kibana-security

Kibana Security - detection rules, alerts, and security lists

Server path: /kibana-security | Type: Application | PCID required: Yes

Tools

Tool	Description
kibana_security_create_alerts_index	Create an alerts index
kibana_security_create_list	Create a value list
kibana_security_create_list_item	Create a value list item
kibana_security_create_rule	Create a detection rule
kibana_security_delete_alerts_index	Delete an alerts index
kibana_security_delete_list	Delete a value list
kibana_security_delete_list_index	Delete value list data streams
kibana_security_delete_list_item	Delete a value list item
kibana_security_delete_rule	Delete a detection rule
kibana_security_export_list_items	Export value list items
kibana_security_export_rules	Export detection rules
kibana_security_find_list_items	Get value list items
kibana_security_find_lists	Get value lists
kibana_security_find_rules	List all detection rules
kibana_security_import_list_items	Import value list items
kibana_security_import_rules	Import detection rules
kibana_security_install_prebuilt_rules_and_timelines	Install prebuilt detection rules and Timelines
kibana_security_patch_list	Patch a value list
kibana_security_patch_list_item	Patch a value list item
kibana_security_patch_rule	Patch a detection rule
kibana_security_perform_rules_bulk_action	Apply a bulk action to detection rules
kibana_security_read_alerts_index	Reads the alert index name if it exists
kibana_security_read_list	Get value list details
kibana_security_read_list_index	Get status of value list data streams
kibana_security_read_list_item	Get a value list item
kibana_security_read_list_privileges	Get value list privileges
kibana_security_read_prebuilt_rules_and_timelines_status	Retrieve the status of prebuilt detection rules and Timelines
kibana_security_read_privileges	Returns user privileges for the Kibana space
kibana_security_read_rule	Retrieve a detection rule
kibana_security_read_tags	List all detection rule tags
kibana_security_rule_preview	Preview rule alerts generated on specified time range
kibana_security_search_alerts	Find and/or aggregate detection alerts
kibana_security_set_alert_assignees	Assign and unassign users from detection alerts
kibana_security_set_alert_tags	Add and remove detection alert tags
kibana_security_set_alerts_status	Set a detection alert status
kibana_security_update_list	Update a value list
kibana_security_update_list_item	Update a value list item
kibana_security_update_rule	Update a detection rule

---

kibana_security_create_alerts_index

Create an alerts index

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_create_list

Create a value list

Parameters:

Parameter	Type	Required	Default	Description
description	string	Yes	—	Describes the value list.
id	string	No	—	Value list’s identifier.
meta	object	No	—	Placeholder for metadata about the value list.
name	string	Yes	—	Value list’s name.
type	string	Yes	—	Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - keyword: Many ECS fields are Elasticsearch keywords - ip: IP addresses - ip_range: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)
version	integer	No	—	The version value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "description": {
      "type": "string",
      "description": "Describes the value list."
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list."
    },
    "name": {
      "type": "string",
      "description": "Value list's name."
    },
    "type": {
      "type": "string",
      "description": "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:  - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)",
      "enum": [
        "binary",
        "boolean",
        "byte",
        "date",
        "date_nanos",
        "date_range",
        "double",
        "double_range",
        "float",
        "float_range",
        "geo_point",
        "geo_shape",
        "half_float",
        "integer",
        "integer_range",
        "ip",
        "ip_range",
        "keyword",
        "long",
        "long_range",
        "shape",
        "short",
        "text"
      ]
    },
    "version": {
      "type": "integer",
      "description": "The version value"
    }
  },
  "required": [
    "PCID",
    "description",
    "name",
    "type"
  ]
}

---

kibana_security_create_list_item

Create a value list item

Parameters:

Parameter	Type	Required	Default	Description
id	string	No	—	Value list item’s identifier.
list_id	string	Yes	—	Value list’s identifier.
meta	object	No	—	Placeholder for metadata about the value list item.
refresh	string	No	—	Determines when changes made by the request are made visible to search.
value	string	Yes	—	The value used to evaluate exceptions.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier."
    },
    "list_id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list item."
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions."
    }
  },
  "required": [
    "PCID",
    "list_id",
    "value"
  ]
}

---

kibana_security_create_rule

Create a detection rule

Parameters:

Parameter	Type	Required	Default	Description
body	object	Yes	—	Request body

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "Request body"
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

---

kibana_security_delete_alerts_index

Delete an alerts index

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_delete_list

Delete a value list

Parameters:

Parameter	Type	Required	Default	Description
id	string	Yes	—	Value list’s identifier.
deleteReferences	boolean	No	—	Determines whether exception items referencing this value list should be deleted.
ignoreReferences	boolean	No	—	Determines whether to delete value list without performing any additional checks of where this list may be utilized.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "deleteReferences": {
      "type": "boolean",
      "description": "Determines whether exception items referencing this value list should be deleted."
    },
    "ignoreReferences": {
      "type": "boolean",
      "description": "Determines whether to delete value list without performing any additional checks of where this list may be utilized."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

---

kibana_security_delete_list_index

Delete value list data streams

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_delete_list_item

Delete a value list item

Parameters:

Parameter	Type	Required	Default	Description
id	string	No	—	Value list item’s identifier. Required if list_id and value are not specified.
list_id	string	No	—	Value list’s identifier. Required if id is not specified.
value	string	No	—	The value used to evaluate exceptions. Required if id is not specified.
refresh	string	No	—	Determines when changes made by the request are made visible to search.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier. Required if `list_id` and `value` are not specified."
    },
    "list_id": {
      "type": "string",
      "description": "Value list's identifier. Required if `id` is not specified."
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions. Required if `id` is not specified."
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_delete_rule

Delete a detection rule

Parameters:

Parameter	Type	Required	Default	Description
id	string	No	—	The rule’s id value.
rule_id	string	No	—	The rule’s rule_id value.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The rule's `id` value."
    },
    "rule_id": {
      "type": "string",
      "description": "The rule's `rule_id` value."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_export_list_items

Export value list items

Parameters:

Parameter	Type	Required	Default	Description
list_id	string	Yes	—	Value list’s id to export.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "list_id": {
      "type": "string",
      "description": "Value list's `id` to export."
    }
  },
  "required": [
    "PCID",
    "list_id"
  ]
}

---

kibana_security_export_rules

Export detection rules

Parameters:

Parameter	Type	Required	Default	Description
exclude_export_details	boolean	No	—	Determines whether a summary of the exported rules is returned.
file_name	string	No	—	File name for saving the exported rules. > info > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.
objects	object[]	No	—	Array of objects with a rule’s rule_id field. Do not use rule’s id here. Exports all rules when unspecified.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "exclude_export_details": {
      "type": "boolean",
      "description": "Determines whether a summary of the exported rules is returned."
    },
    "file_name": {
      "type": "string",
      "description": "File name for saving the exported rules. > info > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL."
    },
    "objects": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "rule_id": {
            "type": "string",
            "description": "A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s."
          }
        },
        "required": [
          "rule_id"
        ]
      },
      "description": "Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_find_list_items

Get value list items

Parameters:

Parameter	Type	Required	Default	Description
list_id	string	Yes	—	Value list’s identifier.
page	integer	No	—	The page number to return.
per_page	integer	No	—	The number of list items to return per page.
sort_field	string	No	—	Determines which field is used to sort the results.
sort_order	string	No	—	Determines the sort order, which can be desc or asc
cursor	string	No	—	Returns the items that come after the last item returned in the previous call (use the cursor value returned in the previous call). This parameter uses the tie_breaker_id field to ensure all items are sorted and returned correctly.
filter	string	No	—	Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "list_id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "page": {
      "type": "integer",
      "description": "The page number to return."
    },
    "per_page": {
      "type": "integer",
      "description": "The number of list items to return per page."
    },
    "sort_field": {
      "type": "string",
      "description": "Determines which field is used to sort the results."
    },
    "sort_order": {
      "type": "string",
      "description": "Determines the sort order, which can be `desc` or `asc`",
      "enum": [
        "desc",
        "asc"
      ]
    },
    "cursor": {
      "type": "string",
      "description": "Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly."
    },
    "filter": {
      "type": "string",
      "description": "Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax."
    }
  },
  "required": [
    "PCID",
    "list_id"
  ]
}

---

kibana_security_find_lists

Get value lists

Parameters:

Parameter	Type	Required	Default	Description
page	integer	No	—	The page number to return.
per_page	integer	No	—	The number of value lists to return per page.
sort_field	string	No	—	Determines which field is used to sort the results.
sort_order	string	No	—	Determines the sort order, which can be desc or asc
cursor	string	No	—	Returns the lists that come after the last lists returned in the previous call (use the cursor value returned in the previous call). This parameter uses the tie_breaker_id field to ensure all lists are sorted and returned correctly.
filter	string	No	—	Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "page": {
      "type": "integer",
      "description": "The page number to return."
    },
    "per_page": {
      "type": "integer",
      "description": "The number of value lists to return per page."
    },
    "sort_field": {
      "type": "string",
      "description": "Determines which field is used to sort the results."
    },
    "sort_order": {
      "type": "string",
      "description": "Determines the sort order, which can be `desc` or `asc`",
      "enum": [
        "desc",
        "asc"
      ]
    },
    "cursor": {
      "type": "string",
      "description": "Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly."
    },
    "filter": {
      "type": "string",
      "description": "Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_find_rules

