category: Database
provider: Elastic
sectionorder:
- Connect
- Collect
commonfields:
  id: Elasticsearch v2
  version: -1
configuration:
- display: Server URL
  name: url
  required: false
  type: 0
  additionalinfo: The Elasticsearch server to which the integration connects. Ensure that the URL includes the correct Elasticsearch port. The default port for Elasticsearch v7 and below is 9200. Use the Server URL for on-premises deployments.
  section: Connect
- display: Kibana Server URL
  name: kibana_url
  required: false
  type: 0
  additionalinfo: The Kibana server used by the es-kibana-* commands and by fetching and mirroring security alerts and cases. Required for on-premises (self-managed) deployments, where Kibana is usually hosted separately from Elasticsearch (for example, https://kibana.example.com:5601). If left empty, the Kibana URL is derived from the Server URL, which is supported only for Elastic Cloud deployments whose hostname contains ".es." (the segment is replaced with ".kb.").
  section: Connect
  advanced: true
- display: Authorization type
  defaultvalue: Basic auth
  additionalinfo: |-
    Select the authentication type and enter the appropriate credentials:
    - Basic Auth: Enter Username and Password.
    - Bearer Auth: Enter Username and Password.
    - API Key Auth: Enter the API Key ID and API Key.
  name: auth_type
  options:
  - Basic auth
  - Bearer auth
  - API key auth
  type: 15
  section: Connect
  required: true
- additionalinfo: Use for API key auth
  display: API key ID
  displaypassword: API Key
  name: api_key_auth_credentials
  type: 9
  section: Connect
  required: false
- additionalinfo: Use for Basic auth. Optionally you can use Username as an API key ID and Password as an API key for API Key auth.
  display: Username
  name: credentials
  type: 9
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: Elasticsearch
  additionalinfo: In some hosted ElasticSearch environments, the standard ElasticSearch client is not supported. If you encounter any related client issues, please consider using the OpenSearch client type.
  display: Client type
  name: client_type
  options:
  - Elasticsearch
  - OpenSearch
  - Elasticsearch_v8
  - Elasticsearch_v9
  type: 15
  section: Connect
  advanced: true
  required: false
- display: Index to fetch incidents from
  name: fetch_index
  type: 0
  section: Collect
  required: false
  additionalinfo: CSV
- display: Query String
  name: fetch_query
  type: 0
  additionalinfo: |-
    Query string uses the Lucene syntax.
    For more information about the Lucene syntax, see the link in the help section.
    The query will be used when fetching incidents. Index time field will be used as a filter in the query.

    The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
  section: Collect
  required: false
- display: Fields to Fetch
  name: fetch_fields
  type: 0
  section: Collect
  required: false
  additionalinfo: Comma-separated list of fields to fetch (the `_source` field is always included).
- display: Index time field
  name: fetch_time_field
  type: 0
  section: Collect
  required: false
  additionalinfo: The time field used for sorting and limiting results. If using a nested field, separate field names with dot notation.
- display: Raw Query
  name: raw_query
  type: 12
  additionalinfo: |-
    Raw Query allows raw DSL queries and will override the 'Query String' Lucene syntax string.
    Results will not be filtered or sorted. Use additional parameters in the raw query for these purposes.
    For more information see the link in the help section.

    The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
  section: Collect
  advanced: true
  required: false
- display: Time field type
  defaultvalue: 'Simple-Date'
  name: time_method
  type: 15
  options:
  - Simple-Date
  - Timestamp-Seconds
  - Timestamp-Milliseconds
  section: Collect
  advanced: true
  required: false
  additionalinfo: For more information see the explanation in the help section.
- defaultvalue: 'true'
  display: Map JSON fields into labels
  name: map_labels
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: '3 days'
  display: First fetch timestamp
  name: fetch_time
  type: 0
  section: Collect
  required: false
  additionalinfo: <number> <time unit>, e.g., 12 hours, 7 days
- defaultvalue: '50'
  display: The maximum number of results per fetch
  name: fetch_size
  type: 0
  section: Collect
  required: false
- display: Request timeout (in seconds).
  name: timeout
  type: 0
  defaultvalue: '60'
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - xsiam
  - agentix
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - xsiam
  - agentix
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
  supportedModules:
  - xsiam
  - agentix
- display: Space ID
  name: space_id
  type: 0
  section: Connect
  advanced: true
  required: false
  additionalinfo: The default Kibana space ID to use for es-kibana-* commands. Used to derive the Kibana base URL from the Server URL. If a space_id argument is provided to a command, it overrides this value. See https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
- display: Fetch incident types
  name: fetch_incident_type
  defaultvalue: Elasticsearch Entity
  type: 15
  options:
  - Elasticsearch Entity
  - Elasticsearch Security Alert
  - Elasticsearch Case
  section: Collect
  required: false
  additionalinfo: The type of incident to fetch from Elasticsearch (Security Alert, Case, or other entity).
- display: Incident Mirroring Direction
  name: mirror_direction
  defaultvalue: None
  type: 15
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  section: Collect
  required: false
  additionalinfo: The mirroring direction. Mirroring works only for incident types Elasticsearch Security Alert and Elasticsearch Case.
- display: Fetch cases by Severity
  name: fetch_severity
  type: 16
  options:
  - critical
  - high
  - medium
  - low
  section: Collect
  advanced: true
  required: false
  additionalinfo: The case severities to fetch. If none is chosen, all severity levels will be returned. Relevant only for incident type Elasticsearch Case.
