number to return. Optional
size The number of value lists to return per page. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ValueList.id String The value list ID.
Elasticsearch.Kibana.ValueList.name String The value list name.
Elasticsearch.Kibana.ValueList.description String The value list description.
Elasticsearch.Kibana.ValueList.created_at Date The creation date of the value list.

Command Example


#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "ValueList": [
                {
                    "id": "1234",
                    "name": "trusted-ips",
                    "description": "List of trusted IP addresses",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Value Lists

Value list ID Name Description Creation date
1234 trusted-ips List of trusted IP addresses 2024-01-15T10:00:00.000Z

es-kibana-value-list-item-get

Retrieves value list items.

Base Command

es-kibana-value-list-item-get

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
value_list_item_id Value list item identifier. Required if list_id and value are not specified. Optional
value_list_id Parent value list’s id to page through items for. Optional
value The value used to evaluate exceptions. Required if id is not specified. Optional
filter Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax. Optional
cursor Opaque cursor returned in a previous response; pass it to continue listing from the next page. Optional
sort_field Determines which field is used to sort the results. Optional
sort_order Determines the sort order. Optional
page The page number to return. Optional
size The number of list items to return per page. Optional

Context Output

Path Type Description
Elasticsearch.Kibana.ValueListItem.id String The value list item ID.
Elasticsearch.Kibana.ValueListItem.list_id String The value list ID.
Elasticsearch.Kibana.ValueListItem.name String The value list item name.
Elasticsearch.Kibana.ValueListItem.description String The value list item description.
Elasticsearch.Kibana.ValueListItem.created_at Date The creation date of the value list item.

Command Example

!es-kibana-value-list-item-get value_list_id="1234"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": [
                {
                    "id": "5678",
                    "list_id": "1234",
                    "value": "192.168.1.1",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Value List Items

Value list item ID List ID Value Creation date
5678 1234 192.168.1.1 2024-01-15T10:00:00.000Z

es-kibana-value-list-item-create

Adds a new item to a value list.

Base Command

es-kibana-value-list-item-create

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
value_list_id Value list’s identifier. Required
meta Placeholder for metadata about the value list item (JSON object). Example {“source”:”threatfeed”,”priority”:3,”active”:true}. Optional
refresh Determines when changes made by the request are made visible to search. Optional
value The value used to evaluate exceptions. Required

Context Output

Path Type Description
Elasticsearch.Kibana.ValueListItem.id String The value list item ID.
Elasticsearch.Kibana.ValueListItem.list_id String The value list ID.
Elasticsearch.Kibana.ValueListItem.name String The value list item name.
Elasticsearch.Kibana.ValueListItem.description String The value list item description.
Elasticsearch.Kibana.ValueListItem.created_at Date The creation date of the value list item.

Command Example

!es-kibana-value-list-item-create value_list_id="1234" value="10.0.0.1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": {
                "id": "5678",
                "list_id": "1234",
                "value": "10.0.0.1",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Value List Item

Value list item ID List ID Value Creation date
5678 1234 10.0.0.1 2024-01-15T10:00:00.000Z

es-kibana-value-list-item-update

Updates an existing value list item.

Base Command

es-kibana-value-list-item-update

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
_version The version id, normally returned by the API when the document is retrieved. Optional
value_list_item_id Value list item identifier. Required
meta Placeholder for metadata about the value list item (JSON object). Example {“source”:”threatfeed”,”priority”:3,”active”:true}. Optional
value The value used to evaluate exceptions. Required

Context Output

Path Type Description
Elasticsearch.Kibana.ValueListItem.id String The value list item ID.
Elasticsearch.Kibana.ValueListItem.list_id String The value list ID.
Elasticsearch.Kibana.ValueListItem.name String The value list item name.
Elasticsearch.Kibana.ValueListItem.description String The value list item description.
Elasticsearch.Kibana.ValueListItem.created_at Date The creation date of the value list item.

Command Example

!es-kibana-value-list-item-update value_list_item_id="5678" value="10.0.0.2"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": {
                "id": "5678",
                "list_id": "1234",
                "value": "10.0.0.2",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Value List Item

Value list item ID List ID Value Creation date
5678 1234 10.0.0.2 2024-01-15T10:00:00.000Z

es-kibana-value-list-item-delete

Deletes a value list item.

Base Command

es-kibana-value-list-item-delete

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
value_list_item_id Value list item’s identifier. Required if list_id and value are not specified. Optional
value_list_id Value list’s identifier. Optional
value The value used to evaluate exceptions. Required if id is not specified. Optional
refresh Determines when changes made by the request are made visible to search. Optional

Context Output

There is no context output for this command.

Command Example

!es-kibana-value-list-item-delete value_list_item_id="5678"

Context Example

{}

Human Readable Output

The value list item 5678 has been successfully deleted.

es-kibana-value-list-item-export

Exports all items of a value list as a file (returned to the War Room).

Base Command

es-kibana-value-list-item-export

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
value_list_id Value list’s ID to export. Optional

Context Output

There is no context output for this command.

Command Example

!es-kibana-value-list-item-export value_list_id="1234"

Context Example

{}

Human Readable Output

The value list 1234 has been exported successfully.

es-kibana-value-list-item-import

Import value list items from a TXT or CSV file.

Base Command

es-kibana-value-list-item-import

Input

Argument Name Description Required
space_id Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information. Optional
value_list_id List’s ID to import. Optional
type Type of the importing list. Optional
refresh Determines when changes made by the request are made visible to search. Optional
entry_id Entry ID for the file containing the items to import. Required

Context Output

Path Type Description
Elasticsearch.Kibana.ValueListItem.id String The value list item ID.
Elasticsearch.Kibana.ValueListItem.list_id String The value list ID.
Elasticsearch.Kibana.ValueListItem.name String The value list item name.
Elasticsearch.Kibana.ValueListItem.description String The value list item description.
Elasticsearch.Kibana.ValueListItem.created_at Date The creation date of the value list item.

