Elasticsearch v2

Elasticsearch_v2 integration is used to search for and analyze data in real time.
Supports version 6 and later.
This integration was integrated and tested with versions 6.6.2, 7.3, 8.4.1 of Elasticsearch.

Permissions

The permissions required to use this integration depends on which operations you need to perform. The API user should have the same permissions a regular user would have in order to access the data via the UI. Following are the permissions needed for certain commands:

• !es-eql-search/search/es-search/fetch-incidents - If the Elasticsearch security features are enabled, you must have the read index privilege for the target data stream, index, or alias.
• !get-mapping-fields - If the Elasticsearch security features are enabled, you must have the view_index_metadata or manage index privilege for the target data stream, index, or alias.
• !es-index - If the Elasticsearch security features are enabled, you must have the write index privilege for the target data stream, index, or alias.
• !es-kibana-* commands - To execute Kibana commands, you must have the necessary privileges for the applicable resource. The privilege required depends on the command you are using. Kibana API endpoints are gated by feature privileges granted at one of two levels: Read (GET / list / view operations) and All (POST / PUT / PATCH / DELETE operations). For rules and cases, the privilege is scoped to the feature that owns the object — a Security-owned object requires the Security feature privilege, an Observability-owned object requires the Observability feature privilege, and a stack-owned object requires the Management / Stack Rules feature privilege.

Configure Elasticsearch v2 in Cortex

Fetch

Use the Fetch incident types parameter to select what to fetch from Elasticsearch: the default Elasticsearch Entity, Elasticsearch Security Alert, or Elasticsearch Case.

Mirroring is only available for Elasticsearch Security Alerts and Cases.

Fetch

The default fetch behavior. Configure the Index to fetch incidents from, Query String, and/or Raw Query fields to fetch generic Elasticsearch documents as incidents.

Fetch Security Alerts

To fetch security alerts, use the Raw Query field (DSL query). The index must follow one of these patterns: .internal.alerts-security.alerts-* or .siem-signals-*.

Fetch Cases

Use the Fetch cases by Severity parameter to filter cases by the required severity and the Fetch cases by Status parameter to filter cases by the required status. Enable Fetch alerts for case to also retrieve the alerts associated with each case.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Elasticsearch (Kibana) Security Alerts and Cases.

Mirroring is only available for Elasticsearch Security Alert and Elasticsearch Case incident types.

To set up mirroring:

1. Enable Fetch incidents in your instance configuration.
2. In the Fetch incident types parameter, select Elasticsearch Security Alert or Elasticsearch Case.
3. In the Incident Mirroring Direction parameter, select in which direction the incidents should be mirrored:
   • Incoming - Changes in Elasticsearch (status, tags, workflow reason, case fields) are reflected in Cortex XSOAR.
   • Outgoing - Changes in Cortex XSOAR are reflected in Elasticsearch.
   • Incoming And Outgoing - Changes are mirrored in both directions.
4. Optionally, select Close Mirrored XSOAR Incident to close the Cortex XSOAR incident when the Elasticsearch alert/case is closed, and Close Mirrored Elasticsearch Incident to close the Elasticsearch alert/case when the Cortex XSOAR incident is closed.

Notes:

• The mirroring is affected by the following integration parameters: Incident Mirroring Direction, Close Mirrored XSOAR Incident, and Close Mirrored Elasticsearch Incident.
• To ensure mirroring works as expected, mappers are required so that the fields are properly mapped to and from Elasticsearch. Select the appropriate incoming and outgoing mappers per incident type (Elasticsearch Security Alert - Incoming/Outgoing Mapper and Elasticsearch Case - Incoming/Outgoing Mapper).
• Set the Fetch incident types parameter even when mirroring only. It is used to resolve the incident type when the remote lookup is unavailable; without it, changes may not be mirrored out.
• Mirroring out always uses the Kibana API, because the security alert indices are Kibana system indices and writing to them directly would skip Kibana’s bookkeeping (such as kibana.alert.workflow_status_updated_at, which mirroring in relies on). The configured credentials therefore need the Security → Alerts: All Kibana privilege, and the Space ID must match the space that owns the alerts. If either is wrong, the fetch keeps working while mirroring out reports that 0 alerts were updated.