List all detection rules

Parameters:

Parameter	Type	Required	Default	Description
fields	string[]	No	—	The fields value
filter	string	No	—	Search query Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be: - name - enabled - tags - createdBy - interval - updatedBy > info > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.
sort_field	string	No	—	Field to sort by
sort_order	string	No	—	Sort order
page	integer	No	—	Page number
per_page	integer	No	—	Rules per page
gaps_range_start	string	No	—	Gaps range start
gaps_range_end	string	No	—	Gaps range end
gap_fill_statuses	string[]	No	—	Gap fill statuses
gap_auto_fill_scheduler_id	string	No	—	Gap auto fill scheduler ID used to determine gap fill status for rules

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "fields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The fields value"
    },
    "filter": {
      "type": "string",
      "description": "Search query  Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be: - name - enabled - tags - createdBy - interval - updatedBy > info > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter."
    },
    "sort_field": {
      "type": "string",
      "description": "Field to sort by",
      "enum": [
        "created_at",
        "createdAt",
        "enabled",
        "execution_summary.last_execution.date",
        "execution_summary.last_execution.metrics.execution_gap_duration_s",
        "execution_summary.last_execution.metrics.total_indexing_duration_ms",
        "execution_summary.last_execution.metrics.total_search_duration_ms",
        "execution_summary.last_execution.status",
        "name",
        "risk_score",
        "riskScore",
        "severity",
        "updated_at",
        "updatedAt"
      ]
    },
    "sort_order": {
      "type": "string",
      "description": "Sort order",
      "enum": [
        "asc",
        "desc"
      ]
    },
    "page": {
      "type": "integer",
      "description": "Page number"
    },
    "per_page": {
      "type": "integer",
      "description": "Rules per page"
    },
    "gaps_range_start": {
      "type": "string",
      "description": "Gaps range start"
    },
    "gaps_range_end": {
      "type": "string",
      "description": "Gaps range end"
    },
    "gap_fill_statuses": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "unfilled",
          "in_progress",
          "filled",
          "error"
        ]
      },
      "description": "Gap fill statuses"
    },
    "gap_auto_fill_scheduler_id": {
      "type": "string",
      "description": "Gap auto fill scheduler ID used to determine gap fill status for rules"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_import_list_items

Import value list items

Parameters:

Parameter	Type	Required	Default	Description
list_id	string	No	—	List’s id. Required when importing to an existing list.
type	string	No	—	Type of the importing list. Required when importing a new list whose list id is not specified.
refresh	string	No	—	Determines when changes made by the request are made visible to search.
file	string	No	—	A .txt or .csv file containing newline separated list items.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "list_id": {
      "type": "string",
      "description": "List's id.  Required when importing to an existing list."
    },
    "type": {
      "type": "string",
      "description": "Type of the importing list.  Required when importing a new list whose list `id` is not specified.",
      "enum": [
        "binary",
        "boolean",
        "byte",
        "date",
        "date_nanos",
        "date_range",
        "double",
        "double_range",
        "float",
        "float_range",
        "geo_point",
        "geo_shape",
        "half_float",
        "integer",
        "integer_range",
        "ip",
        "ip_range",
        "keyword",
        "long",
        "long_range",
        "shape",
        "short",
        "text"
      ]
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    },
    "file": {
      "type": "string",
      "description": "A `.txt` or `.csv` file containing newline separated list items."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_import_rules

Import detection rules

Parameters:

Parameter	Type	Required	Default	Description
overwrite	boolean	No	—	Determines whether existing rules with the same rule_id are overwritten.
overwrite_exceptions	boolean	No	—	Determines whether existing exception lists with the same list_id are overwritten. Both the exception list container and its items are overwritten.
overwrite_action_connectors	boolean	No	—	Determines whether existing actions with the same kibana.alert.rule.actions.id are overwritten.
as_new_list	boolean	No	—	Generates a new list ID for each imported exception list.
file	string	No	—	The .ndjson file containing the rules.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "overwrite": {
      "type": "boolean",
      "description": "Determines whether existing rules with the same `rule_id` are overwritten."
    },
    "overwrite_exceptions": {
      "type": "boolean",
      "description": "Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten."
    },
    "overwrite_action_connectors": {
      "type": "boolean",
      "description": "Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten."
    },
    "as_new_list": {
      "type": "boolean",
      "description": "Generates a new list ID for each imported exception list."
    },
    "file": {
      "type": "string",
      "description": "The `.ndjson` file containing the rules."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_install_prebuilt_rules_and_timelines