Command Example

!es-kibana-value-list-item-import value_list_id="1234" entry_id="1@1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": {
                "id": "5678",
                "list_id": "1234",
                "value": "10.0.0.1",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Value List Item

Value list item ID List ID Value Creation date
5678 1234 10.0.0.1 2024-01-15T10:00:00.000Z

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

  • Fetch incidents

</~PLATFORM>

Configuration parameters

  • url — Server URL
  • kibana_url — Kibana Server URL
  • auth_type — Authorization type (required)
  • api_key_auth_credentials — API key ID
  • credentials — Username
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • client_type — Client type
  • fetch_index — Index to fetch incidents from
  • fetch_query — Query String
  • fetch_fields — Fields to Fetch
  • fetch_time_field — Index time field
  • raw_query — Raw Query
  • time_method — Time field type
  • map_labels — Map JSON fields into labels
  • fetch_time — First fetch timestamp
  • fetch_size — The maximum number of results per fetch
  • timeout — Request timeout (in seconds).
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • space_id — Space ID
  • fetch_incident_type — Fetch incident types
  • mirror_direction — Incident Mirroring Direction
  • fetch_severity — Fetch cases by Severity
  • fetch_status — Fetch cases by Status
  • fetch_alerts_for_case — Fetch alerts for case
  • close_incident — Close Mirrored XSOAR Incident
  • close_elastic_incident — Close Mirrored Elasticsearch Incident

Commands (48)

  • es-eql-search

    Search using EQL query.

  • es-esql-search

    Search using ES|QL query. (Elastic >=8.11).

  • es-get-indices-statistics

    Returns Elasticsearch indices statistics and information. This command is not supported for client type OpenSearch.

  • es-index

    Indexes a document into an Elasticsearch index.

  • es-integration-health-check

    Returns the health status of the integration. This commmand should be used for debugging purposes.

  • es-kibana-alerting-health-get

    Retrieves the health of the Kibana alerting framework.

  • es-kibana-case-alerts-list

    Retrieves all alerts for a case.

  • es-kibana-case-comment-add

    Add a case comment or alert.

  • es-kibana-case-comment-delete

    Deletes all comments and alerts from a case.

  • es-kibana-case-comment-update

    Update a case comment or alert.

  • es-kibana-case-create

    Creates a new case in Kibana.

  • es-kibana-case-delete

    Deletes one or more cases by ID.

  • es-kibana-case-file-attach

    Attach a file to a case.

  • es-kibana-case-list

    Retrieves the details of Kibana cases.

  • es-kibana-case-update

    Update cases in Kibana.

  • es-kibana-detection-alert-status-set

    Set the status of one or more detection alerts.

  • es-kibana-endpoint-exception-list-item-create

    Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.

  • es-kibana-endpoint-exception-list-item-delete

    Delete an Elastic Endpoint exception list item.

  • es-kibana-endpoint-exception-list-item-list

    Retrieves Elastic Endpoint exception list items.

  • es-kibana-endpoint-exception-list-item-update

    Update an Elastic Endpoint exception list item.

  • es-kibana-exception-item-list-update

    Updates an existing exception list item.

  • es-kibana-exception-list-create

    Create an exception list.

  • es-kibana-exception-list-delete

    Delete an exception list using the id or list_id field.

  • es-kibana-exception-list-item-create

    Create an exception item and associate it with the specified exception list.

  • es-kibana-exception-list-item-delete

    Deletes an exception list item.

  • es-kibana-exception-list-item-list

    Get a list of all exception list items in the specified list.

  • es-kibana-exception-list-list

    Get a list of all exception list containers.

  • es-kibana-exception-list-update

    Updates an existing exception list.

  • es-kibana-rule-alert-mute

    Mute an alert, or mute all alerts for a rule.

  • es-kibana-rule-alert-unmute

    Unmute an alert, or unmute all alerts for a rule.

  • es-kibana-rule-disable

    Disable a rule.

  • es-kibana-rule-enable

    Enable a rule.

  • es-kibana-rule-list

    Retrieves information about rules.

  • es-kibana-rule-types-list

    Retrieves all rule types available in Kibana.

  • es-kibana-rule-update

    Update a rule.

  • es-kibana-value-list-item-create

    Adds a new item to a value list.

  • es-kibana-value-list-item-delete

    Deletes a value list item.

  • es-kibana-value-list-item-export

    Exports all items of a value list as a file (returned to the War Room).

  • es-kibana-value-list-item-get

    Retrieves value list items.

  • es-kibana-value-list-item-import

    Import value list items from a TXT or CSV file.

  • es-kibana-value-list-item-update

    Updates an existing value list item.

  • es-kibana-value-lists-list

    Retrieves details of a value list (the list container).

  • es-search

    Queries an index.

  • get-mapping-fields

    Returns the schema of the index to fetch from. This commmand should be used for debugging purposes.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update time. This command is used for mirroring in and should be used for debugging purposes.

  • get-remote-data

    Gets remote data of a specific incident. This command is used for mirroring in and should be used for debugging purposes.

  • search

    Searches an index.

  • update-remote-system

    Updates the remote system with local incident changes. This command is used for mirroring out and should be used for debugging purposes.

Source

Elasticsearch_v2.py Elasticsearch_v2_test.py Elasticsearch_v2.yml Elasticsearch_v2_description.md
Download History Raw 
category: Database
provider: Elastic
sectionorder:
- Connect
- Collect
commonfields:
  id: Elasticsearch v2
  version: -1
configuration:
- display: Server URL
  name: url
  required: false
  type: 0
  additionalinfo: The Elasticsearch server to which the integration connects. Ensure that the URL includes the correct Elasticsearch port. The default port for Elasticsearch v7 and below is 9200. Use the Server URL for on-premises deployments.
  section: Connect
- display: Kibana Server URL
  name: kibana_url
  required: false
  type: 0
  additionalinfo: The Kibana server used by the es-kibana-* commands and by fetching and mirroring security alerts and cases. Required for on-premises (self-managed) deployments, where Kibana is usually hosted separately from Elasticsearch (for example, https://kibana.example.com:5601). If left empty, the Kibana URL is derived from the Server URL, which is supported only for Elastic Cloud deployments whose hostname contains ".es." (the segment is replaced with ".kb.").
  section: Connect
  advanced: true
- display: Authorization type
  defaultvalue: Basic auth
  additionalinfo: |-
    Select the authentication type and enter the appropriate credentials:
    - Basic Auth: Enter Username and Password.
    - Bearer Auth: Enter Username and Password.
    - API Key Auth: Enter the API Key ID and API Key.
  name: auth_type
  options:
  - Basic auth
  - Bearer auth
  - API key auth
  type: 15
  section: Connect
  required: true
- additionalinfo: Use for API key auth
  display: API key ID
  displaypassword: API Key
  name: api_key_auth_credentials
  type: 9
  section: Connect
  required: false
- additionalinfo: Use for Basic auth. Optionally you can use Username as an API key ID and Password as an API key for API Key auth.
  display: Username
  name: credentials
  type: 9
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: Elasticsearch
  additionalinfo: In some hosted ElasticSearch environments, the standard ElasticSearch client is not supported. If you encounter any related client issues, please consider using the OpenSearch client type.
  display: Client type
  name: client_type
  options:
  - Elasticsearch
  - OpenSearch
  - Elasticsearch_v8
  - Elasticsearch_v9
  type: 15
  section: Connect
  advanced: true
  required: false
- display: Index to fetch incidents from
  name: fetch_index
  type: 0
  section: Collect
  required: false
  additionalinfo: CSV
- display: Query String
  name: fetch_query
  type: 0
  additionalinfo: |-
    Query string uses the Lucene syntax.
    For more information about the Lucene syntax, see the link in the help section.
    The query will be used when fetching incidents. Index time field will be used as a filter in the query.

