> ## Documentation Index > Fetch the complete documentation index at: https://docs.pinkfish.ai/llms.txt > Use this file to discover all available pages before exploring further. # kibana-security > Kibana Security - detection rules, alerts, and security lists **Server path:** `/kibana-security` | **Type:** Application | **PCID required:** Yes ## Tools | Tool | Description | | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | [`kibana_security_create_alerts_index`](#kibana_security_create_alerts_index) | Create an alerts index | | [`kibana_security_create_list`](#kibana_security_create_list) | Create a value list | | [`kibana_security_create_list_item`](#kibana_security_create_list_item) | Create a value list item | | [`kibana_security_create_rule`](#kibana_security_create_rule) | Create a detection rule | | [`kibana_security_delete_alerts_index`](#kibana_security_delete_alerts_index) | Delete an alerts index | | [`kibana_security_delete_list`](#kibana_security_delete_list) | Delete a value list | | [`kibana_security_delete_list_index`](#kibana_security_delete_list_index) | Delete value list data streams | | [`kibana_security_delete_list_item`](#kibana_security_delete_list_item) | Delete a value list item | | [`kibana_security_delete_rule`](#kibana_security_delete_rule) | Delete a detection rule | | [`kibana_security_export_list_items`](#kibana_security_export_list_items) | Export value list items | | [`kibana_security_export_rules`](#kibana_security_export_rules) | Export detection rules | | [`kibana_security_find_list_items`](#kibana_security_find_list_items) | Get value list items | | [`kibana_security_find_lists`](#kibana_security_find_lists) | Get value lists | | [`kibana_security_find_rules`](#kibana_security_find_rules) | List all detection rules | | [`kibana_security_import_list_items`](#kibana_security_import_list_items) | Import value list items | | [`kibana_security_import_rules`](#kibana_security_import_rules) | Import detection rules | | [`kibana_security_install_prebuilt_rules_and_timelines`](#kibana_security_install_prebuilt_rules_and_timelines) | Install prebuilt detection rules and Timelines | | [`kibana_security_patch_list`](#kibana_security_patch_list) | Patch a value list | | [`kibana_security_patch_list_item`](#kibana_security_patch_list_item) | Patch a value list item | | [`kibana_security_patch_rule`](#kibana_security_patch_rule) | Patch a detection rule | | [`kibana_security_perform_rules_bulk_action`](#kibana_security_perform_rules_bulk_action) | Apply a bulk action to detection rules | | [`kibana_security_read_alerts_index`](#kibana_security_read_alerts_index) | Reads the alert index name if it exists | | [`kibana_security_read_list`](#kibana_security_read_list) | Get value list details | | [`kibana_security_read_list_index`](#kibana_security_read_list_index) | Get status of value list data streams | | [`kibana_security_read_list_item`](#kibana_security_read_list_item) | Get a value list item | | [`kibana_security_read_list_privileges`](#kibana_security_read_list_privileges) | Get value list privileges | | [`kibana_security_read_prebuilt_rules_and_timelines_status`](#kibana_security_read_prebuilt_rules_and_timelines_status) | Retrieve the status of prebuilt detection rules and Timelines | | [`kibana_security_read_privileges`](#kibana_security_read_privileges) | Returns user privileges for the Kibana space | | [`kibana_security_read_rule`](#kibana_security_read_rule) | Retrieve a detection rule | | [`kibana_security_read_tags`](#kibana_security_read_tags) | List all detection rule tags | | [`kibana_security_rule_preview`](#kibana_security_rule_preview) | Preview rule alerts generated on specified time range | | [`kibana_security_search_alerts`](#kibana_security_search_alerts) | Find and/or aggregate detection alerts | | [`kibana_security_set_alert_assignees`](#kibana_security_set_alert_assignees) | Assign and unassign users from detection alerts | | [`kibana_security_set_alert_tags`](#kibana_security_set_alert_tags) | Add and remove detection alert tags | | [`kibana_security_set_alerts_status`](#kibana_security_set_alerts_status) | Set a detection alert status | | [`kibana_security_update_list`](#kibana_security_update_list) | Update a value list | | [`kibana_security_update_list_item`](#kibana_security_update_list_item) | Update a value list item | | [`kibana_security_update_rule`](#kibana_security_update_rule) | Update a detection rule | *** ## kibana\_security\_create\_alerts\_index Create an alerts index ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_create\_list Create a value list **Parameters:** | Parameter | Type | Required | Default | Description | | ------------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `description` | string | Yes | — | Describes the value list. | | `id` | string | No | — | Value list's identifier. | | `meta` | object | No | — | Placeholder for metadata about the value list. | | `name` | string | Yes | — | Value list's name. | | `type` | string | Yes | — | Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation) | | `version` | integer | No | — | The version value | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "description": { "type": "string", "description": "Describes the value list." }, "id": { "type": "string", "description": "Value list's identifier." }, "meta": { "type": "object", "description": "Placeholder for metadata about the value list." }, "name": { "type": "string", "description": "Value list's name." }, "type": { "type": "string", "description": "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples: - `keyword`: Many ECS fields are Elasticsearch keywords - `ip`: IP addresses - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)", "enum": [ "binary", "boolean", "byte", "date", "date_nanos", "date_range", "double", "double_range", "float", "float_range", "geo_point", "geo_shape", "half_float", "integer", "integer_range", "ip", "ip_range", "keyword", "long", "long_range", "shape", "short", "text" ] }, "version": { "type": "integer", "description": "The version value" } }, "required": [ "PCID", "description", "name", "type" ] } ``` *** ## kibana\_security\_create\_list\_item Create a value list item **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ----------------------------------------------------------------------- | | `id` | string | No | — | Value list item's identifier. | | `list_id` | string | Yes | — | Value list's identifier. | | `meta` | object | No | — | Placeholder for metadata about the value list item. | | `refresh` | string | No | — | Determines when changes made by the request are made visible to search. | | `value` | string | Yes | — | The value used to evaluate exceptions. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "Value list item's identifier." }, "list_id": { "type": "string", "description": "Value list's identifier." }, "meta": { "type": "object", "description": "Placeholder for metadata about the value list item." }, "refresh": { "type": "string", "description": "Determines when changes made by the request are made visible to search.", "enum": [ "true", "false", "wait_for" ] }, "value": { "type": "string", "description": "The value used to evaluate exceptions." } }, "required": [ "PCID", "list_id", "value" ] } ``` *** ## kibana\_security\_create\_rule Create a detection rule **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ------------ | | `body` | object | Yes | — | Request body | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "body": { "description": "Request body" } }, "required": [ "PCID", "body" ] } ``` *** ## kibana\_security\_delete\_alerts\_index Delete an alerts index ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_delete\_list Delete a value list **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------ | ------- | -------- | ------- | -------------------------------------------------------------------------------------------------------------------- | | `id` | string | Yes | — | Value list's identifier. | | `deleteReferences` | boolean | No | — | Determines whether exception items referencing this value list should be deleted. | | `ignoreReferences` | boolean | No | — | Determines whether to delete value list without performing any additional checks of where this list may be utilized. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "Value list's identifier." }, "deleteReferences": { "type": "boolean", "description": "Determines whether exception items referencing this value list should be deleted." }, "ignoreReferences": { "type": "boolean", "description": "Determines whether to delete value list without performing any additional checks of where this list may be utilized." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_security\_delete\_list\_index Delete value list data streams ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_delete\_list\_item Delete a value list item **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ---------------------------------------------------------------------------------- | | `id` | string | No | — | Value list item's identifier. Required if `list_id` and `value` are not specified. | | `list_id` | string | No | — | Value list's identifier. Required if `id` is not specified. | | `value` | string | No | — | The value used to evaluate exceptions. Required if `id` is not specified. | | `refresh` | string | No | — | Determines when changes made by the request are made visible to search. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "Value list item's identifier. Required if `list_id` and `value` are not specified." }, "list_id": { "type": "string", "description": "Value list's identifier. Required if `id` is not specified." }, "value": { "type": "string", "description": "The value used to evaluate exceptions. Required if `id` is not specified." }, "refresh": { "type": "string", "description": "Determines when changes made by the request are made visible to search.", "enum": [ "true", "false", "wait_for" ] } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_delete\_rule Delete a detection rule **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | --------------------------- | | `id` | string | No | — | The rule's `id` value. | | `rule_id` | string | No | — | The rule's `rule_id` value. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "The rule's `id` value." }, "rule_id": { "type": "string", "description": "The rule's `rule_id` value." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_export\_list\_items Export value list items **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ---------------------------- | | `list_id` | string | Yes | — | Value list's `id` to export. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "list_id": { "type": "string", "description": "Value list's `id` to export." } }, "required": [ "PCID", "list_id" ] } ``` *** ## kibana\_security\_export\_rules Export detection rules **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------------ | --------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `exclude_export_details` | boolean | No | — | Determines whether a summary of the exported rules is returned. | | `file_name` | string | No | — | File name for saving the exported rules. > info > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL. | | `objects` | object\[] | No | — | Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "exclude_export_details": { "type": "boolean", "description": "Determines whether a summary of the exported rules is returned." }, "file_name": { "type": "string", "description": "File name for saving the exported rules. > info > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL." }, "objects": { "type": "array", "items": { "type": "object", "properties": { "rule_id": { "type": "string", "description": "A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s." } }, "required": [ "rule_id" ] }, "description": "Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_find\_list\_items Get value list items **Parameters:** | Parameter | Type | Required | Default | Description | | ------------ | ------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `list_id` | string | Yes | — | Value list's identifier. | | `page` | integer | No | — | The page number to return. | | `per_page` | integer | No | — | The number of list items to return per page. | | `sort_field` | string | No | — | Determines which field is used to sort the results. | | `sort_order` | string | No | — | Determines the sort order, which can be `desc` or `asc` | | `cursor` | string | No | — | Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly. | | `filter` | string | No | — | Filters the returned results according to the value of the specified field, using the \:\ syntax. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "list_id": { "type": "string", "description": "Value list's identifier." }, "page": { "type": "integer", "description": "The page number to return." }, "per_page": { "type": "integer", "description": "The number of list items to return per page." }, "sort_field": { "type": "string", "description": "Determines which field is used to sort the results." }, "sort_order": { "type": "string", "description": "Determines the sort order, which can be `desc` or `asc`", "enum": [ "desc", "asc" ] }, "cursor": { "type": "string", "description": "Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly." }, "filter": { "type": "string", "description": "Filters the returned results according to the value of the specified field, using the : syntax." } }, "required": [ "PCID", "list_id" ] } ``` *** ## kibana\_security\_find\_lists Get value lists **Parameters:** | Parameter | Type | Required | Default | Description | | ------------ | ------- | -------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `page` | integer | No | — | The page number to return. | | `per_page` | integer | No | — | The number of value lists to return per page. | | `sort_field` | string | No | — | Determines which field is used to sort the results. | | `sort_order` | string | No | — | Determines the sort order, which can be `desc` or `asc` | | `cursor` | string | No | — | Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly. | | `filter` | string | No | — | Filters the returned results according to the value of the specified field, using the \:\ syntax. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "page": { "type": "integer", "description": "The page number to return." }, "per_page": { "type": "integer", "description": "The number of value lists to return per page." }, "sort_field": { "type": "string", "description": "Determines which field is used to sort the results." }, "sort_order": { "type": "string", "description": "Determines the sort order, which can be `desc` or `asc`", "enum": [ "desc", "asc" ] }, "cursor": { "type": "string", "description": "Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly." }, "filter": { "type": "string", "description": "Filters the returned results according to the value of the specified field, using the : syntax." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_find\_rules List all detection rules **Parameters:** | Parameter | Type | Required | Default | Description | | ---------------------------- | --------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `fields` | string\[] | No | — | The fields value | | `filter` | string | No | — | Search query Filters the returned results according to the value of the specified field, using the alert.attributes.\:\ syntax, where \ can be: - name - enabled - tags - createdBy - interval - updatedBy > info > Even though the JSON rule object uses created\_by and updated\_by fields, you must use createdBy and updatedBy fields in the filter. | | `sort_field` | string | No | — | Field to sort by | | `sort_order` | string | No | — | Sort order | | `page` | integer | No | — | Page number | | `per_page` | integer | No | — | Rules per page | | `gaps_range_start` | string | No | — | Gaps range start | | `gaps_range_end` | string | No | — | Gaps range end | | `gap_fill_statuses` | string\[] | No | — | Gap fill statuses | | `gap_auto_fill_scheduler_id` | string | No | — | Gap auto fill scheduler ID used to determine gap fill status for rules | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "fields": { "type": "array", "items": { "type": "string" }, "description": "The fields value" }, "filter": { "type": "string", "description": "Search query Filters the returned results according to the value of the specified field, using the alert.attributes.: syntax, where can be: - name - enabled - tags - createdBy - interval - updatedBy > info > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter." }, "sort_field": { "type": "string", "description": "Field to sort by", "enum": [ "created_at", "createdAt", "enabled", "execution_summary.last_execution.date", "execution_summary.last_execution.metrics.execution_gap_duration_s", "execution_summary.last_execution.metrics.total_indexing_duration_ms", "execution_summary.last_execution.metrics.total_search_duration_ms", "execution_summary.last_execution.status", "name", "risk_score", "riskScore", "severity", "updated_at", "updatedAt" ] }, "sort_order": { "type": "string", "description": "Sort