> ## Documentation Index > Fetch the complete documentation index at: https://docs.pinkfish.ai/llms.txt > Use this file to discover all available pages before exploring further. # kibana-alerting > Kibana Alerting - manage rules, connectors, and maintenance windows **Server path:** `/kibana-alerting` | **Type:** Application | **PCID required:** Yes ## Tools | Tool | Description | | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | | [`kibana_alerting_delete_actions_connector_id`](#kibana_alerting_delete_actions_connector_id) | Delete a connector | | [`kibana_alerting_delete_maintenance_window_id`](#kibana_alerting_delete_maintenance_window_id) | Delete a maintenance window. | | [`kibana_alerting_delete_rule_id`](#kibana_alerting_delete_rule_id) | Delete a rule | | [`kibana_alerting_delete_rule_ruleid_snooze_schedule_scheduleid`](#kibana_alerting_delete_rule_ruleid_snooze_schedule_scheduleid) | Delete a snooze schedule for a rule | | [`kibana_alerting_delete_rules_backfill_id`](#kibana_alerting_delete_rules_backfill_id) | Delete a backfill by ID | | [`kibana_alerting_get_actions_connector_id`](#kibana_alerting_get_actions_connector_id) | Get connector information | | [`kibana_alerting_get_actions_connector_oauth_callback`](#kibana_alerting_get_actions_connector_oauth_callback) | Handle OAuth callback | | [`kibana_alerting_get_actions_connector_types`](#kibana_alerting_get_actions_connector_types) | Get connector types | | [`kibana_alerting_get_actions_connectors`](#kibana_alerting_get_actions_connectors) | Get all connectors | | [`kibana_alerting_get_health`](#kibana_alerting_get_health) | Get the alerting framework health | | [`kibana_alerting_get_maintenance_window_find`](#kibana_alerting_get_maintenance_window_find) | Search for a maintenance window. | | [`kibana_alerting_get_maintenance_window_id`](#kibana_alerting_get_maintenance_window_id) | Get maintenance window details. | | [`kibana_alerting_get_rule_id`](#kibana_alerting_get_rule_id) | Get rule details | | [`kibana_alerting_get_rule_types`](#kibana_alerting_get_rule_types) | Get the rule types | | [`kibana_alerting_get_rules_backfill_id`](#kibana_alerting_get_rules_backfill_id) | Get a backfill by ID | | [`kibana_alerting_get_rules_find`](#kibana_alerting_get_rules_find) | Get information about rules | | [`kibana_alerting_patch_maintenance_window_id`](#kibana_alerting_patch_maintenance_window_id) | Update a maintenance window. | | [`kibana_alerting_post_actions_connector_id`](#kibana_alerting_post_actions_connector_id) | Create a connector | | [`kibana_alerting_post_actions_connector_id_execute`](#kibana_alerting_post_actions_connector_id_execute) | Run a connector | | [`kibana_alerting_post_maintenance_window`](#kibana_alerting_post_maintenance_window) | Create a maintenance window. | | [`kibana_alerting_post_maintenance_window_id_archive`](#kibana_alerting_post_maintenance_window_id_archive) | Archive a maintenance window. | | [`kibana_alerting_post_maintenance_window_id_unarchive`](#kibana_alerting_post_maintenance_window_id_unarchive) | Unarchive a maintenance window. | | [`kibana_alerting_post_rule_id`](#kibana_alerting_post_rule_id) | Create a rule | | [`kibana_alerting_post_rule_id_disable`](#kibana_alerting_post_rule_id_disable) | Disable a rule | | [`kibana_alerting_post_rule_id_enable`](#kibana_alerting_post_rule_id_enable) | Enable a rule | | [`kibana_alerting_post_rule_id_mute_all`](#kibana_alerting_post_rule_id_mute_all) | Mute all alerts | | [`kibana_alerting_post_rule_id_snooze_schedule`](#kibana_alerting_post_rule_id_snooze_schedule) | Schedule a snooze for the rule | | [`kibana_alerting_post_rule_id_unmute_all`](#kibana_alerting_post_rule_id_unmute_all) | Unmute all alerts | | [`kibana_alerting_post_rule_id_update_api_key`](#kibana_alerting_post_rule_id_update_api_key) | Update the API key for a rule | | [`kibana_alerting_post_rule_rule_id_alert_alert_id_mute`](#kibana_alerting_post_rule_rule_id_alert_alert_id_mute) | Mute an alert | | [`kibana_alerting_post_rule_rule_id_alert_alert_id_unmute`](#kibana_alerting_post_rule_rule_id_alert_alert_id_unmute) | Unmute an alert | | [`kibana_alerting_post_rules_backfill_find`](#kibana_alerting_post_rules_backfill_find) | Find backfills for rules | | [`kibana_alerting_post_rules_backfill_schedule`](#kibana_alerting_post_rules_backfill_schedule) | Schedule a backfill for rules | | [`kibana_alerting_put_actions_connector_id`](#kibana_alerting_put_actions_connector_id) | Update a connector | | [`kibana_alerting_put_rule_id`](#kibana_alerting_put_rule_id) | Update a rule | *** ## kibana\_alerting\_delete\_actions\_connector\_id Delete a connector **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | An identifier for the connector. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "An identifier for the connector." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_delete\_maintenance\_window\_id Delete a maintenance window. **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | -------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the maintenance window to be deleted. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the maintenance window to be deleted." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_delete\_rule\_id Delete a rule **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the rule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_delete\_rule\_ruleid\_snooze\_schedule\_scheduleid Delete a snooze schedule for a rule **Parameters:** | Parameter | Type | Required | Default | Description | | ------------ | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `ruleId` | string | Yes | — | The identifier for the rule. | | `scheduleId` | string | Yes | — | The identifier for the snooze schedule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "ruleId": { "type": "string", "description": "The identifier for the rule." }, "scheduleId": { "type": "string", "description": "The identifier for the snooze schedule." } }, "required": [ "PCID", "kbn-xsrf", "ruleId", "scheduleId" ] } ``` *** ## kibana\_alerting\_delete\_rules\_backfill\_id Delete a backfill by ID **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the backfill. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the backfill." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_get\_actions\_connector\_id Get connector information **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | -------------------------------- | | `id` | string | Yes | — | An identifier for the connector. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "An identifier for the connector." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_alerting\_get\_actions\_connector\_oauth\_callback Handle OAuth callback **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------- | ------ | -------- | ------- | -------------------------------------------------------- | | `code` | string | No | — | The authorization code returned by the OAuth provider. | | `state` | string | No | — | The state parameter for CSRF protection. | | `error` | string | No | — | Error code if the authorization failed. | | `error_description` | string | No | — | Human-readable error description. | | `session_state` | string | No | — | Session state from the OAuth provider (e.g., Microsoft). | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "code": { "type": "string", "description": "The authorization code returned by the OAuth provider." }, "state": { "type": "string", "description": "The state parameter for CSRF protection." }, "error": { "type": "string", "description": "Error code if the authorization failed." }, "error_description": { "type": "string", "description": "Human-readable error description." }, "session_state": { "type": "string", "description": "Session state from the OAuth provider (e.g., Microsoft)." } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_get\_actions\_connector\_types Get connector types **Parameters:** | Parameter | Type | Required | Default | Description | | ------------ | ------ | -------- | ------- | --------------------------------------------------------------------------------------------------------------------- | | `feature_id` | string | No | — | A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases). | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "feature_id": { "type": "string", "description": "A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases)." } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_get\_actions\_connectors Get all connectors ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_get\_health Get the alerting framework health ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_get\_maintenance\_window\_find Search for a maintenance window. **Parameters:** | Parameter | Type | Required | Default | Description | | ------------ | --------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------- | | `title` | string | No | — | The title of the maintenance window. | | `created_by` | string | No | — | The user who created the maintenance window. | | `status` | string\[] | No | — | The status of the maintenance window. It can be "running", "upcoming", "finished", "archived", or "disabled". | | `page` | number | No | — | The page number to return. | | `per_page` | number | No | — | The number of maintenance windows to return per page. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "title": { "type": "string", "description": "The title of the maintenance window." }, "created_by": { "type": "string", "description": "The user who created the maintenance window." }, "status": { "type": "array", "items": { "type": "string", "enum": [ "running", "finished", "upcoming", "archived", "disabled" ] }, "description": "The status of the maintenance window. It can be \"running\", \"upcoming\", \"finished\", \"archived\", or \"disabled\"." }, "page": { "type": "number", "description": "The page number to return." }, "per_page": { "type": "number", "description": "The number of maintenance windows to return per page." } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_get\_maintenance\_window\_id Get maintenance window details. **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ------------------------------------------ | | `id` | string | Yes | — | The identifier for the maintenance window. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "The identifier for the maintenance window." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_alerting\_get\_rule\_id Get rule details **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ---------------------------- | | `id` | string | Yes | — | The identifier for the rule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "The identifier for the rule." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_alerting\_get\_rule\_types Get the rule types ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_get\_rules\_backfill\_id Get a backfill by ID **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | -------------------------------- | | `id` | string | Yes | — | The identifier for the backfill. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "The identifier for the backfill." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_alerting\_get\_rules\_find Get information about rules **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------------- | --------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `per_page` | number | No | — | The number of rules to return per page. | | `page` | number | No | — | The page number to return. | | `search` | string | No | — | An Elasticsearch simple\_query\_string query that filters the objects in the response. | | `default_search_operator` | string | No | — | The default operator to use for the simple\_query\_string. | | `search_fields` | string\[] | No | — | The fields to perform the simple\_query\_string parsed query against. | | `sort_field` | string | No | — | Determines which field is used to sort the results. The field must exist in the `attributes` key of the response. | | `sort_order` | string | No | — | Determines the sort order. | | `has_reference` | object | No | — | Filters the rules that have a relation with the reference objects with a specific type and identifier. | | `fields` | string\[] | No | — | The fields to return in the `attributes` key of the response. | | `filter` | string | No | — | A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`. | | `filter_consumers` | string\[] | No | — | Filter Consumers | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "per_page": { "type": "number", "description": "The number of rules to return per page." }, "page": { "type": "number", "description": "The page number to return." }, "search": { "type": "string", "description": "An Elasticsearch simple_query_string query that filters the objects in the response." }, "default_search_operator": { "type": "string", "description": "The default operator to use for the simple_query_string.", "enum": [ "OR", "AND" ] }, "search_fields": { "type": "array", "items": { "type": "string" }, "description": "The fields to perform the simple_query_string parsed query against." }, "sort_field": { "type": "string", "description": "Determines which field is used to sort the results. The field must exist in the `attributes` key of the response." }, "sort_order": { "type": "string", "description": "Determines the sort order.", "enum": [ "asc", "desc" ] }, "has_reference": { "type": "object", "description": "Filters the rules that have a relation with the reference objects with a specific type and identifier.", "properties": { "id": { "type": "string", "description": "The id value" }, "type": { "type": "string", "description": "The type value" } }, "required": [ "type", "id" ] }, "fields": { "type": "array", "items": { "type": "string" }, "description": "The fields to return in the `attributes` key of the response." }, "filter": { "type": "string", "description": "A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: \"myTitle\"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`." }, "filter_consumers": { "type": "array", "items": { "type": "string" }, "description": "Filter Consumers" } }, "required": [ "PCID" ] } ``` *** ## kibana\_alerting\_patch\_maintenance\_window\_id Update a maintenance window. **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The id value | | `enabled` | boolean | No | — | Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications. | | `schedule` | object | No | — | The schedule value | | `scope` | object | No | — | The scope value | | `title` | string | No | — | The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The id value" }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "schedule": { "type": "object", "description": "The schedule value", "properties": { "custom": { "type": "object", "description": "The custom value" } }, "required": [ "custom" ] }, "scope": { "type": "object", "description": "The scope value", "properties": { "alerting": { "type": "object", "description": "The alerting value" } }, "required": [ "alerting" ] }, "title": { "type": "string", "description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_actions\_connector\_id Create a connector **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | An identifier for the connector. | | `config` | object | No | — | The connector configuration details. | | `connector_type_id` | string | Yes | — | The type of connector. | | `name` | string | Yes | — | The display name for the connector. | | `secrets` | object | No | — | The secrets value | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "An identifier for the connector." }, "config": { "description": "The connector configuration details." }, "connector_type_id": { "type": "string", "description": "The type of connector." }, "name": { "type": "string", "description": "The display name for the connector." }, "secrets": { "description": "The secrets value" } }, "required": [ "PCID", "kbn-xsrf", "id", "connector_type_id", "name" ] } ``` *** ## kibana\_alerting\_post\_actions\_connector\_id\_execute Run a connector **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | An identifier for the connector. | | `params` | object | Yes | — | The params value | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "An identifier for the connector." }, "params": { "description": "The params