Which Security Alert fields can be mirrored

Elasticsearch only allows a detection alert’s workflow status, status reason, and workflow tags to be changed. These are the only fields mirrored out:

Other fields, such as severity, risk score, or the detection rule, cannot be pushed back to Elasticsearch because no API exists to change them on an existing alert. Editing those fields in Cortex XSOAR updates the local incident only, and an error is written to the log explaining that nothing was mirrored out. These fields are still mirrored in (from Elasticsearch to Cortex XSOAR).

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

es-search

Queries an index.

Base Command

es-search

Input

Context Output

search

Searches an index.

Base Command

search

Input

Context Output

get-mapping-fields

Returns the schema of the index to fetch from. This commmand should be used for debugging purposes.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

es-eql-search

Search using EQL query

Base Command

es-eql-search

Input

Context Output

es-index

Indexes a document into an Elasticsearch index.

Base Command

es-index

Input

Context Output

Command Example

!es-index index_name=test-xsoar document="{\"name\":\"test\"}" id=1234

Context Example

{
    "Elasticsearch": {
        "Index": {
            "id": "1234",
            "index": "test-xsoar",
            "version": 1,
            "result": "created"
        }
    }
}

Human Readable Output

Indexed document

ID	Index name	Version	Result
1234	test-xsoar	1	created

es-integration-health-check

Returns the health status of the integration. This commmand should be used for debugging purposes.

Base Command

es-integration-health-check

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

es-get-indices-statistics

Returns Elasticsearch indices statistics and information. This command is not supported for client type OpenSearch.

Base Command

es-get-indices-statistics

Input

Context Output

es-esql-search

Search using ES|QL query (Elasticsearch 8.11 and above).

Base Command

es-esql-search

Input

Context Output

Command Example

!es-esql-search query="FROM logs-* | WHERE host.name == \"web-01\" | LIMIT 5"

Context Example

{
    "Elasticsearch": {
        "ESQLSearch": [
            {
                "@timestamp": "2024-01-15T10:23:45.000Z",
                "host.name": "web-01",
                "message": "Connection established"
            }
        ]
    }
}

Human Readable Output

Search query

Query	Total
FROM logs-* | WHERE host.name == “web-01” | LIMIT 5	1

Results

@timestamp	host.name	message
2024-01-15T10:23:45.000Z	web-01	Connection established

es-kibana-alerting-health-get

Retrieves the health of the Kibana alerting framework.

Base Command

es-kibana-alerting-health-get

Input

Context Output

Command Example

#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "AlertingHealth": {
                "is_sufficiently_secure": true,
                "has_permanent_encryption_key": true,
                "alerting_framework_health": {
                    "decryption_health": {"status": "ok"},
                    "execution_health": {"status": "ok"},
                    "read_health": {"status": "ok"}
                }
            }
        }
    }
}

Human Readable Output

Kibana Alerting Framework Health

Is sufficiently secure	Has permanent encryption key	Decryption status	Execution status	Read status
true	true	ok	ok	ok

es-kibana-rule-types-list

Retrieves all rule types available in Kibana.

Base Command

es-kibana-rule-types-list

Input

Context Output

Command Example

#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "RuleType": [
                {
                    "id": ".index-threshold",
                    "name": "Index threshold",
                    "category": "management",
                    "producer": "stackAlerts",
                    "action_groups": [{"id": "threshold met"}, {"id": "recovered"}]
                }
            ]
        }
    }
}

Human Readable Output

Kibana Rule Types

Rule type ID	Name	Category	Producer	Action Group Id
.index-threshold	Index threshold	management	stackAlerts	threshold met, recovered

es-kibana-rule-list

Retrieves information about rules.

Base Command

es-kibana-rule-list

Input

Context Output

Command Example

!es-kibana-rule-list rule_id="1234"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Rule": {
                "id": "1234",
                "enabled": true,
                "name": "CPU threshold alert",
                "rule_type_id": ".index-threshold",
                "created_at": "2024-01-10T08:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Rules

Rule ID	Enabled	Name	Type ID	Creation date
1234	true	CPU threshold alert	.index-threshold	2024-01-10T08:00:00.000Z

es-kibana-rule-enable

Enable a rule.

Base Command

es-kibana-rule-enable

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-enable rule_id="1234"

Context Example

{}

Human Readable Output

The rule 1234 has been successfully enabled.

es-kibana-rule-disable

Disable a rule.