- display: Fetch cases by Status
  name: fetch_status
  defaultvalue: open,in-progress
  type: 16
  options:
  - open
  - acknowledged
  - in-progress
  - closed
  section: Collect
  advanced: true
  required: false
  additionalinfo: The case statuses to fetch. If none is chosen, in-progress and open will be returned. Relevant only for incident type Elasticsearch Case.
- display: Fetch alerts for case
  name: fetch_alerts_for_case
  type: 8
  defaultvalue: 'false'
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether to fetch alerts associated with each Elasticsearch Case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges.
- display: Close Mirrored XSOAR Incident
  name: close_incident
  type: 8
  defaultvalue: 'false'
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether closing the Elasticsearch alert or case is mirrored in Cortex XSOAR.
- display: Close Mirrored Elasticsearch Incident
  name: close_elastic_incident
  type: 8
  defaultvalue: 'false'
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether closing the Cortex XSOAR incident is mirrored in Elasticsearch.
description: "Search for and analyze data in real time. \n Supports version 6 and later."
display: Elasticsearch v2
name: Elasticsearch v2
script:
  commands:
  - arguments:
    - description: The index in which to perform a search.
      name: index
      required: true
    - description: The string to query (in Lucene syntax).
      name: query
      predefined:
      - ''
    - description: A comma-separated list of document fields to fetch. If empty, the entire document is fetched.
      isArray: true
      name: fields
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Calculates an explanation of a score for a query. For example, "value:1.6943597".
      name: explain
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '0'
      description: The page number from which to start a search.
      name: page
    - defaultValue: '100'
      description: The number of documents displayed per page. Can be an integer between "1" and "10,000".
      name: size
    - description: The field by which to sort the results table. The supported result types are boolean, numeric, date, and keyword fields. Keyword fields require the doc_values parameter to be set to "true" from the Elasticsearch server.
      name: sort-field
      predefined:
      - ''
    - auto: PREDEFINED
      defaultValue: asc
      description: The order by which to sort the results table. The results tables can only be sorted if a sort-field is defined.
      name: sort-order
      predefined:
      - asc
      - desc
    - description: Will overwrite the ‘query' arguments.
      name: query_dsl
    - description: The starting time of the time range.
      name: timestamp_range_start
    - description: The ending time of the time range.
      name: timestamp_range_end
    - description: Timestamp field name.
      defaultValue: "@timestamp"
      name: timestamp_field
    description: Queries an index.
    name: es-search
    outputs:
    - contextPath: Elasticsearch.Search.Results._index
      description: The index to which the document belongs.
      type: String
    - contextPath: Elasticsearch.Search.Results._id
      description: The ID of the document.
      type: String
    - contextPath: Elasticsearch.Search.Results._type
      description: The mapping type of the document.
      type: String
    - contextPath: Elasticsearch.Search.max_score
      description: The maximum relevance score of a query.
      type: Number
    - contextPath: Elasticsearch.Search.Query
      description: The query performed in the search.
      type: String
    - contextPath: Elasticsearch.Search.total.value
      description: The number of search results.
      type: Number
    - contextPath: Elasticsearch.Search.Results._score
      description: The relevance score of the search result.
      type: Number
    - contextPath: Elasticsearch.Search.Index
      description: The index in which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.Server
      description: The server on which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.timed_out
      description: Whether the search stopped due to a timeout.
      type: Boolean
    - contextPath: Elasticsearch.Search.took
      description: The time in milliseconds taken for the search to complete.
      type: Number
    - contextPath: Elasticsearch.Search.Page
      description: The page number from which the search started.
      type: Number
    - contextPath: Elasticsearch.Search.Size
      description: The maximum number of scores that a search can return.
      type: Number
  - arguments:
    - description: The index in which to perform a search.
      name: index
      required: true
    - description: The string to query (in Lucene syntax).
      name: query
      predefined:
      - ''
    - description: A comma-separated list of document fields to fetch. If empty, fetches the entire document.
      isArray: true
      name: fields
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Calculates an explanation of a score for a query. For example, "value:1.6943597".
      name: explain
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '0'
      description: The page number from which to start a search.
      name: page
    - defaultValue: '100'
      description: The number of documents displayed per page. Can be an integer between "1" and "10,000".
      name: size
    - description: The field by which to sort the results table. The supported result types are boolean, numeric, date, and keyword fields. Keyword fields require the doc_values parameter to be set to "true" from the Elasticsearch server.
      name: sort-field
      predefined:
      - ''
    - auto: PREDEFINED
      defaultValue: asc
      description: The order by which to sort the results table. The results tables can only be sorted if a sort-field is defined.
      name: sort-order
      predefined:
      - asc
      - desc
    - description: Timestamp field name.
      defaultValue: "@timestamp"
      name: timestamp_field
    description: Searches an index.
    name: search
    outputs:
    - contextPath: Elasticsearch.Search.Results._index
      description: The index to which the document belongs.
      type: String
    - contextPath: Elasticsearch.Search.Results._id
      description: The ID of the document.
      type: String
    - contextPath: Elasticsearch.Search.Results._type
      description: The mapping type of the document.
      type: String
    - contextPath: Elasticsearch.Search.max_score
      description: The maximum relevance score of a query.
      type: Number
    - contextPath: Elasticsearch.Search.Query
      description: The query performed in the search.
      type: String
    - contextPath: Elasticsearch.Search.total.value
      description: The number of search results.
      type: Number
    - contextPath: Elasticsearch.Search.Results._score
      description: The relevance score of the search result.
      type: Number
    - contextPath: Elasticsearch.Search.Index
      description: The index in which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.Server
      description: The server on which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.timed_out
      description: Whether the search stopped due to a time out.
      type: Boolean
    - contextPath: Elasticsearch.Search.took
      description: The time in milliseconds taken for the search to complete.
      type: Number
    - contextPath: Elasticsearch.Search.Page
      description: The page number from which the search started.
      type: Number
    - contextPath: Elasticsearch.Search.Size
      description: The maximum number of scores that a search can return.
      type: Number
  - name: get-mapping-fields
    description: Returns the schema of the index to fetch from. This commmand should be used for debugging purposes.