Install prebuilt detection rules and Timelines

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_patch_list

Patch a value list

Parameters:

Parameter	Type	Required	Default	Description
_version	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
description	string	No	—	Describes the value list.
id	string	Yes	—	Value list’s identifier.
meta	object	No	—	Placeholder for metadata about the value list.
name	string	No	—	Value list’s name.
version	integer	No	—	The document version number.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "description": {
      "type": "string",
      "description": "Describes the value list."
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list."
    },
    "name": {
      "type": "string",
      "description": "Value list's name."
    },
    "version": {
      "type": "integer",
      "description": "The document version number."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

---

kibana_security_patch_list_item

Patch a value list item

Parameters:

Parameter	Type	Required	Default	Description
_version	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
id	string	Yes	—	Value list item’s identifier.
meta	object	No	—	Placeholder for metadata about the value list item.
refresh	string	No	—	Determines when changes made by the request are made visible to search.
value	string	No	—	The value used to evaluate exceptions.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list item."
    },
    "refresh": {
      "type": "string",
      "description": "Determines when changes made by the request are made visible to search.",
      "enum": [
        "true",
        "false",
        "wait_for"
      ]
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

---

kibana_security_patch_rule

Patch a detection rule

Parameters:

Parameter	Type	Required	Default	Description
body	object	Yes	—	> info > You cannot modify the id or rule_id values.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "> info > You cannot modify the `id` or `rule_id` values."
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

---

kibana_security_perform_rules_bulk_action

Apply a bulk action to detection rules

Parameters:

Parameter	Type	Required	Default	Description
dry_run	boolean	No	—	Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter dry_run=true to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. > info > Dry run mode is not supported for the export bulk action. A 400 error will be returned in the request response.
body	object	No	—	Request body

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "dry_run": {
      "type": "boolean",
      "description": "Enables dry run mode for the request call.  Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.  To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. > info > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response."
    },
    "body": {
      "description": "Request body"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_alerts_index

Reads the alert index name if it exists

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_list

Get value list details

Parameters:

Parameter	Type	Required	Default	Description
id	string	Yes	—	Value list’s identifier.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

---

kibana_security_read_list_index

Get status of value list data streams

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_list_item

Get a value list item

Parameters:

Parameter	Type	Required	Default	Description
id	string	No	—	Value list item identifier. Required if list_id and value are not specified.
list_id	string	No	—	Value list item list’s id identfier. Required if id is not specified.
value	string	No	—	The value used to evaluate exceptions. Required if id is not specified.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "Value list item identifier. Required if `list_id` and `value` are not specified."
    },
    "list_id": {
      "type": "string",
      "description": "Value list item list's `id` identfier. Required if `id` is not specified."
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions. Required if `id` is not specified."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_list_privileges

Get value list privileges

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_prebuilt_rules_and_timelines_status

Retrieve the status of prebuilt detection rules and Timelines

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_privileges

Returns user privileges for the Kibana space

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_rule

Retrieve a detection rule

Parameters:

Parameter	Type	Required	Default	Description
id	string	No	—	The rule’s id value.
rule_id	string	No	—	The rule’s rule_id value.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "The rule's `id` value."
    },
    "rule_id": {
      "type": "string",
      "description": "The rule's `rule_id` value."
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_read_tags

List all detection rule tags

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_rule_preview

Preview rule alerts generated on specified time range

Parameters:

Parameter	Type	Required	Default	Description
enable_logged_requests	boolean	No	—	Enables logging and returning in response ES queries, performed during rule execution
body	object	Yes	—	An object containing tags to add or remove and alert ids the changes will be applied

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "enable_logged_requests": {
      "type": "boolean",
      "description": "Enables logging and returning in response ES queries, performed during rule execution"
    },
    "body": {
      "description": "An object containing tags to add or remove and alert ids the changes will be applied"
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

---

kibana_security_search_alerts

Find and/or aggregate detection alerts

Parameters:

Parameter	Type	Required	Default	Description
_source	object	No	—	The source value
aggs	object	No	—	The aggs value
fields	string[]	No	—	The fields value
query	object	No	—	Search query string
runtime_mappings	object	No	—	Runtime Mappings
size	integer	No	—	The size value
sort	object	No	—	Sort order for results
track_total_hits	boolean	No	—	Track Total Hits

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_source": {
      "description": "The source value"
    },
    "aggs": {
      "type": "object",
      "description": "The aggs value"
    },
    "fields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The fields value"
    },
    "query": {
      "type": "object",
      "description": "Search query string"
    },
    "runtime_mappings": {
      "type": "object",
      "description": "Runtime Mappings"
    },
    "size": {
      "type": "integer",
      "description": "The size value"
    },
    "sort": {
      "description": "Sort order for results"
    },
    "track_total_hits": {
      "type": "boolean",
      "description": "Track Total Hits"
    }
  },
  "required": [
    "PCID"
  ]
}

---

kibana_security_set_alert_assignees

Assign and unassign users from detection alerts

Parameters:

Parameter	Type	Required	Default	Description
assignees	object	Yes	—	The assignees value
ids	string[]	Yes	—	A list of alerts ids.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "assignees": {
      "type": "object",
      "description": "The assignees value",
      "properties": {
        "add": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "nonempty"
          },
          "description": "The add value"
        },
        "remove": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "nonempty"
          },
          "description": "The remove value"
        }
      },
      "required": [
        "add",
        "remove"
      ]
    },
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "nonempty"
      },
      "description": "A list of alerts `id`s."
    }
  },
  "required": [
    "PCID",
    "assignees",
    "ids"
  ]
}

---

kibana_security_set_alert_tags

Add and remove detection alert tags

Parameters:

Parameter	Type	Required	Default	Description
ids	string[]	Yes	—	A list of alerts ids.
tags	object	Yes	—	Object with list of tags to add and remove.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "nonempty"
      },
      "description": "A list of alerts `id`s."
    },
    "tags": {
      "type": "object",
      "description": "Object with list of tags to add and remove.",
      "properties": {
        "tags_to_add": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "nonempty"
          },
          "description": "List of keywords to organize related alerts into categories that you can filter and group."
        },
        "tags_to_remove": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "nonempty"
          },
          "description": "List of keywords to organize related alerts into categories that you can filter and group."
        }
      },
      "required": [
        "tags_to_add",
        "tags_to_remove"
      ]
    }
  },
  "required": [
    "PCID",
    "ids",
    "tags"
  ]
}

---

kibana_security_set_alerts_status

Set a detection alert status

Parameters:

Parameter	Type	Required	Default	Description
body	object	Yes	—	An object containing desired status and explicit alert ids or a query to select alerts

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "An object containing desired status and explicit alert ids or a query to select alerts"
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}

---

kibana_security_update_list

Update a value list

Parameters:

Parameter	Type	Required	Default	Description
_version	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
description	string	Yes	—	Describes the value list.
id	string	Yes	—	Value list’s identifier.
meta	object	No	—	Placeholder for metadata about the value list.
name	string	Yes	—	Value list’s name.
version	integer	No	—	The document version number.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "description": {
      "type": "string",
      "description": "Describes the value list."
    },
    "id": {
      "type": "string",
      "description": "Value list's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list."
    },
    "name": {
      "type": "string",
      "description": "Value list's name."
    },
    "version": {
      "type": "integer",
      "description": "The document version number."
    }
  },
  "required": [
    "PCID",
    "description",
    "id",
    "name"
  ]
}

---

kibana_security_update_list_item

Update a value list item

Parameters:

Parameter	Type	Required	Default	Description
_version	string	No	—	The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
id	string	Yes	—	Value list item’s identifier.
meta	object	No	—	Placeholder for metadata about the value list item.
value	string	Yes	—	The value used to evaluate exceptions.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_version": {
      "type": "string",
      "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version."
    },
    "id": {
      "type": "string",
      "description": "Value list item's identifier."
    },
    "meta": {
      "type": "object",
      "description": "Placeholder for metadata about the value list item."
    },
    "value": {
      "type": "string",
      "description": "The value used to evaluate exceptions."
    }
  },
  "required": [
    "PCID",
    "id",
    "value"
  ]
}

---

kibana_security_update_rule

Update a detection rule

Parameters:

Parameter	Type	Required	Default	Description
body	object	Yes	—	> info > All unspecified fields are deleted. You cannot modify the id or rule_id values.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "body": {
      "description": "> info > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values."
    }
  },
  "required": [
    "PCID",
    "body"
  ]
}