Base Command

es-kibana-rule-disable

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-disable rule_id="1234"

Context Example

{}

Human Readable Output

The rule 1234 has been successfully disabled.

es-kibana-rule-update

Update a rule.

Base Command

es-kibana-rule-update

Input

Context Output

Command Example

!es-kibana-rule-update rule_id="1234" name="Updated CPU alert" schedule_interval="5m"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Rule": {
                "id": "1234",
                "name": "Updated CPU alert",
                "enabled": true,
                "rule_type_id": ".index-threshold",
                "created_at": "2024-01-10T08:00:00.000Z"
            }
        }
    }
}

Human Readable Output

The rule 1234 has been successfully changed.

Rule ID	Changed fields
1234	name, schedule

es-kibana-rule-alert-mute

Mute an alert, or mute all alerts for a rule.

Base Command

es-kibana-rule-alert-mute

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-alert-mute rule_id="1234" mute_all="true"

Context Example

{}

Human Readable Output

The alerts have been successfully muted.

es-kibana-rule-alert-unmute

Unmute an alert, or unmute all alerts for a rule.

Base Command

es-kibana-rule-alert-unmute

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-rule-alert-unmute rule_id="1234" unmute_all="true"

Context Example

{}

Human Readable Output

The alerts have been successfully unmuted.

es-kibana-detection-alert-status-set

Set the status of one or more detection alerts.

Base Command

es-kibana-detection-alert-status-set

Input

Context Output

Command Example

!es-kibana-detection-alert-status-set status="closed" signal_ids="1234,5678"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "SecurityAlertSetStatus": {
                "total": 2,
                "updated": 2
            }
        }
    }
}

Human Readable Output

Kibana Detection Alert Status Update

Total	Updated
2	2

es-kibana-case-create

Creates a new case in Kibana.

Base Command

es-kibana-case-create

Input

Context Output

Command Example

!es-kibana-case-create owner="securitySolution" title="Suspicious login" description="Multiple failed logins detected" severity="medium"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "title": "Suspicious login",
                "description": "Multiple failed logins detected",
                "owner": "securitySolution",
                "severity": "medium",
                "status": "open",
                "created_at": "2024-01-15T10:00:00.000Z",
                "connector": {"type": ".none"}
            }
        }
    }
}

Human Readable Output

Kibana Case

Title	ID	Description	Owner	Severity	Status	Created at	Connector type
Suspicious login	1234	Multiple failed logins detected	securitySolution	medium	open	2024-01-15T10:00:00.000Z	.none

es-kibana-case-update

Update cases in Kibana.

Base Command

es-kibana-case-update

Input

Context Output

Command Example

!es-kibana-case-update case_id="1234" version="WzEsMV0=" title="Suspicious login - updated" severity="high"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "title": "Suspicious login - updated",
                "description": "Multiple failed logins detected",
                "owner": "securitySolution",
                "severity": "high",
                "status": "open",
                "created_at": "2024-01-15T10:00:00.000Z",
                "connector": {"type": ".none"}
            }
        }
    }
}

Human Readable Output

Kibana Case(s) Updated

Title	ID	Description	Owner	Severity	Status	Created at	Connector type
Suspicious login - updated	1234	Multiple failed logins detected	securitySolution	high	open	2024-01-15T10:00:00.000Z	.none

es-kibana-case-delete

Deletes one or more cases by ID.

Base Command

es-kibana-case-delete

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-case-delete case_id="1234"

Context Example

{}

Human Readable Output

The cases 1234 have been successfully deleted.

es-kibana-case-list

Retrieves the details of Kibana cases.

Base Command

es-kibana-case-list

Input

Context Output

Command Example

#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "Case": [
                {
                    "id": "1234",
                    "title": "Suspicious login",
                    "description": "Multiple failed logins detected",
                    "owner": "securitySolution",
                    "severity": "medium",
                    "status": "open",
                    "created_at": "2024-01-15T10:00:00.000Z",
                    "connector": {"type": ".none"}
                }
            ]
        }
    }
}

Human Readable Output

Kibana Cases

Title	ID	Description	Owner	Severity	Status	Created at	Connector type
Suspicious login	1234	Multiple failed logins detected	securitySolution	medium	open	2024-01-15T10:00:00.000Z	.none

es-kibana-case-alerts-list

Retrieves all alerts for a case.