  - name: get-remote-data
    description: Gets remote data of a specific incident. This command is used for mirroring in and should be used for debugging purposes.
    arguments:
    - name: id
      required: true
      description: The remote incident ID.
    - name: lastUpdate
      description: The ISO format date with timezone. Retrieves entries that were created after lastUpdate.
  - name: get-modified-remote-data
    description: Gets the list of incidents that were modified since the last update time. This command is used for mirroring in and should be used for debugging purposes.
    arguments:
    - name: lastUpdate
      description: The ISO format date with timezone. Retrieves entries that were modified after lastUpdate.
  - name: update-remote-system
    description: Updates the remote system with local incident changes. This command is used for mirroring out and should be used for debugging purposes.
    arguments:
    - name: remoteId
      description: The remote incident ID.
    - name: data
      description: The data of the incident to update in the remote system.
    - name: entries
      description: The entries to update in the remote system.
    - name: incidentChanged
      description: Whether the incident has changed.
    - name: delta
      description: The fields that changed in the incident.
    - name: status
      description: The status of the incident.
  - name: es-integration-health-check
    description: Returns the health status of the integration. This commmand should be used for debugging purposes.
  - name: es-get-indices-statistics
    description: Returns Elasticsearch indices statistics and information. This command is not supported for client type OpenSearch.
    arguments:
    - description: The maximum number of indices to return.
      name: limit
      required: false
      defaultValue: '50'
    - description: Whether to retrieve all the Elasticsearch indices. If true, the "limit" argument will be ignored.
      name: all_results
      required: false
      defaultValue: false
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
    outputs:
    - contextPath: Elasticsearch.IndexStatistics.Name
      description: The name of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.Status
      description: The status of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.Health
      description: The health status of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.UUID
      description: The UUID of the index.
      type: String
    - contextPath: Elasticsearch.IndexStatistics.DocumentsCount
      description: The number of documents that are indexed in the index.
      type: Number
    - contextPath: Elasticsearch.IndexStatistics.DocumentsDeleted
      description: The number of documents that were deleted from the index.
      type: Number
  - description: Search using EQL query.
    name: es-eql-search
    arguments:
    - description: The index in which to perform a search.
      name: index
      required: true
    - description: The string to query (in Lucene syntax).
      name: query
      required: true
    - description: A comma-separated list of document fields to fetch. If empty, fetches the entire document.
      isArray: true
      name: fields
    - description: If two or more events share the same timestamp, Elasticsearch uses a tiebreaker field value to sort the events in ascending order.
      name: sort-tiebreaker
    - description: Filter using query DSL.
      name: filter
    - defaultValue: event.category
      description: The event category field.
      name: event_category_field
    - defaultValue: '100'
      description: The number of documents displayed per page. Can be an integer between "1" and "10,000".
      name: size
    - description: The starting time of the time range.
      name: timestamp_range_start
    - description: The ending time of the time range.
      name: timestamp_range_end
    - description: Timestamp field name.
      defaultValue: "@timestamp"
      name: timestamp_field
    outputs:
    - contextPath: Elasticsearch.Search.Results._index
      description: The index to which the document belongs.
      type: String
    - contextPath: Elasticsearch.Search.Results._id
      description: The ID of the document.
      type: String
    - contextPath: Elasticsearch.Search.Results._type
      description: The mapping type of the document.
      type: String
    - contextPath: Elasticsearch.Search.max_score
      description: The maximum relevance score of a query.
      type: Number
    - contextPath: Elasticsearch.Search.Query
      description: The query performed in the search.
      type: String
    - contextPath: Elasticsearch.Search.total.value
      description: The number of search results.
      type: Number
    - contextPath: Elasticsearch.Search.Results._score
      description: The relevance score of the search result.
      type: Number
    - contextPath: Elasticsearch.Search.Index
      description: The index in which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.Server
      description: The server on which the search was performed.
      type: String
    - contextPath: Elasticsearch.Search.timed_out
      description: Whether the search stopped due to a timeout.
      type: Boolean
    - contextPath: Elasticsearch.Search.took
      description: The time in milliseconds taken for the search to complete.
      type: Number
    - contextPath: Elasticsearch.Search.Page
      description: The page number from which the search started.
      type: Number
    - contextPath: Elasticsearch.Search.Size
      description: The maximum number of scores that a search can return.
      type: Number
  - name: es-index
    arguments:
    - name: index_name
      required: true
      description: The name of the index to ingest into.
    - name: document
      required: true
      description: The document object (JSON format) to be indexed. See Elasticsearch documentation (https://www.elastic.co/guide/en/elasticsearch/client/python-api/current/examples.html#ex-index) for further information about indexing documents.
    - name: id
      description: The ID of the indexed document (will be generated if empty).
    outputs:
    - contextPath: Elasticsearch.Index.id
      description: The ID of the indexed document.
      type: string
    - contextPath: Elasticsearch.Index.index
      description: The name of the index which the document was ingested to.
      type: string
    - contextPath: Elasticsearch.Index.version
      description: The version number of the indexed document.
      type: number
    - contextPath: Elasticsearch.Index.result
      description: The result of the index operation.
      type: string
    description: Indexes a document into an Elasticsearch index.