    The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
  section: Collect
  required: false
- display: Fields to Fetch
  name: fetch_fields
  type: 0
  section: Collect
  required: false
  additionalinfo: Comma-separated list of fields to fetch (the `_source` field is always included).
- display: Index time field
  name: fetch_time_field
  type: 0
  section: Collect
  required: false
  additionalinfo: The time field used for sorting and limiting results. If using a nested field, separate field names with dot notation.
- display: Raw Query
  name: raw_query
  type: 12
  additionalinfo: |-
    Raw Query allows raw DSL queries and will override the 'Query String' Lucene syntax string.
    Results will not be filtered or sorted. Use additional parameters in the raw query for these purposes.
    For more information see the link in the help section.

    The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
  section: Collect
  advanced: true
  required: false
- display: Time field type
  defaultvalue: 'Simple-Date'
  name: time_method
  type: 15
  options:
  - Simple-Date
  - Timestamp-Seconds
  - Timestamp-Milliseconds
  section: Collect
  advanced: true
  required: false
  additionalinfo: For more information see the explanation in the help section.
- defaultvalue: 'true'
  display: Map JSON fields into labels
  name: map_labels
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: '3 days'
  display: First fetch timestamp
  name: fetch_time
  type: 0
  section: Collect
  required: false
  additionalinfo: <number> <time unit>, e.g., 12 hours, 7 days
- defaultvalue: '50'
  display: The maximum number of results per fetch
  name: fetch_size
  type: 0
  section: Collect
  required: false
- display: Request timeout (in seconds).
  name: timeout
  type: 0
  defaultvalue: '60'
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - xsiam
  - agentix
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - xsiam
  - agentix
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
  supportedModules:
  - xsiam
  - agentix
- display: Space ID
  name: space_id
  type: 0
  section: Connect
  advanced: true
  required: false
  additionalinfo: The default Kibana space ID to use for es-kibana-* commands. Used to derive the Kibana base URL from the Server URL. If a space_id argument is provided to a command, it overrides this value. See https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
- display: Fetch incident types
  name: fetch_incident_type
  defaultvalue: Elasticsearch Entity
  type: 15
  options:
  - Elasticsearch Entity
  - Elasticsearch Security Alert
  - Elasticsearch Case
  section: Collect
  required: false
  additionalinfo: The type of incident to fetch from Elasticsearch (Security Alert, Case, or other entity).
- display: Incident Mirroring Direction
  name: mirror_direction
  defaultvalue: None
  type: 15
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  section: Collect
  required: false
  additionalinfo: The mirroring direction. Mirroring works only for incident types Elasticsearch Security Alert and Elasticsearch Case.
- display: Fetch cases by Severity
  name: fetch_severity
  type: 16
  options:
  - critical
  - high
  - medium
  - low
  section: Collect
  advanced: true
  required: false
  additionalinfo: The case severities to fetch. If none is chosen, all severity levels will be returned. Relevant only for incident type Elasticsearch Case.
- display: Fetch cases by Status
  name: fetch_status
  defaultvalue: open,in-progress
  type: 16
  options:
  - open
  - acknowledged
  - in-progress
  - closed
  section: Collect
  advanced: true
  required: false
  additionalinfo: The case statuses to fetch. If none is chosen, in-progress and open will be returned. Relevant only for incident type Elasticsearch Case.
- display: Fetch alerts for case
  name: fetch_alerts_for_case
  type: 8
  defaultvalue: 'false'
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether to fetch alerts associated with each Elasticsearch Case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges.
- display: Close Mirrored XSOAR Incident
  name: close_incident
  type: 8
  defaultvalue: 'false'
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether closing the Elasticsearch alert or case is mirrored in Cortex XSOAR.
- display: Close Mirrored Elasticsearch Incident
  name: close_elastic_incident
  type: 8
  defaultvalue: 'false'
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether closing the Cortex XSOAR incident is mirrored in Elasticsearch.
description: "Search for and analyze data in real time. \n Supports version 6 and later."
display: Elasticsearch v2
name: Elasticsearch v2
script:
  commands:
  - arguments:
    - description: The index in which to perform a search.
      name: index
      required: true
    - description: The string to query (in Lucene syntax).
      name: query
      predefined:
      - ''
    - description: A comma-separated list of document fields to fetch. If empty, the entire document is fetched.
      isArray: true
      name: fields
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Calculates an explanation of a score for a query. For example, "value:1.6943597".
      name: explain
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '0'
      description: The page number from which to start a search.
      name: page
    - defaultValue: '100'
      description: The number of documents displayed per page. Can be an integer between "1" and "10,000".
      name: size
    - description: The field by which to sort the results table. The supported result types are boolean, numeric, date, and keyword fields. Keyword fields require the doc_values parameter to be set to "true" from the Elasticsearch server.
      name: sort-field
      predefined:
      - ''
    - auto: PREDEFINED
      defaultValue: asc
      description: The order by which to sort the results table. The results tables can only be sorted if a sort-field is defined.
      name: sort-order
      predefined:
      - asc
      - desc
    - description: Will overwrite the ‘query' arguments.
      name: query_dsl
    - description: The starting time of the time range.
      name: timestamp_range_start
    - description: The ending time of the time range.
      name: timestamp_range_end
    - description: Timestamp field name.
      defaultValue: "@timestamp"
      name: timestamp_field
    description: Queries an index.
    name: es-search
    outputs:
    - contextPath: Elasticsearch.Search.Results._index
      description: The index to which the document belongs.
      type: String
    - contextPath: Elasticsearch.Search.Results._id
      description: The ID of the document.
      type: String
    - contextPath: Elasticsearch.Search.Results._type
      description: The mapping type of the document.
      type: String
    - contextPath: Elasticsearch.Search.max_score
      description: The maximum relevance score of a query.
      type: Number
    - contextPath: Elasticsearch.Search.Query
      description: The query performed in the search.
      type: String
    - contextPath: Elasticsearch.Search.total.value
      description: The number of search results.
      type: Number
    - contextPath: Elasticsearch.Search.Results._score
      description: The relevance score of the search result.
      type: Number
    - contextPath: Elasticsearch.Search.Index
      description: The index in which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.Server
      description: The server on which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.timed_out
      description: Whether the search stopped due to a timeout.
      type: Boolean
    - contextPath: Elasticsearch.Search.took
      description: The time in milliseconds taken for the search to complete.
      type: Number
    - contextPath: Elasticsearch.Search.Page
      description: The page number from which the search started.
      type: Number
    - contextPath: Elasticsearch.Search.Size
      description: The maximum number of scores that a search can return.
      type: Number
  - arguments:
    - description: The index in which to perform a search.
      name: index
      required: true
    - description: The string to query (in Lucene syntax).
      name: query
      predefined:
      - ''
    - description: A comma-separated list of document fields to fetch. If empty, fetches the entire document.
      isArray: true
      name: fields
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Calculates an explanation of a score for a query. For example, "value:1.6943597".
      name: explain
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '0'
      description: The page number from which to start a search.
      name: page
    - defaultValue: '100'
      description: The number of documents displayed per page. Can be an integer between "1" and "10,000".
      name: size
    - description: The field by which to sort the results table. The supported result types are boolean, numeric, date, and keyword fields. Keyword fields require the doc_values parameter to be set to "true" from the Elasticsearch server.
      name: sort-field
      predefined:
      - ''
    - auto: PREDEFINED
      defaultValue: asc
      description: The order by which to sort the results table. The results tables can only be sorted if a sort-field is defined.
      name: sort-order
      predefined:
      - asc
      - desc
    - description: Timestamp field name.
      defaultValue: "@timestamp"
      name: timestamp_field
    description: Searches an index.
    name: search
    outputs:
    - contextPath: Elasticsearch.Search.Results._index