Base Command

es-kibana-case-alerts-list

Input

Context Output

Command Example

!es-kibana-case-alerts-list case_id="1234"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "1234": {
                    "Alert": [
                        {
                            "id": "5678",
                            "index": ".alerts-security.alerts-default",
                            "attached_at": "2024-01-15T11:00:00.000Z"
                        }
                    ]
                }
            }
        }
    }
}

Human Readable Output

Alerts for Case 1234

Case id	Attached at	Alert id	Index
1234	2024-01-15T11:00:00.000Z	5678	.alerts-security.alerts-default

es-kibana-case-comment-add

Add a case comment or alert.

Base Command

es-kibana-case-comment-add

Input

Context Output

Command Example

!es-kibana-case-comment-add case_id="1234" type="user" owner="securitySolution" comment="Investigated and confirmed malicious activity."

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "comments": [
                    {
                        "comment": "Investigated and confirmed malicious activity.",
                        "created_by": {"username": "analyst"}
                    }
                ]
            }
        }
    }
}

Human Readable Output

Kibana Case Comment Added

Case id	Comment	Created by
1234	Investigated and confirmed malicious activity.	analyst

es-kibana-case-comment-update

Update a case comment or alert.

Base Command

es-kibana-case-comment-update

Input

Context Output

Command Example

!es-kibana-case-comment-update case_id="1234" comment_id="5678" type="user" owner="securitySolution" comment="Updated: confirmed false positive." version="WzEsMV0="

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "comments": [
                    {
                        "id": "5678",
                        "comment": "Updated: confirmed false positive.",
                        "updated_by": {"username": "analyst"},
                        "updated_at": "2024-01-15T12:00:00.000Z"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Kibana Case Comment Updated

Case id	Comment	Updated by	Updated at
1234	Updated: confirmed false positive.	analyst	2024-01-15T12:00:00.000Z

es-kibana-case-comment-delete

Deletes all comments and alerts from a case.

Base Command

es-kibana-case-comment-delete

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-case-comment-delete case_id="1234"

Context Example

{}

Human Readable Output

The comments and alerts for the case 1234 have been successfully deleted.

es-kibana-case-file-attach

Attach a file to a case.

Base Command

es-kibana-case-file-attach

Input

Context Output

Command Example

!es-kibana-case-file-attach case_id="1234" entry_id="1@1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "Case": {
                "id": "1234",
                "comments": [
                    {
                        "updated_by": {"username": "analyst"}
                    }
                ]
            }
        }
    }
}

Human Readable Output

File successfully attached to case 1234.

es-kibana-endpoint-exception-list-item-create

Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.

Base Command

es-kibana-endpoint-exception-list-item-create

Input

Context Output

Command Example

!es-kibana-endpoint-exception-list-item-create name="Trusted process" description="Allow known safe process" entries_field="process.name" entries_type="match" entries_operator="included" entries_value="safe_process.exe" os_types="windows"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "EndpointExceptionListItem": {
                "id": "1234",
                "item_id": "trusted-process-1",
                "list_id": "endpoint_list",
                "name": "Trusted process",
                "description": "Allow known safe process",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Endpoint Exception List Item

ID	Item ID	List ID	Name	Description	Creation date
1234	trusted-process-1	endpoint_list	Trusted process	Allow known safe process	2024-01-15T10:00:00.000Z

es-kibana-endpoint-exception-list-item-update

Update an Elastic Endpoint exception list item.

Base Command

es-kibana-endpoint-exception-list-item-update

Input

Context Output

Command Example

!es-kibana-endpoint-exception-list-item-update item_id="trusted-process-1" name="Trusted process updated" description="Updated description" entries_field="process.name" entries_type="match" entries_operator="included" entries_value="safe_process.exe"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "EndpointExceptionListItem": {
                "id": "1234",
                "item_id": "trusted-process-1",
                "list_id": "endpoint_list",
                "name": "Trusted process updated",
                "description": "Updated description",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Endpoint Exception List Item

ID	Item ID	List ID	Name	Description	Creation date
1234	trusted-process-1	endpoint_list	Trusted process updated	Updated description	2024-01-15T10:00:00.000Z

es-kibana-endpoint-exception-list-item-delete

Delete an Elastic Endpoint exception list item.