  - name: es-esql-search
    arguments:
    - description: The ES|QL query string to execute using piped syntax (for example, FROM index | WHERE field == "value").
      name: query
      required: true
    - description: Maximum number of results to return.
      name: limit
    description: Search using ES|QL query. (Elastic >=8.11).
    outputs:
    - contextPath: Elasticsearch.ESQLSearch
      description: ES|QL search result.
  - name: es-kibana-case-create
    description: Creates a new case in Kibana.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: assignee_uid
      isArray: true
      description: An array containing users that are assigned to the case. Not more than 10 elements.
    - name: category
      description: A word or phrase that categorizes the case. Maximum length is 50.
    - name: connector_fields
      description: A JSON object containing the connector fields. To create a case without a connector, specify null.
    - name: connector_id
      description: The identifier for the connector. To create a case without a connector, use none.
    - name: connector_name
      description: The name of the connector. To create a case without a connector, use none.
    - name: connector_type
      description: The type of connector. To create a case without a connector, use .none.
      auto: PREDEFINED
      predefined:
      - .none
      - .cases-webhook
      - .jira
      - .resilient
      - .servicenow
      - .servicenow-sir
      - .swimlane
    - name: connector_fields_issue_type_jira
      description: The type of issue.
    - name: connector_fields_parent_jira
      description: The key of the parent issue, when the issue type is sub-task.
    - name: connector_fields_priority_jira
      description: The priority of the issue.
    - name: connector_fields_issue_types_resilient
      isArray: true
      description: The type of incident.
    - name: connector_fields_severity_code_resilient
      description: The severity code of the incident.
    - name: connector_fields_category_servicenow
      description: The category of the incident.
    - name: connector_fields_impact_servicenow
      description: The effect an incident had on business.
    - name: connector_fields_severity_servicenow
      description: The severity of the incident.
    - name: connector_fields_subcategory_servicenow
      description: The subcategory of the incident.
    - name: connector_fields_urgency_servicenow
      description: The extent to which the incident resolution can be delayed.
    - name: connector_fields_dest_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of destination IPs.
    - name: connector_fields_malware_hash_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware hashes.
    - name: connector_fields_malware_url_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware URLs.
    - name: connector_fields_priority_servicenow
      description: The priority of the issue.
    - name: connector_fields_source_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of source IPs.
    - name: connector_fields_case_id_swimlane
      description: The case identifier for Swimlane connectors.
    - name: custom_key
      description: The unique identifier for the custom field. The key value must exist in the case configuration settings.
    - name: custom_type
      auto: PREDEFINED
      predefined:
      - text
      - toggle
      description: The custom field type. It must match the type specified in the case configuration settings.
    - name: custom_value
      description: The custom field value (string or boolean).
    - name: description
      description: The description for the case. Maximum length is 30000.
    - name: owner
      required: true
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.'
    - name: extract_observables
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments.
    - name: sync_alerts
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Turns alert syncing on or off.
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      description: The severity of the case.
    - name: tags
      isArray: true
      description: The words and phrases that help categorize cases. Not more than 200 elements.
    - name: title
      description: A title for the case. Maximum length is 160.
    - name: entry_id
      description: Entry ID for the file containing the full request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.title
      description: The title of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.description
      description: The description of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.owner
      description: The owner of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.status
      description: The status of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.created_at
      description: The creation date of the case.
      type: Date
    - contextPath: Elasticsearch.Kibana.Case.connector.type
      description: The connector type of the case.
      type: String
  - name: es-kibana-case-update
    description: Update cases in Kibana.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case.
    - name: version
      required: true
      description: The current version of the case. To determine this value, use es-kibana-case-list.
    - name: assignee_uid
      isArray: true
      description: An array containing users that are assigned to the case. Not more than 10 elements.
    - name: category
      description: A word or phrase that categorizes the case. Maximum length is 50.
    - name: close_reason
      auto: PREDEFINED
      predefined:
      - false_positive
      - duplicate
      - true_positive
      - benign_positive
      - automated_closure
      - other
      description: The close reason to sync to attached alerts when closing the case.
    - name: connector_fields
      description: A JSON object containing the connector fields. To remove a connector, specify null.
    - name: connector_id
      description: The identifier for the connector. To remove a connector, specify none.
    - name: connector_name
      description: The name of the connector. To remove a connector, specify none.
    - name: connector_type
      auto: PREDEFINED
      predefined:
      - .none
      - .cases-webhook
      - .jira
      - .resilient
      - .servicenow
      - .servicenow-sir
      - .swimlane
      description: The type of connector. To remove a connector, specify .none.
    - name: connector_fields_issue_type_jira
      description: The type of issue.
    - name: connector_fields_parent_jira
      description: The key of the parent issue, when the issue type is sub-task.
    - name: connector_fields_priority_jira
      description: The priority of the issue.
    - name: connector_fields_issue_types_resilient
      isArray: true
      description: The type of incident.
    - name: connector_fields_severity_code_resilient
      description: The severity code of the incident.
    - name: connector_fields_category_servicenow
      description: The category of the incident.
    - name: connector_fields_impact_servicenow
      description: The effect an incident had on business.
    - name: connector_fields_severity_servicenow
      description: The severity of the incident.
    - name: connector_fields_subcategory_servicenow
      description: The subcategory of the incident.
    - name: connector_fields_urgency_servicenow
      description: The extent to which the incident resolution can be delayed.
    - name: connector_fields_dest_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of destination IPs.
    - name: connector_fields_malware_hash_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware hashes.
    - name: connector_fields_malware_url_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of malware URLs.
    - name: connector_fields_priority_servicenow
      description: The priority of the issue.