      description: The index to which the document belongs.
      type: String
    - contextPath: Elasticsearch.Search.Results._id
      description: The ID of the document.
      type: String
    - contextPath: Elasticsearch.Search.Results._type
      description: The mapping type of the document.
      type: String
    - contextPath: Elasticsearch.Search.max_score
      description: The maximum relevance score of a query.
      type: Number
    - contextPath: Elasticsearch.Search.Query
      description: The query performed in the search.
      type: String
    - contextPath: Elasticsearch.Search.total.value
      description: The number of search results.
      type: Number
    - contextPath: Elasticsearch.Search.Results._score
      description: The relevance score of the search result.
      type: Number
    - contextPath: Elasticsearch.Search.Index
      description: The index in which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.Server
      description: The server on which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.timed_out
      description: Whether the search stopped due to a time out.
      type: Boolean
    - contextPath: Elasticsearch.Search.took
      description: The time in milliseconds taken for the search to complete.
      type: Number
    - contextPath: Elasticsearch.Search.Page
      description: The page number from which the search started.
      type: Number
    - contextPath: Elasticsearch.Search.Size
      description: The maximum number of scores that a search can return.
      type: Number
  - name: get-mapping-fields
    description: Returns the schema of the index to fetch from. This commmand should be used for debugging purposes.
  - name: get-remote-data
    description: Gets remote data of a specific incident. This command is used for mirroring in and should be used for debugging purposes.
    arguments:
    - name: id
      required: true
      description: The remote incident ID.
    - name: lastUpdate
      description: The ISO format date with timezone. Retrieves entries that were created after lastUpdate.
  - name: get-modified-remote-data
    description: Gets the list of incidents that were modified since the last update time. This command is used for mirroring in and should be used for debugging purposes.
    arguments:
    - name: lastUpdate
      description: The ISO format date with timezone. Retrieves entries that were modified after lastUpdate.
  - name: update-remote-system
    description: Updates the remote system with local incident changes. This command is used for mirroring out and should be used for debugging purposes.
    arguments:
    - name: remoteId
      description: The remote incident ID.
    - name: data
      description: The data of the incident to update in the remote system.
    - name: entries
      description: The entries to update in the remote system.
    - name: incidentChanged
      description: Whether the incident has changed.
    - name: delta
      description: The fields that changed in the incident.
    - name: status
      description: The status of the incident.
  - name: es-integration-health-check
    description: Returns the health status of the integration. This commmand should be used for debugging purposes.
  - name: es-get-indices-statistics
    description: Returns Elasticsearch indices statistics and information. This command is not supported for client type OpenSearch.
    arguments:
    - description: The maximum number of indices to return.
      name: limit
      required: false
      defaultValue: '50'
    - description: Whether to retrieve all the Elasticsearch indices. If true, the "limit" argument will be ignored.
      name: all_results
      required: false
      defaultValue: false
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
    outputs:
    - contextPath: Elasticsearch.IndexStatistics.Name
      description: The name of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.Status
      description: The status of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.Health
      description: The health status of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.UUID
      description: The UUID of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.DocumentsCount
      description: The number of documents that are indexed in the index.
      type: Number
    - contextPath: Elasticsearch.IndexStatistics.DocumentsDeleted
      description: The number of documents that were deleted from the index.
      type: Number
  - description: Search using EQL query.
    name: es-eql-search
    arguments:
    - description: The index in which to perform a search.
      name: index
      required: true
    - description: The string to query (in Lucene syntax).
      name: query
      required: true
    - description: A comma-separated list of document fields to fetch. If empty, fetches the entire document.
      isArray: true
      name: fields
    - description: If two or more events share the same timestamp, Elasticsearch uses a tiebreaker field value to sort the events in ascending order.
      name: sort-tiebreaker
    - description: Filter using query DSL.
      name: filter
    - defaultValue: event.category
      description: The event category field.
      name: event_category_field
    - defaultValue: '100'
      description: The number of documents displayed per page. Can be an integer between "1" and "10,000".
      name: size
    - description: The starting time of the time range.
      name: timestamp_range_start
    - description: The ending time of the time range.
      name: timestamp_range_end
    - description: Timestamp field name.
      defaultValue: "@timestamp"
      name: timestamp_field
    outputs:
    - contextPath: Elasticsearch.Search.Results._index
      description: The index to which the document belongs.
      type: String
    - contextPath: Elasticsearch.Search.Results._id
      description: The ID of the document.
      type: String
    - contextPath: Elasticsearch.Search.Results._type
      description: The mapping type of the document.
      type: String
    - contextPath: Elasticsearch.Search.max_score
      description: The maximum relevance score of a query.
      type: Number
    - contextPath: Elasticsearch.Search.Query
      description: The query performed in the search.
      type: String
    - contextPath: Elasticsearch.Search.total.value
      description: The number of search results.
      type: Number
    - contextPath: Elasticsearch.Search.Results._score
      description: The relevance score of the search result.
      type: Number
    - contextPath: Elasticsearch.Search.Index
      description: The index in which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.Server
      description: The server on which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.timed_out
      description: Whether the search stopped due to a timeout.
      type: Boolean
    - contextPath: Elasticsearch.Search.took
      description: The time in milliseconds taken for the search to complete.
      type: Number
    - contextPath: Elasticsearch.Search.Page
      description: The page number from which the search started.
      type: Number
    - contextPath: Elasticsearch.Search.Size
      description: The maximum number of scores that a search can return.
      type: Number
  - name: es-index
    arguments:
    - name: index_name
      required: true
      description: The name of the index to ingest into.
    - name: document
      required: true
      description: The document object (JSON format) to be indexed. See Elasticsearch documentation (https://www.elastic.co/guide/en/elasticsearch/client/python-api/current/examples.html#ex-index) for further information about indexing documents.
    - name: id
      description: The ID of the indexed document (will be generated if empty).
    outputs:
    - contextPath: Elasticsearch.Index.id
      description: The ID of the indexed document.
      type: string
    - contextPath: Elasticsearch.Index.index
      description: The name of the index which the document was ingested to.
      type: string
    - contextPath: Elasticsearch.Index.version
      description: The version number of the indexed document.
      type: number
    - contextPath: Elasticsearch.Index.result
      description: The result of the index operation.
      type: string
    description: Indexes a document into an Elasticsearch index.
  - name: es-esql-search
    arguments:
    - description: The ES|QL query string to execute using piped syntax (for example, FROM index | WHERE field == "value").
      name: query
      required: true
    - description: Maximum number of results to return.
      name: limit
    description: Search using ES|QL query. (Elastic >=8.11).
    outputs:
    - contextPath: Elasticsearch.ESQLSearch
      description: ES|QL search result.
  - name: es-kibana-case-create
    description: Creates a new case in Kibana.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: assignee_uid
      isArray: true
      description: An array containing users that are assigned to the case. Not more than 10 elements.
    - name: category
      description: A word or phrase that categorizes the case. Maximum length is 50.
    - name: connector_fields
      description: A JSON object containing the connector fields. To create a case without a connector, specify null.
    - name: connector_id
      description: The identifier for the connector. To create a case without a connector, use none.
    - name: connector_name
