Elasticsearch v2

Search for and analyze data in real time. Supports version 6 and later.

Category

Database

Pack

Elasticsearch

Configuration parameters

• url — Server URL
• kibana_url — Kibana Server URL
• auth_type — Authorization type (required)
• api_key_auth_credentials — API key ID
• credentials — Username
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• client_type — Client type
• fetch_index — Index to fetch incidents from
• fetch_query — Query String
• fetch_fields — Fields to Fetch
• fetch_time_field — Index time field
• raw_query — Raw Query
• time_method — Time field type
• map_labels — Map JSON fields into labels
• fetch_time — First fetch timestamp
• fetch_size — The maximum number of results per fetch
• timeout — Request timeout (in seconds).
• incidentType — Incident type
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• space_id — Space ID
• fetch_incident_type — Fetch incident types
• mirror_direction — Incident Mirroring Direction
• fetch_severity — Fetch cases by Severity
• fetch_status — Fetch cases by Status
• fetch_alerts_for_case — Fetch alerts for case
• close_incident — Close Mirrored XSOAR Incident
• close_elastic_incident — Close Mirrored Elasticsearch Incident

Commands (48)

• es-eql-search — Search using EQL query.
• es-esql-search — Search using ES|QL query. (Elastic >=8.11).
• es-get-indices-statistics — Returns Elasticsearch indices statistics and information. This command is not supported for client type OpenSearch.
• es-index — Indexes a document into an Elasticsearch index.
• es-integration-health-check — Returns the health status of the integration. This commmand should be used for debugging purposes.
• es-kibana-alerting-health-get — Retrieves the health of the Kibana alerting framework.
• es-kibana-case-alerts-list — Retrieves all alerts for a case.
• es-kibana-case-comment-add — Add a case comment or alert.
• es-kibana-case-comment-delete — Deletes all comments and alerts from a case.
• es-kibana-case-comment-update — Update a case comment or alert.
• es-kibana-case-create — Creates a new case in Kibana.
• es-kibana-case-delete — Deletes one or more cases by ID.
• es-kibana-case-file-attach — Attach a file to a case.
• es-kibana-case-list — Retrieves the details of Kibana cases.
• es-kibana-case-update — Update cases in Kibana.
• es-kibana-detection-alert-status-set — Set the status of one or more detection alerts.
• es-kibana-endpoint-exception-list-item-create — Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.
• es-kibana-endpoint-exception-list-item-delete — Delete an Elastic Endpoint exception list item.
• es-kibana-endpoint-exception-list-item-list — Retrieves Elastic Endpoint exception list items.
• es-kibana-endpoint-exception-list-item-update — Update an Elastic Endpoint exception list item.
• es-kibana-exception-item-list-update — Updates an existing exception list item.
• es-kibana-exception-list-create — Create an exception list.
• es-kibana-exception-list-delete — Delete an exception list using the id or list_id field.
• es-kibana-exception-list-item-create — Create an exception item and associate it with the specified exception list.
• es-kibana-exception-list-item-delete — Deletes an exception list item.
• es-kibana-exception-list-item-list — Get a list of all exception list items in the specified list.
• es-kibana-exception-list-list — Get a list of all exception list containers.
• es-kibana-exception-list-update — Updates an existing exception list.
• es-kibana-rule-alert-mute — Mute an alert, or mute all alerts for a rule.
• es-kibana-rule-alert-unmute — Unmute an alert, or unmute all alerts for a rule.
• es-kibana-rule-disable — Disable a rule.
• es-kibana-rule-enable — Enable a rule.
• es-kibana-rule-list — Retrieves information about rules.
• es-kibana-rule-types-list — Retrieves all rule types available in Kibana.
• es-kibana-rule-update — Update a rule.
• es-kibana-value-list-item-create — Adds a new item to a value list.
• es-kibana-value-list-item-delete — Deletes a value list item.
• es-kibana-value-list-item-export — Exports all items of a value list as a file (returned to the War Room).
• es-kibana-value-list-item-get — Retrieves value list items.
• es-kibana-value-list-item-import — Import value list items from a TXT or CSV file.
• es-kibana-value-list-item-update — Updates an existing value list item.
• es-kibana-value-lists-list — Retrieves details of a value list (the list container).
• es-search — Queries an index.
• get-mapping-fields — Returns the schema of the index to fetch from. This commmand should be used for debugging purposes.
• get-modified-remote-data — Gets the list of incidents that were modified since the last update time. This command is used for mirroring in and should be used for debugging purposes.
• get-remote-data — Gets remote data of a specific incident. This command is used for mirroring in and should be used for debugging purposes.
• search — Searches an index.
• update-remote-system — Updates the remote system with local incident changes. This command is used for mirroring out and should be used for debugging purposes.