    - name: connector_fields_source_ip_servicenow
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Indicates whether cases will send a comma-separated list of source IPs.
    - name: connector_fields_case_id_swimlane
      description: The case identifier for Swimlane connectors.
    - name: custom_key
      description: The unique identifier for the custom field. The key value must exist in the case configuration settings.
    - name: custom_type
      auto: PREDEFINED
      predefined:
      - text
      - toggle
      description: The custom field type. It must match the type specified in the case configuration settings.
    - name: custom_value
      description: The custom field value (string or boolean).
    - name: description
      description: The description for the case. Maximum length is 30000.
    - name: extract_observables
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments.
    - name: sync_alerts
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Turns alert syncing on or off.
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      description: The severity of the case.
    - name: status
      auto: PREDEFINED
      predefined:
      - closed
      - in-progress
      - open
      description: The status of the case.
    - name: tags
      isArray: true
      description: The words and phrases that help categorize cases. Not more than 200 elements.
    - name: title
      description: A title for the case. Maximum length is 160.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.title
      description: The title of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.description
      description: The description of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.owner
      description: The owner of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.status
      description: The status of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.created_at
      description: The creation date of the case.
      type: Date
    - contextPath: Elasticsearch.Kibana.Case.connector.type
      description: The connector type of the case.
      type: String
  - name: es-kibana-case-delete
    description: Deletes one or more cases by ID.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      isArray: true
      description: The cases that you want to remove. To get the case identifiers, use es-kibana-case-list.
  - name: es-kibana-case-list
    description: Retrieves the details of Kibana cases.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      description: The identifier for the case. To retrieve case IDs, use the search cases API (leave empty).
    - name: assignees
      isArray: true
      description: Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles.
    - name: category
      isArray: true
      description: Filters the returned cases by category.
    - name: default_search_operator
      auto: PREDEFINED
      predefined:
      - OR
      - AND
      description: The default operator to use for the simple_query_string.
    - name: search
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
    - name: from
      description: Returns only cases that were created after a specific date (KQL data range or date match expression).
    - name: to
      description: Returns only cases that were created before a specific date (KQL data range or date match expression).
    - name: owner
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: A filter to limit the response to a specific set of applications.
    - name: reporters
      isArray: true
      description: Filters the returned cases by the user name of the reporter.
    - name: search_fields
      auto: PREDEFINED
      predefined:
      - description
      - title
      description: The fields to perform the simple_query_string parsed query against.
    - name: severity
      auto: PREDEFINED
      predefined:
      - critical
      - high
      - medium
      - low
      description: The severity of the case.
    - name: sort_field
      auto: PREDEFINED
      predefined:
      - createdAt
      - updatedAt
      - closedAt
      - title
      - category
      - status
      - severity
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: status
      auto: PREDEFINED
      predefined:
      - closed
      - in-progress
      - open
      description: Filters the returned cases by state.
    - name: tags
      description: Filters the returned cases by tags.
    - name: page
      defaultValue: '1'
      description: The page number from which to start a search.
    - name: size
      defaultValue: '20'
      description: The number of items to return. Limited to 100 items.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.title
      description: The title of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.description
      description: The description of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.owner
      description: The owner of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.status
      description: The status of the case.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.created_at
      description: The creation date of the case.
      type: Date
    - contextPath: Elasticsearch.Kibana.Case.connector.type
      description: The connector type of the case.
      type: String
  - name: es-kibana-case-alerts-list
    description: Retrieves all alerts for a case.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: limit
      defaultValue: '50'
      description: Limit on the number of keys to return.
    - name: offset
      defaultValue: '0'
      description: Starting record index to begin retrieving records from.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.Alert.id
      description: The alert ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.Alert.index
      description: The alert index.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.Alert.attached_at
      description: The date the alert was attached to the case.
      type: Date
  - name: es-kibana-case-comment-add
    description: Add a case comment or alert.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: alert_id
      isArray: true
      description: The alert identifiers. Required only when type is alert.
    - name: index
      isArray: true
      description: The alert indices. Required only when type is alert.
    - name: owner
      required: true
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.'
    - name: rule_id
      description: The rule identifier.
    - name: rule_name
      description: The rule name.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - alert
      - user
      description: The type of comment.
    - name: comment
      description: The new comment. Required only when type is user. Maximum length is 30000.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.comment
      description: The comment text.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.created_by.username
      description: The user who created the comment.
      type: String
  - name: es-kibana-case-comment-update
    description: Update a case comment or alert.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: comment_id
      description: The identifier for the comment.
    - name: comment
      description: The new comment. Required only when type is user. Maximum length is 30000.
    - name: alert_id
      isArray: true
      description: The alert identifiers. Required only when type is alert.
    - name: index
      isArray: true
      description: The alert indices. Required only when type is alert.
    - name: owner
      required: true
      auto: PREDEFINED
      predefined:
      - cases
      - observability
      - securitySolution
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.'
    - name: rule_id
      description: The rule identifier.
    - name: rule_name
      description: The rule name.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - alert
      - user
      description: The type of comment.
    - name: version
      description: The current comment version. To retrieve version values, use the get comments API.
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.comment
      description: The comment text.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.updated_by.username
      description: The user who updated the comment.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.updated_at
      description: The date the comment was updated.
      type: Date
  - name: es-kibana-case-comment-delete
    description: Deletes all comments and alerts from a case.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
  - name: es-kibana-case-file-attach
    description: Attach a file to a case.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: case_id
      required: true
      description: The identifier for the case. To retrieve case IDs, use es-kibana-case-list.
    - name: entry_id
      required: true
      description: Entry ID for the file that needs to be attached.