      description: The name of the connector. To create a case without a connector, use none.
    - name: connector_type
      description: The type of connector. To create a case without a connector, use .none.
      auto: PREDEFINED
      predefined:
      - .none
      - .cases-webhook
      - .jira
      - .resilient
      - .servicenow
      - .servicenow-sir
      - .swimlane
    - name: connector_fields_issue_type_jira
      description: The type of issue.
    - name: connector_fields_parent_jira
      description: The key of the parent issue, when the issue type is sub-task.
    - name: connector_fields_priority_jira
      description: The priority of the issue.
    - name: connector_fields_issue_types_resilient
      isArray: true
      description: The type of incident.
    - name: connector_fields_severity_code_resilient
      description: The severity code of the incident.
    - name: connector_fields_category_servicenow
      description: The category of the incident.
    - name: connector_fields_impact_servicenow
      description: The effect an incident had on business.
    - name: connector_fields_severity_servicenow
      description: The severity of the incident.
    - name: connector_fields_subcategory_servicenow
      description: The subcategory of the incident.
    - name: connector_fields_urgency_servicenow
      description: The extent to which the incident resolution can be delayed.
    - name: connector_fields_dest_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of destination IPs.
    - name: connector_fields_malware_hash_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware hashes.
    - name: connector_fields_malware_url_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware URLs.
    - name: connector_fields_priority_servicenow
      description: The priority of the issue.
    - name: connector_fields_source_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of source IPs.
    - name: connector_fields_case_id_swimlane
      description: The case identifier for Swimlane connectors.
    - name: custom_key
      description: The unique identifier for the custom field. The key value must exist in the case configuration settings.
    - name: custom_type
      auto: PREDEFINED
      predefined:
      - text
      - toggle
      description: The custom field type. It must match the type specified in the case configuration settings.
    - name: custom_value
      description: The custom field value (string or boolean).
    - name: description
      description: The description for the case. Maximum length is 30000.
    - name: owner
      required: true
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.'
    - name: extract_observables
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments.
    - name: sync_alerts
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Turns alert syncing on or off.
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      description: The severity of the case.
    - name: tags
      isArray: true
      description: The words and phrases that help categorize cases. Not more than 200 elements.
    - name: title
      description: A title for the case. Maximum length is 160.
    - name: entry_id
      description: Entry ID for the file containing the full request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.title
      description: The title of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.description
      description: The description of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.owner
      description: The owner of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.status
      description: The status of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.created_at
      description: The creation date of the case.
      type: Date
    - contextPath: Elasticsearch.Kibana.Case.connector.type
      description: The connector type of the case.
      type: String
  - name: es-kibana-case-update
    description: Update cases in Kibana.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case.
    - name: version
      required: true
      description: The current version of the case. To determine this value, use es-kibana-case-list.
    - name: assignee_uid
      isArray: true
      description: An array containing users that are assigned to the case. Not more than 10 elements.
    - name: category
      description: A word or phrase that categorizes the case. Maximum length is 50.
    - name: close_reason
      auto: PREDEFINED
      predefined:
      - false_positive
      - duplicate
      - true_positive
      - benign_positive
      - automated_closure
      - other
      description: The close reason to sync to attached alerts when closing the case.
    - name: connector_fields
      description: A JSON object containing the connector fields. To remove a connector, specify null.
    - name: connector_id
      description: The identifier for the connector. To remove a connector, specify none.
    - name: connector_name
      description: The name of the connector. To remove a connector, specify none.
    - name: connector_type
      auto: PREDEFINED
      predefined:
      - .none
      - .cases-webhook
      - .jira
      - .resilient
      - .servicenow
      - .servicenow-sir
      - .swimlane
      description: The type of connector. To remove a connector, specify .none.
    - name: connector_fields_issue_type_jira
      description: The type of issue.
    - name: connector_fields_parent_jira
      description: The key of the parent issue, when the issue type is sub-task.
    - name: connector_fields_priority_jira
      description: The priority of the issue.
    - name: connector_fields_issue_types_resilient
      isArray: true
      description: The type of incident.
    - name: connector_fields_severity_code_resilient
      description: The severity code of the incident.
    - name: connector_fields_category_servicenow
      description: The category of the incident.
    - name: connector_fields_impact_servicenow
      description: The effect an incident had on business.
    - name: connector_fields_severity_servicenow
      description: The severity of the incident.
    - name: connector_fields_subcategory_servicenow
      description: The subcategory of the incident.
    - name: connector_fields_urgency_servicenow
      description: The extent to which the incident resolution can be delayed.
    - name: connector_fields_dest_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of destination IPs.
    - name: connector_fields_malware_hash_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware hashes.
    - name: connector_fields_malware_url_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware URLs.
    - name: connector_fields_priority_servicenow
      description: The priority of the issue.
    - name: connector_fields_source_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of source IPs.
    - name: connector_fields_case_id_swimlane
      description: The case identifier for Swimlane connectors.
    - name: custom_key
      description: The unique identifier for the custom field. The key value must exist in the case configuration settings.
    - name: custom_type
      auto: PREDEFINED
      predefined:
      - text
      - toggle
      description: The custom field type. It must match the type specified in the case configuration settings.
    - name: custom_value
      description: The custom field value (string or boolean).
    - name: description
      description: The description for the case. Maximum length is 30000.
    - name: extract_observables
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments.
    - name: sync_alerts
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Turns alert syncing on or off.
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      description: The severity of the case.
    - name: status
      auto: PREDEFINED
      predefined:
      - closed
      - in-progress
      - open
      description: The status of the case.
    - name: tags
      isArray: true
      description: The words and phrases that help categorize cases. Not more than 200 elements.
    - name: title
      description: A title for the case. Maximum length is 160.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.title
      description: The title of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.description
      description: The description of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.owner
      description: The owner of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.status
      description: The status of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.created_at
      description: The creation date of the case.
      type: Date
    - contextPath: Elasticsearch.Kibana.Case.connector.type
      description: The connector type of the case.
      type: String
  - name: es-kibana-case-delete
    description: Deletes one or more cases by ID.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      isArray: true
      description: The cases that you want to remove. To get the case identifiers, use es-kibana-case-list.
  - name: es-kibana-case-list
    description: Retrieves the details of Kibana cases.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      description: The identifier for the case. To retrieve case IDs, use the search cases API (leave empty).
    - name: assignees
      isArray: true
      description: Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles.
    - name: category
      isArray: true
      description: Filters the returned cases by category.
    - name: default_search_operator
      auto: PREDEFINED