Base Command

es-kibana-endpoint-exception-list-item-delete

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-endpoint-exception-list-item-delete item_id="trusted-process-1"

Context Example

{}

Human Readable Output

The item trusted-process-1 has been successfully deleted.

es-kibana-endpoint-exception-list-item-list

Retrieves Elastic Endpoint exception list items.

Base Command

es-kibana-endpoint-exception-list-item-list

Input

Context Output

Command Example

#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "EndpointExceptionListItem": [
                {
                    "id": "1234",
                    "item_id": "trusted-process-1",
                    "list_id": "endpoint_list",
                    "name": "Trusted process",
                    "description": "Allow known safe process",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Endpoint Exception List Items

ID	Item ID	List ID	Name	Description	Creation date
1234	trusted-process-1	endpoint_list	Trusted process	Allow known safe process	2024-01-15T10:00:00.000Z

es-kibana-exception-list-list

Get a list of all exception list containers.

Base Command

es-kibana-exception-list-list

Input

Context Output

Command Example

#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionList": [
                {
                    "id": "1234",
                    "list_id": "my-exception-list",
                    "name": "My Exception List",
                    "description": "Exceptions for trusted processes",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Exception Lists

Exception list ID	List ID	Name	Description	Creation date
1234	my-exception-list	My Exception List	Exceptions for trusted processes	2024-01-15T10:00:00.000Z

es-kibana-exception-list-create

Create an exception list.

Base Command

es-kibana-exception-list-create

Input

Context Output

Command Example

!es-kibana-exception-list-create type="detection" name="My Exception List" description="Exceptions for trusted processes" list_id="my-exception-list"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionList": {
                "id": "1234",
                "list_id": "my-exception-list",
                "name": "My Exception List",
                "description": "Exceptions for trusted processes",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List

Exception list ID	List ID	Name	Description	Creation date
1234	my-exception-list	My Exception List	Exceptions for trusted processes	2024-01-15T10:00:00.000Z

es-kibana-exception-list-update

Updates an existing exception list.

Base Command

es-kibana-exception-list-update

Input

Context Output

Command Example

!es-kibana-exception-list-update exception_list_id="1234" name="My Exception List Updated" description="Updated description" type="detection"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionList": {
                "id": "1234",
                "list_id": "my-exception-list",
                "name": "My Exception List Updated",
                "description": "Updated description",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List

Exception list ID	List ID	Name	Description	Creation date
1234	my-exception-list	My Exception List Updated	Updated description	2024-01-15T10:00:00.000Z

es-kibana-exception-list-delete

Delete an exception list using the id or list_id field.

Base Command

es-kibana-exception-list-delete

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-exception-list-delete list_id="my-exception-list"

Context Example

{}

Human Readable Output

The exception list my-exception-list has been successfully deleted.

es-kibana-exception-list-item-list

Get a list of all exception list items in the specified list.

Base Command

es-kibana-exception-list-item-list

Input

Context Output

Command Example

!es-kibana-exception-list-item-list exception_list_id="my-exception-list"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionListItem": [
                {
                    "id": "1234",
                    "item_id": "my-item-1",
                    "list_id": "my-exception-list",
                    "name": "Trusted IP",
                    "description": "Known safe IP address",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Exception List Items

ID	Item ID	List ID	Name	Description	Creation date
1234	my-item-1	my-exception-list	Trusted IP	Known safe IP address	2024-01-15T10:00:00.000Z

es-kibana-exception-list-item-create

Create an exception item and associate it with the specified exception list.

Base Command

es-kibana-exception-list-item-create

Input

Context Output

Command Example

!es-kibana-exception-list-item-create list_id="my-exception-list" name="Trusted IP" description="Known safe IP address" entries_field="source.ip" entries_type="match" entries_operator="included" entries_value="192.168.1.1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionListItem": {
                "id": "1234",
                "item_id": "my-item-1",
                "list_id": "my-exception-list",
                "name": "Trusted IP",
                "description": "Known safe IP address",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List Item

ID	Item ID	List ID	Name	Description	Creation date
1234	my-item-1	my-exception-list	Trusted IP	Known safe IP address	2024-01-15T10:00:00.000Z

es-kibana-exception-item-list-update

Updates an existing exception list item.