    - name: file_name
      description: The desired name of the file being attached to the case (without file extension).
    outputs:
    - contextPath: Elasticsearch.Kibana.Case.id
      description: The case ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Case.comments.updated_by.username
      description: The user who attached the file.
      type: String
  - name: es-kibana-alerting-health-get
    description: Retrieves the health of the Kibana alerting framework.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    outputs:
    - contextPath: Elasticsearch.Kibana.AlertingHealth.is_sufficiently_secure
      description: Whether the alerting framework is sufficiently secure.
      type: Boolean
    - contextPath: Elasticsearch.Kibana.AlertingHealth.has_permanent_encryption_key
      description: Whether a permanent encryption key is configured.
      type: Boolean
    - contextPath: Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.decryption_health.status
      description: The decryption health status.
      type: String
    - contextPath: Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.execution_health.status
      description: The execution health status.
      type: String
    - contextPath: Elasticsearch.Kibana.AlertingHealth.alerting_framework_health.read_health.status
      description: The read health status.
      type: String
  - name: es-kibana-rule-types-list
    description: Retrieves all rule types available in Kibana.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    outputs:
    - contextPath: Elasticsearch.Kibana.RuleType.id
      description: The rule type ID.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.name
      description: The rule type name.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.category
      description: The rule type category.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.producer
      description: The rule type producer.
      type: String
    - contextPath: Elasticsearch.Kibana.RuleType.action_groups.id
      description: The action group ID.
      type: String
  - name: es-kibana-rule-list
    description: Retrieves information about rules.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      description: The identifier for the rule.
    - name: search
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
    - name: default_search_operator
      defaultValue: OR
      auto: PREDEFINED
      predefined:
      - OR
      - AND
      description: The default operator to use for the simple_query_string.
    - name: search_fields
      isArray: true
      description: The fields to perform the simple_query_string parsed query against.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: has_reference_id
      description: Filters the rules that have a relation with the reference objects with a specific identifier.
    - name: has_reference_type
      description: Filters the rules that have a relation with the reference objects with a specific type.
    - name: fields
      isArray: true
      description: The fields to return in the attributes key of the response.
    - name: filter
      description: A KQL string that you filter with an attribute from your saved object.
    - name: filter_consumers
      isArray: true
      description: List of consumers to filter.
    - name: page
      defaultValue: '1'
      description: The page number from which to start a search.
    - name: size
      defaultValue: '10'
      description: The number of rules to return per page.
    outputs:
    - contextPath: Elasticsearch.Kibana.Rule.id
      description: The rule ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Rule.enabled
      description: Whether the rule is enabled.
      type: Boolean
    - contextPath: Elasticsearch.Kibana.Rule.name
      description: The rule name.
      type: String
    - contextPath: Elasticsearch.Kibana.Rule.rule_type_id
      description: The rule type ID.
      type: String
    - contextPath: Elasticsearch.Kibana.Rule.created_at
      description: The creation date of the rule.
      type: Date
  - name: es-kibana-rule-enable
    description: Enable a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
  - name: es-kibana-rule-disable
    description: Disable a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
  - name: es-kibana-rule-update
    description: Update a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
    - name: alert_delay_active
      description: The number of consecutive runs that must meet the rule conditions.
    - name: artifacts_dashboards_id
      isArray: true
      description: Not more than 10 elements.
    - name: artifacts_investigation_guide_blob
      description: Maximum length is 10000.
    - name: consumer
      auto: PREDEFINED
      predefined:
      - alerts
      - apm
      - discover
      - infrastructure
      - logs
      - metrics
      - ml
      - monitoring
      - securitySolution
      - siem
      - stackAlerts
      - uptime
      description: The name of the application or feature that owns the rule.
    - name: flapping_enabled
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Determines whether the rule can enter the flapping state. When provided, flapping_look_back_window and flapping_status_change_threshold are required.
    - name: flapping_look_back_window
      description: The minimum number of runs in which the threshold must be met. Minimum value is 2, maximum value is 20. Required when configuring flapping settings.
    - name: flapping_status_change_threshold
      description: The minimum number of times an alert must switch states within the defined look back window time. Minimum value is 2, maximum value is 20. Required when configuring flapping settings.
    - name: name
      description: The name of the rule.
    - name: notify_when
      auto: PREDEFINED
      predefined:
      - onActionGroupChange
      - onActiveAlert
      - onThrottleInterval
      description: Indicates how frequently rule actions are triggered.
    - name: schedule_interval
      description: The interval is specified in seconds, minutes, hours, or days.
    - name: tags
      isArray: true
      description: The tags for the rule.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.Rule.id
      description: The rule ID.
      type: String
  - name: es-kibana-rule-alert-mute
    description: Mute an alert, or mute all alerts for a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
    - name: alert_id
      description: The identifier for the alert.
    - name: validate_alerts_existence
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to validate the existence of the alert.
    - name: mute_all
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to mute all alerts.
  - name: es-kibana-rule-alert-unmute
    description: Unmute an alert, or unmute all alerts for a rule.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: rule_id
      required: true
      description: The identifier for the rule.
    - name: alert_id
      description: The identifier for the alert.
    - name: unmute_all
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to unmute all alerts.
  - name: es-kibana-detection-alert-status-set
    description: Set the status of one or more detection alerts.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - open
      - acknowledged
      - in-progress
      - closed
      description: The new status of the detection alert(s).
    - name: signal_ids
      isArray: true
      description: List of alert ids. Use field _id on alert document or kibana.alert.uuid.
    - name: query
      description: An Elasticsearch query used to select which alerts to update, as an alternative to signal_ids.