      predefined:
      - OR
      - AND
      description: The default operator to use for the simple_query_string.
    - name: search
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
    - name: from
      description: Returns only cases that were created after a specific date (KQL data range or date match expression).
    - name: to
      description: Returns only cases that were created before a specific date (KQL data range or date match expression).
    - name: owner
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: A filter to limit the response to a specific set of applications.
    - name: reporters
      isArray: true
      description: Filters the returned cases by the user name of the reporter.
    - name: search_fields
      auto: PREDEFINED
      predefined:
      - description
      - title
      description: The fields to perform the simple_query_string parsed query against.
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      description: The severity of the case.
    - name: sort_field
      auto: PREDEFINED
      predefined:
      - createdAt
      - updatedAt
      - closedAt
      - title
      - category
      - status
      - severity
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: status
      auto: PREDEFINED
      predefined:
      - closed
      - in-progress
      - open
      description: Filters the returned cases by state.
    - name: tags
      description: Filters the returned cases by tags.
    - name: page
      defaultValue: '1'
      description: The page number from which to start a search.
    - name: size
      defaultValue: '20'
      description: The number of items to return. Limited to 100 items.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.title
      description: The title of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.description
      description: The description of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.owner
      description: The owner of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.status
      description: The status of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.created_at
      description: The creation date of the case.
      type: Date
    - contextPath: Elasticsearch.Kibana.Case.connector.type
      description: The connector type of the case.
      type: String
  - name: es-kibana-case-alerts-list
    description: Retrieves all alerts for a case.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: limit
      defaultValue: '50'
      description: Limit on the number of keys to return.
    - name: offset
      defaultValue: '0'
      description: Starting record index to begin retrieving records from.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.Alert.id
      description: The alert ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.Alert.index
      description: The alert index.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.Alert.attached_at
      description: The date the alert was attached to the case.
      type: Date
  - name: es-kibana-case-comment-add
    description: Add a case comment or alert.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: alert_id
      isArray: true
      description: The alert identifiers. Required only when type is alert.
    - name: index
      isArray: true
      description: The alert indices. Required only when type is alert.
    - name: owner
      required: true
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.'
    - name: rule_id
      description: The rule identifier.
    - name: rule_name
      description: The rule name.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - alert
      - user
      description: The type of comment.
    - name: comment
      description: The new comment. Required only when type is user. Maximum length is 30000.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.comment
      description: The comment text.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.created_by.username
      description: The user who created the comment.
      type: String
  - name: es-kibana-case-comment-update
    description: Update a case comment or alert.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: comment_id
      description: The identifier for the comment.
    - name: comment
      description: The new comment. Required only when type is user. Maximum length is 30000.
    - name: alert_id
      isArray: true
      description: The alert identifiers. Required only when type is alert.
    - name: index
      isArray: true
      description: The alert indices. Required only when type is alert.
    - name: owner
      required: true
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.'
    - name: rule_id
      description: The rule identifier.
    - name: rule_name
      description: The rule name.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - alert
      - user
      description: The type of comment.
    - name: version
      description: The current comment version. To retrieve version values, use the get comments API.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.comment
      description: The comment text.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.updated_by.username
      description: The user who updated the comment.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.updated_at
      description: The date the comment was updated.
      type: Date
  - name: es-kibana-case-comment-delete
    description: Deletes all comments and alerts from a case.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
  - name: es-kibana-case-file-attach
    description: Attach a file to a case.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: entry_id
      required: true
      description: Entry ID for the file that needs to be attached.
    - name: file_name
      description: The desired name of the file being attached to the case (without file extension).
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.updated_by.username
      description: The user who attached the file.
      type: String
  - name: es-kibana-alerting-health-get
    description: Retrieves the health of the Kibana alerting framework.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    outputs:
    - contextPath: Elasticsearch.Kibana.AlertingHealth.is_sufficiently_secure
      description: Whether the alerting framework is sufficiently secure.
      type: Boolean
    - contextPath: Elasticsearch.Kibana.AlertingHealth.has_permanent_encryption_key
      description: Whether a permanent encryption key is configured.
      type: Boolean
    - contextPath: Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.decryption_health.status
      description: The decryption health status.
      type: String
    - contextPath: Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.execution_health.status
      description: The execution health status.
      type: String
    - contextPath: Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.read_health.status
      description: The read health status.
      type: String
  - name: es-kibana-rule-types-list
    description: Retrieves all rule types available in Kibana.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    outputs:
    - contextPath: Elasticsearch.Kibana.RuleType.id
      description: The rule type ID.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.name
      description: The rule type name.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.category
      description: The rule type category.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.producer
      description: The rule type producer.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.action_groups.id
      description: The action group ID.
      type: String
  - name: es-kibana-rule-list
    description: Retrieves information about rules.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      description: The identifier for the rule.
    - name: search
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
    - name: default_search_operator
      defaultValue: OR
      auto: PREDEFINED
      predefined:
      - OR
      - AND
      description: The default operator to use for the simple_query_string.
    - name: search_fields
      isArray: true
      description: The fields to perform the simple_query_string parsed query against.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: has_reference_id
      description: Filters the rules that have a relation with the reference objects with a specific identifier.
    - name: has_reference_type
      description: Filters the rules that have a relation with the reference objects with a specific type.
    - name: fields
      isArray: true
      description: The fields to return in the attributes key of the response.
    - name: filter
      description: A KQL string that you filter with an attribute from your saved object.
    - name: filter_consumers
      isArray: true
      description: List of consumers to filter.
    - name: page
      defaultValue: '1'
      description: The page number from which to start a search.
    - name: size
      defaultValue: '10'
      description: The number of rules to return per page.
    outputs:
    - contextPath: Elasticsearch.Kibana.Rule.id
      description: The rule ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Rule.enabled
      description: Whether the rule is enabled.
      type: Boolean
    - contextPath: Elasticsearch.Kibana.Rule.name
      description: The rule name.
      type: String
    - contextPath: Elasticsearch.Kibana.Rule.rule_type_id