value" } }, "required": [ "PCID", "kbn-xsrf", "id", "params" ] } ``` *** ## kibana\_alerting\_post\_maintenance\_window Create a maintenance window. **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `enabled` | boolean | No | — | Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications. | | `schedule` | object | Yes | — | The schedule value | | `scope` | object | No | — | The scope value | | `title` | string | Yes | — | The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "enabled": { "type": "boolean", "description": "Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications." }, "schedule": { "type": "object", "description": "The schedule value", "properties": { "custom": { "type": "object", "description": "The custom value" } }, "required": [ "custom" ] }, "scope": { "type": "object", "description": "The scope value", "properties": { "alerting": { "type": "object", "description": "The alerting value" } }, "required": [ "alerting" ] }, "title": { "type": "string", "description": "The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window." } }, "required": [ "PCID", "kbn-xsrf", "schedule", "title" ] } ``` *** ## kibana\_alerting\_post\_maintenance\_window\_id\_archive Archive a maintenance window. **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | --------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the maintenance window to be archived. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the maintenance window to be archived." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_maintenance\_window\_id\_unarchive Unarchive a maintenance window. **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ----------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the maintenance window to be unarchived. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the maintenance window to be unarchived." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_rule\_id Create a rule **Parameters:** | Parameter | Type | Required | Default | Description | | | -------------- | --------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | | `id` | string | Yes | — | The identifier for the rule. If it is omitted, an ID is randomly generated. | | | `actions` | object\[] | No | — | The actions value | | | `alert_delay` | object | No | — | Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions. | | | `artifacts` | object | No | — | The artifacts value | | | `consumer` | string | Yes | — | The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`. | | | `enabled` | boolean | No | — | Indicates whether you want to run the rule on an interval basis after it is created. | | | `flapping` | object | No | — | When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced. | | | `name` | string | Yes | — | The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. | | | `notify_when` | string | null | No | — | Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. | | `params` | object | No | — | The parameters for the rule. | | | `rule_type_id` | string | Yes | — | The rule type identifier. | | | `schedule` | object | Yes | — | The check interval, which specifies how frequently the rule conditions are checked. | | | `tags` | string\[] | No | — | The tags for the rule. | | | `throttle` | string | null | No | — | Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule. If it is omitted, an ID is randomly generated." }, "actions": { "type": "array", "items": { "type": "object", "properties": { "alerts_filter": { "type": "object", "description": "Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs." }, "frequency": { "type": "object", "description": "The frequency value" }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "required": [ "id" ] }, "description": "The actions value" }, "alert_delay": { "type": "object", "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "required": [ "active" ] }, "artifacts": { "type": "object", "description": "The artifacts value", "properties": { "dashboards": { "type": "array", "items": { "type": "object" }, "description": "The dashboards value" }, "investigation_guide": { "type": "object", "description": "Investigation Guide" } } }, "consumer": { "type": "string", "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`." }, "enabled": { "type": "boolean", "description": "Indicates whether you want to run the rule on an interval basis after it is created." }, "flapping": { "type": "object", "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.", "properties": { "enabled": { "type": "boolean", "description": "Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state." }, "look_back_window": { "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "required": [ "look_back_window", "status_change_threshold" ] }, "name": { "type": "string", "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule." }, "notify_when": { "type": [ "string", "null" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.", "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ] }, "params": { "description": "The parameters for the rule." }, "rule_type_id": { "type": "string", "description": "The rule type identifier." }, "schedule": { "type": "object", "description": "The check interval, which specifies how frequently the rule conditions are checked.", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "required": [ "interval" ] }, "tags": { "type": "array", "items": { "type": "string" }, "description": "The tags for the rule." }, "throttle": { "type": [ "string", "null" ], "description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "required": [ "PCID", "kbn-xsrf", "id", "consumer", "name", "rule_type_id", "schedule" ] } ``` *** ## kibana\_alerting\_post\_rule\_id\_disable Disable a rule **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------- | -------- | ------- | ------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the rule. | | `untrack` | boolean | No | — | Defines whether this rule's alerts should be untracked. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." }, "untrack": { "type": "boolean", "description": "Defines whether this rule's alerts should be untracked." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_rule\_id\_enable Enable a rule **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the rule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_rule\_id\_mute\_all Mute all alerts **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the rule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_rule\_id\_snooze\_schedule Schedule a snooze for the rule **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | Identifier of the rule. | | `schedule` | object | Yes | — | The schedule value | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "Identifier of the rule." }, "schedule": { "type": "object", "description": "The schedule value", "properties": { "custom": { "type": "object", "description": "The custom value" } } } }, "required": [ "PCID", "kbn-xsrf", "id", "schedule" ] } ``` *** ## kibana\_alerting\_post\_rule\_id\_unmute\_all Unmute all alerts **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the rule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_rule\_id\_update\_api\_key Update the API key for a rule **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | The identifier for the rule. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." } }, "required": [ "PCID", "kbn-xsrf", "id" ] } ``` *** ## kibana\_alerting\_post\_rule\_rule\_id\_alert\_alert\_id\_mute Mute an alert **Parameters:** | Parameter | Type | Required | Default | Description | | --------------------------- | ------- | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `rule_id` | string | Yes | — | The identifier for the rule. | | `alert_id` | string | Yes | — | The identifier for the alert. | | `validate_alerts_existence` | boolean | No | — | Whether to validate the existence of the alert. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "rule_id": { "type": "string", "description": "The identifier for the rule." }, "alert_id": { "type": "string", "description": "The identifier for the alert." }, "validate_alerts_existence": { "type": "boolean", "description": "Whether to validate the existence of the alert." } }, "required": [ "PCID", "kbn-xsrf", "rule_id", "alert_id" ] } ``` *** ## kibana\_alerting\_post\_rule\_rule\_id\_alert\_alert\_id\_unmute Unmute an alert **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `rule_id` | string | Yes | — | The identifier for the rule. | | `alert_id` | string | Yes | — | The identifier for the alert. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "rule_id": { "type": "string", "description": "The identifier for the rule." }, "alert_id": { "type": "string", "description": "The identifier for the alert." } }, "required": [ "PCID", "kbn-xsrf", "rule_id", "alert_id" ] } ``` *** ## kibana\_alerting\_post\_rules\_backfill\_find Find backfills for rules **Parameters:** | Parameter | Type | Required | Default | Description | | ------------ | ------ | -------- | ------- | ------------------------------------------------------------------------------------------------------ | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `end` | string | No | — | The end date for filtering backfills. | | `page` | number | No | — | The page number to return. | | `per_page` | number | No | — | The number of backfills to return per page. | | `rule_ids` | string | No | — | A comma-separated list of rule identifiers. | | `initiator` | string | No | — | The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills. | | `start` | string | No | — | The start date for filtering backfills. | | `sort_field` | string | No | — | The field to sort backfills by. | | `sort_order` | string | No | — | The sort order. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "end": { "type": "string", "description": "The end date for filtering backfills." }, "page": { "type": "number", "description": "The page number to return." }, "per_page": { "type": "number", "description": "The number of backfills to return per page." }, "rule_ids": { "type": "string", "description": "A comma-separated list of rule identifiers." }, "initiator": { "type": "string", "description": "The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills.", "enum": [ "user", "system" ] }, "start": { "type": "string", "description": "The start date for filtering backfills." }, "sort_field": { "type": "string", "description": "The field to sort backfills by.", "enum": [ "createdAt", "start" ] }, "sort_order": { "type": "string", "description": "The sort order.", "enum": [ "asc", "desc" ] } }, "required": [ "PCID", "kbn-xsrf" ] } ``` *** ## kibana\_alerting\_post\_rules\_backfill\_schedule Schedule a backfill for rules **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | --------- | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `body` | object\[] | No | — | Request body | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "body": { "type": "array", "items": { "type": "object", "properties": { "ranges": { "type": "array", "items": { "type": "object", "properties": { "end": { "type": "string" }, "start": { "type": "string" } } }, "description": "The ranges value" }, "rule_id": { "type": "string", "description": "Rule Id" }, "run_actions": { "type": "boolean", "description": "Run Actions" } }, "required": [ "rule_id", "ranges" ] }, "description": "Request body" } }, "required": [ "PCID", "kbn-xsrf" ] } ``` *** ## kibana\_alerting\_put\_actions\_connector\_id Update a connector **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | ------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | `id` | string | Yes | — | An identifier for the connector. | | `config` | object | No | — | The connector configuration details. | | `name` | string | Yes | — | The display name for the connector. | | `secrets` | object | No | — | The secrets value | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "An identifier for the connector." }, "config": { "description": "The connector configuration details." }, "name": { "type": "string", "description": "The display name for the connector." }, "secrets": { "description": "The secrets value" } }, "required": [ "PCID", "kbn-xsrf", "id", "name" ] } ``` *** ## kibana\_alerting\_put\_rule\_id Update a rule **Parameters:** | Parameter | Type | Required | Default | Description | | | ------------- | --------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `kbn-xsrf` | string | Yes | — | A required header to protect against CSRF attacks | | | `id` | string | Yes | — | The identifier for the rule. | | | `actions` | object\[] | No | — | The actions value | | | `alert_delay` | object | No | — | Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions. | | | `artifacts` | object | No | — | The artifacts value | | | `flapping` | object | No | — | When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced. | | | `name` | string | Yes | — | The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. | | | `notify_when` | string | null | No | — | Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. | | `params` | object | No | — | The parameters for the rule. | | | `schedule` | object | Yes | — | The schedule value | | | `tags` | string\[] | No | — | The tags value | | | `throttle` | string | null | No | — | Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "kbn-xsrf": { "type": "string", "description": "A required header to protect against CSRF attacks" }, "id": { "type": "string", "description": "The identifier for the rule." }, "actions": { "type": "array", "items": { "type": "object", "properties": { "alerts_filter": { "type": "object", "description": "Alerts Filter" }, "frequency": { "type": "object", "description": "The frequency value" }, "group": { "type": "string", "description": "The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`." }, "id": { "type": "string", "description": "The identifier for the connector saved object." }, "params": { "type": "object", "description": "The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context." }, "use_alert_data_for_template": { "type": "boolean", "description": "Indicates whether to use alert data as a template." }, "uuid": { "type": "string", "description": "A universally unique identifier (UUID) for the action." } }, "required": [ "id" ] }, "description": "The actions value" }, "alert_delay": { "type": "object", "description": "Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.", "properties": { "active": { "type": "number", "description": "The number of consecutive runs that must meet the rule conditions." } }, "required": [ "active" ] }, "artifacts": { "type": "object", "description": "The artifacts value", "properties": { "dashboards": { "type": "array", "items": { "type": "object" }, "description": "The dashboards value" }, "investigation_guide": { "type": "object", "description": "Investigation Guide" } } }, "flapping": { "type": "object", "description": "When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.", "properties": { "enabled": { "type": "boolean", "description": "Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state." }, "look_back_window": { "type": "number", "description": "The minimum number of runs in which the threshold must be met." }, "status_change_threshold": { "type": "number", "description": "The minimum number of times an alert must switch states in the look back window." } }, "required": [ "look_back_window", "status_change_threshold" ] }, "name": { "type": "string", "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule." }, "notify_when": { "type": [ "string", "null" ], "description": "Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.", "enum": [ "onActionGroupChange", "onActiveAlert", "onThrottleInterval" ] }, "params": { "type": "object", "description": "The parameters for the rule." }, "schedule": { "type": "object", "description": "The schedule value", "properties": { "interval": { "type": "string", "description": "The interval is specified in seconds, minutes, hours, or days." } }, "required": [ "interval" ] }, "tags": { "type": "array", "items": { "type": "string" }, "description": "The tags value" }, "throttle": { "type": [ "string", "null" ], "description": "Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values." } }, "required": [ "PCID", "kbn-xsrf", "id", "name", "schedule" ] } ```