    - name: reason
      auto: PREDEFINED
      predefined:
      - false_positive
      - duplicate
      - true_positive
      - benign_positive
      - automated_closure
      - other
      description: The reason for the status change.
    - name: conflicts
      defaultValue: abort
      auto: PREDEFINED
      predefined:
      - abort
      - proceed
      description: Determines how version conflicts should be handled.
    outputs:
    - contextPath: Elasticsearch.Kibana.SecurityAlertSetStatus.total
      description: The total number of alerts matched by the request.
      type: Number
    - contextPath: Elasticsearch.Kibana.SecurityAlertSetStatus.updated
      description: The number of alerts that were updated.
      type: Number
  - name: es-kibana-endpoint-exception-list-item-create
    description: Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: description
      description: Describes the exception list.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: A string that does not contain only whitespace characters.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name. Minimum length is 1.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception items.
    - name: entry_id
      description: Entry ID for the file containing the full request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-endpoint-exception-list-item-update
    description: Update an Elastic Endpoint exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_item_id
      description: Exception's identifier.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: _version
      description: The version id, normally returned by the API when the item is retrieved.
    - name: description
      description: Describes the exception list.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: A string that does not contain only whitespace characters.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name. Minimum length is 1.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception items.
    - name: entry_id
      description: Entry ID for the file containing the full request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-endpoint-exception-list-item-delete
    description: Delete an Elastic Endpoint exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: item_id
      required: true
      description: Either id or item_id must be specified.
  - name: es-kibana-endpoint-exception-list-item-list
    description: Retrieves Elastic Endpoint exception list items.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: item_id
      description: Either id or item_id must be specified.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      defaultValue: '1'
      description: The page number to return. Minimum value is 0.
    - name: size
      description: The number of exception list items to return per page. Minimum value is 0.
    outputs:
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.EndpointExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-exception-list-list
    description: Get a list of all exception list containers.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_id
      description: Exception list's identifier. Either id or list_id must be specified.
    - name: list_id
      description: Human readable exception list string identifier. Either id or list_id must be specified.
    - name: filter
      description: Filters the returned results according to the value of the specified field.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      defaultValue: '1'
      description: The page number to return. Minimum value is 1.
    - name: size
      description: The number of exception lists to return per page. Minimum value is 1.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionList.id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.list_id
      description: The human-readable exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.name
      description: The exception list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.description
      description: The exception list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.created_at
      description: The creation date of the exception list.
      type: Date
  - name: es-kibana-exception-list-create
    description: Create an exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: description
      description: Describes the exception list.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: meta
      description: Placeholder for metadata about the list container (JSON object).
    - name: name
      description: The name of the exception list.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - detection
      - rule_default
      - endpoint
      - endpoint_trusted_apps
      - endpoint_trusted_devices
      - endpoint_events
      - endpoint_host_isolation_exceptions
      - endpoint_blocklists
      description: The type of exception list to be created.
    - name: version
      description: The document version automatically increased on updates.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionList.id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.list_id
      description: The human-readable exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.name
      description: The exception list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.description
      description: The exception list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.created_at
      description: The creation date of the exception list.
      type: Date
  - name: es-kibana-exception-list-update
    description: Updates an existing exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: _version
      description: The version id, normally returned by the API when the item was retrieved.
    - name: description
      required: true
      description: Describes the exception list.
    - name: exception_list_id
      description: Exception list's identifier.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: meta
      description: Placeholder for metadata about the list container (JSON object).
    - name: name
      required: true
      description: The name of the exception list.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - detection
      - rule_default
      - endpoint
      - endpoint_trusted_apps
      - endpoint_trusted_devices
      - endpoint_events
      - endpoint_host_isolation_exceptions
      - endpoint_blocklists
      description: The type of exception list to be created.
    - name: version
      description: The document version automatically increased on updates.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionList.id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.list_id
      description: The human-readable exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.name
      description: The exception list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.description
      description: The exception list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionList.created_at
      description: The creation date of the exception list.
      type: Date
  - name: es-kibana-exception-list-delete
    description: Delete an exception list using the id or list_id field.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_id
      description: Exception list's identifier. Either id or list_id must be specified.
    - name: list_id
      description: Human readable exception list string identifier. Either id or list_id must be specified.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
  - name: es-kibana-exception-list-item-list
    description: Get a list of all exception list items in the specified list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_item_id
      description: Exception list item's identifier. Either id or item_id must be specified.
    - name: item_id
      description: Human readable exception item string identifier. Either id or item_id must be specified.
    - name: exception_list_id
      isArray: true
      description: The list_ids of the items to fetch.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: search
      description: Free-text search term applied to exception list item fields.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      defaultValue: '1'
      description: The page number to return. Minimum value is 0.
    - name: size
      description: The number of exception list items to return per page. Minimum value is 0.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-exception-list-item-create
    description: Create an exception item and associate it with the specified exception list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: comment
      description: A string that does not contain only whitespace characters.
    - name: description
      description: Describes the exception list.
    - name: expire_time
      description: The exception item's expiration date, in ISO format.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: type
      description: The type of exception list to be created.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: The exception item entry value.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.created_at
      description: The creation date of the exception list item.
      type: Date
  - name: es-kibana-exception-item-list-update
    description: Updates an existing exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: _version
      description: The version ID, normally returned by the API when the item is retrieved.
    - name: comment
      description: A string that does not contain only whitespace characters.
    - name: comment_id
      description: A string that does not contain only whitespace characters.
    - name: description
      description: Describes the exception list.
    - name: expire_time
      description: The exception item's expiration date, in ISO format.
    - name: exception_list_item_id
      description: Exception's identifier.