      description: The rule type ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Rule.created_at
      description: The creation date of the rule.
      type: Date
  - name: es-kibana-rule-enable
    description: Enable a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
  - name: es-kibana-rule-disable
    description: Disable a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
  - name: es-kibana-rule-update
    description: Update a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
    - name: alert_delay_active
      description: The number of consecutive runs that must meet the rule conditions.
    - name: artifacts_dashboards_id
      isArray: true
      description: Not more than 10 elements.
    - name: artifacts_investigation_guide_blob
      description: Maximum length is 10000.
    - name: consumer
      auto: PREDEFINED
      predefined:
      - alerts
      - apm
      - discover
      - infrastructure
      - logs
      - metrics
      - ml
      - monitoring
      - securitySolution
      - siem
      - stackAlerts
      - uptime
      description: The name of the application or feature that owns the rule.
    - name: flapping_enabled
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Determines whether the rule can enter the flapping state. When provided, flapping_look_back_window and flapping_status_change_threshold are required.
    - name: flapping_look_back_window
      description: The minimum number of runs in which the threshold must be met. Minimum value is 2, maximum value is 20. Required when configuring flapping settings.
    - name: flapping_status_change_threshold
      description: The minimum number of times an alert must switch states within the defined look back window time. Minimum value is 2, maximum value is 20. Required when configuring flapping settings.
    - name: name
      description: The name of the rule.
    - name: notify_when
      auto: PREDEFINED
      predefined:
      - onActionGroupChange
      - onActiveAlert
      - onThrottleInterval
      description: Indicates how frequently rule actions are triggered.
    - name: schedule_interval
      description: The interval is specified in seconds, minutes, hours, or days.
    - name: tags
      isArray: true
      description: The tags for the rule.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.Rule.id
      description: The rule ID.
      type: String
  - name: es-kibana-rule-alert-mute
    description: Mute an alert, or mute all alerts for a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
    - name: alert_id
      description: The identifier for the alert.
    - name: validate_alerts_existence
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to validate the existence of the alert.
    - name: mute_all
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to mute all alerts.
  - name: es-kibana-rule-alert-unmute
    description: Unmute an alert, or unmute all alerts for a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
    - name: alert_id
      description: The identifier for the alert.
    - name: unmute_all
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to unmute all alerts.
  - name: es-kibana-detection-alert-status-set
    description: Set the status of one or more detection alerts.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - open
      - acknowledged
      - in-progress
      - closed
      description: The new status of the detection alert(s).
    - name: signal_ids
      isArray: true
      description: List of alert ids. Use field _id on alert document or kibana.alert.uuid.
    - name: query
      description: An Elasticsearch query used to select which alerts to update, as an alternative to signal_ids.
    - name: reason
      auto: PREDEFINED
      predefined:
      - false_positive
      - duplicate
      - true_positive
      - benign_positive
      - automated_closure
      - other
      description: The reason for the status change.
    - name: conflicts
      defaultValue: abort
      auto: PREDEFINED
      predefined:
      - abort
      - proceed
      description: Determines how version conflicts should be handled.
    outputs:
    - contextPath: Elasticsearch.Kibana.SecurityAlertSetStatus.total
      description: The total number of alerts matched by the request.
      type: Number
    - contextPath: Elasticsearch.Kibana.SecurityAlertSetStatus.updated
      description: The number of alerts that were updated.
      type: Number
  - name: es-kibana-endpoint-exception-list-item-create
    description: Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: description
      description: Describes the exception list.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: A string that does not contain only whitespace characters.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name. Minimum length is 1.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception items.
    - name: entry_id
      description: Entry ID for the file containing the full request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-endpoint-exception-list-item-update
    description: Update an Elastic Endpoint exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_item_id
      description: Exception's identifier.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: _version
      description: The version id, normally returned by the API when the item is retrieved.
    - name: description
      description: Describes the exception list.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: A string that does not contain only whitespace characters.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name. Minimum length is 1.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception items.
    - name: entry_id
      description: Entry ID for the file containing the full request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-endpoint-exception-list-item-delete
    description: Delete an Elastic Endpoint exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: item_id
      required: true
      description: Either id or item_id must be specified.
  - name: es-kibana-endpoint-exception-list-item-list
    description: Retrieves Elastic Endpoint exception list items.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: item_id
      description: Either id or item_id must be specified.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      defaultValue: '1'
      description: The page number to return. Minimum value is 0.
    - name: size
      description: The number of exception list items to return per page. Minimum value is 0.
    outputs:
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-exception-list-list
    description: Get a list of all exception list containers.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_id
      description: Exception list's identifier. Either id or list_id must be specified.
    - name: list_id
      description: Human readable exception list string identifier. Either id or list_id must be specified.
    - name: filter
      description: Filters the returned results according to the value of the specified field.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      defaultValue: '1'
      description: The page number to return. Minimum value is 1.
    - name: size
      description: The number of exception lists to return per page. Minimum value is 1.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionList.id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.list_id
      description: The human-readable exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.name
      description: The exception list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.description
      description: The exception list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.created_at
      description: The creation date of the exception list.
      type: Date
  - name: es-kibana-exception-list-create
    description: Create an exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: description
      description: Describes the exception list.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: meta
      description: Placeholder for metadata about the list container (JSON object).
    - name: name
      description: The name of the exception list.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - detection
      - rule_default
      - endpoint
      - endpoint_trusted_apps
      - endpoint_trusted_devices
      - endpoint_events
      - endpoint_host_isolation_exceptions
      - endpoint_blocklists
      description: The type of exception list to be created.
    - name: version
      description: The document version automatically increased on updates.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionList.id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.list_id
      description: The human-readable exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.name
      description: The exception list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.description
      description: The exception list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.created_at
      description: The creation date of the exception list.
      type: Date
  - name: es-kibana-exception-list-update
    description: Updates an existing exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: _version
      description: The version id, normally returned by the API when the item was retrieved.
    - name: description
      required: true
      description: Describes the exception list.
    - name: exception_list_id
      description: Exception list's identifier.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: meta