Base Command

es-kibana-exception-item-list-update

Input

Context Output

Command Example

!es-kibana-exception-item-list-update item_id="my-item-1" name="Trusted IP updated" description="Updated safe IP" entries_field="source.ip" entries_type="match" entries_operator="included" entries_value="192.168.1.1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ExceptionListItem": {
                "id": "1234",
                "item_id": "my-item-1",
                "list_id": "my-exception-list",
                "name": "Trusted IP updated",
                "description": "Updated safe IP",
                "updated_at": "2024-01-15T12:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Exception List Item Updated

Exception list item ID	Item Id	List ID	Name	Description	Update date
1234	my-item-1	my-exception-list	Trusted IP updated	Updated safe IP	2024-01-15T12:00:00.000Z

es-kibana-exception-list-item-delete

Deletes an exception list item.

Base Command

es-kibana-exception-list-item-delete

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-exception-list-item-delete item_id="my-item-1"

Context Example

{}

Human Readable Output

The exception list item my-item-1 has been successfully deleted.

es-kibana-value-lists-list

Retrieves details of a value list (the list container).

Base Command

es-kibana-value-lists-list

Input

Context Output

Command Example

#### Context Example

```json
{
    "Elasticsearch": {
        "Kibana": {
            "ValueList": [
                {
                    "id": "1234",
                    "name": "trusted-ips",
                    "description": "List of trusted IP addresses",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Value Lists

Value list ID	Name	Description	Creation date
1234	trusted-ips	List of trusted IP addresses	2024-01-15T10:00:00.000Z

es-kibana-value-list-item-get

Retrieves value list items.

Base Command

es-kibana-value-list-item-get

Input

Context Output

Command Example

!es-kibana-value-list-item-get value_list_id="1234"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": [
                {
                    "id": "5678",
                    "list_id": "1234",
                    "value": "192.168.1.1",
                    "created_at": "2024-01-15T10:00:00.000Z"
                }
            ]
        }
    }
}

Human Readable Output

Kibana Value List Items

Value list item ID	List ID	Value	Creation date
5678	1234	192.168.1.1	2024-01-15T10:00:00.000Z

es-kibana-value-list-item-create

Adds a new item to a value list.

Base Command

es-kibana-value-list-item-create

Input

Context Output

Command Example

!es-kibana-value-list-item-create value_list_id="1234" value="10.0.0.1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": {
                "id": "5678",
                "list_id": "1234",
                "value": "10.0.0.1",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Value List Item

Value list item ID	List ID	Value	Creation date
5678	1234	10.0.0.1	2024-01-15T10:00:00.000Z

es-kibana-value-list-item-update

Updates an existing value list item.

Base Command

es-kibana-value-list-item-update

Input

Context Output

Command Example

!es-kibana-value-list-item-update value_list_item_id="5678" value="10.0.0.2"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": {
                "id": "5678",
                "list_id": "1234",
                "value": "10.0.0.2",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Value List Item

Value list item ID	List ID	Value	Creation date
5678	1234	10.0.0.2	2024-01-15T10:00:00.000Z

es-kibana-value-list-item-delete

Deletes a value list item.

Base Command

es-kibana-value-list-item-delete

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-value-list-item-delete value_list_item_id="5678"

Context Example

{}

Human Readable Output

The value list item 5678 has been successfully deleted.

es-kibana-value-list-item-export

Exports all items of a value list as a file (returned to the War Room).

Base Command

es-kibana-value-list-item-export

Input

Context Output

There is no context output for this command.

Command Example

!es-kibana-value-list-item-export value_list_id="1234"

Context Example

{}

Human Readable Output

The value list 1234 has been exported successfully.

es-kibana-value-list-item-import

Import value list items from a TXT or CSV file.

Base Command

es-kibana-value-list-item-import

Input

Context Output

Command Example

!es-kibana-value-list-item-import value_list_id="1234" entry_id="1@1"

Context Example

{
    "Elasticsearch": {
        "Kibana": {
            "ValueListItem": {
                "id": "5678",
                "list_id": "1234",
                "value": "10.0.0.1",
                "created_at": "2024-01-15T10:00:00.000Z"
            }
        }
    }
}

Human Readable Output

Kibana Value List Item

Value list item ID	List ID	Value	Creation date
5678	1234	10.0.0.1	2024-01-15T10:00:00.000Z

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

• Fetch incidents

</~PLATFORM>