    - name: item_id
      description: Human readable string identifier, e.g. trusted-linux-processes.
    - name: meta
      description: Additional properties are allowed (JSON object).
    - name: name
      description: Exception list name.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
    - name: type
      description: The type of exception list to be created.
    - name: entries_field
      description: A string that does not contain only whitespace characters.
    - name: entries_operator
      auto: PREDEFINED
      predefined:
      - excluded
      - included
      description: The exception item entry operator.
    - name: entries_type
      description: The exception item entry type.
    - name: entries_value
      description: The exception item entry value.
    - name: entries_list_id
      description: Value list's identifier.
    - name: entries_list_type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Specifies the Elasticsearch data type of excludes the list container holds.
    - name: list_id
      description: The exception list's human-readable string identifier.
    - name: os_types
      auto: PREDEFINED
      predefined:
      - linux
      - macos
      - windows
      description: Use this field to specify the operating system. Only enter one value.
    - name: tags
      isArray: true
      description: String array containing words and phrases to help categorize exception containers.
    - name: entry_id
      description: Entry ID for the file containing the request JSON. If provided, other parameters won't be considered.
    outputs:
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.id
      description: The exception list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.item_id
      description: The exception list item human-readable ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.list_id
      description: The exception list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.name
      description: The exception list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.description
      description: The exception list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ExceptionListItem.updated_at
      description: The update date of the exception list item.
      type: Date
  - name: es-kibana-exception-list-item-delete
    description: Deletes an exception list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: exception_list_item_id
      description: Exception list item's identifier. Either id or item_id must be specified.
    - name: item_id
      description: Human readable exception item string identifier. Either id or item_id must be specified.
    - name: namespace_type
      auto: PREDEFINED
      predefined:
      - agnostic
      - single
      description: Determines whether the returned containers are Kibana associated with a Kibana space or available in all spaces.
  - name: es-kibana-value-lists-list
    description: Retrieves details of a value list (the list container).
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      description: Value list identifier (id) returned when the list was created.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: cursor
      description: Returns the lists that come after the last lists returned in the previous call.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      description: The page number to return.
    - name: size
      description: The number of value lists to return per page.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueList.id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueList.name
      description: The value list name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueList.description
      description: The value list description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueList.created_at
      description: The creation date of the value list.
      type: Date
  - name: es-kibana-value-list-item-get
    description: Retrieves value list items.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_item_id
      description: Value list item identifier. Required if list_id and value are not specified.
    - name: value_list_id
      description: Parent value list's id to page through items for.
    - name: value
      description: The value used to evaluate exceptions. Required if id is not specified.
    - name: filter
      description: Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.
    - name: cursor
      description: Opaque cursor returned in a previous response; pass it to continue listing from the next page.
    - name: sort_field
      description: Determines which field is used to sort the results.
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Determines the sort order.
    - name: page
      description: The page number to return.
    - name: size
      description: The number of list items to return per page.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  - name: es-kibana-value-list-item-create
    description: Adds a new item to a value list.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      required: true
      description: Value list's identifier.
    - name: meta
      description: Placeholder for metadata about the value list item (JSON object). Example {"source":"threatfeed","priority":3,"active":true}.
    - name: refresh
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      - wait_for
      description: Determines when changes made by the request are made visible to search.
    - name: value
      required: true
      description: The value used to evaluate exceptions.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  - name: es-kibana-value-list-item-update
    description: Updates an existing value list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: _version
      description: The version id, normally returned by the API when the document is retrieved.
    - name: value_list_item_id
      required: true
      description: Value list item identifier.
    - name: meta
      description: Placeholder for metadata about the value list item (JSON object). Example {"source":"threatfeed","priority":3,"active":true}.
    - name: value
      required: true
      description: The value used to evaluate exceptions.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  - name: es-kibana-value-list-item-delete
    description: Deletes a value list item.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_item_id
      description: Value list item's identifier. Required if list_id and value are not specified.
    - name: value_list_id
      description: Value list's identifier.
    - name: value
      description: The value used to evaluate exceptions. Required if id is not specified.
    - name: refresh
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      - wait_for
      description: Determines when changes made by the request are made visible to search.
  - name: es-kibana-value-list-item-export
    description: Exports all items of a value list as a file (returned to the War Room).
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      description: Value list's id to export.
  - name: es-kibana-value-list-item-import
    description: Import value list items from a TXT or CSV file.
    arguments:
    - name: space_id
      description: Refer to https://www.elastic.co/docs/deploy-manage/manage-spaces for more information.
    - name: value_list_id
      description: List's id to import.
    - name: type
      auto: PREDEFINED
      predefined:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      description: Type of the importing list.
    - name: refresh
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      - wait_for
      description: Determines when changes made by the request are made visible to search.
    - name: entry_id
      required: true
      description: Entry ID for the file containing the items to import.
    outputs:
    - contextPath: Elasticsearch.Kibana.ValueListItem.id
      description: The value list item ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.list_id
      description: The value list ID.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.name
      description: The value list item name.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.description
      description: The value list item description.
      type: String
    - contextPath: Elasticsearch.Kibana.ValueListItem.created_at
      description: The creation date of the value list item.
      type: Date
  dockerimage: demisto/elasticsearch:1.0.0.11195141
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
autoUpdateDockerImage: false
fromversion: 5.0.0
defaultmapperin: Elasticsearch - Incoming Mapper
defaultclassifier: Elasticsearch
tests:
- Elasticsearch_v2_test
- Elasticsearch_v2_test-v6
- Elasticsearch_v2_test-v7-v8
- Elasticsearch_v2_test-v8