order", "enum": [ "asc", "desc" ] }, "page": { "type": "integer", "description": "Page number" }, "per_page": { "type": "integer", "description": "Rules per page" }, "gaps_range_start": { "type": "string", "description": "Gaps range start" }, "gaps_range_end": { "type": "string", "description": "Gaps range end" }, "gap_fill_statuses": { "type": "array", "items": { "type": "string", "enum": [ "unfilled", "in_progress", "filled", "error" ] }, "description": "Gap fill statuses" }, "gap_auto_fill_scheduler_id": { "type": "string", "description": "Gap auto fill scheduler ID used to determine gap fill status for rules" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_import\_list\_items Import value list items **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ------------------------------------------------------------------------------------------------- | | `list_id` | string | No | — | List's id. Required when importing to an existing list. | | `type` | string | No | — | Type of the importing list. Required when importing a new list whose list `id` is not specified. | | `refresh` | string | No | — | Determines when changes made by the request are made visible to search. | | `file` | string | No | — | A `.txt` or `.csv` file containing newline separated list items. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "list_id": { "type": "string", "description": "List's id. Required when importing to an existing list." }, "type": { "type": "string", "description": "Type of the importing list. Required when importing a new list whose list `id` is not specified.", "enum": [ "binary", "boolean", "byte", "date", "date_nanos", "date_range", "double", "double_range", "float", "float_range", "geo_point", "geo_shape", "half_float", "integer", "integer_range", "ip", "ip_range", "keyword", "long", "long_range", "shape", "short", "text" ] }, "refresh": { "type": "string", "description": "Determines when changes made by the request are made visible to search.", "enum": [ "true", "false", "wait_for" ] }, "file": { "type": "string", "description": "A `.txt` or `.csv` file containing newline separated list items." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_import\_rules Import detection rules **Parameters:** | Parameter | Type | Required | Default | Description | | ----------------------------- | ------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `overwrite` | boolean | No | — | Determines whether existing rules with the same `rule_id` are overwritten. | | `overwrite_exceptions` | boolean | No | — | Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten. | | `overwrite_action_connectors` | boolean | No | — | Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten. | | `as_new_list` | boolean | No | — | Generates a new list ID for each imported exception list. | | `file` | string | No | — | The `.ndjson` file containing the rules. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "overwrite": { "type": "boolean", "description": "Determines whether existing rules with the same `rule_id` are overwritten." }, "overwrite_exceptions": { "type": "boolean", "description": "Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten." }, "overwrite_action_connectors": { "type": "boolean", "description": "Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten." }, "as_new_list": { "type": "boolean", "description": "Generates a new list ID for each imported exception list." }, "file": { "type": "string", "description": "The `.ndjson` file containing the rules." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_install\_prebuilt\_rules\_and\_timelines Install prebuilt detection rules and Timelines ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_patch\_list Patch a value list **Parameters:** | Parameter | Type | Required | Default | Description | | ------------- | ------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `_version` | string | No | — | The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version. | | `description` | string | No | — | Describes the value list. | | `id` | string | Yes | — | Value list's identifier. | | `meta` | object | No | — | Placeholder for metadata about the value list. | | `name` | string | No | — | Value list's name. | | `version` | integer | No | — | The document version number. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "_version": { "type": "string", "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version." }, "description": { "type": "string", "description": "Describes the value list." }, "id": { "type": "string", "description": "Value list's identifier." }, "meta": { "type": "object", "description": "Placeholder for metadata about the value list." }, "name": { "type": "string", "description": "Value list's name." }, "version": { "type": "integer", "description": "The document version number." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_security\_patch\_list\_item Patch a value list item **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `_version` | string | No | — | The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version. | | `id` | string | Yes | — | Value list item's identifier. | | `meta` | object | No | — | Placeholder for metadata about the value list item. | | `refresh` | string | No | — | Determines when changes made by the request are made visible to search. | | `value` | string | No | — | The value used to evaluate exceptions. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "_version": { "type": "string", "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version." }, "id": { "type": "string", "description": "Value list item's identifier." }, "meta": { "type": "object", "description": "Placeholder for metadata about the value list item." }, "refresh": { "type": "string", "description": "Determines when changes made by the request are made visible to search.", "enum": [ "true", "false", "wait_for" ] }, "value": { "type": "string", "description": "The value used to evaluate exceptions." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_security\_patch\_rule Patch a detection rule **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | -------------------------------------------------------- | | `body` | object | Yes | — | > info > You cannot modify the `id` or `rule_id` values. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "body": { "description": "> info > You cannot modify the `id` or `rule_id` values." } }, "required": [ "PCID", "body" ] } ``` *** ## kibana\_security\_perform\_rules\_bulk\_action Apply a bulk action to detection rules **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------- | -------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dry_run` | boolean | No | — | Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. > info > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response. | | `body` | object | No | — | Request body | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "dry_run": { "type": "boolean", "description": "Enables dry run mode for the request call. Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch. > info > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response." }, "body": { "description": "Request body" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_alerts\_index Reads the alert index name if it exists ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_list Get value list details **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | ------------------------ | | `id` | string | Yes | — | Value list's identifier. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "Value list's identifier." } }, "required": [ "PCID", "id" ] } ``` *** ## kibana\_security\_read\_list\_index Get status of value list data streams ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_list\_item Get a value list item **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | -------------------------------------------------------------------------------- | | `id` | string | No | — | Value list item identifier. Required if `list_id` and `value` are not specified. | | `list_id` | string | No | — | Value list item list's `id` identfier. Required if `id` is not specified. | | `value` | string | No | — | The value used to evaluate exceptions. Required if `id` is not specified. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "Value list item identifier. Required if `list_id` and `value` are not specified." }, "list_id": { "type": "string", "description": "Value list item list's `id` identfier. Required if `id` is not specified." }, "value": { "type": "string", "description": "The value used to evaluate exceptions. Required if `id` is not specified." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_list\_privileges Get value list privileges ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_prebuilt\_rules\_and\_timelines\_status Retrieve the status of prebuilt detection rules and Timelines ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_privileges Returns user privileges for the Kibana space ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_rule Retrieve a detection rule **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | --------------------------- | | `id` | string | No | — | The rule's `id` value. | | `rule_id` | string | No | — | The rule's `rule_id` value. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "id": { "type": "string", "description": "The rule's `id` value." }, "rule_id": { "type": "string", "description": "The rule's `rule_id` value." } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_read\_tags List all detection rule tags ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_rule\_preview Preview rule alerts generated on specified time range **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------------ | ------- | -------- | ------- | ------------------------------------------------------------------------------------- | | `enable_logged_requests` | boolean | No | — | Enables logging and returning in response ES queries, performed during rule execution | | `body` | object | Yes | — | An object containing tags to add or remove and alert ids the changes will be applied | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "enable_logged_requests": { "type": "boolean", "description": "Enables logging and returning in response ES queries, performed during rule execution" }, "body": { "description": "An object containing tags to add or remove and alert ids the changes will be applied" } }, "required": [ "PCID", "body" ] } ``` *** ## kibana\_security\_search\_alerts Find and/or aggregate detection alerts **Parameters:** | Parameter | Type | Required | Default | Description | | ------------------ | --------- | -------- | ------- | ---------------------- | | `_source` | object | No | — | The source value | | `aggs` | object | No | — | The aggs value | | `fields` | string\[] | No | — | The fields value | | `query` | object | No | — | Search query string | | `runtime_mappings` | object | No | — | Runtime Mappings | | `size` | integer | No | — | The size value | | `sort` | object | No | — | Sort order for results | | `track_total_hits` | boolean | No | — | Track Total Hits | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "_source": { "description": "The source value" }, "aggs": { "type": "object", "description": "The aggs value" }, "fields": { "type": "array", "items": { "type": "string" }, "description": "The fields value" }, "query": { "type": "object", "description": "Search query string" }, "runtime_mappings": { "type": "object", "description": "Runtime Mappings" }, "size": { "type": "integer", "description": "The size value" }, "sort": { "description": "Sort order for results" }, "track_total_hits": { "type": "boolean", "description": "Track Total Hits" } }, "required": [ "PCID" ] } ``` *** ## kibana\_security\_set\_alert\_assignees Assign and unassign users from detection alerts **Parameters:** | Parameter | Type | Required | Default | Description | | ----------- | --------- | -------- | ------- | ----------------------- | | `assignees` | object | Yes | — | The assignees value | | `ids` | string\[] | Yes | — | A list of alerts `id`s. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "assignees": { "type": "object", "description": "The assignees value", "properties": { "add": { "type": "array", "items": { "type": "string", "format": "nonempty" }, "description": "The add value" }, "remove": { "type": "array", "items": { "type": "string", "format": "nonempty" }, "description": "The remove value" } }, "required": [ "add", "remove" ] }, "ids": { "type": "array", "items": { "type": "string", "format": "nonempty" }, "description": "A list of alerts `id`s." } }, "required": [ "PCID", "assignees", "ids" ] } ``` *** ## kibana\_security\_set\_alert\_tags Add and remove detection alert tags **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | --------- | -------- | ------- | ------------------------------------------- | | `ids` | string\[] | Yes | — | A list of alerts `id`s. | | `tags` | object | Yes | — | Object with list of tags to add and remove. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "ids": { "type": "array", "items": { "type": "string", "format": "nonempty" }, "description": "A list of alerts `id`s." }, "tags": { "type": "object", "description": "Object with list of tags to add and remove.", "properties": { "tags_to_add": { "type": "array", "items": { "type": "string", "format": "nonempty" }, "description": "List of keywords to organize related alerts into categories that you can filter and group." }, "tags_to_remove": { "type": "array", "items": { "type": "string", "format": "nonempty" }, "description": "List of keywords to organize related alerts into categories that you can filter and group." } }, "required": [ "tags_to_add", "tags_to_remove" ] } }, "required": [ "PCID", "ids", "tags" ] } ``` *** ## kibana\_security\_set\_alerts\_status Set a detection alert status **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | -------------------------------------------------------------------------------------- | | `body` | object | Yes | — | An object containing desired status and explicit alert ids or a query to select alerts | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "body": { "description": "An object containing desired status and explicit alert ids or a query to select alerts" } }, "required": [ "PCID", "body" ] } ``` *** ## kibana\_security\_update\_list Update a value list **Parameters:** | Parameter | Type | Required | Default | Description | | ------------- | ------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `_version` | string | No | — | The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version. | | `description` | string | Yes | — | Describes the value list. | | `id` | string | Yes | — | Value list's identifier. | | `meta` | object | No | — | Placeholder for metadata about the value list. | | `name` | string | Yes | — | Value list's name. | | `version` | integer | No | — | The document version number. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "_version": { "type": "string", "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version." }, "description": { "type": "string", "description": "Describes the value list." }, "id": { "type": "string", "description": "Value list's identifier." }, "meta": { "type": "object", "description": "Placeholder for metadata about the value list." }, "name": { "type": "string", "description": "Value list's name." }, "version": { "type": "integer", "description": "The document version number." } }, "required": [ "PCID", "description", "id", "name" ] } ``` *** ## kibana\_security\_update\_list\_item Update a value list item **Parameters:** | Parameter | Type | Required | Default | Description | | ---------- | ------ | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `_version` | string | No | — | The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version. | | `id` | string | Yes | — | Value list item's identifier. | | `meta` | object | No | — | Placeholder for metadata about the value list item. | | `value` | string | Yes | — | The value used to evaluate exceptions. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "_version": { "type": "string", "description": "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version." }, "id": { "type": "string", "description": "Value list item's identifier." }, "meta": { "type": "object", "description": "Placeholder for metadata about the value list item." }, "value": { "type": "string", "description": "The value used to evaluate exceptions." } }, "required": [ "PCID", "id", "value" ] } ``` *** ## kibana\_security\_update\_rule Update a detection rule **Parameters:** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ------- | -------------------------------------------------------------------------------------------- | | `body` | object | Yes | — | > info > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values. | ```json theme={null} { "type": "object", "properties": { "PCID": { "type": "string", "description": "Pink Connect ID for the authenticated connection" }, "body": { "description": "> info > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values." } }, "required": [ "PCID", "body" ] } ```