      description: Placeholder for metadata about the list container (JSON object).
    - name: name
      required: true
      description: The name of the exception list.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - detection
      - rule_default
      - endpoint
      - endpoint_trusted_apps
      - endpoint_trusted_devices
      - endpoint_events
      - endpoint_host_isolation_exceptions
      - endpoint_blocklists
      description: The type of exception list to be created.
    - name: version
      description: The document version automatically increased on updates.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionList.id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.list_id
      description: The human-readable exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.name
      description: The exception list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.description
      description: The exception list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.created_at
      description: The creation date of the exception list.
      type: Date
  - name: es-kibana-exception-list-delete
    description: Delete an exception list using the id or list_id field.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_id
      description: Exception list's identifier. Either id or list_id must be specified.
    - name: list_id
      description: Human readable exception list string identifier. Either id or list_id must be specified.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
  - name: es-kibana-exception-list-item-list
    description: Get a list of all exception list items in the specified list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_item_id
      description: Exception list item's identifier. Either id or item_id must be specified.
    - name: item_id
      description: Human readable exception item string identifier. Either id or item_id must be specified.
    - name: exception_list_id
      isArray: true
      description: The list_ids of the items to fetch.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: search
      description: Free-text search term applied to exception list item fields.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      defaultValue: '1'
      description: The page number to return. Minimum value is 0.
    - name: size
      description: The number of exception list items to return per page. Minimum value is 0.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-exception-list-item-create
    description: Create an exception item and associate it with the specified exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: comment
      description: A string that does not contain only whitespace characters.
    - name: description
      description: Describes the exception list.
    - name: expire_time
      description: The exception item's expiration date, in ISO format.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: type
      description: The type of exception list to be created.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: The exception item entry value.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-exception-item-list-update
    description: Updates an existing exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: _version
      description: The version ID, normally returned by the API when the item is retrieved.
    - name: comment
      description: A string that does not contain only whitespace characters.
    - name: comment_id
      description: A string that does not contain only whitespace characters.
    - name: description
      description: Describes the exception list.
    - name: expire_time
      description: The exception item's expiration date, in ISO format.
    - name: exception_list_item_id
      description: Exception's identifier.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: type
      description: The type of exception list to be created.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: The exception item entry value.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.updated_at
      description: The update date of the exception list item.
      type: Date
  - name: es-kibana-exception-list-item-delete
    description: Deletes an exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_item_id
      description: Exception list item's identifier. Either id or item_id must be specified.
    - name: item_id
      description: Human readable exception item string identifier. Either id or item_id must be specified.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
  - name: es-kibana-value-lists-list
    description: Retrieves details of a value list (the list container).
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      description: Value list identifier (id) returned when the list was created.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: cursor
      description: Returns the lists that come after the last lists returned in the previous call.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      description: The page number to return.
    - name: size
      description: The number of value lists to return per page.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueList.id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueList.name
      description: The value list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueList.description
      description: The value list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueList.created_at
      description: The creation date of the value list.
      type: Date
  - name: es-kibana-value-list-item-get
    description: Retrieves value list items.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_item_id
      description: Value list item identifier. Required if list_id and value are not specified.
    - name: value_list_id
      description: Parent value list's id to page through items for.
    - name: value
      description: The value used to evaluate exceptions. Required if id is not specified.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: cursor
      description: Opaque cursor returned in a previous response; pass it to continue listing from the next page.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      description: The page number to return.
    - name: size
      description: The number of list items to return per page.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  - name: es-kibana-value-list-item-create
    description: Adds a new item to a value list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      required: true
      description: Value list's identifier.
    - name: meta
      description: Placeholder for metadata about the value list item (JSON object). Example {"source":"threatfeed","priority":3,"active":true}.
    - name: refresh
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      - wait_for
      description: Determines when changes made by the request are made visible to search.
    - name: value
      required: true
      description: The value used to evaluate exceptions.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  - name: es-kibana-value-list-item-update
    description: Updates an existing value list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: _version
      description: The version id, normally returned by the API when the document is retrieved.
    - name: value_list_item_id
      required: true
      description: Value list item identifier.
    - name: meta
      description: Placeholder for metadata about the value list item (JSON object). Example {"source":"threatfeed","priority":3,"active":true}.
    - name: value
      required: true
      description: The value used to evaluate exceptions.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  - name: es-kibana-value-list-item-delete
    description: Deletes a value list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_item_id
      description: Value list item's identifier. Required if list_id and value are not specified.
    - name: value_list_id
      description: Value list's identifier.
    - name: value
      description: The value used to evaluate exceptions. Required if id is not specified.
    - name: refresh
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      - wait_for
      description: Determines when changes made by the request are made visible to search.
  - name: es-kibana-value-list-item-export
    description: Exports all items of a value list as a file (returned to the War Room).
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      description: Value list's id to export.
  - name: es-kibana-value-list-item-import
    description: Import value list items from a TXT or CSV file.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      description: List's id to import.
    - name: type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Type of the importing list.
    - name: refresh
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      - wait_for
      description: Determines when changes made by the request are made visible to search.
    - name: entry_id
      required: true
      description: Entry ID for the file containing the items to import.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  dockerimage: demisto/elasticsearch:1.0.0.11195141
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
autoUpdateDockerImage: false
fromversion: 5.0.0
defaultmapperin: Elasticsearch - Incoming Mapper
defaultclassifier: Elasticsearch
tests:
- Elasticsearch_v2_test
- Elasticsearch_v2_test-v6
- Elasticsearch_v2_test-v7-v8
- Elasticsearch_v2_test-v8